main.yaml

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: |
  PSU lambda functions and related resources

Globals:
  Function:
    Timeout: 50
    MemorySize: 256
    Architectures:
      - x86_64
    Runtime: nodejs24.x
    Environment:
      Variables:
        NODE_OPTIONS: "--enable-source-maps"
    Layers:
      - !Sub arn:aws:lambda:${AWS::Region}:580247275435:layer:LambdaInsightsExtension:49

Parameters:
  StackName:
    Type: String
    Default: none

  PrescriptionStatusUpdatesTableName:
    Type: String
    Default: none

  PrescriptionNotificationStatesTableName:
    Type: String
    Default: none

  NHSNotifyPrescriptionsSQSQueueUrl:
    Type: String
    Default: none

  PostDatedNotificationsSQSQueueUrl:
    Type: String
    Default: none

  SQSSaltSecret:
    Type: AWS::SecretsManager::Secret::Name<String>

  EnabledSiteODSCodesParam:
    Type: AWS::SSM::Parameter::Name<String>

  EnabledSystemsParam:
    Type: AWS::SSM::Parameter::Name<String>

  BlockedSiteODSCodesParam:
    Type: AWS::SSM::Parameter::Name<String>

  NotifyRoutingPlanIDParam:
    Type: AWS::SSM::Parameter::Name<String>

  NotifyAPIBaseURLParam:
    Type: AWS::SSM::Parameter::Name<String>

  EnableNotificationsExternalParam:
    Type: AWS::SSM::Parameter::Name<String>

  EnableNotificationsInternalParam:
    Type: AWS::SSM::Parameter::Name<String>

  EnablePostDatedNotifications:
    Type: AWS::SSM::Parameter::Name<String>
    Default: "false"

  RequireApplicationName:
    Type: String
    Default: false
    AllowedValues:
      - true
      - false

  LogLevel:
    Type: String

  LogRetentionInDays:
    Type: Number

  EnableSplunk:
    Type: String

  VersionNumber:
    Type: String

  CommitId:
    Type: String

  DeployCheckPrescriptionStatusUpdate:
    Type: String

  DeployNotificationsReporting:
    Type: String
    Default: false

  Environment:
    Type: String

  EnableBackup:
    Type: String

  TestPrescriptionsParamName1:
    Type: AWS::SSM::Parameter::Name<String>

  TestPrescriptionsParamName2:
    Type: AWS::SSM::Parameter::Name<String>

  TestPrescriptionsParamName3:
    Type: AWS::SSM::Parameter::Name<String>

  TestPrescriptionsParamName4:
    Type: AWS::SSM::Parameter::Name<String>

Conditions:
  ShouldDeployCheckPrescriptionStatusUpdate: !Equals
    - true
    - !Ref DeployCheckPrescriptionStatusUpdate

  ShouldDeployNotificationsReporting: !Equals
    - true
    - !Ref DeployNotificationsReporting

  EnableBackupCondition: !Equals
    - "True"
    - !Ref EnableBackup

Resources:
  UpdatePrescriptionStatus:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${StackName}-UpdatePrescriptionStatus
      CodeUri: ../../packages
      Handler: updatePrescriptionStatus.handler
      Role: !GetAtt UpdatePrescriptionStatusResources.Outputs.LambdaRoleArn
      Environment:
        Variables:
          TABLE_NAME: !Ref PrescriptionStatusUpdatesTableName
          NHS_NOTIFY_PRESCRIPTIONS_SQS_QUEUE_URL: !Ref NHSNotifyPrescriptionsSQSQueueUrl
          POST_DATED_PRESCRIPTIONS_SQS_QUEUE_URL: !Ref PostDatedNotificationsSQSQueueUrl
          ENABLE_POST_DATED_NOTIFICATIONS: !Ref EnablePostDatedNotifications
          SQS_SALT: !Ref SQSSaltSecret
          ENABLED_SITE_ODS_CODES_PARAM: !Ref EnabledSiteODSCodesParam
          ENABLED_SYSTEMS_PARAM: !Ref EnabledSystemsParam
          BLOCKED_SITE_ODS_CODES_PARAM: !Ref BlockedSiteODSCodesParam
          ENABLE_NOTIFICATIONS_PARAM: !Ref EnableNotificationsInternalParam
          LOG_LEVEL: !Ref LogLevel
          ENVIRONMENT: !Ref Environment
          REQUIRE_APPLICATION_NAME: !Ref RequireApplicationName
          TEST_PRESCRIPTIONS_PARAM_NAME_1: !Ref TestPrescriptionsParamName1
          TEST_PRESCRIPTIONS_PARAM_NAME_2: !Ref TestPrescriptionsParamName2
          TEST_PRESCRIPTIONS_PARAM_NAME_3: !Ref TestPrescriptionsParamName3
          TEST_PRESCRIPTIONS_PARAM_NAME_4: !Ref TestPrescriptionsParamName4
    Metadata:
      BuildMethod: esbuild
      guard:
        SuppressedRules:
          - LAMBDA_DLQ_CHECK
          - LAMBDA_INSIDE_VPC
          - LAMBDA_CONCURRENCY_CHECK
      BuildProperties:
        Minify: true
        Target: es2020
        Sourcemap: true
        tsconfig: updatePrescriptionStatus/tsconfig.json
        packages: bundle
        EntryPoints:
          - updatePrescriptionStatus/src/updatePrescriptionStatus.ts

