CLDC-3516: Add collection resources bucket

terraform/development/per_review_app/main.tf

@@ -84,6 +84,7 @@ module "application" {
   bulk_upload_bucket_details                        = data.terraform_remote_state.development_shared.outputs.bulk_upload_details
   cloudfront_header_name                            = data.terraform_remote_state.development_shared.outputs.front_door_cloudfront_header_name
   cloudfront_header_password                        = data.terraform_remote_state.development_shared.outputs.front_door_cloudfront_header_password
+  collection_resources_bucket_details               = data.terraform_remote_state.development_shared.outputs.collection_resources_details
   database_name                                     = local.prefix
   database_partial_connection_string_parameter_name = data.terraform_remote_state.development_shared.outputs.database_rds_partial_connection_string_parameter_name
   ecs_deployment_role_name                          = data.terraform_remote_state.development_shared.outputs.application_roles_ecs_deployment_role_name

terraform/development/shared/main.tf

@@ -82,10 +82,11 @@ module "application_roles" {
 
   github_actions_role_arn = "arn:aws:iam::815624722760:role/core-application-repo"
 
-  prefix                               = local.prefix
-  bulk_upload_bucket_access_policy_arn = module.bulk_upload.read_write_policy_arn
-  database_data_access_policy_arn      = module.database.rds_data_access_policy_arn
-  export_bucket_access_policy_arn      = module.cds_export.read_write_policy_arn
+  prefix                                        = local.prefix
+  bulk_upload_bucket_access_policy_arn          = module.bulk_upload.read_write_policy_arn
+  collection_resources_bucket_access_policy_arn = module.collection_resources.details.bucket_name
+  database_data_access_policy_arn               = module.database.rds_data_access_policy_arn
+  export_bucket_access_policy_arn               = module.cds_export.read_write_policy_arn
 
   secret_arns = [
     module.application_secrets.govuk_notify_api_key_secret_arn,
@@ -143,6 +144,12 @@ module "certificates" {
   load_balancer_domain_name = local.load_balancer_domain_name
 }
 
+module "collection_resources" {
+  source = "../../modules/collection_resources"
+
+  prefix = local.prefix
+}
+
 module "database" {
   source = "../../modules/rds"
 

terraform/development/shared/outputs.tf

@@ -88,6 +88,11 @@ output "certificates_load_balancer_certificate_validation" {
   description = "The domain validation objects for the load balancer certificate"
 }
 
+output "collection_resources_details" {
+  value       = module.collection_resources.details
+  description = "Details block of the collection resources bucket for the application to use to connect"
+}
+
 output "database_rds_partial_connection_string_parameter_name" {
   value       = module.database.rds_partial_connection_string_parameter_name
   description = "The name of the partial database connection string in the parameter store"

terraform/modules/application/ecs.tf

@@ -5,19 +5,24 @@ resource "aws_ecs_cluster" "this" {
 }
 
 locals {
-  app_container_name     = "app"
-  sidekiq_container_name = "sidekiq"
-  export_bucket_key      = "export-bucket"
-  bulk_upload_bucket_key = "bulk-upload-bucket"
+  app_container_name              = "app"
+  bulk_upload_bucket_key          = "bulk-upload-bucket"
+  collection_resources_bucket_key = "collection-resources-bucket"
+  export_bucket_key               = "export-bucket"
+  sidekiq_container_name          = "sidekiq"
   s3_config = [
     {
       instance_name : local.bulk_upload_bucket_key,
       credentials : var.bulk_upload_bucket_details
     },
+    {
+      instance_name : local.collection_resources_bucket_key,
+      credentials : var.collection_resources_bucket_details
+    },
     {
       instance_name : local.export_bucket_key,
       credentials : var.export_bucket_details
-    },
+    }
   ]
 }
 
@@ -26,6 +31,7 @@ locals {
   app_container_environment_base = [
     { Name = "APP_HOST", Value = var.app_host },
     { Name = "BULK_UPLOAD_BUCKET", Value = local.bulk_upload_bucket_key },
+    { Name = "COLLECTION_RESOURCES_BUCKET", Value = local.collection_resources_bucket_key },
     { Name = "EXPORT_BUCKET", Value = local.export_bucket_key },
     { Name = "RAILS_ENV", Value = var.rails_env },
     { Name = "RAILS_LOG_TO_STDOUT", Value = "true" },

terraform/modules/application/variables.tf

@@ -41,6 +41,14 @@ variable "cloudfront_header_password" {
   description = "The password on the custom header used for cloudfront"
 }
 
+variable "collection_resources_bucket_details" {
+  type = object({
+    aws_region  = string
+    bucket_name = string
+  })
+  description = "Details block for collection resources bucket"
+}
+
 variable "database_name" {
   type        = string
   description = "The name of the database to connect to"

terraform/modules/application_roles/role_task.tf

@@ -76,6 +76,11 @@ resource "aws_iam_role_policy_attachment" "task_bulk_upload_bucket_access" {
   policy_arn = var.bulk_upload_bucket_access_policy_arn
 }
 
+resource "aws_iam_role_policy_attachment" "task_collection_resources_bucket_access" {
+  role       = aws_iam_role.task.name
+  policy_arn = var.collection_resources_bucket_access_policy_arn
+}
+
 resource "aws_iam_role_policy_attachment" "task_export_bucket_access" {
   role       = aws_iam_role.task.name
   policy_arn = var.export_bucket_access_policy_arn

terraform/modules/application_roles/variables.tf

@@ -3,6 +3,11 @@ variable "bulk_upload_bucket_access_policy_arn" {
   description = "The arn of the policy allowing access to the bulk upload bucket"
 }
 
+variable "collection_resources_bucket_access_policy_arn" {
+  type        = string
+  description = "The arn of the policy allowing access to the collection resources bucket"
+}
+
 variable "database_data_access_policy_arn" {
   type        = string
   description = "The arn of the policy allowing database data access"