Skip to content

Commit 5a4af5e

Browse files
mattdean3-nhsmattdean3-nhs
committed
NRL-1875 Define dynamodb pointers table as deploy parameter
1 parent e165b1c commit 5a4af5e

14 files changed

Lines changed: 173 additions & 52 deletions

File tree

‎scripts/seed_nft_tables.py‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,8 @@
2222
from nrlf.tests.data import load_document_reference
2323
from tests.performance.seed_data_constants import ( # DEFAULT_COUNT_DISTRIBUTIONS,
2424
CHECKSUM_WEIGHTS,
25-
DEFAULT_CUSTODIAN_DISTRIBUTIONS,
26-
DEFAULT_TYPE_DISTRIBUTIONS,
25+
CUSTODIAN_DISTRIBUTION_PROFILES,
26+
TYPE_DISTRIBUTION_PROFILES,
2727
)
2828

2929
dynamodb = boto3.client("dynamodb")
@@ -87,22 +87,24 @@ def _populate_seed_table(
8787
table_name: str,
8888
px_with_pointers: int,
8989
pointers_per_px: float = 1.0,
90-
type_dists: dict[str, int] = DEFAULT_TYPE_DISTRIBUTIONS,
91-
custodian_dists: dict[str, dict[str, int]] = DEFAULT_CUSTODIAN_DISTRIBUTIONS,
90+
type_dist_profile: str = "default",
91+
custodian_dist_profile: str = "default",
9292
):
9393
"""
9494
Seeds a table with example data for non-functional testing.
9595
"""
9696
if pointers_per_px < 1.0:
9797
raise ValueError("Cannot populate table with patients with zero pointers")
98+
99+
type_dists = TYPE_DISTRIBUTION_PROFILES[type_dist_profile]
100+
custodian_dists = CUSTODIAN_DISTRIBUTION_PROFILES[custodian_dist_profile]
101+
98102
# set up iterations
99103
type_iter = _set_up_cyclical_iterator(type_dists)
100104
custodian_iters = _set_up_custodian_iterators(custodian_dists)
101-
# count_iter = _set_up_cyclical_iterator(DEFAULT_COUNT_DISTRIBUTIONS)
102105
count_iter = _get_pointer_count_poisson_distributions(
103106
px_with_pointers, pointers_per_px
104107
)
105-
# count_iter = _get_pointer_count_negbinom_distributions(px_with_pointers, pointers_per_px)
106108
testnum_cls = TestNhsNumbersIterator()
107109
testnum_iter = iter(testnum_cls)
108110

‎terraform/infrastructure/data.tf‎

Lines changed: 4 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -17,22 +17,12 @@ data "aws_iam_policy" "auth-store-read-policy" {
1717

1818
data "aws_dynamodb_table" "pointers-table" {
1919
count = var.use_shared_resources ? 1 : 0
20-
name = "${local.pointers_table_prefix}-pointers-table"
20+
name = local.shared_pointers_table_name
2121
}
2222

23-
data "aws_iam_policy" "pointers-table-read" {
24-
count = var.use_shared_resources ? 1 : 0
25-
name = "${local.pointers_table_prefix}-pointers-table-read"
26-
}
27-
28-
data "aws_iam_policy" "pointers-table-write" {
29-
count = var.use_shared_resources ? 1 : 0
30-
name = "${local.pointers_table_prefix}-pointers-table-write"
31-
}
32-
33-
data "aws_iam_policy" "pointers-kms-read-write" {
34-
count = var.use_shared_resources ? 1 : 0
35-
name = "${local.pointers_table_prefix}-pointers-kms-read-write"
23+
data "aws_kms_key" "pointers-table-key" {
24+
count = var.use_shared_resources ? 1 : 0
25+
key_id = "alias/${local.shared_pointers_table_name}-key"
3626
}
3727

3828
data "external" "current-info" {

‎terraform/infrastructure/etc/dev.tfvars‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
account_name = "dev"
22
aws_account_name = "dev"
33

4-
dynamodb_pointers_table_prefix = "nhsd-nrlf--dev"
5-
dynamodb_sandbox_pointers_table_prefix = "nhsd-nrlf--dev-sandbox"
4+
dynamodb_pointers_table_name = "nhsd-nrlf--dev-pointers-table"
5+
dynamodb_sandbox_pointers_table_name = "nhsd-nrlf--dev-sandbox-pointers-table"
66

