[PRMP-1584] S3 buckets not enforcing HTTPS by MohammadIqbalAD-NHS · Pull Request #162 · NHSDigital/orphaned-record-continuity

MohammadIqbalAD-NHS · 2025-02-28T13:28:50Z

No description provided.

github-actions · 2025-02-28T13:29:21Z

Report for environment: test

Terraform Format and Style 🖌`success`

Format Output

Terraform Initialization ⚙️`success`

Initialization Output


Initializing the backend...

Successfully configured the backend "s3"! Terraform will automatically
use this backend unless the backend configuration changes.
Initializing provider plugins...
- Finding hashicorp/aws versions matching "~> 4.0"...
- Installing hashicorp/aws v4.67.0...
- Installed hashicorp/aws v4.67.0 (signed by HashiCorp)
Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

Terraform Validation 🤖`success`

Validation Output


Success! The configuration is valid.

Terraform Plan 📖`success`

Show Plan (no changes)



No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

github-actions · 2025-02-28T13:29:24Z

Report for environment: pre-prod

Terraform Format and Style 🖌`success`

Format Output

Terraform Initialization ⚙️`success`

Initialization Output


Initializing the backend...

Successfully configured the backend "s3"! Terraform will automatically
use this backend unless the backend configuration changes.
Initializing provider plugins...
- Finding hashicorp/aws versions matching "~> 4.0"...
- Installing hashicorp/aws v4.67.0...
- Installed hashicorp/aws v4.67.0 (signed by HashiCorp)
Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

Terraform Validation 🤖`success`

Validation Output


Success! The configuration is valid.

Terraform Plan 📖`success`

Show Plan (0 to add, 1 to change, 0 to destroy)



Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_s3_bucket_policy.ehr_repo_permit_developer_to_see_access_logs_policy[0] will be updated in-place
  ~ resource "aws_s3_bucket_policy" "ehr_repo_permit_developer_to_see_access_logs_policy" {
        id     = "pre-prod-ehr-repo-access-logs"
      ~ policy = jsonencode(
          ~ {
              ~ Statement = [
                    # (1 unchanged element hidden)
                    {
                        Action    = [
                            "s3:Get*",
                            "s3:ListBucket",
                        ]
                        Condition = {
                            Bool = {
                                "aws:SecureTransport" = "false"
                            }
                        }
                        Effect    = "Allow"
                        Principal = {
                            AWS = "arn:aws:iam::108148468272:role/RepoDeveloper"
                        }
                        Resource  = [
                            "arn:aws:s3:::pre-prod-ehr-repo-access-logs",
                            "arn:aws:s3:::pre-prod-ehr-repo-access-logs/*",
                        ]
                        Sid       = "S3PermitDeveloperAccessLogsPolicy"
                    },
                  + {
                      + Action    = "s3:*"
                      + Condition = {
                          + Bool = {
                              + "aws:SecureTransport" = "false"
                            }
                        }
                      + Effect    = "Deny"
                      + Principal = "*"
                      + Resource  = [
                          + "arn:aws:s3:::pre-prod-ehr-repo-access-logs",
                          + "arn:aws:s3:::pre-prod-ehr-repo-access-logs/*",
                        ]
                      + Sid       = "S3EnforceHTTPSPolicy"
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        # (1 unchanged attribute hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

github-actions · 2025-02-28T13:29:24Z

Report for environment: dev

Terraform Format and Style 🖌`success`

Format Output

Terraform Initialization ⚙️`success`

Initialization Output


Initializing the backend...

Successfully configured the backend "s3"! Terraform will automatically
use this backend unless the backend configuration changes.
Initializing provider plugins...
- Finding hashicorp/aws versions matching "~> 4.0"...
- Installing hashicorp/aws v4.67.0...
- Installed hashicorp/aws v4.67.0 (signed by HashiCorp)
Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

Terraform Validation 🤖`success`

Validation Output


Success! The configuration is valid.

Terraform Plan 📖`success`

Show Plan (no changes)



No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

github-actions · 2025-02-28T13:29:25Z

Report for environment: prod

Terraform Format and Style 🖌`success`

Format Output

Terraform Initialization ⚙️`success`

Initialization Output


Initializing the backend...

Successfully configured the backend "s3"! Terraform will automatically
use this backend unless the backend configuration changes.
Initializing provider plugins...
- Finding hashicorp/aws versions matching "~> 4.0"...
- Installing hashicorp/aws v4.67.0...
- Installed hashicorp/aws v4.67.0 (signed by HashiCorp)
Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

Terraform Validation 🤖`success`

Validation Output


Success! The configuration is valid.