  UpdatePrescriptionStatusResources:
    Type: AWS::Serverless::Application
    Properties:
      Location: lambda_resources.yaml
      Parameters:
        StackName: !Ref StackName
        LambdaName: !Sub ${StackName}-UpdatePrescriptionStatus
        LambdaArn: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${StackName}-UpdatePrescriptionStatus
        IncludeAdditionalPolicies: true
        AdditionalPolicies: !Join
          - ","
          - - Fn::ImportValue: !Sub ${StackName}:tables:${PrescriptionStatusUpdatesTableName}:TableWritePolicyArn
            - Fn::ImportValue: !Sub ${StackName}:tables:${PrescriptionStatusUpdatesTableName}:TableReadPolicyArn
            - Fn::ImportValue: !Sub ${StackName}:tables:UsePrescriptionStatusUpdatesKMSKeyPolicyArn
            - Fn::ImportValue: !Sub ${StackName}-UseNotificationSQSQueueKMSKeyPolicyArn
            - Fn::ImportValue: !Sub ${StackName}-WriteNHSNotifyPrescriptionsSQSQueuePolicyArn
            - Fn::ImportValue: !Sub ${StackName}-WritePostDatedNotificationsSQSQueuePolicyArn
            - Fn::ImportValue: !Sub ${StackName}-GetSQSSaltSecretPolicy
            - Fn::ImportValue: !Sub ${StackName}-GetNotificationsParameterPolicy
        LogRetentionInDays: !Ref LogRetentionInDays
        CloudWatchKMSKeyId: !ImportValue account-resources:CloudwatchLogsKmsKeyArn
        EnableSplunk: !Ref EnableSplunk
        SplunkSubscriptionFilterRole: !ImportValue lambda-resources:SplunkSubscriptionFilterRole
        SplunkDeliveryStreamArn: !ImportValue lambda-resources:SplunkDeliveryStream

  ConvertRequestToFhirFormat:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${StackName}-ConvertRequestToFhirFormat
      CodeUri: ../../packages
      Handler: cpsu.format_1_handler
      Role: !GetAtt ConvertRequestToFhirFormatResources.Outputs.LambdaRoleArn
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
    Metadata:
      BuildMethod: esbuild
      guard:
        SuppressedRules:
          - LAMBDA_DLQ_CHECK
          - LAMBDA_INSIDE_VPC
          - LAMBDA_CONCURRENCY_CHECK
      BuildProperties:
        Minify: true
        Target: es2020
        Sourcemap: true
        tsconfig: cpsuLambda/tsconfig.json
        packages: bundle
        EntryPoints:
          - cpsuLambda/src/cpsu.ts

  ConvertRequestToFhirFormatResources:
    Type: AWS::Serverless::Application
    Properties:
      Location: lambda_resources.yaml
      Parameters:
        StackName: !Ref StackName
        LambdaName: !Sub ${StackName}-ConvertRequestToFhirFormat
        LambdaArn: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${StackName}-ConvertRequestToFhirFormat
        IncludeAdditionalPolicies: false
        LogRetentionInDays: !Ref LogRetentionInDays
        CloudWatchKMSKeyId: !ImportValue account-resources:CloudwatchLogsKmsKeyArn
        EnableSplunk: !Ref EnableSplunk
        SplunkSubscriptionFilterRole: !ImportValue lambda-resources:SplunkSubscriptionFilterRole
        SplunkDeliveryStreamArn: !ImportValue lambda-resources:SplunkDeliveryStream

