CCM-13399 supplier allocation on 12950

infrastructure/terraform/components/api/README.md

@@ -43,6 +43,8 @@ No requirements.
 
 | Name | Source | Version |
 |------|--------|---------|
+| <a name="module_amendment_event_transformer"></a> [amendment\_event\_transformer](#module\_amendment\_event\_transformer) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
+| <a name="module_amendments_queue"></a> [amendments\_queue](#module\_amendments\_queue) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
 | <a name="module_authorizer_lambda"></a> [authorizer\_lambda](#module\_authorizer\_lambda) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
 | <a name="module_domain_truststore"></a> [domain\_truststore](#module\_domain\_truststore) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-s3bucket.zip | n/a |
 | <a name="module_eventpub"></a> [eventpub](#module\_eventpub) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.31/terraform-eventpub.zip | n/a |
@@ -52,7 +54,6 @@ No requirements.
 | <a name="module_get_letters"></a> [get\_letters](#module\_get\_letters) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
 | <a name="module_get_status"></a> [get\_status](#module\_get\_status) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
 | <a name="module_kms"></a> [kms](#module\_kms) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-kms.zip | n/a |
-| <a name="module_letter_status_update"></a> [letter\_status\_update](#module\_letter\_status\_update) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
 | <a name="module_letter_status_updates_queue"></a> [letter\_status\_updates\_queue](#module\_letter\_status\_updates\_queue) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
 | <a name="module_letter_updates_transformer"></a> [letter\_updates\_transformer](#module\_letter\_updates\_transformer) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
 | <a name="module_logging_bucket"></a> [logging\_bucket](#module\_logging\_bucket) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-s3bucket.zip | n/a |
@@ -62,6 +63,8 @@ No requirements.
 | <a name="module_post_mi"></a> [post\_mi](#module\_post\_mi) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
 | <a name="module_s3bucket_test_letters"></a> [s3bucket\_test\_letters](#module\_s3bucket\_test\_letters) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-s3bucket.zip | n/a |
 | <a name="module_sqs_letter_updates"></a> [sqs\_letter\_updates](#module\_sqs\_letter\_updates) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-sqs.zip | n/a |
+| <a name="module_sqs_supplier_allocator"></a> [sqs\_supplier\_allocator](#module\_sqs\_supplier\_allocator) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-sqs.zip | n/a |
+| <a name="module_supplier_allocator"></a> [supplier\_allocator](#module\_supplier\_allocator) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
 | <a name="module_supplier_ssl"></a> [supplier\_ssl](#module\_supplier\_ssl) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-ssl.zip | n/a |
 | <a name="module_upsert_letter"></a> [upsert\_letter](#module\_upsert\_letter) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
 ## Outputs

infrastructure/terraform/components/api/event_source_mapping_status_updates_to_handler.tf

@@ -1,12 +1,12 @@
 resource "aws_lambda_event_source_mapping" "status_updates_sqs_to_status_update_handler" {
-  event_source_arn                   = module.letter_status_updates_queue.sqs_queue_arn
-  function_name                      = module.letter_status_update.function_arn
+  event_source_arn                   = module.amendments_queue.sqs_queue_arn
+  function_name                      = module.amendment_event_transformer.function_arn
   batch_size                         = 10
   maximum_batching_window_in_seconds = 1
   scaling_config { maximum_concurrency = 10 }
 
   depends_on = [
-    module.letter_status_updates_queue, # ensures queue exists
-    module.letter_status_update         # ensures update handler exists
+    module.amendments_queue,           # ensures queue exists
+    module.amendment_event_transformer # ensures update handler exists
   ]
 }

infrastructure/terraform/components/api/lambda_event_source_mapping_amendments.tf

@@ -0,0 +1,9 @@
+resource "aws_lambda_event_source_mapping" "amendment_event_transformer" {
+  event_source_arn                   = module.amendments_queue.sqs_queue_arn
+  function_name                      = module.amendment_event_transformer.function_name
+  batch_size                         = 10
+  maximum_batching_window_in_seconds = 5
+  function_response_types = [
+    "ReportBatchItemFailures"
+  ]
+}

infrastructure/terraform/components/api/lambda_event_source_mapping_letter_status_update.tf

@@ -0,0 +1,9 @@
+resource "aws_lambda_event_source_mapping" "letter_status_update" {
+  event_source_arn                   = module.letter_status_updates_queue.sqs_queue_arn
+  function_name                      = module.amendment_event_transformer.function_name
+  batch_size                         = 10
+  maximum_batching_window_in_seconds = 5
+  function_response_types = [
+    "ReportBatchItemFailures"
+  ]
+}

infrastructure/terraform/components/api/lambda_event_source_mapping_supplier_allocator.tf