Terraform Plan 📖`success`

Show Plan (1 to add, 7 to change, 16 to destroy)



Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place
  - destroy
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # aws_db_subnet_group.db-cluster-subnet-group will be destroyed
  # (because aws_db_subnet_group.db-cluster-subnet-group is not in configuration)
  - resource "aws_db_subnet_group" "db-cluster-subnet-group" {
      - arn         = "arn:aws:rds:eu-west-2:535760944720:subgrp:prod-ehr-db-subnet-group" -> null
      - description = "Managed by Terraform" -> null
      - id          = "prod-ehr-db-subnet-group" -> null
      - name        = "prod-ehr-db-subnet-group" -> null
      - subnet_ids  = (sensitive value) -> null
      - tags        = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
          - "Name"        = "prod-ehr-db-subnet-group"
        } -> null
      - tags_all    = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
          - "Name"        = "prod-ehr-db-subnet-group"
        } -> null
    }

  # aws_ecs_service.ecs-service will be updated in-place
  ~ resource "aws_ecs_service" "ecs-service" {
        id                                 = "arn:aws:ecs:eu-west-2:535760944720:service/prod-ehr-repo-ecs-cluster/prod-ehr-repo-service"
        name                               = "prod-ehr-repo-service"
        tags                               = {}
      ~ task_definition                    = "arn:aws:ecs:eu-west-2:535760944720:task-definition/ehr-repo:20" -> (known after apply)
        # (15 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

  # aws_ecs_task_definition.task must be replaced
-/+ resource "aws_ecs_task_definition" "task" {
      ~ arn                      = "arn:aws:ecs:eu-west-2:535760944720:task-definition/ehr-repo:20" -> (known after apply)
      ~ arn_without_revision     = "arn:aws:ecs:eu-west-2:535760944720:task-definition/ehr-repo" -> (known after apply)
      ~ container_definitions    = (sensitive value) # forces replacement
      ~ id                       = "ehr-repo" -> (known after apply)
      ~ revision                 = 20 -> (known after apply)
        tags                     = {
            "CreatedBy"   = "prm-deductions-ehr-repository"
            "Environment" = "prod"
        }
        # (11 unchanged attributes hidden)
    }

  # aws_kms_alias.ehr_repo_encryption will be destroyed
  # (because aws_kms_alias.ehr_repo_encryption is not in configuration)
  - resource "aws_kms_alias" "ehr_repo_encryption" {
      - arn            = "arn:aws:kms:eu-west-2:535760944720:alias/ehr-repo-encryption-kms-key" -> null
      - id             = "alias/ehr-repo-encryption-kms-key" -> null
      - name           = "alias/ehr-repo-encryption-kms-key" -> null
      - target_key_arn = "arn:aws:kms:eu-west-2:535760944720:key/a3c164bb-c5ac-4ef7-999e-0000475e0176" -> null
      - target_key_id  = "a3c164bb-c5ac-4ef7-999e-0000475e0176" -> null
        # (1 unchanged attribute hidden)
    }

  # aws_kms_key.ehr-repo-key will be destroyed
  # (because aws_kms_key.ehr-repo-key is not in configuration)
  - resource "aws_kms_key" "ehr-repo-key" {
      - arn                                = "arn:aws:kms:eu-west-2:535760944720:key/a3c164bb-c5ac-4ef7-999e-0000475e0176" -> null
      - bypass_policy_lockout_safety_check = false -> null
      - customer_master_key_spec           = "SYMMETRIC_DEFAULT" -> null
      - description                        = "EHR repository KMS key in prod environment" -> null
      - enable_key_rotation                = true -> null
      - id                                 = "a3c164bb-c5ac-4ef7-999e-0000475e0176" -> null
      - is_enabled                         = true -> null
      - key_id                             = "a3c164bb-c5ac-4ef7-999e-0000475e0176" -> null
      - key_usage                          = "ENCRYPT_DECRYPT" -> null
      - multi_region                       = false -> null
      - policy                             = jsonencode(
            {
              - Id        = "key-default-1"
              - Statement = [
                  - {
                      - Action    = "kms:*"
                      - Effect    = "Allow"
                      - Principal = {
                          - AWS = "arn:aws:iam::535760944720:root"
                        }
                      - Resource  = "*"
                      - Sid       = "Enable IAM User Permissions"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
      - tags                               = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
          - "Name"        = "prod-ehr-repo-db"
        } -> null
      - tags_all                           = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
          - "Name"        = "prod-ehr-repo-db"
        } -> null
    }

