Skip to content

CCM-18398: Allow access to eventpub's event cache bucket to be restricted #211

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gareth-allan merged 2 commits into from
Jun 5, 2026
Merged

CCM-18398: Allow access to eventpub's event cache bucket to be restricted #211

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1da0ab6
CCM-18398: Allow access to eventpub's event cache bucket to be restri…
gareth-allan Jun 3, 2026
05f4e75
CCM-18398: Make tag conditional
gareth-allan Jun 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions infrastructure/terraform/modules/eventpub/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@
| <a name="input_event_anomaly_period"></a> [event\_anomaly\_period](#input\_event\_anomaly\_period) | The period in seconds over which the specified statistic is applied for anomaly detection. Minimum 300 seconds (5 minutes). Recommended: 300-600. | `number` | `300` | no |
| <a name="input_event_cache_buffer_interval"></a> [event\_cache\_buffer\_interval](#input\_event\_cache\_buffer\_interval) | The buffer interval for data firehose | `number` | `500` | no |
| <a name="input_event_cache_expiry_days"></a> [event\_cache\_expiry\_days](#input\_event\_cache\_expiry\_days) | s3 archiving expiry in days | `number` | `30` | no |
| <a name="input_event_cache_restrict_data_access"></a> [event\_cache\_restrict\_data\_access](#input\_event\_cache\_restrict\_data\_access) | Whether to restrict access to data in the event cache bucket | `bool` | `false` | no |
| <a name="input_force_destroy"></a> [force\_destroy](#input\_force\_destroy) | When enabled will force destroy event-cache S3 bucket | `bool` | `false` | no |
| <a name="input_group"></a> [group](#input\_group) | The name of the tfscaffold group | `string` | `null` | no |
| <a name="input_iam_permissions_boundary_arn"></a> [iam\_permissions\_boundary\_arn](#input\_iam\_permissions\_boundary\_arn) | The ARN of the permissions boundary to use for the IAM role | `string` | `null` | no |
Expand Down
6 changes: 4 additions & 2 deletions infrastructure/terraform/modules/eventpub/module_s3bucket_event_cache.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
module "s3bucket_event_cache" {
source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/3.0.3/terraform-s3bucket.zip"
source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/4.0.5/terraform-s3bucket.zip"

count = var.enable_event_cache ? 1 : 0

Expand All @@ -14,6 +14,7 @@ module "s3bucket_event_cache" {
acl = "private"
force_destroy = var.force_destroy
versioning = true
enable_abac = var.event_cache_restrict_data_access

lifecycle_rules = [
{
Expand Down Expand Up @@ -54,7 +55,8 @@ module "s3bucket_event_cache" {
}

default_tags = {
Name = "Event Cache Storage"
Name = "Event Cache Storage"
NHSE-RESTRICTED-PID = var.event_cache_restrict_data_access ? "True" : "False"
}
}

Expand Down
6 changes: 6 additions & 0 deletions infrastructure/terraform/modules/eventpub/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,6 +97,12 @@ variable "enable_event_cache" {
default = false
}

variable "event_cache_restrict_data_access" {
type = bool
description = "Whether to restrict access to data in the event cache bucket"
default = false
}

variable "enable_firehose_raw_message_delivery" {
type = bool
description = "Enables raw message delivery on firehose subscription"
Expand Down