Merge pull request #48 from NHSDigital/feature/CCM-8200_grafana

CCM-8200: Add IAM role for grafana access

Author: sidnhs

infrastructure/terraform/components/acct/iam_role_grafana_access.tf

@@ -0,0 +1,20 @@
+resource "aws_iam_role" "grafana_access" {
+  name               = "${local.csi}-grafana-cross-access-role"
+  assume_role_policy = data.aws_iam_policy_document.observability_grafana_role_assume_role_policy.json
+}
+
+data "aws_iam_policy_document" "observability_grafana_role_assume_role_policy" {
+  statement {
+    actions = ["sts:AssumeRole"]
+    effect  = "Allow"
+    principals {
+      type        = "AWS"
+      identifiers = ["arn:aws:iam::${var.observability_account_id}:role/${local.csi}-grafana-workspace-role"]
+    }
+  }
+}
+
+resource "aws_iam_role_policy_attachment" "grafana_workspace_cloudwatch" {
+  role       = aws_iam_role.grafana_access.name
+  policy_arn = "arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess"
+}

infrastructure/terraform/components/acct/module_s3bucket_lambda_function_artefacts.tf

@@ -100,7 +100,7 @@ data "aws_iam_policy_document" "s3bucket_lambda_artefacts" {
     ]
 
     principals {
-      type        = "AWS"
+      type = "AWS"
       identifiers = [
         "arn:aws:iam::${var.aws_account_id}:root"
       ]
@@ -120,7 +120,7 @@ data "aws_iam_policy_document" "s3bucket_lambda_artefacts" {
     ]
 
     principals {
-      type        = "AWS"
+      type = "AWS"
       identifiers = [
         "arn:aws:iam::${var.aws_account_id}:root"
       ]

infrastructure/terraform/components/acct/outputs.tf

@@ -9,9 +9,9 @@ output "dns_zone" {
 output "s3_buckets" {
   value = {
     lambda_function_artefacts = {
-      arn = module.s3bucket_lambda_artefacts.arn
+      arn    = module.s3bucket_lambda_artefacts.arn
       bucket = module.s3bucket_lambda_artefacts.bucket
-      id  = module.s3bucket_lambda_artefacts.id
+      id     = module.s3bucket_lambda_artefacts.id
     }
   }
 }

infrastructure/terraform/components/acct/variables.tf

@@ -62,3 +62,8 @@ variable "root_domain_name" {
   description = "The service's root DNS root nameespace, like nonprod.nhsnotify.national.nhs.uk"
   default     = "nonprod.nhsnotify.national.nhs.uk"
 }
+
+variable "observability_account_id" {
+  type        = string
+  description = "The Observability Account ID that needs access"
+}

infrastructure/terraform/components/cdn/cloudfront_distribution_cdn.tf

@@ -11,7 +11,7 @@ resource "aws_cloudfront_distribution" "main" {
   restrictions {
     geo_restriction {
       restriction_type = "none" # Moved to WAF
-      locations        = [] # Moved to WAF
+      locations        = []     # Moved to WAF
     }
   }
 
@@ -71,8 +71,8 @@ resource "aws_cloudfront_distribution" "main" {
     }
 
     lambda_function_association {
-        event_type = "viewer-response"
-        lambda_arn = module.lambda_rewrite_viewer_trailing_slashes.function_qualified_arn
+      event_type = "viewer-response"
+      lambda_arn = module.lambda_rewrite_viewer_trailing_slashes.function_qualified_arn
     }
 
     viewer_protocol_policy = "redirect-to-https"

infrastructure/terraform/components/cdn/cloudfront_monitoring_subscription_cdn.tf

@@ -0,0 +1,9 @@
+resource "aws_cloudfront_monitoring_subscription" "cdn" {
+  distribution_id = aws_cloudfront_distribution.main.id
+
+  monitoring_subscription {
+    realtime_metrics_subscription_config {
+      realtime_metrics_subscription_status = "Enabled"
+    }
+  }
+}

infrastructure/terraform/components/cdn/wafv2_ip_set.tf

@@ -1,5 +1,5 @@
 resource "aws_wafv2_ip_set" "github_actions_ipv4" {
-  count = var.enable_github_actions_ip_access ? 1:0
+  count = var.enable_github_actions_ip_access ? 1 : 0
 
   provider = aws.us-east-1
 
@@ -11,7 +11,7 @@ resource "aws_wafv2_ip_set" "github_actions_ipv4" {
 }
 
 resource "aws_wafv2_ip_set" "github_actions_ipv6" {
-  count = var.enable_github_actions_ip_access ? 1:0
+  count = var.enable_github_actions_ip_access ? 1 : 0
 
   provider = aws.us-east-1