Skip to content

Commit 8743107

Browse files
anthony-nhsanthony-nhs
authored
Chore: [AEA-6593] - move to new import names (#711)
## Summary - Routine Change ### Details - move to new import names
1 parent d0e50de commit 8743107

13 files changed

Lines changed: 60 additions & 58 deletions

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -172,7 +172,7 @@ In the project you want to test in, run the following as appropriate:
172172
npm install --save nhsdigital-eps-cdk-constructs-1.0.0.tgz --workspace packages/cdk/
173173

174174
# Install the deploymentUtils library
175-
npm install --save nhsdigital-eps-deployment-utils-1.0.0.tgz --workspace packages/specifications/
175+
npm install --save nhsdigital-eps-deployment-utils-1.0.0.tgz --workspace packages/specification/
176176
```
177177

178178
You will then be able to use them - for example:

‎packages/cdkConstructs/src/constants.ts‎

Lines changed: 20 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -5,27 +5,29 @@ export const CDK_ENV_PREFIX = "CDK_CONFIG_"
55

66
/** Imported cross-stack account resource values used by constructs in this package. */
77
export const ACCOUNT_RESOURCES = {
8-
CloudwatchEncryptionKMSPolicyArn: Fn.importValue("account-resources:CloudwatchEncryptionKMSPolicyArn"),
9-
CloudwatchLogsKmsKeyArn: Fn.importValue("account-resources:CloudwatchLogsKmsKeyArn"),
8+
CloudwatchEncryptionKMSPolicyArn: Fn.importValue("account-resources-cdk-uk:IAM:CloudwatchEncryptionKMSPolicy:Arn"),
9+
CloudwatchLogsKmsKeyArn: Fn.importValue("account-resources-cdk-uk:KMS:CloudwatchLogsKmsKey:Arn"),
10+
TrustStoreBucketArn: Fn.importValue("account-resources-cdk-uk:Bucket:TrustStoreBucket:Arn"),
11+
TrustStoreBucketKMSKeyArn: Fn.importValue("account-resources-cdk-uk:KMS:TrustStoreBucketKMSKey:Arn"),
12+
TrustStoreDeploymentBucketArn: Fn.importValue("account-resources-cdk-uk:Bucket:TrustStoreDeploymentBucket:Arn"),
13+
LambdaInsightsLogGroupPolicyArn: Fn.importValue("account-resources-cdk-uk:IAM:LambdaInsightsLogGroupPolicy:Arn"),
14+
SplunkDeliveryStreamArn: Fn.importValue("account-resources-cdk-uk:Firehose:SplunkDeliveryStream:Arn"),
15+
SplunkSubscriptionFilterRoleArn: Fn.importValue("account-resources-cdk-uk:IAM:SplunkSubscriptionFilterRole:Arn")
16+
}
17+
18+
export const ROUTE53_RESOURCES = {
1019
EpsDomainName: Fn.importValue("eps-route53-resources:EPS-domain"),
11-
EpsZoneId: Fn.importValue("eps-route53-resources:EPS-ZoneID"),
12-
LambdaAccessSecretsPolicy: Fn.importValue("account-resources:LambdaAccessSecretsPolicy"),
13-
LambdaDecryptSecretsKMSPolicy: Fn.importValue("account-resources:LambdaDecryptSecretsKMSPolicy"),
14-
SpinePrivateKeyARN: Fn.importValue("account-resources:SpinePrivateKey"),
15-
SpinePublicCertificateARN: Fn.importValue("account-resources:SpinePublicCertificate"),
16-
SpineASIDARN: Fn.importValue("account-resources:SpineASID"),
17-
SpinePartyKeyARN: Fn.importValue("account-resources:SpinePartyKey"),
18-
SpineCAChainARN: Fn.importValue("account-resources:SpineCAChain"),
19-
