Skip to content

Commit 3bfd165

Browse files
jamesthompson26-nhsjamesthompson26-nhs
authored
Feature/ccm 10203 obs datasource (#109)
* CCM-10203: Add Observability Datasource * CCM-10203: Add Observability Datasource * CCM-10203: Add Observability Datasource * CCM-10203: Add Observability Datasource * CCM-10203: Add Observability Datasource * CCM-10203: Add Observability Datasource * CCM-10203: Add Observability Datasource * CCM-10203: Add Observability Datasource * CCM-10203: Add Observability Datasource * CCM-10203: Add Observability Datasource * CCM-10203: Add Observability Datasource * CCM-10203: Add Observability Datasource * CCM-10203: Add Observability Datasource * CCM-10203: Add Observability Datasource * CCM-10203: Add Observability Datasource * CCM-10203: Add Observability Datasource * CCM-10203: Add Observability Datasource * CCM-10203: Add Observability Datasource * CCM-10203: Add Observability Datasource
1 parent f3796bf commit 3bfd165

17 files changed

Lines changed: 141 additions & 16 deletions

‎.tool-versions‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ trivy 0.61.0
1212
# The section below is reserved for Docker image versions.
1313

1414
# TODO: Move this section - consider using a different file for the repository template dependencies.
15-
# docker/ghcr.io/anchore/grype v0.69.1@sha256:d41fcb371d0af59f311e72123dff46900ebd6d0482391b5a830853ee4f9d1a76 # SEE: https://github.com/anchore/grype/pkgs/container/grype
16-
# docker/ghcr.io/anchore/syft v0.92.0@sha256:63c60f0a21efb13e80aa1359ab243e49213b6cc2d7e0f8179da38e6913b997e0 # SEE: https://github.com/anchore/syft/pkgs/container/syft
15+
# docker/ghcr.io/anchore/grype v0.92.2@sha256:651e558f9ba84f2a790b3449c8a57cbbf4f34e004f7d3f14ae8f8cbeede4cd33 # SEE: https://github.com/anchore/grype/pkgs/container/grype
16+
# docker/ghcr.io/anchore/syft v1.26.0@sha256:de078f51704a213906970b1475edd6006b8af50aa159852e125518237487b8c6 # SEE: https://github.com/anchore/syft/pkgs/container/syft
1717
# docker/ghcr.io/gitleaks/gitleaks v8.18.0@sha256:fd2b5cab12b563d2cc538b14631764a1c25577780e3b7dba71657d58da45d9d9 # SEE: https://github.com/gitleaks/gitleaks/pkgs/container/gitleaks
1818
# docker/ghcr.io/igorshubovych/markdownlint-cli v0.37.0@sha256:fb3e79946fce78e1cde84d6798c6c2a55f2de11fc16606a40d49411e281d950d # SEE: https://github.com/igorshubovych/markdownlint-cli/pkgs/container/markdownlint-cli
1919
# docker/ghcr.io/make-ops-tools/gocloc latest@sha256:6888e62e9ae693c4ebcfed9f1d86c70fd083868acb8815fe44b561b9a73b5032 # SEE: https://github.com/make-ops-tools/gocloc/pkgs/container/gocloc

‎infrastructure/terraform/components/acct/README.md‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,17 +18,21 @@
1818
| <a name="input_default_tags"></a> [default\_tags](#input\_default\_tags) | A map of default tags to apply to all taggable resources within the component | `map(string)` | `{}` | no |
1919
| <a name="input_environment"></a> [environment](#input\_environment) | The name of the tfscaffold environment | `string` | n/a | yes |
2020
| <a name="input_group"></a> [group](#input\_group) | The group variables are being inherited from (often synonmous with account short-name) | `string` | n/a | yes |
21-
| <a name="input_observability_account_id"></a> [observability\_account\_id](#input\_observability\_account\_id) | The Observability Account ID that needs access | `string` | n/a | yes |
21+
| <a name="input_oam_sink_id"></a> [oam\_sink\_id](#input\_oam\_sink\_id) | The ID of the Cloudwatch OAM sink in the appropriate observability account. | `string` | `null` | no |
22+
| <a name="input_observability_account_id"></a> [observability\_account\_id](#input\_observability\_account\_id) | The Observability Account ID that needs access | `string` | `null` | no |
2223
| <a name="input_project"></a> [project](#input\_project) | The name of the tfscaffold project | `string` | n/a | yes |
2324
| <a name="input_region"></a> [region](#input\_region) | The AWS Region | `string` | n/a | yes |
2425
## Modules
2526