  # aws_rds_cluster.db-cluster will be destroyed
  # (because aws_rds_cluster.db-cluster is not in configuration)
  - resource "aws_rds_cluster" "db-cluster" {
      - allow_major_version_upgrade         = true -> null
      - apply_immediately                   = true -> null
      - arn                                 = "arn:aws:rds:eu-west-2:535760944720:cluster:prod-ehr-db-cluster" -> null
      - availability_zones                  = [
          - "eu-west-2a",
          - "eu-west-2b",
          - "eu-west-2c",
        ] -> null
      - backtrack_window                    = 0 -> null
      - backup_retention_period             = 35 -> null
      - cluster_identifier                  = "prod-ehr-db-cluster" -> null
      - cluster_members                     = [
          - "prod-ehr-db-instance-0",
          - "prod-ehr-db-instance-1",
          - "prod-ehr-db-instance-2",
        ] -> null
      - cluster_resource_id                 = "cluster-ZTTUOUYKB2M5FLE6CBYCUU6PMI" -> null
      - copy_tags_to_snapshot               = false -> null
      - database_name                       = "ehrdb" -> null
      - db_cluster_parameter_group_name     = (sensitive value) -> null
      - db_subnet_group_name                = "prod-ehr-db-subnet-group" -> null
      - deletion_protection                 = true -> null
      - enable_global_write_forwarding      = false -> null
      - enable_http_endpoint                = false -> null
      - enabled_cloudwatch_logs_exports     = [] -> null
      - endpoint                            = "prod-ehr-db-cluster.cluster-cyniu6lsek4i.eu-west-2.rds.amazonaws.com" -> null
      - engine                              = "aurora-postgresql" -> null
      - engine_mode                         = "provisioned" -> null
      - engine_version                      = "13.12" -> null
      - engine_version_actual               = "13.12" -> null
      - hosted_zone_id                      = "Z1TTGA775OQIYO" -> null
      - iam_database_authentication_enabled = true -> null
      - iam_roles                           = [] -> null
      - id                                  = "prod-ehr-db-cluster" -> null
      - kms_key_id                          = "arn:aws:kms:eu-west-2:535760944720:key/a3c164bb-c5ac-4ef7-999e-0000475e0176" -> null
      - master_password                     = (sensitive value) -> null
      - master_username                     = (sensitive value) -> null
      - port                                = 5432 -> null
      - preferred_backup_window             = "06:30-08:00" -> null
      - preferred_maintenance_window        = "sat:04:35-sat:05:05" -> null
      - reader_endpoint                     = "prod-ehr-db-cluster.cluster-ro-cyniu6lsek4i.eu-west-2.rds.amazonaws.com" -> null
      - skip_final_snapshot                 = true -> null
      - storage_encrypted                   = true -> null
      - tags                                = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
        } -> null
      - tags_all                            = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
        } -> null
      - vpc_security_group_ids              = [
          - "sg-0202aa7080b14a4fe",
          - "sg-04a1bdc4b2d04025f",
          - "sg-0d10d724060aac975",
        ] -> null
        # (2 unchanged attributes hidden)
    }