77
domain = "api.record-locator.dev.national.nhs.uk"
88
public_domain = "internal-dev.api.service.nhs.uk"

‎terraform/infrastructure/etc/int.tfvars‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
account_name = "int"
22
aws_account_name = "test"
33

4-
dynamodb_pointers_table_prefix = "nhsd-nrlf--int"
5-
dynamodb_sandbox_pointers_table_prefix = "nhsd-nrlf--int-sandbox"
6-
deletion_protection = true
4+
dynamodb_pointers_table_name = "nhsd-nrlf--int-pointers-table"
5+
dynamodb_sandbox_pointers_table_name = "nhsd-nrlf--int-sandbox-pointers-table"
6+
deletion_protection = true
77

88
domain = "api.record-locator.int.national.nhs.uk"
99
public_domain = "int.api.service.nhs.uk"

‎terraform/infrastructure/etc/perftest.tfvars‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
account_name = "perftest"
22
aws_account_name = "test"
33

4-
dynamodb_pointers_table_prefix = "nhsd-nrlf--perftest-baseline"
4+
dynamodb_pointers_table_name = "nhsd-nrlf--perftest-baseline-pointers-table"
55

66
domain = "perftest.record-locator.national.nhs.uk"
77
public_domain = "perftest.api.service.nhs.uk"

‎terraform/infrastructure/etc/prod.tfvars‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
account_name = "prod"
22
aws_account_name = "prod"
33

4-
dynamodb_pointers_table_prefix = "nhsd-nrlf--prod"
5-
deletion_protection = true
4+
dynamodb_pointers_table_name = "nhsd-nrlf--prod-pointers-table"
5+
deletion_protection = true
66

77
domain = "api.record-locator.national.nhs.uk"
88
public_domain = "api.service.nhs.uk"

‎terraform/infrastructure/etc/qa.tfvars‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
account_name = "qa"
22
aws_account_name = "test"
33

4-
dynamodb_pointers_table_prefix = "nhsd-nrlf--qa"
5-
dynamodb_sandbox_pointers_table_prefix = "nhsd-nrlf--qa-sandbox"
4+
dynamodb_pointers_table_name = "nhsd-nrlf--qa-pointers-table"
5+
dynamodb_sandbox_pointers_table_name = "nhsd-nrlf--qa-sandbox-pointers-table"
66

77
domain = "qa.record-locator.national.nhs.uk"
88
public_domain = "internal-qa.api.service.nhs.uk"

‎terraform/infrastructure/etc/ref.tfvars‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
account_name = "ref"
22
aws_account_name = "test"
33

4-
dynamodb_pointers_table_prefix = "nhsd-nrlf--ref"
4+
dynamodb_pointers_table_name = "nhsd-nrlf--ref-pointers-table"
55

66
domain = "api.record-locator.ref.national.nhs.uk"
77
public_domain = "ref.api.service.nhs.uk"