26-
No modules.
27+
| Name | Source | Version |
28+
|------|--------|---------|
29+
| <a name="module_obs_datasource"></a> [obs\_datasource](#module\_obs\_datasource) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/obs-datasource | v2.0.3 |
2730
## Outputs
2831

2932
| Name | Description |
3033
|------|-------------|
3134
| <a name="output_aws_account_id"></a> [aws\_account\_id](#output\_aws\_account\_id) | n/a |
35+
| <a name="output_log_subscription_role_arn"></a> [log\_subscription\_role\_arn](#output\_log\_subscription\_role\_arn) | n/a |
3236
<!-- vale on -->
3337
<!-- markdownlint-enable -->
3438
<!-- END_TF_DOCS -->

‎infrastructure/terraform/components/acct/iam_policy_github_deploy_overload.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ data "aws_iam_policy_document" "github_deploy" {
1919
"firehose:*",
2020
"glue:*",
2121
"kinesis:*",
22+
"oam:*",
2223
]
2324
resources = ["*"]
2425
}

‎infrastructure/terraform/components/acct/module_obs_datasource.tf‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
module "obs_datasource" {
2+
source = "git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/obs-datasource?ref=v2.0.3"
3+
4+
name = "obs-datasource"
5+
6+
aws_account_id = var.aws_account_id
7+
region = var.region
8+
project = var.project
9+
environment = var.environment
10+
component = var.component
11+
12+
oam_sink_id = var.oam_sink_id
13+
observability_account_id = var.observability_account_id
14+
}

‎infrastructure/terraform/components/acct/outputs.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
11
output "aws_account_id" {
22
value = var.aws_account_id
33
}
4+
5+
output "log_subscription_role_arn" {
6+
value = module.obs_datasource.log_subscription_role_arn
7+
}

‎infrastructure/terraform/components/acct/variables.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,4 +60,11 @@ variable "core_account_ids" {
6060
variable "observability_account_id" {
6161
type = string
6262
description = "The Observability Account ID that needs access"
63+
default = null
64+
}
65+
66+
variable "oam_sink_id" {
67+
description = "The ID of the Cloudwatch OAM sink in the appropriate observability account."
68+
type = string
69+
default = null
6370
}

‎infrastructure/terraform/components/reporting/README.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ No requirements.
1313
| <a name="input_account_name"></a> [account\_name](#input\_account\_name) | The name of the AWS Account to deploy into (see globals.tfvars) | `string` | n/a | yes |
1414
| <a name="input_app_deployer_role_name"></a> [app\_deployer\_role\_name](#input\_app\_deployer\_role\_name) | Name of the app deployer role that is allowed to deploy Comms Mgr applications but not create other IAM roles | `string` | n/a | yes |
1515
| <a name="input_app_deployer_role_permission_account_ids"></a> [app\_deployer\_role\_permission\_account\_ids](#input\_app\_deployer\_role\_permission\_account\_ids) | All AWS Account IDs for this project that have the AppDeployer role created | `map(string)` | `{}` | no |
16+
| <a name="input_aws_account_id"></a> [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes |
1617
| <a name="input_batch_client_ids"></a> [batch\_client\_ids](#input\_batch\_client\_ids) | List of client ids that require additional batch identifier dimensions when aggregating data | `list(string)` | <pre>[<br/> "NULL"<br/>]</pre> | no |
1718
| <a name="input_cloudtrail_log_group_name"></a> [cloudtrail\_log\_group\_name](#input\_cloudtrail\_log\_group\_name) | The name of the Cloudtrail log group name on the account (see globals.tfvars) | `string` | n/a | yes |
1819
| <a name="input_component"></a> [component](#input\_component) | The name of the component | `string` | `"reporting"` | no |
@@ -21,6 +22,7 @@ No requirements.
2122
| <a name="input_core_account_ids"></a> [core\_account\_ids](#input\_core\_account\_ids) | List of all corresponding core account id's that exist in the Non-Prod domain | `list(string)` | `[]` | no |
2223
| <a name="input_core_env"></a> [core\_env](#input\_core\_env) | The core environment that contains the corresponding Glue table/S3 buckets etc. | `string` | `"internal-dev"` | no |
2324
| <a name="input_default_kms_deletion_window_in_days"></a> [default\_kms\_deletion\_window\_in\_days](#input\_default\_kms\_deletion\_window\_in\_days) | Default number of days to set KMS key deletion window | `number` | `14` | no |
25+
| <a name="input_default_tags"></a> [default\_tags](#input\_default\_tags) | A map of default tags to apply to all taggable resources within the component | `map(string)` | `{}` | no |
2426
| <a name="input_desired_capacity"></a> [desired\_capacity](#input\_desired\_capacity) | The desired number of instances in the Power BI On-Premises Gateway Auto Scaling group. | `number` | `1` | no |
2527
| <a name="input_enable_powerbi_gateway"></a> [enable\_powerbi\_gateway](#input\_enable\_powerbi\_gateway) | Deploy EC2 instance for PowerBI On-Premises Gateway | `bool` | `true` | no |
2628
| <a name="input_enable_s3_backup"></a> [enable\_s3\_backup](#input\_enable\_s3\_backup) | Enable AWS S3 Backup of the data bucket | `bool` | `true` | no |
@@ -33,7 +35,7 @@ No requirements.
3335
| <a name="input_max_size"></a> [max\_size](#input\_max\_size) | The maximum number of instances in the Power BI On-Premises Gateway Auto Scaling group. | `number` | `1` | no |
3436
| <a name="input_min_size"></a> [min\_size](#input\_min\_size) | The minimum number of instances in the Power BI On-Premises Gateway Auto Scaling group. | `number` | `1` | no |
3537
| <a name="input_module"></a> [module](#input\_module) | The variable encapsulating the name of this module | `string` | `"n/a"` | no |
36-
| <a name="input_observability_account_id"></a> [observability\_account\_id](#input\_observability\_account\_id) | The Observability Account ID that needs access | `string` | n/a | yes |
38+
| <a name="input_observability_account_id"></a> [observability\_account\_id](#input\_observability\_account\_id) | The Observability Account ID that needs access | `string` | `null` | no |
3739
| <a name="input_periodic_s3backup_retention_days"></a> [periodic\_s3backup\_retention\_days](#input\_periodic\_s3backup\_retention\_days) | number of days to retain weekly s3 backups | `number` | `90` | no |
3840
| <a name="input_periodic_s3backup_schedule"></a> [periodic\_s3backup\_schedule](#input\_periodic\_s3backup\_schedule) | Crontab formatted schedule for Periodic S3 Backups | `string` | `"cron(0 5 ? * 7 *)"` | no |
3941
| <a name="input_private_subnet_cidrs"></a> [private\_subnet\_cidrs](#input\_private\_subnet\_cidrs) | List of CIDR blocks for private subnets. | `list(string)` | `[]` | no |