TrustStoreBucket: Fn.importValue("account-resources:TrustStoreBucket"),
20-
TrustStoreBucketKMSKey: Fn.importValue("account-resources:TrustStoreBucketKMSKey"),
21-
TrustStoreDeploymentBucket: Fn.importValue("account-resources:TrustStoreDeploymentBucket")
20+
EpsZoneId: Fn.importValue("eps-route53-resources:EPS-ZoneID")
2221
}
2322

24-
/** Imported shared Lambda resource values used by Lambda and API Gateway constructs. */
25-
export const LAMBDA_RESOURCES = {
26-
LambdaInsightsLogGroupPolicy: Fn.importValue("lambda-resources:LambdaInsightsLogGroupPolicy"),
27-
SplunkDeliveryStream: Fn.importValue("lambda-resources:SplunkDeliveryStream"),
28-
SplunkSubscriptionFilterRole: Fn.importValue("lambda-resources:SplunkSubscriptionFilterRole")
23+
export const SECRETS_RESOURCES = {
24+
LambdaAccessSecretsPolicyArn: Fn.importValue("secrets-cdk:IAM:LambdaAccessSecretsPolicy:Arn"),
25+
LambdaDecryptSecretsKMSPolicyArn: Fn.importValue("secrets-cdk:IAM:LambdaDecryptSecretsKMSPolicy:Arn"),
26+
SpinePrivateKeyArn: Fn.importValue("secrets-cdk:Secrets:SpinePrivateKey:Arn"),
27+
SpinePublicCertificateArn: Fn.importValue("secrets-cdk:Secrets:SpinePublicCertificate:Arn"),
28+
SpineASIDArn: Fn.importValue("secrets-cdk:Secrets:SpineASID:Arn"),
29+
SpinePartyKeyArn: Fn.importValue("secrets-cdk:Secrets:SpinePartyKey:Arn"),
30+
SpineCAChainArn: Fn.importValue("secrets-cdk:Secrets:SpineCAChain:Arn")
2931
}
3032

3133
/** Shared cfn-guard rule identifiers used for metadata suppressions. */

‎packages/cdkConstructs/src/constructs/RestApiGateway.ts‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ import {
3333
} from "aws-cdk-lib/aws-route53"
3434
import {ApiGateway as ApiGatewayTarget} from "aws-cdk-lib/aws-route53-targets"
3535
import {NagSuppressions} from "cdk-nag"
36-
import {ACCOUNT_RESOURCES, LAMBDA_RESOURCES} from "../constants"
36+
import {ACCOUNT_RESOURCES, ROUTE53_RESOURCES} from "../constants"
3737
import {addSuppressions} from "../utils/helpers"
3838

3939
/** Configuration for creating a REST API with optional mTLS and log forwarding integrations. */
@@ -119,27 +119,27 @@ export class RestApiGateway extends Construct {
119119
this, "cloudWatchLogsKmsKey", ACCOUNT_RESOURCES.CloudwatchLogsKmsKeyArn)
120120

121121
const splunkDeliveryStream = Stream.fromStreamArn(
122-
this, "SplunkDeliveryStream", LAMBDA_RESOURCES.SplunkDeliveryStream)
122+
this, "SplunkDeliveryStream", ACCOUNT_RESOURCES.SplunkDeliveryStreamArn)
123123

124124
const splunkSubscriptionFilterRole = Role.fromRoleArn(
125-
this, "splunkSubscriptionFilterRole", LAMBDA_RESOURCES.SplunkSubscriptionFilterRole)
125+
this, "splunkSubscriptionFilterRole", ACCOUNT_RESOURCES.SplunkSubscriptionFilterRoleArn)
126126

127127
const trustStoreBucket = Bucket.fromBucketArn(
128-
this, "TrustStoreBucket", ACCOUNT_RESOURCES.TrustStoreBucket)
128+
this, "TrustStoreBucket", ACCOUNT_RESOURCES.TrustStoreBucketArn)
129129

130130
const trustStoreDeploymentBucket = Bucket.fromBucketArn(
131-
this, "TrustStoreDeploymentBucket", ACCOUNT_RESOURCES.TrustStoreDeploymentBucket)
131+