‎terraform/infrastructure/iam.tf‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
resource "aws_iam_policy" "pointers-table-read" {
2+
count = var.use_shared_resources ? 1 : 0
3+
name = "${local.prefix}-allow-pointers-table-read"
4+
description = "Read the pointers-table"
5+
policy = jsonencode({
6+
Version = "2012-10-17"
7+
Statement = [
8+
{
9+
Action = [
10+
"kms:Decrypt",
11+
"kms:DescribeKey"
12+
]
13+
Effect = "Allow"
14+
Resource = [
15+
data.aws_kms_key.pointers-table-key[0].arn
16+
]
17+
},
18+
{
19+
Effect = "Allow"
20+
Action = [
21+
"dynamodb:Query",
22+
"dynamodb:Scan",
23+
"dynamodb:GetItem",
24+
],
25+
Resource = [
26+
"${data.aws_dynamodb_table.pointers-table[0].arn}*"
27+
]
28+
}
29+
]
30+
})
31+
}
32+
33+
resource "aws_iam_policy" "pointers-table-write" {
34+
count = var.use_shared_resources ? 1 : 0
35+
name = "${local.prefix}-allow-pointers-table-write"
36+
description = "Write to the pointers-table"
37+
policy = jsonencode({
38+
Version = "2012-10-17"
39+
Statement = [
40+
{
41+
Action = [
42+
"kms:Encrypt",
43+
"kms:GenerateDataKey"
44+
]
45+
Effect = "Allow"
46+
Resource = [
47+
data.aws_kms_key.pointers-table-key[0].arn
48+
]
49+
},
50+
{
51+
Effect = "Allow"
52+
Action = [
53+
"dynamodb:PutItem",
54+
"dynamodb:UpdateItem",
55+
"dynamodb:DeleteItem",
56+
],
57+
Resource = [
58+
"${data.aws_dynamodb_table.pointers-table[0].arn}*"
59+
]
60+
}
61+
]
62+
})
63+
}
64+
65+
resource "aws_iam_policy" "pointers-kms-read-write" {
66+
count = var.use_shared_resources ? 1 : 0
67+
name = "${local.prefix}-allow-pointers-kms-read-write"
68+
description = "Encrypt and decrypt with the pointers table kms key"
69+
policy = jsonencode({
70+
Version = "2012-10-17"
71+
Statement = [
72+
{
73+
Action = [
74+
"kms:Decrypt",
75+
"kms:DescribeKey",
76+
"kms:Encrypt",
77+
"kms:GenerateDataKey"
78+
]
79+
Effect = "Allow"
80+
Resource = [
81+
data.aws_kms_key.pointers-table-key[0].arn
82+
]
83+
}
84+
]
85+
})
86+
}