@@ -0,0 +1,9 @@
+resource "aws_lambda_event_source_mapping" "supplier_allocator" {
+  event_source_arn                   = module.sqs_supplier_allocator.sqs_queue_arn
+  function_name                      = module.supplier_allocator.function_name
+  batch_size                         = 10
+  maximum_batching_window_in_seconds = 5
+  function_response_types = [
+    "ReportBatchItemFailures"
+  ]
+}

infrastructure/terraform/components/api/locals.tf

@@ -27,6 +27,8 @@ locals {
     SUPPLIER_ID_HEADER       = "nhsd-supplier-id",
     APIM_CORRELATION_HEADER  = "nhsd-correlation-id",
     DOWNLOAD_URL_TTL_SECONDS = 60
+    SNS_TOPIC_ARN            = "${module.eventsub.sns_topic.arn}",
+    EVENT_SOURCE             = "/data-plane/supplier-api/${var.group}/${var.environment}/letters"
   }
 
   core_pdf_bucket_arn        = "arn:aws:s3:::comms-${var.core_account_id}-eu-west-2-${var.core_environment}-api-stg-pdf-pipeline"

infrastructure/terraform/components/api/module_lambda_letter_status_update.tf → infrastructure/terraform/components/api/module_lambda_amendment_event_transformer.tf

@@ -1,7 +1,7 @@
-module "letter_status_update" {
+module "amendment_event_transformer" {
   source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip"
 
-  function_name = "letter_status_update"
+  function_name = "amendment_event_transformer"
   description   = "Processes letter status updates"
 
   aws_account_id = var.aws_account_id
@@ -15,14 +15,14 @@ module "letter_status_update" {
   kms_key_arn           = module.kms.key_arn
 
   iam_policy_document = {
-    body = data.aws_iam_policy_document.letter_status_update.json
+    body = data.aws_iam_policy_document.amendment_event_transformer.json
   }
 
   function_s3_bucket      = local.acct.s3_buckets["lambda_function_artefacts"]["id"]
   function_code_base_path = local.aws_lambda_functions_dir_path
   function_code_dir       = "api-handler/dist"
   function_include_common = true
-  handler_function_name   = "letterStatusUpdate"
+  handler_function_name   = "transformAmendmentEvent"
   runtime                 = "nodejs22.x"
   memory                  = 512
   timeout                 = 29
@@ -37,7 +37,7 @@ module "letter_status_update" {
   lambda_env_vars = merge(local.common_lambda_env_vars, {})
 }
 
-data "aws_iam_policy_document" "letter_status_update" {
+data "aws_iam_policy_document" "amendment_event_transformer" {
   statement {
     sid    = "KMSPermissions"
     effect = "Allow"
@@ -59,7 +59,6 @@ data "aws_iam_policy_document" "letter_status_update" {
     actions = [
       "dynamodb:GetItem",
       "dynamodb:Query",
-      "dynamodb:UpdateItem",
     ]
 
     resources = [
@@ -79,7 +78,21 @@ data "aws_iam_policy_document" "letter_status_update" {
     ]
 
     resources = [
-      module.letter_status_updates_queue.sqs_queue_arn
+      module.letter_status_updates_queue.sqs_queue_arn,
+      module.amendments_queue.sqs_queue_arn,
+    ]
+  }
+
+  statement {
+    sid    = "AllowSNSPublish"
+    effect = "Allow"
+
+    actions = [
+      "sns:Publish"
+    ]
+
+    resources = [
+      module.eventsub.sns_topic.arn
     ]
   }
 }

infrastructure/terraform/components/api/module_lambda_patch_letter.tf

@@ -35,7 +35,7 @@ module "patch_letter" {
   log_subscription_role_arn = local.acct.log_subscription_role_arn
 
   lambda_env_vars = merge(local.common_lambda_env_vars, {
-    QUEUE_URL = module.letter_status_updates_queue.sqs_queue_url
+    QUEUE_URL = module.amendments_queue.sqs_queue_url
   })
 }
 
@@ -64,7 +64,7 @@ data "aws_iam_policy_document" "patch_letter_lambda" {
     ]
 
     resources = [
-      module.letter_status_updates_queue.sqs_queue_arn
+      module.amendments_queue.sqs_queue_arn
     ]
   }
 }

infrastructure/terraform/components/api/module_lambda_post_letters.tf

@@ -35,7 +35,7 @@ module "post_letters" {
   log_subscription_role_arn = local.acct.log_subscription_role_arn
 
   lambda_env_vars = merge(local.common_lambda_env_vars, {
-    QUEUE_URL = module.letter_status_updates_queue.sqs_queue_url,
+    QUEUE_URL = module.amendments_queue.sqs_queue_url,
     MAX_LIMIT = var.max_get_limit
   })
 }
@@ -65,7 +65,7 @@ data "aws_iam_policy_document" "post_letters" {
     ]
 
     resources = [
-      module.letter_status_updates_queue.sqs_queue_arn
+      module.amendments_queue.sqs_queue_arn
     ]
   }
 }