‎infrastructure/terraform/components/reporting/cloudwatch_log_group_reporting.tf‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,11 @@ resource "aws_cloudwatch_log_group" "reporting" {
22
name = "/aws/sfn-state-machine/${local.csi}"
33
retention_in_days = var.log_retention_days
44
}
5+
6+
resource "aws_cloudwatch_log_subscription_filter" "reporting" {
7+
name = "${local.csi}-reporting"
8+
log_group_name = aws_cloudwatch_log_group.reporting.name
9+
filter_pattern = ""
10+
destination_arn = "arn:aws:logs:${var.region}:${var.observability_account_id}:destination:nhs-notify-main-acct-firehose-logs"
11+
role_arn = local.acct.log_subscription_role_arn
12+
}

‎infrastructure/terraform/components/reporting/locals_remote_state.tf‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
locals {
2+
bootstrap = data.terraform_remote_state.bootstrap.outputs
3+
acct = data.terraform_remote_state.acct.outputs
4+
}
5+
6+
data "terraform_remote_state" "bootstrap" {
7+
backend = "s3"
8+
9+
config = {
10+
bucket = local.terraform_state_bucket
11+
12+
key = format(
13+
"%s/%s/%s/%s/bootstrap.tfstate",
14+
var.project,
15+
var.aws_account_id,
16+
"eu-west-2",
17+
"bootstrap"
18+
)
19+
20+
region = "eu-west-2"
21+
}
22+
}
23+
24+
data "terraform_remote_state" "acct" {
25+
backend = "s3"
26+
27+
config = {
28+
bucket = local.terraform_state_bucket
29+
30+
key = format(
31+
"%s/%s/%s/%s/acct.tfstate",
32+
var.project,
33+
var.aws_account_id,
34+
"eu-west-2",
35+
var.environment
36+
)
37+
38+
region = "eu-west-2"
39+
}
40+
}

‎infrastructure/terraform/components/reporting/locals_tfscaffold.tf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
locals {
2+
terraform_state_bucket = format(
3+
"%s-tfscaffold-%s-%s",
4+
var.project,
5+
var.aws_account_id,
6+
var.region,
7+
)
8+
9+
default_tags = merge(
10+
var.default_tags,
11+
{
12+
Project = var.project
13+
Environment = var.environment
14+
Component = var.component
15+
Group = var.group
16+
Name = local.csi
17+
},
18+
)
19+
}

0 commit comments

Comments
 (0)