this, "TrustStoreDeploymentBucket", ACCOUNT_RESOURCES.TrustStoreDeploymentBucketArn)
132132

133133
const trustStoreBucketKmsKey = Key.fromKeyArn(
134-
this, "TrustStoreBucketKmsKey", ACCOUNT_RESOURCES.TrustStoreBucketKMSKey)
134+
this, "TrustStoreBucketKmsKey", ACCOUNT_RESOURCES.TrustStoreBucketKMSKeyArn)
135135

136136
let hostedZone: IHostedZone | undefined
137137
let serviceDomainName: string | undefined
138138

139139
if (enableServiceDomain) {
140-
const epsDomainName: string = ACCOUNT_RESOURCES.EpsDomainName
140+
const epsDomainName: string = ROUTE53_RESOURCES.EpsDomainName
141141
hostedZone = HostedZone.fromHostedZoneAttributes(this, "HostedZone", {
142-
hostedZoneId: ACCOUNT_RESOURCES.EpsZoneId,
142+
hostedZoneId: ROUTE53_RESOURCES.EpsZoneId,
143143
zoneName: epsDomainName
144144
})
145145
serviceDomainName = `${props.stackName}.${epsDomainName}`

‎packages/cdkConstructs/src/constructs/StateMachine.ts‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ import {
2020
} from "aws-cdk-lib/aws-stepfunctions"
2121
import {Construct} from "constructs"
2222
import {CfnDeliveryStream} from "aws-cdk-lib/aws-kinesisfirehose"
23-
import {ACCOUNT_RESOURCES, CFN_GUARD_RULES, LAMBDA_RESOURCES} from "../constants"
23+
import {ACCOUNT_RESOURCES, CFN_GUARD_RULES} from "../constants"
2424
import {addSuppressions} from "../utils/helpers"
2525

2626
/**
@@ -98,7 +98,7 @@ export class ExpressStateMachine extends Construct {
9898
this, "cloudwatchEncryptionKMSPolicy", ACCOUNT_RESOURCES.CloudwatchEncryptionKMSPolicyArn),
9999
splunkDeliveryStream,
100100
splunkSubscriptionFilterRole = Role.fromRoleArn(
101-
this, "splunkSubscriptionFilterRole", LAMBDA_RESOURCES.SplunkSubscriptionFilterRole),
101+
this, "splunkSubscriptionFilterRole", ACCOUNT_RESOURCES.SplunkSubscriptionFilterRoleArn),
102102
addSplunkSubscriptionFilter = true
103103
} = props
104104

@@ -122,7 +122,7 @@ export class ExpressStateMachine extends Construct {
122122
})
123123
} else {
124124
const splunkDeliveryStreamImport = Stream.fromStreamArn(
125-
this, "SplunkDeliveryStream", LAMBDA_RESOURCES.SplunkDeliveryStream)
125+
this, "SplunkDeliveryStream", ACCOUNT_RESOURCES.SplunkDeliveryStreamArn)
126126
new CfnSubscriptionFilter(this, "StateMachineLogsSplunkSubscriptionFilter", {
127127
destinationArn: splunkDeliveryStreamImport.streamArn,
128128
filterPattern: "",

‎packages/cdkConstructs/src/constructs/lambdaSharedResources.ts‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ import {
1313
} from "aws-cdk-lib/aws-iam"
1414
import {NagSuppressions} from "cdk-nag"
1515
import {LAMBDA_INSIGHTS_LAYER_ARNS} from "../config"
16-
import {ACCOUNT_RESOURCES, CFN_GUARD_RULES, LAMBDA_RESOURCES} from "../constants"
16+
import {ACCOUNT_RESOURCES, CFN_GUARD_RULES} from "../constants"
1717
import {addSuppressions} from "../utils/helpers"
1818
import {CfnDeliveryStream} from "aws-cdk-lib/aws-kinesisfirehose"
1919
import {Stream} from "aws-cdk-lib/aws-kinesis"
@@ -55,9 +55,9 @@ export const createSharedLambdaResources = (
5555
),
5656
splunkDeliveryStream,