  GetStatusUpdates:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${StackName}-GetStatusUpdates
      CodeUri: ../../packages
      Handler: getStatusUpdates.handler
      Role: !GetAtt GetStatusUpdatesResources.Outputs.LambdaRoleArn
      Environment:
        Variables:
          TABLE_NAME: !Ref PrescriptionStatusUpdatesTableName
          LOG_LEVEL: !Ref LogLevel
    Metadata:
      BuildMethod: esbuild
      guard:
        SuppressedRules:
          - LAMBDA_DLQ_CHECK
          - LAMBDA_INSIDE_VPC
          - LAMBDA_CONCURRENCY_CHECK
      BuildProperties:
        Minify: true
        Target: es2020
        Sourcemap: true
        tsconfig: gsul/tsconfig.json
        packages: bundle
        EntryPoints:
          - gsul/src/getStatusUpdates.ts

  GetStatusUpdatesResources:
    Type: AWS::Serverless::Application
    Properties:
      Location: lambda_resources.yaml
      Parameters:
        StackName: !Ref StackName
        LambdaName: !Sub ${StackName}-GetStatusUpdates
        LambdaArn: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${StackName}-GetStatusUpdates
        IncludeAdditionalPolicies: true
        AdditionalPolicies: !Join
          - ","
          - - Fn::ImportValue: !Sub ${StackName}:tables:${PrescriptionStatusUpdatesTableName}:TableReadPolicyArn
            - Fn::ImportValue: !Sub ${StackName}:tables:UsePrescriptionStatusUpdatesKMSKeyPolicyArn
        LogRetentionInDays: !Ref LogRetentionInDays
        CloudWatchKMSKeyId: !ImportValue account-resources:CloudwatchLogsKmsKeyArn
        EnableSplunk: !Ref EnableSplunk
        SplunkSubscriptionFilterRole: !ImportValue lambda-resources:SplunkSubscriptionFilterRole
        SplunkDeliveryStreamArn: !ImportValue lambda-resources:SplunkDeliveryStream

  Status:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${StackName}-status
      CodeUri: ../../packages
      Handler: statusLambda.handler
      Role: !GetAtt StatusResources.Outputs.LambdaRoleArn
      Environment:
        Variables:
          VERSION_NUMBER: !Ref VersionNumber
          COMMIT_ID: !Ref CommitId
    Metadata:
      BuildMethod: esbuild
      guard:
        SuppressedRules:
          - LAMBDA_DLQ_CHECK
          - LAMBDA_INSIDE_VPC
          - LAMBDA_CONCURRENCY_CHECK
      BuildProperties:
        Minify: true
        Target: es2020
        Sourcemap: true
        tsconfig: statusLambda/tsconfig.json
        packages: bundle
        EntryPoints:
          - statusLambda/src/statusLambda.ts

  StatusResources:
    Type: AWS::Serverless::Application
    Properties:
      Location: lambda_resources.yaml
      Parameters:
        StackName: !Ref StackName
        LambdaName: !Sub ${StackName}-status
        LambdaArn: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${StackName}-status
        IncludeAdditionalPolicies: true
        AdditionalPolicies: !Join
          - ","
          - - !ImportValue account-resources:LambdaAccessSecretsPolicy
        LogRetentionInDays: !Ref LogRetentionInDays
        CloudWatchKMSKeyId: !ImportValue account-resources:CloudwatchLogsKmsKeyArn
        EnableSplunk: !Ref EnableSplunk
        SplunkSubscriptionFilterRole: !ImportValue lambda-resources:SplunkSubscriptionFilterRole
        SplunkDeliveryStreamArn: !ImportValue lambda-resources:SplunkDeliveryStream

  CapabilityStatement:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${StackName}-CapabilityStatement
      CodeUri: ../../packages
      Handler: capabilityStatement.handler
      Role: !GetAtt CapabilityStatementResources.Outputs.LambdaRoleArn
    Metadata:
      BuildMethod: esbuild
      guard:
        SuppressedRules:
          - LAMBDA_DLQ_CHECK
          - LAMBDA_INSIDE_VPC
          - LAMBDA_CONCURRENCY_CHECK
      BuildProperties:
        Minify: true
        Target: es2020
        Sourcemap: true
        tsconfig: capabilityStatement/tsconfig.json
        packages: bundle
        EntryPoints:
          - capabilityStatement/src/capabilityStatement.ts

  CapabilityStatementResources:
    Type: AWS::Serverless::Application
    Properties:
      Location: lambda_resources.yaml
      Parameters:
        StackName: !Ref StackName
        LambdaName: !Sub ${StackName}-CapabilityStatement
        LambdaArn: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${StackName}-CapabilityStatement
        LogRetentionInDays: !Ref LogRetentionInDays
        CloudWatchKMSKeyId: !ImportValue account-resources:CloudwatchLogsKmsKeyArn
        EnableSplunk: !Ref EnableSplunk
        SplunkSubscriptionFilterRole: !ImportValue lambda-resources:SplunkSubscriptionFilterRole
        SplunkDeliveryStreamArn: !ImportValue lambda-resources:SplunkDeliveryStream

