From 0022ef51b10245cd26453a34441a647474abbb55 Mon Sep 17 00:00:00 2001
From: Ajay Mudgal <ajay.mudgal1@nhs.net>
Date: Mon, 1 Sep 2025 11:05:47 +0100
Subject: [PATCH 1/2] Updating pipeline trigger mechanism

---
 .../cicd_blue_green_deployment_pipeline.tf                      | 2 +-
 .../cicd_shared_resources_pipeline.tf                           | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/infrastructure/stacks/development-and-deployment-tools/cicd_blue_green_deployment_pipeline.tf b/infrastructure/stacks/development-and-deployment-tools/cicd_blue_green_deployment_pipeline.tf
index 77a4d0666..c74a0f32b 100644
--- a/infrastructure/stacks/development-and-deployment-tools/cicd_blue_green_deployment_pipeline.tf
+++ b/infrastructure/stacks/development-and-deployment-tools/cicd_blue_green_deployment_pipeline.tf
@@ -21,7 +21,7 @@ resource "aws_codepipeline" "cicd_blue_green_deployment_pipeline" {
       configuration = {
         S3Bucket             = var.cicd_blue_green_deployment_pipeline_artefact_bucket
         S3ObjectKey          = "repository.zip"
-        PollForSourceChanges = "True"
+        DetectChanges        = "True"
       }
     }
   }
diff --git a/infrastructure/stacks/development-and-deployment-tools/cicd_shared_resources_pipeline.tf b/infrastructure/stacks/development-and-deployment-tools/cicd_shared_resources_pipeline.tf
index aab7e5b4b..c0a6289e7 100644
--- a/infrastructure/stacks/development-and-deployment-tools/cicd_shared_resources_pipeline.tf
+++ b/infrastructure/stacks/development-and-deployment-tools/cicd_shared_resources_pipeline.tf
@@ -20,7 +20,7 @@ resource "aws_codepipeline" "cicd_shared_resources_deployment_pipeline" {
       configuration = {
         S3Bucket             = var.cicd_shared_resoures_deployment_pipeline_artefact_bucket
         S3ObjectKey          = "repository.zip"
-        PollForSourceChanges = "True"
+        DetectChanges        = "True"
       }
     }
   }

From c1addcb59cdc65311b1d4af4e62d1690f3325d77 Mon Sep 17 00:00:00 2001
From: Ajay Mudgal <ajay.mudgal1@nhs.net>
Date: Tue, 2 Sep 2025 13:53:11 +0100
Subject: [PATCH 2/2] Updating pipeline trigger mechanism to even based

---
 build/automation/var/project.mk               |  2 ++
 .../eventbridge_pipeline_trigger/main.tf      | 22 ++++++++++++++
 .../eventbridge_pipeline_trigger/outputs.tf   |  9 ++++++
 .../eventbridge_pipeline_trigger/variables.tf | 30 +++++++++++++++++++
 .../cicd_blue_green_deployment_pipeline.tf    | 19 ++++++++++--
 .../cicd_shared_resources_pipeline.tf         | 18 ++++++++++-
 .../variables.tf                              | 11 +++++++
 .../stacks/shared-resources/dynamodb.tf       |  8 ++---
 infrastructure/stacks/shared-resources/waf.tf |  6 ++--
 9 files changed, 115 insertions(+), 10 deletions(-)
 create mode 100644 infrastructure/modules/eventbridge_pipeline_trigger/main.tf
 create mode 100644 infrastructure/modules/eventbridge_pipeline_trigger/outputs.tf
 create mode 100644 infrastructure/modules/eventbridge_pipeline_trigger/variables.tf

diff --git a/build/automation/var/project.mk b/build/automation/var/project.mk
index f1530429f..3a4961307 100644
--- a/build/automation/var/project.mk
+++ b/build/automation/var/project.mk
@@ -50,6 +50,8 @@ TF_VAR_pipeline_topic_name := $(PROJECT_ID)-$(ENVIRONMENT)-pipeline-topic
 TF_VAR_pipeline_notification_name := $(PROJECT_ID)-$(ENVIRONMENT)-pipeline-notification
 TF_VAR_cicd_blue_green_deployment_pipeline_nofitication_name := $(PROJECT_ID)-$(ENVIRONMENT)-blue-green-pipeline-notification
 TF_VAR_cicd_shared_resources_deployment_pipeline_nofitication_name := $(PROJECT_ID)-$(ENVIRONMENT)-shared-resources-pipeline-notification
+TF_VAR_cicd_blue_green_deployment_pipeline_eventbridge_rule_name := $(PROJECT_ID)-$(ENVIRONMENT)-trigger-blue-green-pipeline
+TF_VAR_cicd_shared_resources_deployment_pipeline_eventbridge_rule_name := $(PROJECT_ID)-$(ENVIRONMENT)-trigger-shared-resources-pipeline
 TF_VAR_pipeline_chatbot_channel := $(PROJECT_ID)-cicd-slk-channel
 TF_VAR_nightly_rule_name := $(PROJECT_ID)-$(ENVIRONMENT)-performance-pipeline-nightly-rule
 