  # aws_rds_cluster_instance.ehr-db-instances[0] will be destroyed
  # (because aws_rds_cluster_instance.ehr-db-instances is not in configuration)
  - resource "aws_rds_cluster_instance" "ehr-db-instances" {
      - arn                                   = "arn:aws:rds:eu-west-2:535760944720:db:prod-ehr-db-instance-0" -> null
      - auto_minor_version_upgrade            = true -> null
      - availability_zone                     = "eu-west-2a" -> null
      - ca_cert_identifier                    = "rds-ca-ecc384-g1" -> null
      - cluster_identifier                    = "prod-ehr-db-cluster" -> null
      - copy_tags_to_snapshot                 = false -> null
      - db_parameter_group_name               = "default.aurora-postgresql13" -> null
      - db_subnet_group_name                  = "prod-ehr-db-subnet-group" -> null
      - dbi_resource_id                       = "db-GMPCED57L6P4JNJ6A5OC54WHCU" -> null
      - endpoint                              = "prod-ehr-db-instance-0.cyniu6lsek4i.eu-west-2.rds.amazonaws.com" -> null
      - engine                                = "aurora-postgresql" -> null
      - engine_version                        = "13.12" -> null
      - engine_version_actual                 = "13.12" -> null
      - id                                    = "prod-ehr-db-instance-0" -> null
      - identifier                            = "prod-ehr-db-instance-0" -> null
      - instance_class                        = "db.t3.medium" -> null
      - kms_key_id                            = "arn:aws:kms:eu-west-2:535760944720:key/a3c164bb-c5ac-4ef7-999e-0000475e0176" -> null
      - monitoring_interval                   = 0 -> null
      - performance_insights_enabled          = false -> null
      - performance_insights_retention_period = 0 -> null
      - port                                  = 5432 -> null
      - preferred_backup_window               = "06:30-08:00" -> null
      - preferred_maintenance_window          = "mon:22:23-mon:22:53" -> null
      - promotion_tier                        = 0 -> null
      - publicly_accessible                   = false -> null
      - storage_encrypted                     = true -> null
      - tags                                  = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
        } -> null
      - tags_all                              = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
        } -> null
      - writer                                = true -> null
        # (2 unchanged attributes hidden)
    }

  # aws_rds_cluster_instance.ehr-db-instances[1] will be destroyed
  # (because aws_rds_cluster_instance.ehr-db-instances is not in configuration)
  - resource "aws_rds_cluster_instance" "ehr-db-instances" {
      - arn                                   = "arn:aws:rds:eu-west-2:535760944720:db:prod-ehr-db-instance-1" -> null
      - auto_minor_version_upgrade            = true -> null
      - availability_zone                     = "eu-west-2b" -> null
      - ca_cert_identifier                    = "rds-ca-ecc384-g1" -> null
      - cluster_identifier                    = "prod-ehr-db-cluster" -> null
      - copy_tags_to_snapshot                 = false -> null
      - db_parameter_group_name               = "default.aurora-postgresql13" -> null
      - db_subnet_group_name                  = "prod-ehr-db-subnet-group" -> null
      - dbi_resource_id                       = "db-XYC4IK37KX2NKSJ5K7LUSYJPWQ" -> null
      - endpoint                              = "prod-ehr-db-instance-1.cyniu6lsek4i.eu-west-2.rds.amazonaws.com" -> null
      - engine                                = "aurora-postgresql" -> null
      - engine_version                        = "13.12" -> null
      - engine_version_actual                 = "13.12" -> null
      - id                                    = "prod-ehr-db-instance-1" -> null
      - identifier                            = "prod-ehr-db-instance-1" -> null
      - instance_class                        = "db.t3.medium" -> null
      - kms_key_id                            = "arn:aws:kms:eu-west-2:535760944720:key/a3c164bb-c5ac-4ef7-999e-0000475e0176" -> null
      - monitoring_interval                   = 0 -> null
      - performance_insights_enabled          = false -> null
      - performance_insights_retention_period = 0 -> null
      - port                                  = 5432 -> null
      - preferred_backup_window               = "06:30-08:00" -> null
      - preferred_maintenance_window          = "fri:02:45-fri:03:15" -> null
      - promotion_tier                        = 0 -> null
      - publicly_accessible                   = false -> null
      - storage_encrypted                     = true -> null
      - tags                                  = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
        } -> null
      - tags_all                              = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
        } -> null
      - writer                                = false -> null
        # (2 unchanged attributes hidden)
    }