  CheckPrescriptionStatusUpdates:
    Condition: ShouldDeployCheckPrescriptionStatusUpdate
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${StackName}-CheckPrescriptionStatusUpdates
      CodeUri: ../../packages
      Handler: checkPrescriptionStatusUpdates.handler
      Role: !GetAtt CheckPrescriptionStatusUpdatesResources.Outputs.LambdaRoleArn
      Environment:
        Variables:
          TABLE_NAME: !Ref PrescriptionStatusUpdatesTableName
          LOG_LEVEL: !Ref LogLevel
          MIN_RESULTS_RETURNED: 5
          MAX_RESULTS_RETURNED: 15
    Metadata:
      BuildMethod: esbuild
      guard:
        SuppressedRules:
          - LAMBDA_DLQ_CHECK
          - LAMBDA_INSIDE_VPC
          - LAMBDA_CONCURRENCY_CHECK
      BuildProperties:
        Minify: true
        Target: es2020
        Sourcemap: true
        tsconfig: checkPrescriptionStatusUpdates/tsconfig.json
        EntryPoints:
          - checkPrescriptionStatusUpdates/src/checkPrescriptionStatusUpdates.ts

  CheckPrescriptionStatusUpdatesResources:
    Condition: ShouldDeployCheckPrescriptionStatusUpdate
    Type: AWS::Serverless::Application
    Properties:
      Location: lambda_resources.yaml
      Parameters:
        StackName: !Ref StackName
        LambdaName: !Sub ${StackName}-CheckPrescriptionStatusUpdates
        LambdaArn: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${StackName}-CheckPrescriptionStatusUpdates
        IncludeAdditionalPolicies: true
        AdditionalPolicies: !Join
          - ","
          - - Fn::ImportValue: !Sub ${StackName}:tables:${PrescriptionStatusUpdatesTableName}:TableReadPolicyArn
            - Fn::ImportValue: !Sub ${StackName}:tables:UsePrescriptionStatusUpdatesKMSKeyPolicyArn
        LogRetentionInDays: !Ref LogRetentionInDays
        CloudWatchKMSKeyId: !ImportValue account-resources:CloudwatchLogsKmsKeyArn
        EnableSplunk: !Ref EnableSplunk
        SplunkSubscriptionFilterRole: !ImportValue lambda-resources:SplunkSubscriptionFilterRole
        SplunkDeliveryStreamArn: !ImportValue lambda-resources:SplunkDeliveryStream

  NotificationsReporting:
    Condition: ShouldDeployNotificationsReporting
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${StackName}-NotificationsReporting
      CodeUri: ../../packages
      Handler: notificationsReportingLambda.handler
      Role: !GetAtt NotificationsReportingResources.Outputs.LambdaRoleArn
      Environment:
        Variables:
          TABLE_NAME: !Ref PrescriptionNotificationStatesTableName
    Metadata:
      BuildMethod: esbuild
      guard:
        SuppressedRules:
          - LAMBDA_DLQ_CHECK
          - LAMBDA_INSIDE_VPC
          - LAMBDA_CONCURRENCY_CHECK
      BuildProperties:
        Minify: true
        Target: es2020
        Sourcemap: true
        tsconfig: notificationsReportingLambda/tsconfig.json
        packages: bundle
        EntryPoints:
          - notificationsReportingLambda/src/notificationsReportingLambda.ts

  NotificationsReportingResources:
    Condition: ShouldDeployNotificationsReporting
    Type: AWS::Serverless::Application
    Properties:
      Location: lambda_resources.yaml
      Parameters:
        StackName: !Ref StackName
        LambdaName: !Sub ${StackName}-NotificationsReporting
        LambdaArn: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${StackName}-NotificationsReporting
        IncludeAdditionalPolicies: true
        AdditionalPolicies: !Join
          - ","
          - - Fn::ImportValue: !Sub ${StackName}:tables:${PrescriptionNotificationStatesTableName}:TableReadPolicyArn
            - Fn::ImportValue: !Sub ${StackName}:tables:UsePrescriptionNotificationStatesKMSKeyPolicyArn
        LogRetentionInDays: !Ref LogRetentionInDays
        CloudWatchKMSKeyId: !ImportValue account-resources:CloudwatchLogsKmsKeyArn
        EnableSplunk: !Ref EnableSplunk
        SplunkSubscriptionFilterRole: !ImportValue lambda-resources:SplunkSubscriptionFilterRole
        SplunkDeliveryStreamArn: !ImportValue lambda-resources:SplunkDeliveryStream

  NotifyProcessorScheduleEventRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - scheduler.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - !Ref NotifyProcessorScheduleEventRolePolicy

  NotifyProcessorScheduleEventRolePolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - lambda:InvokeFunction
            Resource:
              - !GetAtt NotifyProcessor.Arn

  NotifyProcessor:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${StackName}-NotifyProcessor
      Timeout: 900 # 15 minutes
      CodeUri: ../../packages/
      Handler: nhsNotifyLambda.handler
      Role: !GetAtt NotifyProcessorResources.Outputs.LambdaRoleArn
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          NHS_NOTIFY_PRESCRIPTIONS_SQS_QUEUE_URL: !Ref NHSNotifyPrescriptionsSQSQueueUrl
          TABLE_NAME: !Ref PrescriptionNotificationStatesTableName
          API_KEY_SECRET:
            Fn::ImportValue: !Sub ${StackName}-PSU-Notify-API-Key
          PRIVATE_KEY_SECRET:
            Fn::ImportValue: !Sub ${StackName}-PSU-Notify-PrivateKey
          KID_SECRET:
            Fn::ImportValue: !Sub ${StackName}-PSU-Notify-KID
          NHS_NOTIFY_ROUTING_ID_PARAM: !Ref NotifyRoutingPlanIDParam
          NOTIFY_API_BASE_URL_PARAM: !Ref NotifyAPIBaseURLParam
          MAKE_REAL_NOTIFY_REQUESTS_PARAM: !Ref EnableNotificationsExternalParam
      Events:
        ScheduleEvent:
          Type: ScheduleV2
          Properties:
            Name: !Sub ${StackName}-NotifySchedule
            ScheduleExpression: "rate(1 minute)"
            RoleArn: !GetAtt NotifyProcessorScheduleEventRole.Arn
    Metadata:
      BuildMethod: esbuild
      guard:
        SuppressedRules:
          - LAMBDA_DLQ_CHECK
          - LAMBDA_INSIDE_VPC
          - LAMBDA_CONCURRENCY_CHECK
      BuildProperties:
        Minify: true
        Target: es2020
        Sourcemap: true
        tsconfig: nhsNotifyLambda/tsconfig.json
        packages: bundle
        EntryPoints:
          - nhsNotifyLambda/src/nhsNotifyLambda.ts

  NotifyProcessorResources:
    Type: AWS::Serverless::Application
    Properties:
      Location: lambda_resources.yaml
      Parameters:
        StackName: !Ref StackName
        LambdaName: !Sub ${StackName}-NotifyProcessor
        LambdaArn: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${StackName}-NotifyProcessor
        LogRetentionInDays: !Ref LogRetentionInDays
        CloudWatchKMSKeyId: !ImportValue account-resources:CloudwatchLogsKmsKeyArn
        EnableSplunk: !Ref EnableSplunk
        SplunkSubscriptionFilterRole: !ImportValue lambda-resources:SplunkSubscriptionFilterRole
        SplunkDeliveryStreamArn: !ImportValue lambda-resources:SplunkDeliveryStream
        IncludeAdditionalPolicies: true
        AdditionalPolicies: !Join
          - ","
          - - Fn::ImportValue: !Sub ${StackName}-WriteNHSNotifyPrescriptionsSQSQueuePolicyArn
            - Fn::ImportValue: !Sub ${StackName}-ReadNHSNotifyPrescriptionsSQSQueuePolicyArn
            - Fn::ImportValue: !Sub ${StackName}-UseNotificationSQSQueueKMSKeyPolicyArn
            - Fn::ImportValue: !Sub ${StackName}:tables:${PrescriptionNotificationStatesTableName}:TableReadPolicyArn
            - Fn::ImportValue: !Sub ${StackName}:tables:${PrescriptionNotificationStatesTableName}:TableWritePolicyArn
            - Fn::ImportValue: !Sub ${StackName}:tables:UsePrescriptionNotificationStatesKMSKeyPolicyArn
            - Fn::ImportValue: !Sub ${StackName}-GetNotificationsParameterPolicy
            - Fn::ImportValue: !Sub ${StackName}-GetPSUSecretPolicy
            - Fn::ImportValue: !Sub ${StackName}-UsePSUSecretsKMSKeyPolicyArn

  ## Post-dated lambda definitions
  PostDatedNotifyLambdaScheduleEventRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - scheduler.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - !Ref PostDatedNotifyLambdaScheduleEventRolePolicy

