eps-prescription-status-update-api/SAMtemplates/apis/api_resources.yaml at 900789a2d3d6498fcb12e4e00bf84db2b72cf1b8 · NHSDigital/eps-prescription-status-update-api · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: |
  Resources for an API

Parameters:
  AdditionalPolicies:
    Type: CommaDelimitedList
    Description: A list of additional policies to attach to the API gateway role (comma delimited).
    Default: ""

  ApiName:
    Type: String
    Default: none

  LogRetentionInDays:
    Type: Number

  EnableSplunk:
    Type: String

  ForwardCsocLogs:
    Type: String
    Default: false

Conditions:
  ShouldUseSplunk: !Equals
    - true
    - !Ref EnableSplunk
  ShouldForwardCsocLogs: !Equals
    - true
    - !Ref ForwardCsocLogs
  HasAdditionalPolicies: !Not
    - !Equals
      - !Join [",", !Ref AdditionalPolicies]
      - ""

Resources:
  ApiGwRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - apigateway.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns: !If
        - HasAdditionalPolicies
        - !Split
          - ","
          - !Join
            - ","
            - - !Join
                - ","
                - !Ref AdditionalPolicies
        - !Ref "AWS::NoValue"

  ApiGwAccessLogs:
    Type: AWS::Logs::LogGroup
    Metadata:
      guard:
        SuppressedRules:
          - CW_LOGGROUP_RETENTION_PERIOD_CHECK
    Properties:
      LogGroupName: !Sub /aws/apigateway/${ApiName}
      RetentionInDays: !Ref LogRetentionInDays
      KmsKeyId: !ImportValue account-resources-cdk-uk:KMS:CloudwatchLogsKmsKey:Arn

  ApiGwAccessLogsSplunkSubscriptionFilter:
    Condition: ShouldUseSplunk
    Type: AWS::Logs::SubscriptionFilter
    Properties:
      RoleArn: !ImportValue account-resources-cdk-uk:IAM:SplunkSubscriptionFilterRole:Arn
      LogGroupName: !Ref ApiGwAccessLogs
      FilterPattern: ""
      DestinationArn: !ImportValue account-resources-cdk-uk:Firehose:SplunkDeliveryStream:Arn

  ApiGwAccessLogsCsocSubscriptionFilter:
    Condition: ShouldForwardCsocLogs
    Type: AWS::Logs::SubscriptionFilter
    Properties:
      RoleArn: !ImportValue account-resources-cdk-uk:IAM:SplunkSubscriptionFilterRole:Arn
      LogGroupName: !Ref ApiGwAccessLogs
      FilterPattern: ""
      DestinationArn: "arn:aws:logs:eu-west-2:693466633220:destination:api_gateway_log_destination"

Outputs:
  ApiGwRoleArn:
    Description: The API GW role ARN
    Value: !GetAtt ApiGwRole.Arn

  ApiGwAccessLogsArn:
    Description: The API GW access logs ARN
    Value: !GetAtt ApiGwAccessLogs.Arn