  # aws_rds_cluster_instance.ehr-db-instances[2] will be destroyed
  # (because aws_rds_cluster_instance.ehr-db-instances is not in configuration)
  - resource "aws_rds_cluster_instance" "ehr-db-instances" {
      - arn                                   = "arn:aws:rds:eu-west-2:535760944720:db:prod-ehr-db-instance-2" -> null
      - auto_minor_version_upgrade            = true -> null
      - availability_zone                     = "eu-west-2b" -> null
      - ca_cert_identifier                    = "rds-ca-ecc384-g1" -> null
      - cluster_identifier                    = "prod-ehr-db-cluster" -> null
      - copy_tags_to_snapshot                 = false -> null
      - db_parameter_group_name               = "default.aurora-postgresql13" -> null
      - db_subnet_group_name                  = "prod-ehr-db-subnet-group" -> null
      - dbi_resource_id                       = "db-O5LXTPCNCTJFQSYDKYXE3ZWPWM" -> null
      - endpoint                              = "prod-ehr-db-instance-2.cyniu6lsek4i.eu-west-2.rds.amazonaws.com" -> null
      - engine                                = "aurora-postgresql" -> null
      - engine_version                        = "13.12" -> null
      - engine_version_actual                 = "13.12" -> null
      - id                                    = "prod-ehr-db-instance-2" -> null
      - identifier                            = "prod-ehr-db-instance-2" -> null
      - instance_class                        = "db.t3.medium" -> null
      - kms_key_id                            = "arn:aws:kms:eu-west-2:535760944720:key/a3c164bb-c5ac-4ef7-999e-0000475e0176" -> null
      - monitoring_interval                   = 0 -> null
      - performance_insights_enabled          = false -> null
      - performance_insights_retention_period = 0 -> null
      - port                                  = 5432 -> null
      - preferred_backup_window               = "06:30-08:00" -> null
      - preferred_maintenance_window          = "thu:02:16-thu:02:46" -> null
      - promotion_tier                        = 0 -> null
      - publicly_accessible                   = false -> null
      - storage_encrypted                     = true -> null
      - tags                                  = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
        } -> null
      - tags_all                              = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
        } -> null
      - writer                                = false -> null
        # (2 unchanged attributes hidden)
    }

  # aws_s3_bucket_policy.ehr_repo_permit_developer_to_see_access_logs_policy[0] will be updated in-place
  ~ resource "aws_s3_bucket_policy" "ehr_repo_permit_developer_to_see_access_logs_policy" {
        id     = "prod-ehr-repo-access-logs"
      ~ policy = jsonencode(
          ~ {
              ~ Statement = [
                    {
                        Action    = "s3:PutObject"
                        Condition = {
                            Bool = {
                                "aws:SecureTransport" = "false"
                            }
                        }
                        Effect    = "Allow"
                        Principal = {
                            Service = "logging.s3.amazonaws.com"
                        }
                        Resource  = "arn:aws:s3:::prod-ehr-repo-access-logs/s3-access-log/*"
                        Sid       = "S3ServerAccessLogsPolicy"
                    },
                  + {
                      + Action    = [
                          + "s3:Get*",
                          + "s3:ListBucket",
                        ]
                      + Condition = {
                          + Bool = {
                              + "aws:SecureTransport" = "false"
                            }
                        }
                      + Effect    = "Allow"
                      + Principal = {
                          + AWS = "arn:aws:iam::535760944720:role/RepoDeveloper"
                        }
                      + Resource  = [
                          + "arn:aws:s3:::prod-ehr-repo-access-logs",
                          + "arn:aws:s3:::prod-ehr-repo-access-logs/*",
                        ]
                      + Sid       = "S3PermitDeveloperAccessLogsPolicy"
                    },
                  + {
                      + Action    = "s3:*"
                      + Condition = {
                          + Bool = {
                              + "aws:SecureTransport" = "false"
                            }
                        }
                      + Effect    = "Deny"
                      + Principal = "*"
                      + Resource  = [
                          + "arn:aws:s3:::prod-ehr-repo-access-logs",
                          + "arn:aws:s3:::prod-ehr-repo-access-logs/*",
                        ]
                      + Sid       = "S3EnforceHTTPSPolicy"
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        # (1 unchanged attribute hidden)
    }

  # aws_s3_bucket_policy.ehr_repo_permit_s3_to_write_access_logs_policy will be destroyed
  # (because aws_s3_bucket_policy.ehr_repo_permit_s3_to_write_access_logs_policy is not in configuration)
  - resource "aws_s3_bucket_policy" "ehr_repo_permit_s3_to_write_access_logs_policy" {
      - bucket = "prod-ehr-repo-access-logs" -> null
      - id     = "prod-ehr-repo-access-logs" -> null
      - policy = jsonencode(
            {
              - Statement = [
                  - {
                      - Action    = "s3:PutObject"
                      - Condition = {
                          - Bool = {
                              - "aws:SecureTransport" = "false"
                            }
                        }
                      - Effect    = "Allow"
                      - Principal = {
                          - Service = "logging.s3.amazonaws.com"
                        }
                      - Resource  = "arn:aws:s3:::prod-ehr-repo-access-logs/s3-access-log/*"
                      - Sid       = "S3ServerAccessLogsPolicy"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
    }

