From d0e56bf06d9962ee3fc8985bed22ed74331dc65c Mon Sep 17 00:00:00 2001 From: sidnhs Date: Fri, 11 Sep 2026 20:20:11 +0100 Subject: [PATCH 1/4] CCM-22820: Add tags to lambda role and policy --- infrastructure/terraform/modules/lambda/iam_policy.tf | 2 ++ infrastructure/terraform/modules/lambda/iam_role.tf | 1 + 2 files changed, 3 insertions(+) diff --git a/infrastructure/terraform/modules/lambda/iam_policy.tf b/infrastructure/terraform/modules/lambda/iam_policy.tf index 7ccb5a14..e7cfe6c2 100644 --- a/infrastructure/terraform/modules/lambda/iam_policy.tf +++ b/infrastructure/terraform/modules/lambda/iam_policy.tf @@ -4,4 +4,6 @@ resource "aws_iam_policy" "main" { name = local.csi description = "Policy created from the data object supplied through the modules attributes" policy = var.iam_policy_document.body + + tags = local.default_tags } diff --git a/infrastructure/terraform/modules/lambda/iam_role.tf b/infrastructure/terraform/modules/lambda/iam_role.tf index 6ae8ac3a..66b0b422 100644 --- a/infrastructure/terraform/modules/lambda/iam_role.tf +++ b/infrastructure/terraform/modules/lambda/iam_role.tf @@ -1,4 +1,5 @@ resource "aws_iam_role" "main" { name = local.csi assume_role_policy = data.aws_iam_policy_document.lambda_assumerole.json + tags = local.default_tags } From 0c94d746c5ffcc1ab5008e582b909ce5980befd4 Mon Sep 17 00:00:00 2001 From: sidnhs Date: Fri, 11 Sep 2026 20:31:43 +0100 Subject: [PATCH 2/4] CCM-22820: Add tags to lambda role and policy --- .tool-versions | 1 + infrastructure/terraform/modules/amp_branch/README.md | 6 +++--- .../terraform/modules/apim-authentication/README.md | 6 +++--- .../terraform/modules/aws-backup-source/README.md | 2 +- infrastructure/terraform/modules/eventpub/README.md | 6 +++--- infrastructure/terraform/modules/eventsub/README.md | 6 +++--- infrastructure/terraform/modules/kms/README.md | 6 +++--- infrastructure/terraform/modules/lambda/README.md | 6 +++--- infrastructure/terraform/modules/lambda/iam_role.tf | 2 +- infrastructure/terraform/modules/obs-datasource/README.md | 6 +++--- infrastructure/terraform/modules/s3bucket/README.md | 6 +++--- infrastructure/terraform/modules/sqs/README.md | 6 +++--- infrastructure/terraform/modules/ssl/README.md | 6 +++--- 13 files changed, 33 insertions(+), 32 deletions(-) diff --git a/.tool-versions b/.tool-versions index d3c4a490..5f4a288c 100644 --- a/.tool-versions +++ b/.tool-versions @@ -24,6 +24,7 @@ ruby 3.2.0 # docker/hadolint/hadolint 2.12.0-alpine@sha256:7dba9a9f1a0350f6d021fb2f6f88900998a4fb0aaf8e4330aa8c38544f04db42 # SEE: https://hub.docker.com/r/hadolint/hadolint/tags # docker/hashicorp/terraform 1.5.6@sha256:180a7efa983386a27b43657ed610e9deed9e6c3848d54f9ea9b6cb8a5c8c25f5 # SEE: https://hub.docker.com/r/hashicorp/terraform/tags # docker/jdkato/vale v3.6.0@sha256:0ef22c8d537f079633cfff69fc46f69a2196072f69cab1ab232e8a79a388e425 # SEE: https://hub.docker.com/r/jdkato/vale/tags +# docker/quay.io/terraform-docs/terraform-docs 0.24.0-amd64@sha256:16990b28302390f7c4ae398b371a46762b6b3eb8534e75eeee8185caa8029b8c # SEE: https://quay.io/repository/terraform-docs/terraform-docs?tab=tags # docker/koalaman/shellcheck latest@sha256:e40388688bae0fcffdddb7e4dea49b900c18933b452add0930654b2dea3e7d5c # SEE: https://hub.docker.com/r/koalaman/shellcheck/tags # docker/mstruebing/editorconfig-checker 2.7.1@sha256:dd3ca9ea50ef4518efe9be018d669ef9cf937f6bb5cfe2ef84ff2a620b5ddc24 # SEE: https://hub.docker.com/r/mstruebing/editorconfig-checker/tags # docker/sonarsource/sonar-scanner-cli 11.3@sha256:7462f132388135e32b948f8f18ff0db9ae28a87c6777f1df5b2207e04a6d7c5c # SEE: https://hub.docker.com/r/sonarsource/sonar-scanner-cli/tags diff --git a/infrastructure/terraform/modules/amp_branch/README.md b/infrastructure/terraform/modules/amp_branch/README.md index e1a8c7c6..d6598290 100644 --- a/infrastructure/terraform/modules/amp_branch/README.md +++ b/infrastructure/terraform/modules/amp_branch/README.md @@ -6,13 +6,13 @@ ## Requirements | Name | Version | -|------|---------| +| ---- | ------- | | [terraform](#requirement\_terraform) | >= 1.9.0 | ## Inputs | Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| +| ---- | ----------- | ---- | ------- | :------: | | [amplify\_app\_id](#input\_amplify\_app\_id) | Amplify application ID | `string` | n/a | yes | | [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes | | [branch](#input\_branch) | The name of the branch being deployed | `string` | n/a | yes | @@ -34,7 +34,7 @@ ## Outputs | Name | Description | -|------|-------------| +| ---- | ----------- | | [name](#output\_name) | Name of the Amplify branch | diff --git a/infrastructure/terraform/modules/apim-authentication/README.md b/infrastructure/terraform/modules/apim-authentication/README.md index 9e02c271..95a07bc2 100644 --- a/infrastructure/terraform/modules/apim-authentication/README.md +++ b/infrastructure/terraform/modules/apim-authentication/README.md @@ -6,13 +6,13 @@ ## Requirements | Name | Version | -|------|---------| +| ---- | ------- | | [terraform](#requirement\_terraform) | >= 1.9.0 | ## Inputs | Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| +| ---- | ----------- | ---- | ------- | :------: | | [acct\_s3\_buckets](#input\_acct\_s3\_buckets) | Account S3 buckets | `map(any)` | n/a | yes | | [apim\_auth\_token\_schedule](#input\_apim\_auth\_token\_schedule) | Schedule to renew the APIM auth token | `string` | `"rate(9 minutes)"` | no | | [apim\_auth\_token\_url](#input\_apim\_auth\_token\_url) | URL to generate an APIM auth token | `string` | n/a | yes | @@ -41,7 +41,7 @@ ## Outputs | Name | Description | -|------|-------------| +| ---- | ----------- | | [apim\_access\_token\_ssm\_parameter](#output\_apim\_access\_token\_ssm\_parameter) | APIM Access Token SSM parameter details | diff --git a/infrastructure/terraform/modules/aws-backup-source/README.md b/infrastructure/terraform/modules/aws-backup-source/README.md index aa03b35a..11cccdff 100644 --- a/infrastructure/terraform/modules/aws-backup-source/README.md +++ b/infrastructure/terraform/modules/aws-backup-source/README.md @@ -55,7 +55,7 @@ No requirements. ## Inputs | Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| +| ---- | ----------- | ---- | ------- | :------: | | [backup\_copy\_vault\_account\_id](#input\_backup\_copy\_vault\_account\_id) | The account id of the destination backup vault for allowing restores back into the source account. | `string` | `""` | no | | [backup\_copy\_vault\_arn](#input\_backup\_copy\_vault\_arn) | The ARN of the destination backup vault for cross-account backup copies. | `string` | `""` | no | | [backup\_plan\_config\_dynamodb](#input\_backup\_plan\_config\_dynamodb) | Configuration for backup plans with dynamodb | 
object({
    enable                    = bool
    selection_tag             = string
    compliance_resource_types = list(string)
    rules = optional(list(object({
      name                     = string
      schedule                 = string
      enable_continuous_backup = optional(bool)
      lifecycle = object({
        delete_after       = number
        cold_storage_after = optional(number)
      })
      copy_action = optional(object({
        delete_after = optional(number)
      }))
    })))
  })
| 
{
  "compliance_resource_types": [
    "DynamoDB"
  ],
  "enable": false,
  "rules": [
    {
      "copy_action": {
        "delete_after": 365
      },
      "lifecycle": {
        "delete_after": 35
      },
      "name": "dynamodb_daily_kept_5_weeks",
      "schedule": "cron(0 0 * * ? *)"
    },
    {
      "copy_action": {
        "delete_after": 365
      },
      "lifecycle": {
        "delete_after": 90
      },
      "name": "dynamodb_weekly_kept_3_months",
      "schedule": "cron(0 1 ? * SUN *)"
    },
    {
      "copy_action": {
        "delete_after": 365
      },
      "lifecycle": {
        "cold_storage_after": 30,
        "delete_after": 2555