‎terraform/infrastructure/lambda.tf‎

Lines changed: 39 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,9 @@ module "consumer__readDocumentReference" {
1717
}
1818
additional_policies = [
1919
local.pointers_table_read_policy_arn,
20-
local.pointers_kms_read_write_arn,
20+
#local.pointers_kms_read_write_arn,
21+
#aws_iam_policy.pointers-table-read.arn,
22+
#aws_iam_policy.pointers-kms-read-write.arn,
2123
local.auth_store_read_policy_arn
2224
]
2325
firehose_subscriptions = local.firehose_lambda_subscriptions
@@ -44,7 +46,9 @@ module "consumer__searchDocumentReference" {
4446
}
4547
additional_policies = [
4648
local.pointers_table_read_policy_arn,
47-
local.pointers_kms_read_write_arn,
49+
#local.pointers_kms_read_write_arn,
50+
#aws_iam_policy.pointers-table-read.arn,
51+
#aws_iam_policy.pointers-kms-read-write.arn,
4852
local.auth_store_read_policy_arn
4953
]
5054
firehose_subscriptions = local.firehose_lambda_subscriptions
@@ -71,7 +75,9 @@ module "consumer__searchPostDocumentReference" {
7175
}
7276
additional_policies = [
7377
local.pointers_table_read_policy_arn,
74-
local.pointers_kms_read_write_arn,
78+
#local.pointers_kms_read_write_arn,
79+
#aws_iam_policy.pointers-table-read.arn,
80+
#aws_iam_policy.pointers-kms-read-write.arn,
7581
local.auth_store_read_policy_arn
7682
]
7783
firehose_subscriptions = local.firehose_lambda_subscriptions
@@ -99,7 +105,9 @@ module "producer__createDocumentReference" {
99105
additional_policies = [
100106
local.pointers_table_write_policy_arn,
101107
local.pointers_table_read_policy_arn,
102-
local.pointers_kms_read_write_arn,
108+
#aws_iam_policy.pointers-table-read.arn,
109+
#aws_iam_policy.pointers-table-write.arn,
110+
#aws_iam_policy.pointers-table-write.arn,
103111
local.auth_store_read_policy_arn
104112
]
105113
firehose_subscriptions = local.firehose_lambda_subscriptions
@@ -127,7 +135,10 @@ module "producer__deleteDocumentReference" {
127135
additional_policies = [
128136
local.pointers_table_write_policy_arn,
129137
local.pointers_table_read_policy_arn,
130-
local.pointers_kms_read_write_arn,
138+
#local.pointers_kms_read_write_arn,
139+
#aws_iam_policy.pointers-table-read.arn,
140+
#aws_iam_policy.pointers-table-write.arn,
141+
#aws_iam_policy.pointers-kms-read-write.arn,
131142
local.auth_store_read_policy_arn
132143
]
133144
firehose_subscriptions = local.firehose_lambda_subscriptions
@@ -154,7 +165,9 @@ module "producer__readDocumentReference" {
154165
}
155166
additional_policies = [
156167
local.pointers_table_read_policy_arn,
157-
local.pointers_kms_read_write_arn,
168+
#local.pointers_kms_read_write_arn,
169+
#aws_iam_policy.pointers-table-read.arn,
170+
#aws_iam_policy.pointers-kms-read-write.arn,
158171
local.auth_store_read_policy_arn
159172
]
160173
firehose_subscriptions = local.firehose_lambda_subscriptions
@@ -181,7 +194,9 @@ module "producer__searchDocumentReference" {
181194
}
182195
additional_policies = [
183196
local.pointers_table_read_policy_arn,
184-
local.pointers_kms_read_write_arn,
197+
#local.pointers_kms_read_write_arn,
198+
#aws_iam_policy.pointers-table-read.arn,
199+
#aws_iam_policy.pointers-kms-read-write.arn,
185200
local.auth_store_read_policy_arn
186201
]
187202
firehose_subscriptions = local.firehose_lambda_subscriptions
@@ -208,7 +223,9 @@ module "producer__searchPostDocumentReference" {
208223
}
209224
additional_policies = [
210225
local.pointers_table_read_policy_arn,
211-
local.pointers_kms_read_write_arn,
226+
#local.pointers_kms_read_write_arn,
227+
#aws_iam_policy.pointers-table-read.arn,
228+
#aws_iam_policy.pointers-kms-read-write.arn,
212229
local.auth_store_read_policy_arn
213230
]
214231
firehose_subscriptions = local.firehose_lambda_subscriptions
@@ -236,7 +253,10 @@ module "producer__updateDocumentReference" {
236253
additional_policies = [
237254
local.pointers_table_read_policy_arn,
238255
local.pointers_table_write_policy_arn,
239-
local.pointers_kms_read_write_arn,
256+
#local.pointers_kms_read_write_arn,
257+
#aws_iam_policy.pointers-table-read.arn,
258+
#aws_iam_policy.pointers-table-write.arn,
259+
#aws_iam_policy.pointers-kms-read-write.arn,
240260
local.auth_store_read_policy_arn
241261
]
242262
firehose_subscriptions = local.firehose_lambda_subscriptions
@@ -264,7 +284,10 @@ module "producer__upsertDocumentReference" {
264284
additional_policies = [
265285
local.pointers_table_write_policy_arn,
266286
local.pointers_table_read_policy_arn,
267-
local.pointers_kms_read_write_arn,
287+
#local.pointers_kms_read_write_arn,
288+
#aws_iam_policy.pointers-table-read.arn,
289+
#aws_iam_policy.pointers-table-write.arn,
290+
#aws_iam_policy.pointers-kms-read-write.arn,
268291
local.auth_store_read_policy_arn
269292
]
270293
firehose_subscriptions = local.firehose_lambda_subscriptions
@@ -292,7 +315,9 @@ module "consumer__status" {
292315
}
293316
additional_policies = [
294317
local.pointers_table_read_policy_arn,
295-
local.pointers_kms_read_write_arn,
318+
#local.pointers_kms_read_write_arn,
319+
#aws_iam_policy.pointers-table-read.arn,
320+
#aws_iam_policy.pointers-kms-read-write.arn,
296321
local.auth_store_read_policy_arn
297322
]
298323
firehose_subscriptions = local.firehost_lambda_splunk_only_subscription
@@ -321,7 +346,9 @@ module "producer__status" {
321346
}
322347
additional_policies = [
323348
local.pointers_table_read_policy_arn,
324-
local.pointers_kms_read_write_arn,
349+
#local.pointers_kms_read_write_arn,
350+
#aws_iam_policy.pointers-table-read.arn,
351+
#aws_iam_policy.pointers-kms-read-write.arn,
325352
local.auth_store_read_policy_arn
326353
]
327354
firehose_subscriptions = local.firehost_lambda_splunk_only_subscription

0 commit comments

Comments
 (0)