  # aws_security_group.alb_to_ehr_repo_ecs will be updated in-place
  ~ resource "aws_security_group" "alb_to_ehr_repo_ecs" {
        id                     = "sg-091d2c37cedc98276"
        name                   = "prod-alb-to-ehr-repo-ecr"
      + revoke_rules_on_delete = false
        tags                   = {
            "CreatedBy"   = "prm-deductions-ehr-repository"
            "Environment" = "prod"
            "Name"        = "prod-alb-to-ehr-repo-ecs"
        }
        # (8 unchanged attributes hidden)

      - timeouts {}
    }

  # aws_security_group.ehr_repo_alb will be updated in-place
  ~ resource "aws_security_group" "ehr_repo_alb" {
        id                     = "sg-07e5606b3bcd4649d"
        name                   = "prod-alb-ehr-repo"
      + revoke_rules_on_delete = false
        tags                   = {
            "CreatedBy"   = "prm-deductions-ehr-repository"
            "Environment" = "prod"
            "Name"        = "prod-alb-ehr-repo"
        }
        # (8 unchanged attributes hidden)

      - timeouts {}
    }

  # aws_security_group.ehr_repo_to_db_sg will be destroyed
  # (because aws_security_group.ehr_repo_to_db_sg is not in configuration)
  - resource "aws_security_group" "ehr_repo_to_db_sg" {
      - arn         = "arn:aws:ec2:eu-west-2:535760944720:security-group/sg-0d10d724060aac975" -> null
      - description = "Managed by Terraform" -> null
      - egress      = [] -> null
      - id          = "sg-0d10d724060aac975" -> null
      - ingress     = [
          - {
              - cidr_blocks      = []
              - description      = "Allow traffic from ehr-repo to the db"
              - from_port        = 5432
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0c51ae31e24afddf9",
                ]
              - self             = false
              - to_port          = 5432
            },
        ] -> null
      - name        = "prod-ehr-repo-ecs-to-ehr-repo-db-sg" -> null
      - owner_id    = "535760944720" -> null
      - tags        = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
          - "Name"        = "prod-ehr-repo-ecs-to-ehr-repo-db-sg"
        } -> null
      - tags_all    = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
          - "Name"        = "prod-ehr-repo-ecs-to-ehr-repo-db-sg"
        } -> null
      - vpc_id      = (sensitive value) -> null
        # (1 unchanged attribute hidden)

      - timeouts {}
    }

  # aws_security_group.gocd_to_db_sg will be destroyed
  # (because aws_security_group.gocd_to_db_sg is not in configuration)
  - resource "aws_security_group" "gocd_to_db_sg" {
      - arn                    = "arn:aws:ec2:eu-west-2:535760944720:security-group/sg-04a1bdc4b2d04025f" -> null
      - description            = "Managed by Terraform" -> null
      - egress                 = [] -> null
      - id                     = "sg-04a1bdc4b2d04025f" -> null
      - ingress                = (sensitive value) -> null
      - name                   = "prod-gocd-to-ehr-repo-db-sg" -> null
      - owner_id               = "535760944720" -> null
      - revoke_rules_on_delete = false -> null
      - tags                   = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
          - "Name"        = "prod-gocd-to-ehr-repo-db-sg"
        } -> null
      - tags_all               = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
          - "Name"        = "prod-gocd-to-ehr-repo-db-sg"
        } -> null
      - vpc_id                 = (sensitive value) -> null
        # (1 unchanged attribute hidden)

      - timeouts {}
    }

  # aws_security_group.gocd_to_ehr_repo will be updated in-place
  ~ resource "aws_security_group" "gocd_to_ehr_repo" {
        id                     = "sg-03ac6aa886cc858a1"
      ~ ingress                = (sensitive value)
        name                   = "prod-gocd-to-ehr-repo"
        tags                   = {
            "CreatedBy"   = "prm-deductions-ehr-repository"
            "Environment" = "prod"
            "Name"        = "prod-gocd-to-ehr-repo-sg"
        }
        # (8 unchanged attributes hidden)

      - timeouts {}
    }

  # aws_security_group.service_to_ehr_repo will be updated in-place
  ~ resource "aws_security_group" "service_to_ehr_repo" {
        id                     = "sg-0843b1d0b553c2023"
        name                   = "prod-service-to-ehr-repo"
      + revoke_rules_on_delete = false
        tags                   = {
            "CreatedBy"   = "prm-deductions-ehr-repository"
            "Environment" = "prod"
            "Name"        = "prod-service-to-ehr-repo-sg"
        }
        # (8 unchanged attributes hidden)