diff --git a/infrastructure/modules/eventbridge_pipeline_trigger/main.tf b/infrastructure/modules/eventbridge_pipeline_trigger/main.tf
new file mode 100644
index 000000000..1c321ddf7
--- /dev/null
+++ b/infrastructure/modules/eventbridge_pipeline_trigger/main.tf
@@ -0,0 +1,22 @@
+resource "aws_cloudwatch_event_rule" "trigger_pipeline" {
+  name          = var.rule_name
+  description   = var.description
+  event_pattern = <<EOF
+{
+  "source": ["aws.s3"],
+  "detail-type": ["Object Created"],
+  "resources": ["arn:aws:s3:::${var.bucket_name}"],
+  "detail": {
+    "object": {
+      "key": ["${var.object_key}"]
+    }
+  }
+}
+EOF
+}
+
+resource "aws_cloudwatch_event_target" "pipeline_target" {
+  rule     = aws_cloudwatch_event_rule.trigger_pipeline.name
+  arn      = var.pipeline_arn
+  role_arn = var.pipeline_role_arn
+}
diff --git a/infrastructure/modules/eventbridge_pipeline_trigger/outputs.tf b/infrastructure/modules/eventbridge_pipeline_trigger/outputs.tf
new file mode 100644
index 000000000..49a640504
--- /dev/null
+++ b/infrastructure/modules/eventbridge_pipeline_trigger/outputs.tf
@@ -0,0 +1,9 @@
+output "eventbridge_rule_id" {
+  description = "The EventBridge rule Name we just created."
+  value       = aws_cloudwatch_event_rule.trigger_pipeline.id
+}
+
+output "eventbridge_rule_arn" {
+  description = "The EventBridge rule ARN we just created."
+  value       = aws_cloudwatch_event_rule.trigger_pipeline.arn
+}
diff --git a/infrastructure/modules/eventbridge_pipeline_trigger/variables.tf b/infrastructure/modules/eventbridge_pipeline_trigger/variables.tf
new file mode 100644
index 000000000..d2e236bb3
--- /dev/null
+++ b/infrastructure/modules/eventbridge_pipeline_trigger/variables.tf
@@ -0,0 +1,30 @@
+variable "bucket_name" {
+  description = "Name of the S3 bucket to monitor."
+  type        = string
+}
+
+variable "pipeline_arn" {
+  description = "ARN of the CodePipeline to trigger."
+  type        = string
+}
+
+variable "pipeline_role_arn" {
+  description = "Role ARN for EventBridge to trigger the pipeline."
+  type        = string
+}
+
+variable "rule_name" {
+  description = "Name of the EventBridge rule."
+  type        = string
+}
+
+variable "description" {
+  description = "Description of the EventBridge rule."
+  type        = string
+}
+
+variable "object_key" {
+  description = "S3 object key to filter on."
+  type        = string
+  default     = "repository.zip"
+}
diff --git a/infrastructure/stacks/development-and-deployment-tools/cicd_blue_green_deployment_pipeline.tf b/infrastructure/stacks/development-and-deployment-tools/cicd_blue_green_deployment_pipeline.tf
index c74a0f32b..21ef9f639 100644
--- a/infrastructure/stacks/development-and-deployment-tools/cicd_blue_green_deployment_pipeline.tf
+++ b/infrastructure/stacks/development-and-deployment-tools/cicd_blue_green_deployment_pipeline.tf
@@ -21,7 +21,7 @@ resource "aws_codepipeline" "cicd_blue_green_deployment_pipeline" {
       configuration = {
         S3Bucket             = var.cicd_blue_green_deployment_pipeline_artefact_bucket
         S3ObjectKey          = "repository.zip"
-        DetectChanges        = "True"
+        PollForSourceChanges = "False"
       }
     }
   }
@@ -332,7 +332,6 @@ resource "aws_codepipeline" "cicd_blue_green_deployment_pipeline" {
   ]
 }
 