infrastructure/terraform/components/api/module_lambda_supplier_allocator.tf

@@ -0,0 +1,85 @@
+module "supplier_allocator" {
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip"
+
+  function_name = "supplier-allocator"
+  description   = "Allocate a letter to a supplier"
+
+  aws_account_id = var.aws_account_id
+  component      = var.component
+  environment    = var.environment
+  project        = var.project
+  region         = var.region
+  group          = var.group
+
+  log_retention_in_days = var.log_retention_in_days
+  kms_key_arn           = module.kms.key_arn
+
+  iam_policy_document = {
+    body = data.aws_iam_policy_document.sqs_supplier_allocator_lambda.json
+  }
+
+  function_s3_bucket      = local.acct.s3_buckets["lambda_function_artefacts"]["id"]
+  function_code_base_path = local.aws_lambda_functions_dir_path
+  function_code_dir       = "supplier-allocator/dist"
+  function_include_common = true
+  handler_function_name   = "supplierAllocatorHandler"
+  runtime                 = "nodejs22.x"
+  memory                  = 512
+  timeout                 = 29
+  log_level               = var.log_level
+
+  force_lambda_code_deploy = var.force_lambda_code_deploy
+  enable_lambda_insights   = false
+
+  log_destination_arn       = local.destination_arn
+  log_subscription_role_arn = local.acct.log_subscription_role_arn
+
+  lambda_env_vars = merge(local.common_lambda_env_vars, {
+    VARIANT_MAP              = jsonencode(var.letter_variant_map)
+    UPSERT_LETTERS_QUEUE_URL = module.sqs_letter_updates.sqs_queue_url
+  })
+}
+
+data "aws_iam_policy_document" "sqs_supplier_allocator_lambda" {
+  statement {
+    sid    = "KMSPermissions"
+    effect = "Allow"
+
+    actions = [
+      "kms:Decrypt",
+      "kms:GenerateDataKey",
+    ]
+
+    resources = [
+      module.kms.key_arn,
+    ]
+  }
+
+  statement {
+    sid    = "AllowSQSRead"
+    effect = "Allow"
+
+    actions = [
+      "sqs:ReceiveMessage",
+      "sqs:DeleteMessage",
+      "sqs:GetQueueAttributes"
+    ]
+
+    resources = [
+      module.sqs_supplier_allocator.sqs_queue_arn
+    ]
+  }
+
+  statement {
+    sid    = "AllowSQSWrite"
+    effect = "Allow"
+
+    actions = [
+      "sqs:SendMessage"
+    ]
+
+    resources = [
+      module.sqs_letter_updates.sqs_queue_arn
+    ]
+  }
+}

infrastructure/terraform/components/api/module_sqs_amendments.tf

@@ -0,0 +1,16 @@
+# Queue to transport letter status amendment messages
+module "amendments_queue" {
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip"
+
+  name = "amendments_queue"
+
+  aws_account_id = var.aws_account_id
+  component      = var.component
+  environment    = var.environment
+  project        = var.project
+  region         = var.region
+
+  sqs_kms_key_arn = module.kms.key_arn
+
+  create_dlq = true
+}

infrastructure/terraform/components/api/module_sqs_letter_status_updates.tf

@@ -1,4 +1,5 @@
-# Queue to transport update letter status messages
+# Queue to transport update letter status messages. Now replaced by module.amendments_queue.
+# This queue will not be removed just yet, to allow it to be drained following the release in which module.amendments_queue replaces it.
 module "letter_status_updates_queue" {
   source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip"
 

infrastructure/terraform/components/api/module_sqs_supplier_allocator.tf

@@ -0,0 +1,16 @@
+module "sqs_supplier_allocator" {
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-sqs.zip"
+
+  aws_account_id = var.aws_account_id
+  component      = var.component
+  environment    = var.environment
+  project        = var.project
+  region         = var.region
+  name           = "supplier-allocator"
+
+  sqs_kms_key_arn = module.kms.key_arn
+
+  visibility_timeout_seconds = 60
+
+  create_dlq = true
+}

infrastructure/terraform/components/api/sns_topic_subscription_eventsub_sqs_letter_updates.tf

@@ -1,5 +1,11 @@
 resource "aws_sns_topic_subscription" "eventsub_sqs_letter_updates" {
-  topic_arn = module.eventsub.sns_topic.arn
-  protocol  = "sqs"
-  endpoint  = module.sqs_letter_updates.sqs_queue_arn
+  topic_arn            = module.eventsub.sns_topic.arn
+  protocol             = "sqs"
+  endpoint             = module.sqs_letter_updates.sqs_queue_arn
+  raw_message_delivery = true
+
+  filter_policy_scope = "MessageBody"
+  filter_policy = jsonencode({
+    type = [{ prefix = "uk.nhs.notify.supplier-api.letter" }]
+  })
 }

infrastructure/terraform/components/api/sns_topic_subscription_eventsub_sqs_supplier_allocator.tf

@@ -0,0 +1,11 @@
+resource "aws_sns_topic_subscription" "eventsub_sqs_supplier_allocator" {
+  topic_arn            = module.eventsub.sns_topic.arn
+  protocol             = "sqs"
+  endpoint             = module.sqs_supplier_allocator.sqs_queue_arn
+  raw_message_delivery = true
+
+  filter_policy_scope = "MessageBody"
+  filter_policy = jsonencode({
+    type = [{ prefix = "uk.nhs.notify.letter-rendering.letter-request.prepared" }]
+  })
+}