      - timeouts {}
    }

  # aws_security_group.vpn_to_db_sg will be destroyed
  # (because aws_security_group.vpn_to_db_sg is not in configuration)
  - resource "aws_security_group" "vpn_to_db_sg" {
      - arn         = "arn:aws:ec2:eu-west-2:535760944720:security-group/sg-0202aa7080b14a4fe" -> null
      - description = "Managed by Terraform" -> null
      - egress      = [] -> null
      - id          = "sg-0202aa7080b14a4fe" -> null
      - ingress     = [
          - {
              - cidr_blocks      = []
              - description      = "Allow traffic from VPN to the db"
              - from_port        = 5432
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0db679480c00ed82c",
                ]
              - self             = false
              - to_port          = 5432
            },
        ] -> null
      - name        = "prod-vpn-to-ehr-repo-db-sg" -> null
      - owner_id    = "535760944720" -> null
      - tags        = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
          - "Name"        = "prod-vpn-to-ehr-repo-db-sg"
        } -> null
      - tags_all    = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
          - "Name"        = "prod-vpn-to-ehr-repo-db-sg"
        } -> null
      - vpc_id      = (sensitive value) -> null
        # (1 unchanged attribute hidden)

      - timeouts {}
    }

  # aws_security_group.vpn_to_ehr_repo will be updated in-place
  ~ resource "aws_security_group" "vpn_to_ehr_repo" {
        id                     = "sg-0b1fbb458ed13a742"
        name                   = "prod-vpn-to-ehr-repo"
      + revoke_rules_on_delete = false
        tags                   = {
            "CreatedBy"   = "prm-deductions-ehr-repository"
            "Environment" = "prod"
            "Name"        = "prod-vpn-to-ehr-repo-sg"
        }
        # (8 unchanged attributes hidden)

      - timeouts {}
    }

  # aws_security_group_rule.vpn_to_db_sg[0] will be destroyed
  # (because aws_security_group_rule.vpn_to_db_sg is not in configuration)
  - resource "aws_security_group_rule" "vpn_to_db_sg" {
      - cidr_blocks              = [] -> null
      - description              = "Allow traffic from VPN to the db" -> null
      - from_port                = 5432 -> null
      - id                       = "sgrule-2902444858" -> null
      - ipv6_cidr_blocks         = [] -> null
      - prefix_list_ids          = [] -> null
      - protocol                 = "tcp" -> null
      - security_group_id        = "sg-0202aa7080b14a4fe" -> null
      - self                     = false -> null
      - source_security_group_id = (sensitive value) -> null
      - to_port                  = 5432 -> null
      - type                     = "ingress" -> null
    }

  # aws_ssm_parameter.db_host will be destroyed
  # (because aws_ssm_parameter.db_host is not in configuration)
  - resource "aws_ssm_parameter" "db_host" {
      - arn             = "arn:aws:ssm:eu-west-2:535760944720:parameter/repo/prod/output/prm-deductions-ehr-repository/db-host" -> null
      - data_type       = "text" -> null
      - id              = "/repo/prod/output/prm-deductions-ehr-repository/db-host" -> null
      - name            = "/repo/prod/output/prm-deductions-ehr-repository/db-host" -> null
      - tags            = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
        } -> null
      - tags_all        = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
        } -> null
      - tier            = "Standard" -> null
      - type            = "String" -> null
      - value           = (sensitive value) -> null
      - version         = 1 -> null
        # (3 unchanged attributes hidden)
    }

  # aws_ssm_parameter.db_name will be destroyed
  # (because aws_ssm_parameter.db_name is not in configuration)
  - resource "aws_ssm_parameter" "db_name" {
      - arn             = "arn:aws:ssm:eu-west-2:535760944720:parameter/repo/prod/output/prm-deductions-ehr-repository/db-name" -> null
      - data_type       = "text" -> null
      - id              = "/repo/prod/output/prm-deductions-ehr-repository/db-name" -> null
      - name            = "/repo/prod/output/prm-deductions-ehr-repository/db-name" -> null
      - tags            = {} -> null
      - tags_all        = {} -> null
      - tier            = "Standard" -> null
      - type            = "String" -> null
      - value           = (sensitive value) -> null
      - version         = 1 -> null
        # (3 unchanged attributes hidden)
    }