      },
      "name": "dynamodb_monthly_kept_7_years",
      "schedule": "cron(0 2 1  * ? *)"
    }
  ],
  "selection_tag": "BackupDynamoDB"
}
| no | diff --git a/infrastructure/terraform/modules/eventpub/README.md b/infrastructure/terraform/modules/eventpub/README.md index 8b7eee54..dd6f2e41 100644 --- a/infrastructure/terraform/modules/eventpub/README.md +++ b/infrastructure/terraform/modules/eventpub/README.md @@ -6,13 +6,13 @@ ## Requirements | Name | Version | -|------|---------| +| ---- | ------- | | [terraform](#requirement\_terraform) | >= 1.9.0 | ## Inputs | Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| +| ---- | ----------- | ---- | ------- | :------: | | [access\_logging\_bucket](#input\_access\_logging\_bucket) | S3 Access logging bucket name. | `string` | `""` | no | | [additional\_policies\_for\_event\_cache\_bucket](#input\_additional\_policies\_for\_event\_cache\_bucket) | A list of JSON policies to use to build the bucket policy | `list(string)` | `[]` | no | | [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes | @@ -45,7 +45,7 @@ ## Outputs | Name | Description | -|------|-------------| +| ---- | ----------- | | [publishing\_anomaly\_alarm](#output\_publishing\_anomaly\_alarm) | CloudWatch anomaly detection alarm details for SNS publishing | | [s3\_bucket\_event\_cache](#output\_s3\_bucket\_event\_cache) | S3 Bucket ARN and Name for event cache | | [sns\_topic](#output\_sns\_topic) | SNS Topic ARN and Name | diff --git a/infrastructure/terraform/modules/eventsub/README.md b/infrastructure/terraform/modules/eventsub/README.md index f9d812ab..2efc9b6e 100644 --- a/infrastructure/terraform/modules/eventsub/README.md +++ b/infrastructure/terraform/modules/eventsub/README.md @@ -6,13 +6,13 @@ ## Requirements | Name | Version | -|------|---------| +| ---- | ------- | | [terraform](#requirement\_terraform) | >= 1.9.0 | ## Inputs | Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| +| ---- | ----------- | ---- | ------- | :------: | | [access\_logging\_bucket](#input\_access\_logging\_bucket) | Name of S3 bucket to use for access logging | `string` | `""` | no | | [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes | | [component](#input\_component) | The name of the terraformscaffold component calling this module | `string` | n/a | yes | @@ -42,7 +42,7 @@ ## Outputs | Name | Description | -|------|-------------| +| ---- | ----------- | | [s3\_bucket\_event\_cache](#output\_s3\_bucket\_event\_cache) | S3 Bucket ARN and Name for event cache | | [sns\_topic](#output\_sns\_topic) | SNS Topic ARN and Name | diff --git a/infrastructure/terraform/modules/kms/README.md b/infrastructure/terraform/modules/kms/README.md index 3fd7173d..88fb045d 100644 --- a/infrastructure/terraform/modules/kms/README.md +++ b/infrastructure/terraform/modules/kms/README.md @@ -6,13 +6,13 @@ ## Requirements | Name | Version | -|------|---------| +| ---- | ------- | | [terraform](#requirement\_terraform) | >= 1.9.0 | ## Inputs | Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| +| ---- | ----------- | ---- | ------- | :------: | | [alias](#input\_alias) | Alias name for the hieradata KMS key | `string` | n/a | yes | | [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes | | [component](#input\_component) | The name of the terraformscaffold component calling this module | `string` | n/a | yes | @@ -29,7 +29,7 @@ ## Outputs | Name | Description | -|------|-------------| +| ---- | ----------- | | [admin\_policy\_arn](#output\_admin\_policy\_arn) | ARN of the admin IAM policy | | [key\_arn](#output\_key\_arn) | ARN of the KMS key | | [key\_id](#output\_key\_id) | ID of the KMS key | diff --git a/infrastructure/terraform/modules/lambda/README.md b/infrastructure/terraform/modules/lambda/README.md index ebfeeebf..72d7673c 100644 --- a/infrastructure/terraform/modules/lambda/README.md +++ b/infrastructure/terraform/modules/lambda/README.md @@ -23,13 +23,13 @@ output "processor_lambda_error_rate_alarm_arn" { ## Requirements | Name | Version | -|------|---------| +| ---- | ------- | | [terraform](#requirement\_terraform) | >= 0.12 | ## Inputs | Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| +| ---- | ----------- | ---- | ------- | :------: | | [application\_log\_level](#input\_application\_log\_level) | The detail level of the logs the application sends to CloudWatch | `string` | `"INFO"` | no | | [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes | | [component](#input\_component) | The name of the tfscaffold component | `string` | n/a | yes | @@ -91,7 +91,7 @@ output "processor_lambda_error_rate_alarm_arn" { ## Outputs | Name | Description | -|------|-------------| +| ---- | ----------- | | [cloudwatch\_log\_group\_name](#output\_cloudwatch\_log\_group\_name) | Name of the CloudWatch Log Group for the Lambda function | | [function\_arn](#output\_function\_arn) | ARN of the Lambda function | | [function\_env\_vars](#output\_function\_env\_vars) | Environment variables for the Lambda function | diff --git a/infrastructure/terraform/modules/lambda/iam_role.tf b/infrastructure/terraform/modules/lambda/iam_role.tf index 66b0b422..7465a45c 100644 --- a/infrastructure/terraform/modules/lambda/iam_role.tf +++ b/infrastructure/terraform/modules/lambda/iam_role.tf @@ -1,5 +1,5 @@ resource "aws_iam_role" "main" { name = local.csi assume_role_policy = data.aws_iam_policy_document.lambda_assumerole.json - tags = local.default_tags + tags = local.default_tags } diff --git a/infrastructure/terraform/modules/obs-datasource/README.md b/infrastructure/terraform/modules/obs-datasource/README.md index 8b098374..fd7817e8 100644 --- a/infrastructure/terraform/modules/obs-datasource/README.md +++ b/infrastructure/terraform/modules/obs-datasource/README.md @@ -6,13 +6,13 @@ ## Requirements | Name | Version | -|------|---------| +| ---- | ------- | | [terraform](#requirement\_terraform) | >= 1.9.0 | ## Inputs | Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| +| ---- | ----------- | ---- | ------- | :------: | | [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes | | [component](#input\_component) | The name of the terraformscaffold component calling this module | `string` | n/a | yes | | [default\_tags](#input\_default\_tags) | Default tag map for application to all taggable resources in the module | `map(string)` | `{}` | no | @@ -29,7 +29,7 @@ ## Outputs | Name | Description | -|------|-------------| +| ---- | ----------- | | [log\_subscription\_role\_arn](#output\_log\_subscription\_role\_arn) | The ARN of the log subscription IAM role. | diff --git a/infrastructure/terraform/modules/s3bucket/README.md b/infrastructure/terraform/modules/s3bucket/README.md index c596e573..c4748363 100644 --- a/infrastructure/terraform/modules/s3bucket/README.md +++ b/infrastructure/terraform/modules/s3bucket/README.md @@ -6,13 +6,13 @@ ## Requirements | Name | Version | -|------|---------| +| ---- | ------- | | [terraform](#requirement\_terraform) | >= 1.9.0 | ## Inputs | Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| +| ---- | ----------- | ---- | ------- | :------: | | [acl](#input\_acl) | ACL to set on the bucket. Defaults to private | `string` | `"private"` | no | | [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes | | [bucket\_key\_enabled](#input\_bucket\_key\_enabled) | Boolean to toggle bucket key enablement | `bool` | `true` | no | @@ -37,7 +37,7 @@ ## Outputs | Name | Description | -|------|-------------| +| ---- | ----------- | | [acl](#output\_acl) | The ACL of the S3 bucket. If the object ownership is set to 'BucketOwnerEnforced', the ACL will be 'private'. Otherwise, it will reflect the ACL set in the aws\_s3\_bucket\_acl resource. | | [arn](#output\_arn) | The ARN of the S3 bucket | | [bucket](#output\_bucket) | The name of the S3 bucket | diff --git a/infrastructure/terraform/modules/sqs/README.md