5757
splunkSubscriptionFilterRole = Role.fromRoleArn(
58-
scope, "splunkSubscriptionFilterRole", LAMBDA_RESOURCES.SplunkSubscriptionFilterRole),
58+
scope, "splunkSubscriptionFilterRole", ACCOUNT_RESOURCES.SplunkSubscriptionFilterRoleArn),
5959
lambdaInsightsLogGroupPolicy = ManagedPolicy.fromManagedPolicyArn(
60-
scope, "lambdaInsightsLogGroupPolicy", LAMBDA_RESOURCES.LambdaInsightsLogGroupPolicy),
60+
scope, "lambdaInsightsLogGroupPolicy", ACCOUNT_RESOURCES.LambdaInsightsLogGroupPolicyArn),
6161
addSplunkSubscriptionFilter = true
6262
} = props
6363
const insightsLambdaLayerArn = architecture === Architecture.ARM_64
@@ -88,7 +88,7 @@ export const createSharedLambdaResources = (
8888
})
8989
} else {
9090
const splunkDeliveryStreamImport = Stream.fromStreamArn(
91-
scope, "SplunkDeliveryStream", LAMBDA_RESOURCES.SplunkDeliveryStream)
91+
scope, "SplunkDeliveryStream", ACCOUNT_RESOURCES.SplunkDeliveryStreamArn)
9292
new CfnSubscriptionFilter(scope, "LambdaLogsSplunkSubscriptionFilter", {
9393
destinationArn: splunkDeliveryStreamImport.streamArn,
9494
filterPattern: "",

‎packages/cdkConstructs/tests/constructs/RestApiGateway.test.ts‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -48,16 +48,16 @@ describe("RestApiGateway without mTLS", () => {
4848
test("creates CloudWatch log group with correct properties", () => {
4949
template.hasResourceProperties("AWS::Logs::LogGroup", {
5050
LogGroupName: "/aws/apigateway/test-stack-apigw",
51-
KmsKeyId: {"Fn::ImportValue": "account-resources:CloudwatchLogsKmsKeyArn"},
51+
KmsKeyId: {"Fn::ImportValue": "account-resources-cdk-uk:KMS:CloudwatchLogsKmsKey:Arn"},
5252
RetentionInDays: 30
5353
})
5454
})
5555

5656
test("creates Splunk subscription filter", () => {
5757
template.hasResourceProperties("AWS::Logs::SubscriptionFilter", {
5858
FilterPattern: "",
59-
RoleArn: {"Fn::ImportValue": "lambda-resources:SplunkSubscriptionFilterRole"},
60-
DestinationArn: {"Fn::ImportValue": "lambda-resources:SplunkDeliveryStream"}
59+
RoleArn: {"Fn::ImportValue": "account-resources-cdk-uk:IAM:SplunkSubscriptionFilterRole:Arn"},
60+
DestinationArn: {"Fn::ImportValue": "account-resources-cdk-uk:Firehose:SplunkDeliveryStream:Arn"}
6161
})
6262
})
6363

@@ -269,7 +269,7 @@ describe("RestApiGateway with mTLS", () => {
269269
test("creates trust store deployment log group", () => {
270270
template.hasResourceProperties("AWS::Logs::LogGroup", {
271271
LogGroupName: "/aws/lambda/test-stack-truststore-deployment",
272-
KmsKeyId: {"Fn::ImportValue": "account-resources:CloudwatchLogsKmsKeyArn"},
272+
KmsKeyId: {"Fn::ImportValue": "account-resources-cdk-uk:KMS:CloudwatchLogsKmsKey:Arn"},
273273
RetentionInDays: 30
274274
})
275275
})

‎packages/cdkConstructs/tests/constructs/pythonLambdaFunctionConstruct.test.ts‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ describe("pythonFunctionConstruct works correctly", () => {
6666
test("it has the correct log group", () => {
6767
template.hasResourceProperties("AWS::Logs::LogGroup", {
6868