  # aws_ssm_parameter.db_resource_cluster_id will be destroyed
  # (because aws_ssm_parameter.db_resource_cluster_id is not in configuration)
  - resource "aws_ssm_parameter" "db_resource_cluster_id" {
      - arn             = "arn:aws:ssm:eu-west-2:535760944720:parameter/repo/prod/output/prm-deductions-ehr-repository/db-resource-cluster-id" -> null
      - data_type       = "text" -> null
      - id              = "/repo/prod/output/prm-deductions-ehr-repository/db-resource-cluster-id" -> null
      - name            = "/repo/prod/output/prm-deductions-ehr-repository/db-resource-cluster-id" -> null
      - tags            = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
        } -> null
      - tags_all        = {
          - "CreatedBy"   = "prm-deductions-ehr-repository"
          - "Environment" = "prod"
        } -> null
      - tier            = "Standard" -> null
      - type            = "String" -> null
      - value           = (sensitive value) -> null
      - version         = 1 -> null
        # (3 unchanged attributes hidden)
    }

Plan: 1 to add, 7 to change, 16 to destroy.

chrisbloe-nhse

Enforces HTTPS for the bucket.

[PRMP-1584] - Enforce HTTPS for ehr_repo_access_logs bucket

e803d19

MohammadIqbalAD-NHS temporarily deployed to dev February 28, 2025 13:28 — with GitHub Actions Inactive

MohammadIqbalAD-NHS temporarily deployed to test February 28, 2025 13:28 — with GitHub Actions Inactive

MohammadIqbalAD-NHS temporarily deployed to pre-prod February 28, 2025 13:28 — with GitHub Actions Inactive

MohammadIqbalAD-NHS temporarily deployed to prod February 28, 2025 13:28 — with GitHub Actions Inactive

chrisbloe-nhse changed the title ~~[PRMP-1584] - S3 buckets not enforcing HTTPS~~ [PRMP-1584] S3 buckets not enforcing HTTPS Feb 28, 2025

chrisbloe-nhse approved these changes Feb 28, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[PRMP-1584] S3 buckets not enforcing HTTPS#162

[PRMP-1584] S3 buckets not enforcing HTTPS#162
MohammadIqbalAD-NHS wants to merge 1 commit intomainfrom
PRMP-1584

MohammadIqbalAD-NHS commented Feb 28, 2025

Uh oh!

github-actions bot commented Feb 28, 2025

Uh oh!

github-actions bot commented Feb 28, 2025

Uh oh!

github-actions bot commented Feb 28, 2025

Uh oh!

github-actions bot commented Feb 28, 2025

Uh oh!

chrisbloe-nhse left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

MohammadIqbalAD-NHS commented Feb 28, 2025

Uh oh!

github-actions bot commented Feb 28, 2025

Report for environment: test

Terraform Format and Style 🖌success

Terraform Initialization ⚙️success

Terraform Validation 🤖success

Terraform Plan 📖success

Uh oh!

github-actions bot commented Feb 28, 2025

Report for environment: pre-prod

Terraform Format and Style 🖌success

Terraform Initialization ⚙️success

Terraform Validation 🤖success

Terraform Plan 📖success

Uh oh!

github-actions bot commented Feb 28, 2025

Report for environment: dev

Terraform Format and Style 🖌success

Terraform Initialization ⚙️success

Terraform Validation 🤖success

Terraform Plan 📖success

Uh oh!

github-actions bot commented Feb 28, 2025

Report for environment: prod

Terraform Format and Style 🖌success

Terraform Initialization ⚙️success

Terraform Validation 🤖success

Terraform Plan 📖success

Uh oh!

chrisbloe-nhse left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Terraform Format and Style 🖌`success`

Terraform Initialization ⚙️`success`

Terraform Validation 🤖`success`

Terraform Plan 📖`success`

Terraform Format and Style 🖌`success`

Terraform Initialization ⚙️`success`

Terraform Validation 🤖`success`

Terraform Plan 📖`success`

Terraform Format and Style 🖌`success`

Terraform Initialization ⚙️`success`

Terraform Validation 🤖`success`

Terraform Plan 📖`success`

Terraform Format and Style 🖌`success`

Terraform Initialization ⚙️`success`

Terraform Validation 🤖`success`

Terraform Plan 📖`success`