  PostDatedNotifyLambdaScheduleEventRolePolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - lambda:InvokeFunction
            Resource:
              - !GetAtt PostDatedNotifyLambda.Arn

  PostDatedNotifyLambda:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${StackName}-postDatedNotifyLambda
      Timeout: 900
      CodeUri: ../../packages/
      Handler: main.handler
      Role: !GetAtt PostDatedNotifyLambdaResources.Outputs.LambdaRoleArn
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          NHS_NOTIFY_PRESCRIPTIONS_SQS_QUEUE_URL: !Ref NHSNotifyPrescriptionsSQSQueueUrl
          POST_DATED_PRESCRIPTIONS_SQS_QUEUE_URL: !Ref PostDatedNotificationsSQSQueueUrl
          TABLE_NAME: !Ref PrescriptionStatusUpdatesTableName
      Events:
        ScheduleEvent:
          Type: ScheduleV2
          Properties:
            Name: !Sub ${StackName}-PostDatedNotifySchedule
            ScheduleExpression: "rate(15 minutes)"
            RoleArn: !GetAtt PostDatedNotifyLambdaScheduleEventRole.Arn
    Metadata:
      BuildMethod: esbuild
      guard:
        SuppressedRules:
          - LAMBDA_DLQ_CHECK
          - LAMBDA_INSIDE_VPC
          - LAMBDA_CONCURRENCY_CHECK
      BuildProperties:
        Minify: true
        Target: es2020
        Sourcemap: true
        packages: bundle
        # set tsconfig path to whatever you actually have for this lambda package
        tsconfig: postDatedLambda/tsconfig.json
        EntryPoints:
          - postDatedLambda/src/main.ts

  PostDatedNotifyLambdaResources:
    Type: AWS::Serverless::Application
    Properties:
      Location: lambda_resources.yaml
      Parameters:
        StackName: !Ref StackName
        LambdaName: !Sub ${StackName}-postDatedNotifyLambda
        LambdaArn: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${StackName}-postDatedNotifyLambda
        LogRetentionInDays: !Ref LogRetentionInDays
        CloudWatchKMSKeyId: !ImportValue account-resources:CloudwatchLogsKmsKeyArn
        EnableSplunk: !Ref EnableSplunk
        SplunkSubscriptionFilterRole: !ImportValue lambda-resources:SplunkSubscriptionFilterRole
        SplunkDeliveryStreamArn: !ImportValue lambda-resources:SplunkDeliveryStream
        IncludeAdditionalPolicies: true
        AdditionalPolicies: !Join
          - ","
          - - Fn::ImportValue: !Sub ${StackName}-WriteNHSNotifyPrescriptionsSQSQueuePolicyArn
            - Fn::ImportValue: !Sub ${StackName}-ReadNHSNotifyPrescriptionsSQSQueuePolicyArn
            - Fn::ImportValue: !Sub ${StackName}-UseNotificationSQSQueueKMSKeyPolicyArn
            - Fn::ImportValue: !Sub ${StackName}-WritePostDatedNotificationsSQSQueuePolicyArn
            - Fn::ImportValue: !Sub ${StackName}-ReadPostDatedNotificationsSQSQueuePolicyArn
            - Fn::ImportValue: !Sub ${StackName}:tables:${PrescriptionStatusUpdatesTableName}:TableWritePolicyArn
            - Fn::ImportValue: !Sub ${StackName}:tables:${PrescriptionStatusUpdatesTableName}:TableReadPolicyArn
            - Fn::ImportValue: !Sub ${StackName}:tables:UsePrescriptionStatusUpdatesKMSKeyPolicyArn
  ## End of post-dated lambda bits

  NHSNotifyUpdateCallback:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${StackName}-NHSNotifyUpdateCallback
      CodeUri: ../../packages/
      Handler: lambdaHandler.handler
      Role: !GetAtt NHSNotifyUpdateCallbackResources.Outputs.LambdaRoleArn
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          TABLE_NAME: !Ref PrescriptionNotificationStatesTableName
          APP_ID_SECRET:
            Fn::ImportValue: !Sub ${StackName}-PSU-Notify-Application-ID
          API_KEY_SECRET:
            Fn::ImportValue: !Sub ${StackName}-PSU-Notify-API-Key
    Metadata:
      BuildMethod: esbuild
      guard:
        SuppressedRules:
          - LAMBDA_DLQ_CHECK
          - LAMBDA_INSIDE_VPC
          - LAMBDA_CONCURRENCY_CHECK
      BuildProperties:
        Minify: true
        Target: es2020
        Sourcemap: true
        tsconfig: nhsNotifyUpdateCallback/tsconfig.json
        packages: bundle
        EntryPoints:
          - nhsNotifyUpdateCallback/src/lambdaHandler.ts

