Merge branch 'develop' into feature/kabo5-NRL-1826-immutable-backups-compliance-mode

katebobyn-nhs · web-flow · commit 33b2cc6549d7 · 2026-02-02T16:15:58.000Z
diff --git a/scripts/manage_permissions.py b/scripts/manage_permissions.py
@@ -1,4 +1,7 @@
 #!/usr/bin/env python
+"""
+Manage organisation pointer type permissions for NRLF apps in a given environment ENV
+"""
 
 import json
 import os
diff --git a/terraform/account-wide-infrastructure/dev/ec2.tf b/terraform/account-wide-infrastructure/dev/ec2.tf
@@ -19,6 +19,8 @@ module "powerbi_gw_instance" {
   glue_kms_key_arn   = module.dev-glue.aws_kms_key_arn
   athena_kms_key_arn = module.dev-athena[0].kms_key_arn
   athena_bucket_arn  = module.dev-athena[0].bucket_arn
+  root_volume_size   = var.powerbi_gw_root_volume_size
+  root_volume_iops   = var.powerbi_gw_root_volume_iops
 
   subnet_id       = module.vpc[0].private_subnet_id
   security_groups = [module.vpc[0].powerbi_gw_security_group_id]
diff --git a/terraform/account-wide-infrastructure/dev/vars.tf b/terraform/account-wide-infrastructure/dev/vars.tf
@@ -67,3 +67,15 @@ variable "use_powerbi_gw_custom_ami" {
   description = "Use custom image for PowerBI GW instance"
   default     = true
 }
+
+variable "powerbi_gw_root_volume_size" {
+  type        = number
+  description = "Size of the root EBS volume in GB"
+  default     = 40
+}
+
+variable "powerbi_gw_root_volume_iops" {
+  type        = number
+  description = "IOPS for the root EBS volume"
+  default     = 3000
+}
diff --git a/terraform/account-wide-infrastructure/modules/powerbi-gw-ec2/ec2.tf b/terraform/account-wide-infrastructure/modules/powerbi-gw-ec2/ec2.tf
@@ -8,8 +8,9 @@ resource "aws_instance" "powerbi_gw" {
   vpc_security_group_ids      = var.security_groups
 
   root_block_device {
-    volume_size = 40
-    volume_type = "gp2"
+    volume_size = var.root_volume_size
+    volume_type = "gp3"
+    iops        = var.root_volume_iops
   }
 
   user_data = file("${path.module}/scripts/user_data.tpl")
diff --git a/terraform/account-wide-infrastructure/modules/powerbi-gw-ec2/vars.tf b/terraform/account-wide-infrastructure/modules/powerbi-gw-ec2/vars.tf
@@ -7,3 +7,13 @@ variable "athena_kms_key_arn" {}
 variable "target_bucket_arn" {}
 variable "athena_bucket_arn" {}
 variable "use_custom_ami" {}
+variable "root_volume_size" {
+  type        = number
+  description = "Size of the root EBS volume in GB"
+  default     = 40
+}
+variable "root_volume_iops" {
+  type        = number
+  description = "IOPS for the root EBS volume if using io1 or gp3 volume type"
+  default     = 3000
+}
diff --git a/terraform/account-wide-infrastructure/prod/ec2.tf b/terraform/account-wide-infrastructure/prod/ec2.tf
@@ -19,6 +19,8 @@ module "powerbi_gw_instance" {
   glue_kms_key_arn   = module.prod-glue.aws_kms_key_arn
   athena_kms_key_arn = module.prod-athena[0].kms_key_arn
   athena_bucket_arn  = module.prod-athena[0].bucket_arn
+  root_volume_size   = var.powerbi_gw_root_volume_size
+  root_volume_iops   = var.powerbi_gw_root_volume_iops
 
   subnet_id       = module.vpc[0].private_subnet_id
   security_groups = [module.vpc[0].powerbi_gw_security_group_id]
diff --git a/terraform/account-wide-infrastructure/prod/vars.tf b/terraform/account-wide-infrastructure/prod/vars.tf
@@ -68,3 +68,15 @@ variable "use_powerbi_gw_custom_ami" {
   description = "Use custom image for PowerBI GW instance"
   default     = true
 }
+
+variable "powerbi_gw_root_volume_size" {
+  type        = number
+  description = "Size of the root EBS volume in GB"
+  default     = 256
+}
+
+variable "powerbi_gw_root_volume_iops" {
+  type        = number
+  description = "IOPS for the root EBS volume"
+  default     = 3000
+}
diff --git a/terraform/account-wide-infrastructure/test/ec2.tf b/terraform/account-wide-infrastructure/test/ec2.tf
@@ -19,6 +19,8 @@ module "powerbi_gw_instance" {
   glue_kms_key_arn   = module.test-glue.aws_kms_key_arn
   athena_kms_key_arn = module.test-athena[0].kms_key_arn
   athena_bucket_arn  = module.test-athena[0].bucket_arn
+  root_volume_size   = var.powerbi_gw_root_volume_size
+  root_volume_iops   = var.powerbi_gw_root_volume_iops
 