b/infrastructure/terraform/modules/sqs/README.md index 6a3b94b2..263a6473 100644 --- a/infrastructure/terraform/modules/sqs/README.md +++ b/infrastructure/terraform/modules/sqs/README.md @@ -6,13 +6,13 @@ ## Requirements | Name | Version | -|------|---------| +| ---- | ------- | | [terraform](#requirement\_terraform) | >= 1.9.0 | ## Inputs | Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| +| ---- | ----------- | ---- | ------- | :------: | | [allowed\_arns](#input\_allowed\_arns) | A list of AWS account IDs allowed to access this resource | `list(any)` | `null` | no | | [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes | | [component](#input\_component) | The name of the tfscaffold component | `string` | n/a | yes | @@ -42,7 +42,7 @@ ## Outputs | Name | Description | -|------|-------------| +| ---- | ----------- | | [sqs\_dlq\_arn](#output\_sqs\_dlq\_arn) | The ARN of the SQS dead-letter queue | | [sqs\_dlq\_messages\_alarm\_arn](#output\_sqs\_dlq\_messages\_alarm\_arn) | The ARN of the CloudWatch alarm for messages in the SQS dead-letter queue | | [sqs\_dlq\_messages\_alarm\_name](#output\_sqs\_dlq\_messages\_alarm\_name) | The name of the CloudWatch alarm for messages in the SQS dead-letter queue | diff --git a/infrastructure/terraform/modules/ssl/README.md b/infrastructure/terraform/modules/ssl/README.md index 3d3a41d9..034c98b0 100644 --- a/infrastructure/terraform/modules/ssl/README.md +++ b/infrastructure/terraform/modules/ssl/README.md @@ -6,14 +6,14 @@ ## Requirements | Name | Version | -|------|---------| +| ---- | ------- | | [terraform](#requirement\_terraform) | >= 1.10.1 | | [tls](#requirement\_tls) | 4.1.0 | ## Inputs | Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| +| ---- | ----------- | ---- | ------- | :------: | | [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes | | [component](#input\_component) | The name of the tfscaffold component | `string` | n/a | yes | | [default\_tags](#input\_default\_tags) | A map of default tags to apply to all taggable resources within the component | `map(string)` | `{}` | no | @@ -31,7 +31,7 @@ ## Outputs | Name | Description | -|------|-------------| +| ---- | ----------- | | [cacert\_pem](#output\_cacert\_pem) | Truststore | | [server\_crt](#output\_server\_crt) | Server Certificate | | [server\_key](#output\_server\_key) | Server Key | From ca9ad0623c2c80e95c2bcc762f19f9edd97f7ec0 Mon Sep 17 00:00:00 2001 From: sidnhs Date: Mon, 14 Sep 2026 10:47:07 +0100 Subject: [PATCH 3/4] CCM-22820: Fix workflow --- .github/workflows/cicd-1-pull-request.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/cicd-1-pull-request.yaml b/.github/workflows/cicd-1-pull-request.yaml index 9e6c0c05..619042a2 100644 --- a/.github/workflows/cicd-1-pull-request.yaml +++ b/.github/workflows/cicd-1-pull-request.yaml @@ -91,6 +91,8 @@ jobs: name: "Commit stage" needs: [metadata] uses: ./.github/workflows/stage-1-commit.yaml + permissions: + pull-requests: read with: build_datetime: "${{ needs.metadata.outputs.build_datetime }}" build_timestamp: "${{ needs.metadata.outputs.build_timestamp }}" From 43cee52c71e3c5ae8a8b48c09dbacc6d9fb10ea0 Mon Sep 17 00:00:00 2001 From: sidnhs Date: Mon, 14 Sep 2026 10:47:53 +0100 Subject: [PATCH 4/4] CCM-22820: Fix workflow --- .github/workflows/cicd-1-pull-request.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/cicd-1-pull-request.yaml b/.github/workflows/cicd-1-pull-request.yaml index 619042a2..935f109e 100644 --- a/.github/workflows/cicd-1-pull-request.yaml +++ b/.github/workflows/cicd-1-pull-request.yaml @@ -19,6 +19,7 @@ permissions: id-token: write contents: write packages: write + pull-requests: read jobs: metadata: @@ -91,8 +92,6 @@ jobs: name: "Commit stage" needs: [metadata] uses: ./.github/workflows/stage-1-commit.yaml - permissions: - pull-requests: read with: build_datetime: "${{ needs.metadata.outputs.build_datetime }}" build_timestamp: "${{ needs.metadata.outputs.build_timestamp }}"