  NHSNotifyUpdateCallbackResources:
    Type: AWS::Serverless::Application
    Properties:
      Location: lambda_resources.yaml
      Parameters:
        StackName: !Ref StackName
        LambdaName: !Sub ${StackName}-NHSNotifyUpdateCallback
        LambdaArn: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${StackName}-NHSNotifyUpdateCallback
        IncludeAdditionalPolicies: true
        AdditionalPolicies: !Join
          - ","
          - - Fn::ImportValue: !Sub ${StackName}:tables:${PrescriptionNotificationStatesTableName}:TableReadPolicyArn
            - Fn::ImportValue: !Sub ${StackName}:tables:${PrescriptionNotificationStatesTableName}:TableWritePolicyArn
            - Fn::ImportValue: !Sub ${StackName}:tables:UsePrescriptionNotificationStatesKMSKeyPolicyArn
            - Fn::ImportValue: !Sub ${StackName}-GetPSUSecretPolicy
            - Fn::ImportValue: !Sub ${StackName}-UsePSUSecretsKMSKeyPolicyArn
        LogRetentionInDays: !Ref LogRetentionInDays
        CloudWatchKMSKeyId: !ImportValue account-resources:CloudwatchLogsKmsKeyArn
        EnableSplunk: !Ref EnableSplunk
        SplunkSubscriptionFilterRole: !ImportValue lambda-resources:SplunkSubscriptionFilterRole
        SplunkDeliveryStreamArn: !ImportValue lambda-resources:SplunkDeliveryStream

  PsuRestoreValidationPolicy:
    Condition: EnableBackupCondition
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: !Sub ${StackName}-PsuRestoreValidationPolicy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - backup:PutRestoreValidationResult
            Resource: "*"
          - Effect: Allow
            Action:
              - dynamodb:GetItem
              - dynamodb:BatchGetItem
              - dynamodb:Scan
              - dynamodb:Query
              - dynamodb:ConditionCheckItem
              - dynamodb:DescribeTable
            Resource: !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/awsbackup-restore-test-*

  PsuRestoreValidation:
    Condition: EnableBackupCondition
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${StackName}-PsuRestoreValidation
      CodeUri: ../../packages/
      Handler: handler.handler
      Role: !GetAtt PsuRestoreValidationResources.Outputs.LambdaRoleArn
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
    Metadata:
      BuildMethod: esbuild
      guard:
        SuppressedRules:
          - LAMBDA_DLQ_CHECK
          - LAMBDA_INSIDE_VPC
          - LAMBDA_CONCURRENCY_CHECK
      BuildProperties:
        Minify: true
        Target: es2020
        Sourcemap: true
        tsconfig: psuRestoreValidationLambda/tsconfig.json
        packages: bundle
        EntryPoints:
          - psuRestoreValidationLambda/src/handler.ts

  PsuRestoreValidationResources:
    Condition: EnableBackupCondition
    Type: AWS::Serverless::Application
    Properties:
      Location: lambda_resources.yaml
      Parameters:
        StackName: !Ref StackName
        LambdaName: !Sub ${StackName}-PsuRestoreValidation
        LambdaArn: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${StackName}-PsuRestoreValidation
        LogRetentionInDays: !Ref LogRetentionInDays
        CloudWatchKMSKeyId: !ImportValue account-resources:CloudwatchLogsKmsKeyArn
        EnableSplunk: !Ref EnableSplunk
        SplunkSubscriptionFilterRole: !ImportValue lambda-resources:SplunkSubscriptionFilterRole
        SplunkDeliveryStreamArn: !ImportValue lambda-resources:SplunkDeliveryStream
        IncludeAdditionalPolicies: true
        AdditionalPolicies: !Join
          - ","
          - - !Ref PsuRestoreValidationPolicy
            - Fn::ImportValue: !Sub ${StackName}:tables:${PrescriptionStatusUpdatesTableName}:TableReadPolicyArn
            - Fn::ImportValue: !Sub ${StackName}:tables:UsePrescriptionStatusUpdatesKMSKeyPolicyArn

  PsuRestoreValidationLambdaInvokePermission:
    Condition: EnableBackupCondition
    DependsOn:
      - PsuBackupRestoreJobStateChangeRule
      - PsuRestoreValidation
    Type: "AWS::Lambda::Permission"
    Properties:
      Action: "lambda:InvokeFunction"
      FunctionName: !GetAtt PsuRestoreValidation.Arn
      Principal: "events.amazonaws.com"
      SourceArn: !GetAtt PsuBackupRestoreJobStateChangeRule.Arn