-
 module "cicd_blue_green_deployment_pipeline_artefact_bucket" {
   source             = "../../modules/s3"
   name               = var.cicd_blue_green_deployment_pipeline_artefact_bucket
@@ -341,3 +340,19 @@ module "cicd_blue_green_deployment_pipeline_artefact_bucket" {
   versioning_enabled = "true"
   force_destroy      = "true"
 }
+
+resource "aws_s3_bucket_notification" "uec-dos-int-dev-eventbridge_blue_green" {
+  bucket      = module.cicd_blue_green_deployment_pipeline_artefact_bucket.s3_bucket_id
+  eventbridge = true
+  depends_on  = [module.cicd_blue_green_deployment_pipeline_artefact_bucket]
+}
+
+module "blue_green_eventbridge_trigger" {
+  source            = "../../modules/eventbridge_pipeline_trigger"
+  bucket_name       = module.cicd_blue_green_deployment_pipeline_artefact_bucket.s3_bucket_id
+  pipeline_arn      = aws_codepipeline.cicd_blue_green_deployment_pipeline.arn
+  pipeline_role_arn = data.aws_iam_role.pipeline_role.arn
+  rule_name         = var.cicd_blue_green_deployment_pipeline_eventbridge_rule_name
+  description       = "Trigger Blue/Green pipeline when repository.zip is updated"
+  depends_on        = [module.cicd_blue_green_deployment_pipeline_artefact_bucket]
+}
diff --git a/infrastructure/stacks/development-and-deployment-tools/cicd_shared_resources_pipeline.tf b/infrastructure/stacks/development-and-deployment-tools/cicd_shared_resources_pipeline.tf
index c0a6289e7..265980717 100644
--- a/infrastructure/stacks/development-and-deployment-tools/cicd_shared_resources_pipeline.tf
+++ b/infrastructure/stacks/development-and-deployment-tools/cicd_shared_resources_pipeline.tf
@@ -20,7 +20,7 @@ resource "aws_codepipeline" "cicd_shared_resources_deployment_pipeline" {
       configuration = {
         S3Bucket             = var.cicd_shared_resoures_deployment_pipeline_artefact_bucket
         S3ObjectKey          = "repository.zip"
-        DetectChanges        = "True"
+        PollForSourceChanges = "False"
       }
     }
   }
@@ -212,3 +212,19 @@ module "cicd_shared_resoures_deployment_pipeline_artefact_bucket" {
   versioning_enabled = "true"
   force_destroy      = "true"
 }
+
+resource "aws_s3_bucket_notification" "uec-dos-int-dev-eventbridge_shared_resources" {
+  bucket      = module.cicd_shared_resoures_deployment_pipeline_artefact_bucket.s3_bucket_id
+  eventbridge = true
+  depends_on  = [module.cicd_shared_resoures_deployment_pipeline_artefact_bucket]
+}
+
+module "shared_resources_eventbridge_trigger" {
+  source            = "../../modules/eventbridge_pipeline_trigger"
+  bucket_name       = module.cicd_shared_resoures_deployment_pipeline_artefact_bucket.s3_bucket_id
+  pipeline_arn      = aws_codepipeline.cicd_shared_resources_deployment_pipeline.arn
+  pipeline_role_arn = data.aws_iam_role.pipeline_role.arn
+  rule_name         = var.cicd_shared_resources_deployment_pipeline_eventbridge_rule_name
+  description       = "Trigger Shared Resources pipeline when repository.zip is updated"
+  depends_on        = [module.cicd_shared_resoures_deployment_pipeline_artefact_bucket]
+}
diff --git a/infrastructure/stacks/development-and-deployment-tools/variables.tf b/infrastructure/stacks/development-and-deployment-tools/variables.tf
index 2c553bf2c..fcc2753ae 100644
--- a/infrastructure/stacks/development-and-deployment-tools/variables.tf
+++ b/infrastructure/stacks/development-and-deployment-tools/variables.tf
@@ -41,6 +41,17 @@ variable "cicd_shared_resources_deployment_pipeline_nofitication_name" {
   description = "Shared resources deployment pipeline notification name"
 }
 
+variable "cicd_blue_green_deployment_pipeline_eventbridge_rule_name" {
+  type        = string
+  description = "Shared resources deployment pipeline notification name"
+}
+
+variable "cicd_shared_resources_deployment_pipeline_eventbridge_rule_name" {
+  type        = string
+  description = "Shared resources deployment pipeline notification name"
+}
+
+
 variable "pipeline_chatbot_channel" {
   type        = string
   description = ""
diff --git a/infrastructure/stacks/shared-resources/dynamodb.tf b/infrastructure/stacks/shared-resources/dynamodb.tf
index 2734b6f66..0e6fa1fc7 100644
--- a/infrastructure/stacks/shared-resources/dynamodb.tf
+++ b/infrastructure/stacks/shared-resources/dynamodb.tf
@@ -1,8 +1,8 @@
 resource "aws_dynamodb_table" "message-history-table" {
-  name         = var.change_events_table_name
-  billing_mode = "PAY_PER_REQUEST"
-  hash_key     = "Id"
-  range_key    = "ODSCode"
+  name                        = var.change_events_table_name
+  billing_mode                = "PAY_PER_REQUEST"
+  hash_key                    = "Id"
+  range_key                   = "ODSCode"
   deletion_protection_enabled = var.ddb_delete_protection
 
   server_side_encryption {
diff --git a/infrastructure/stacks/shared-resources/waf.tf b/infrastructure/stacks/shared-resources/waf.tf
index 7b7c17495..0d6abe491 100644
--- a/infrastructure/stacks/shared-resources/waf.tf
+++ b/infrastructure/stacks/shared-resources/waf.tf
@@ -76,13 +76,13 @@ resource "aws_wafv2_web_acl" "di_endpoint_waf" {
         sensitivity_level = "HIGH"
         text_transformation {
           priority = 0
-          type = "NONE"
+          type     = "NONE"
         }
       }
     }
     visibility_config {
-      sampled_requests_enabled = true
-      metric_name = var.waf_custom_sqli_rule_name
+      sampled_requests_enabled   = true
+      metric_name                = var.waf_custom_sqli_rule_name
       cloudwatch_metrics_enabled = true
     }
   }