LogGroupName: "/aws/lambda/testPythonLambda",
69-
KmsKeyId: {"Fn::ImportValue": "account-resources:CloudwatchLogsKmsKeyArn"},
69+
KmsKeyId: {"Fn::ImportValue": "account-resources-cdk-uk:KMS:CloudwatchLogsKmsKey:Arn"},
7070
RetentionInDays: 30
7171
})
7272
})
@@ -92,8 +92,8 @@ describe("pythonFunctionConstruct works correctly", () => {
9292
template.hasResourceProperties("AWS::Logs::SubscriptionFilter", {
9393
LogGroupName: {"Ref": lambdaLogGroupResource.Ref},
9494
FilterPattern: "",
95-
RoleArn: {"Fn::ImportValue": "lambda-resources:SplunkSubscriptionFilterRole"},
96-
DestinationArn: {"Fn::ImportValue": "lambda-resources:SplunkDeliveryStream"}
95+
RoleArn: {"Fn::ImportValue": "account-resources-cdk-uk:IAM:SplunkSubscriptionFilterRole:Arn"},
96+
DestinationArn: {"Fn::ImportValue": "account-resources-cdk-uk:Firehose:SplunkDeliveryStream:Arn"}
9797
})
9898
})
9999

@@ -108,8 +108,8 @@ describe("pythonFunctionConstruct works correctly", () => {
108108
}]
109109
},
110110
ManagedPolicyArns: Match.arrayWith([
111-
{"Fn::ImportValue": "lambda-resources:LambdaInsightsLogGroupPolicy"},
112-
{"Fn::ImportValue": "account-resources:CloudwatchEncryptionKMSPolicyArn"}
111+
{"Fn::ImportValue": "account-resources-cdk-uk:IAM:LambdaInsightsLogGroupPolicy:Arn"},
112+
{"Fn::ImportValue": "account-resources-cdk-uk:IAM:CloudwatchEncryptionKMSPolicy:Arn"}
113113
])
114114
})
115115
})
@@ -215,8 +215,8 @@ describe("pythonFunctionConstruct works correctly with additional policies", ()
215215
test("it has the correct policies in the role", () => {
216216
template.hasResourceProperties("AWS::IAM::Role", {
217217
ManagedPolicyArns: Match.arrayWith([
218-
{"Fn::ImportValue": "lambda-resources:LambdaInsightsLogGroupPolicy"},
219-
{"Fn::ImportValue": "account-resources:CloudwatchEncryptionKMSPolicyArn"},
218+
{"Fn::ImportValue": "account-resources-cdk-uk:IAM:LambdaInsightsLogGroupPolicy:Arn"},
219+
{"Fn::ImportValue": "account-resources-cdk-uk:IAM:CloudwatchEncryptionKMSPolicy:Arn"},
220220
{Ref: testPolicyResource.Ref}
221221
])
222222
})

‎packages/cdkConstructs/tests/constructs/stateMachineConstruct.test.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,15 +36,15 @@ describe("ExpressStateMachine construct", () => {
3636
test("creates CloudWatch log group with correct name and KMS key", () => {
3737
template.hasResourceProperties("AWS::Logs::LogGroup", {
3838
LogGroupName: "/aws/stepfunctions/test-state-machine",
39-
KmsKeyId: {"Fn::ImportValue": "account-resources:CloudwatchLogsKmsKeyArn"},
39+
KmsKeyId: {"Fn::ImportValue": "account-resources-cdk-uk:KMS:CloudwatchLogsKmsKey:Arn"},
4040
RetentionInDays: 30
4141
})
4242
})
4343

4444
test("creates Splunk subscription filter by default", () => {
4545
template.hasResourceProperties("AWS::Logs::SubscriptionFilter", {
4646
FilterPattern: "",
47-
RoleArn: {"Fn::ImportValue": "lambda-resources:SplunkSubscriptionFilterRole"}
47+
RoleArn: {"Fn::ImportValue": "account-resources-cdk-uk:IAM:SplunkSubscriptionFilterRole:Arn"}
4848
})
4949
})
5050