  # EventBridge Rule for Backup Restore Job State Change
  PsuBackupRestoreJobStateChangeRule:
    Condition: EnableBackupCondition
    Type: "AWS::Events::Rule"
    Properties:
      EventPattern:
        source:
          - "aws.backup"
        detail-type:
          - "Restore Job State Change"
        detail:
          resourceType:
            - "DynamoDB.FullyManaged"
          status:
            - "COMPLETED"
          sourceResourceArn:
            - !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${PrescriptionStatusUpdatesTableName}
      Targets:
        - Arn: !GetAtt PsuRestoreValidation.Arn
          Id: "RestoreTestingValidationFunction"

Outputs:
  UpdatePrescriptionStatusFunctionName:
    Description: The function name of the UpdatePrescriptionStatus lambda
    Value: !Ref UpdatePrescriptionStatus

  UpdatePrescriptionStatusFunctionArn:
    Description: The function ARN of the UpdatePrescriptionStatus lambda
    Value: !GetAtt UpdatePrescriptionStatus.Arn

  GetStatusUpdatesFunctionName:
    Description: The function name of the GetStatusUpdates lambda
    Value: !Ref GetStatusUpdates

  GetStatusUpdatesFunctionArn:
    Description: The function ARN of the GetStatusUpdates lambda
    Value: !GetAtt GetStatusUpdates.Arn
    Export:
      Name: !Sub ${StackName}:functions:GetStatusUpdates:FunctionArn

  ConvertRequestToFhirFormatFunctionName:
    Description: The function name of the Convert Request to Fhir Format lambda
    Value: !Ref ConvertRequestToFhirFormat

  ConvertRequestToFhirFormatFunctionArn:
    Description: The function ARN of the ConvertRequestToFhirFormat lambda
    Value: !GetAtt ConvertRequestToFhirFormat.Arn
    Export:
      Name: !Sub ${StackName}:functions:ConvertRequestToFhirFormat:FunctionArn

  StatusFunctionName:
    Description: The function name of the Status lambda
    Value: !Ref Status

  StatusFunctionArn:
    Description: The function ARN of the Status lambda
    Value: !GetAtt Status.Arn

  CapabilityStatementFunctionName:
    Description: The function name of the CapabilityStatement lambda
    Value: !Ref CapabilityStatement

  CapabilityStatementFunctionArn:
    Description: The function ARN of the CapabilityStatement lambda
    Value: !GetAtt CapabilityStatement.Arn

  CheckPrescriptionStatusUpdatesFunctionName:
    Description: The function name of the CheckPrescriptionStatusUpdates lambda
    Value: !If
      - ShouldDeployCheckPrescriptionStatusUpdate
      - !Ref CheckPrescriptionStatusUpdates
      - ""

  CheckPrescriptionStatusUpdatesFunctionArn:
    Description: The function ARN of the CheckPrescriptionStatusUpdates lambda
    Value: !If
      - ShouldDeployCheckPrescriptionStatusUpdate
      - !GetAtt CheckPrescriptionStatusUpdates.Arn
      - ""

  NotifyProcessorFunctionName:
    Description: The function name of the NHS Notify lambda
    Value: !Ref NotifyProcessor

  NotifyProcessorFunctionArn:
    Description: The function ARN of the NHS Notify lambda
    Value: !GetAtt NotifyProcessor.Arn

  NHSNotifyUpdateCallbackFunctionName:
    Description: The function name of the NHSNotifyUpdateCallback lambda
    Value: !Ref NHSNotifyUpdateCallback

  NHSNotifyUpdateCallbackFunctionArn:
    Description: The function ARN of the NHSNotifyUpdateCallback lambda
    Value: !GetAtt NHSNotifyUpdateCallback.Arn

  NotificationsReportingFunctionName:
    Description: The function name of the NotificationsReporting lambda
    Value: !If
      - ShouldDeployNotificationsReporting
      - !Ref NotificationsReporting
      - ""

  NotificationsReportingFunctionArn:
    Description: The function ARN of the NotificationsReporting lambda
    Value: !If
      - ShouldDeployNotificationsReporting
      - !GetAtt NotificationsReporting.Arn
      - ""

  # Post-dated lambda outputs
  PostDatedNotifyLambdaFunctionName:
    Description: The function name of the postDatedNotifyLambda
    Value: !Ref PostDatedNotifyLambda

  PostDatedNotifyLambdaFunctionArn:
    Description: The function ARN of the postDatedNotifyLambda
    Value: !GetAtt PostDatedNotifyLambda.Arn