   subnet_id       = module.vpc[0].private_subnet_id
   security_groups = [module.vpc[0].powerbi_gw_security_group_id]
diff --git a/terraform/account-wide-infrastructure/test/vars.tf b/terraform/account-wide-infrastructure/test/vars.tf
@@ -87,3 +87,15 @@ variable "use_powerbi_gw_custom_ami" {
   description = "Use custom image for PowerBI GW instance"
   default     = true
 }
+
+variable "powerbi_gw_root_volume_size" {
+  type        = number
+  description = "Size of the root EBS volume in GB"
+  default     = 40
+}
+
+variable "powerbi_gw_root_volume_iops" {
+  type        = number
+  description = "IOPS for the root EBS volume"
+  default     = 3000
+}
diff --git a/terraform/infrastructure/etc/perftest.tfvars b/terraform/infrastructure/etc/perftest.tfvars
@@ -1,7 +1,7 @@
 account_name     = "perftest"
 aws_account_name = "test"
 
-dynamodb_pointers_table_name = "nhsd-nrlf--perftest-15m-pointers-table"
+dynamodb_pointers_table_name = "nhsd-nrlf--perftest-55m-pointers-table"
 
 domain        = "perftest.record-locator.national.nhs.uk"
 public_domain = "perftest.api.service.nhs.uk"
diff --git a/tests/performance/README.md b/tests/performance/README.md
@@ -45,6 +45,8 @@ make ENV=perftest USE_SHARED_RESOURCES=true apply
 
 You will need to generate pointer permissions the first time performance tests are run in an environment e.g. if the perftest environment is destroyed & recreated.
 
+##### Internal permissions
+
 ```sh
 assume nhsd-nrlf-mgmt
 
@@ -59,6 +61,26 @@ make init TF_WORKSPACE_NAME=perftest-1 ENV=perftest
 make ENV=perftest USE_SHARED_RESOURCES=true apply
 ```
 
+This will set up permissions for the `K6PerformanceTest` organisation, which is used for internal testing.
+
+##### Public permissions
+
+To set additional permissions for public testing, you will need to update the permissions for the default app (currently: `X26-NRL-6981ad7d-cff4-4613-93d0-df60e5e2fc52`) which you can do using [./scripts/manage_permissions.py](./scripts/manage_permissions.py).
+
+You can find the pointer types each ODS code will need permissions for in [tests/performance/seed_data_constants.py](tests/performance/seed_data_constants.py) under `*_POINTERS_CUSTODIAN_DISTRIBUTIONS`. These are used to seed the test data.
+
+For example: while running perf tests, the following failure occurred:
+
+```sh
+WARN[0484] {"issue":[{"severity":"error","code":"forbidden","details":{"coding":[{"system":"https://fhir.nhs.uk/CodeSystem/Spine-ErrorOrWarningCode","code":"ACCESS DENIED","display":"Access has been denied to process this request"}]},"diagnostics":"Your organisation 'TD2L9A' does not have permission to access this resource. Contact the onboarding team."}],"resourceType":"OperationOutcome"}  source=console
+```
+
+To resolve this, we can give the organisation `TD2L9A` permission to access the pointer type `824321000000109` on the default app:
+
+```sh
+ENV=perftest poetry run python ./scripts/manage_permissions.py set_perms X26-NRL-6981ad7d-cff4-4613-93d0-df60e5e2fc52 TD2L9A http://snomed.info/sct\|824321000000109
+```
+
 ### Prepare to run tests
 
 Prepare input files
diff --git a/tests/performance/producer/generate_permissions.py b/tests/performance/producer/generate_permissions.py
@@ -3,7 +3,11 @@
 
 import fire
 
-from tests.performance.seed_data_constants import DEFAULT_CUSTODIAN_DISTRIBUTIONS
+from tests.performance.seed_data_constants import (
+    DEFAULT_CUSTODIAN_DISTRIBUTIONS,
+    VOL_15M_POINTERS_CUSTODIAN_DISTRIBUTIONS,
+    VOL_55M_POINTERS_CUSTODIAN_DISTRIBUTIONS,
+)
 
 
 def main(output_dir="../../dist/nrlf_permissions/K6PerformanceTest"):
@@ -15,6 +19,12 @@ def main(output_dir="../../dist/nrlf_permissions/K6PerformanceTest"):
     for pointer_type, custodians in DEFAULT_CUSTODIAN_DISTRIBUTIONS.items():
         for custodian, _ in custodians.items():
             custodian_permissions.setdefault(custodian, []).append(pointer_type)
+    for pointer_type, custodians in VOL_15M_POINTERS_CUSTODIAN_DISTRIBUTIONS.items():
+        for custodian, _ in custodians.items():
+            custodian_permissions.setdefault(custodian, []).append(pointer_type)
+    for pointer_type, custodians in VOL_55M_POINTERS_CUSTODIAN_DISTRIBUTIONS.items():
+        for custodian, _ in custodians.items():
+            custodian_permissions.setdefault(custodian, []).append(pointer_type)
 
     for custodian, pointer_types in custodian_permissions.items():
         permissions = [f"http://snomed.info/sct|{pt}" for pt in pointer_types]