‎packages/cdkConstructs/tests/constructs/typescriptFunctionConstruct.test.ts‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ describe("TypescriptLambdaFunctionConstruct works correctly", () => {
7171
test("it has the correct log group", () => {
7272
template.hasResourceProperties("AWS::Logs::LogGroup", {
7373
LogGroupName: "/aws/lambda/testLambda",
74-
KmsKeyId: {"Fn::ImportValue": "account-resources:CloudwatchLogsKmsKeyArn"},
74+
KmsKeyId: {"Fn::ImportValue": "account-resources-cdk-uk:KMS:CloudwatchLogsKmsKey:Arn"},
7575
RetentionInDays: 30
7676
})
7777
})
@@ -97,8 +97,8 @@ describe("TypescriptLambdaFunctionConstruct works correctly", () => {
9797
template.hasResourceProperties("AWS::Logs::SubscriptionFilter", {
9898
LogGroupName: {"Ref": lambdaLogGroupResource.Ref},
9999
FilterPattern: "",
100-
RoleArn: {"Fn::ImportValue": "lambda-resources:SplunkSubscriptionFilterRole"},
101-
DestinationArn: {"Fn::ImportValue": "lambda-resources:SplunkDeliveryStream"}
100+
RoleArn: {"Fn::ImportValue": "account-resources-cdk-uk:IAM:SplunkSubscriptionFilterRole:Arn"},
101+
DestinationArn: {"Fn::ImportValue": "account-resources-cdk-uk:Firehose:SplunkDeliveryStream:Arn"}
102102
})
103103
})
104104

@@ -117,8 +117,8 @@ describe("TypescriptLambdaFunctionConstruct works correctly", () => {
117117
"Version": "2012-10-17"
118118
},
119119
"ManagedPolicyArns": Match.arrayWith([
120-
{"Fn::ImportValue": "lambda-resources:LambdaInsightsLogGroupPolicy"},
121-
{"Fn::ImportValue": "account-resources:CloudwatchEncryptionKMSPolicyArn"}
120+
{"Fn::ImportValue": "account-resources-cdk-uk:IAM:LambdaInsightsLogGroupPolicy:Arn"},
121+
{"Fn::ImportValue": "account-resources-cdk-uk:IAM:CloudwatchEncryptionKMSPolicy:Arn"}
122122
])
123123
})
124124
})
@@ -223,8 +223,8 @@ describe("functionConstruct works correctly with additional policies", () => {
223223
test("it has the correct policies in the role", () => {
224224
template.hasResourceProperties("AWS::IAM::Role", {
225225
"ManagedPolicyArns": Match.arrayWith([
226-
{"Fn::ImportValue": "lambda-resources:LambdaInsightsLogGroupPolicy"},
227-
{"Fn::ImportValue": "account-resources:CloudwatchEncryptionKMSPolicyArn"},
226+
{"Fn::ImportValue": "account-resources-cdk-uk:IAM:LambdaInsightsLogGroupPolicy:Arn"},
227+
{"Fn::ImportValue": "account-resources-cdk-uk:IAM:CloudwatchEncryptionKMSPolicy:Arn"},
228228
{Ref: testPolicyResource.Ref}
229229
])
230230
})

‎packages/deploymentUtils/src/specifications/deleteProxygenDeployments.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ async function deleteEnvProxygenDeployments(
4747
const lambda = new LambdaClient({})
4848

4949
const exports = await getCloudFormationExports()
50-
const proxygenPrivateKeyArn = getCFConfigValue(exports, `account-resources:${proxygenPrivateKeyName}`)
50+
const proxygenPrivateKeyArn = getCFConfigValue(exports, `secrets-cdk:Secrets:${proxygenPrivateKeyName}:Arn`)
5151

5252
console.log(`Checking Apigee deployments of ${apigeeApi} on ${apigeeEnvironment}`)
5353
const instances = JSON.parse(await invokeLambda(

0 commit comments

Comments
 (0)