CCM-17343: Add routing for supplier config data

infrastructure/terraform/components/events/cloudwatch_event_bus_policy_control_plane.tf

@@ -28,6 +28,7 @@ data "aws_iam_policy_document" "control_plane_ingest" {
       values = distinct(flatten([
         formatlist("arn:aws:iam::%s:role/comms-*-api-event-publisher", var.event_publisher_account_ids),
         formatlist("arn:aws:iam::%s:role/nhs-notify-*-eventpub", var.event_publisher_account_ids),
+        formatlist("arn:aws:iam::%s:role/service-role/GitHub_Deploy", var.event_publisher_account_ids),
         (
           var.template_control_cross_account_source != null
           ) ? [

infrastructure/terraform/components/events/cloudwatch_event_rule_supplier_config_to_supplier_api.tf

@@ -0,0 +1,87 @@
+resource "aws_cloudwatch_event_rule" "supplier_config_to_supplier_api" {
+  count = (var.supplier_api_data_cross_account_target != null) ? 1 : 0
+
+  name           = "${local.csi}-supplier-config-to-supplier-api"
+  description    = "Supplier Config events to Supplier API Rule"
+  event_bus_name = aws_cloudwatch_event_bus.control_plane.name
+
+  event_pattern = jsonencode({
+    "detail" : {
+      "type" : [
+        { "prefix" : "uk.nhs.notify.supplier-config" }
+      ],
+    }
+  })
+}
+
+resource "aws_cloudwatch_event_target" "supplier_config_to_supplier_api" {
+  count = (var.supplier_api_data_cross_account_target != null) ? 1 : 0
+
+  rule           = aws_cloudwatch_event_rule.supplier_config_to_supplier_api[0].name
+  arn            = var.event_target_arns["supplier_api_sns_topic"]
+  target_id      = "supplier-api-control-incoming"
+  event_bus_name = aws_cloudwatch_event_bus.control_plane.name
+  role_arn       = aws_iam_role.supplier_config_to_supplier_api_events[0].arn
+  input_path     = "$.detail"
+  dead_letter_config {
+    arn = module.supplier_config_to_supplier_api_events_dlq[0].sqs_queue_arn
+  }
+}
+
+data "aws_iam_policy_document" "supplier_config_to_supplier_api_events" {
+  count = (var.supplier_api_data_cross_account_target != null) ? 1 : 0
+
+  statement {
+    effect  = "Allow"
+    actions = ["sts:AssumeRole"]
+    principals {
+      type        = "Service"
+      identifiers = ["events.amazonaws.com"]
+    }
+  }
+}
+
+resource "aws_iam_role" "supplier_config_to_supplier_api_events" {
+  count = (var.supplier_api_data_cross_account_target != null) ? 1 : 0
+
+  name = "${local.csi}-supplier-config-to-supplier-api-events"
+
+  assume_role_policy = data.aws_iam_policy_document.supplier_config_to_supplier_api_events[0].json
+}
+
+resource "aws_iam_policy" "supplier_config_to_supplier_api_events" {
+  count = (var.supplier_api_data_cross_account_target != null) ? 1 : 0
+
+  name = "${local.csi}-supplier-config-to-supplier-api-events"
+
+  policy = jsonencode({
+    Version = "2012-10-17",
+    Statement = [{
+      Effect   = "Allow",
+      Action   = "sns:Publish",
+      Resource = var.event_target_arns["supplier_api_sns_topic"]
+      },
+      {
+        Action = [
+          "kms:GenerateDataKey",
+          "kms:Encrypt",
+          "kms:DescribeKey",
+          "kms:Decrypt"
+        ],
+        Effect   = "Allow",
+        Resource = "arn:aws:kms:${var.region}:${var.supplier_api_data_cross_account_target.account_id}:key/*"
+        Condition = {
+          "ForAnyValue:StringEquals" = {
+            "kms:ResourceAliases" = "alias/nhs-${var.supplier_api_data_cross_account_target.environment}-supapi"
+          }
+        }
+    }]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "supplier_config_to_supplier_api_events" {
+  count = (var.supplier_api_data_cross_account_target != null) ? 1 : 0
+
+  role       = aws_iam_role.supplier_config_to_supplier_api_events[0].name
+  policy_arn = aws_iam_policy.supplier_config_to_supplier_api_events[0].arn
+}

infrastructure/terraform/components/events/module_supplier_config_to_supplier_api_events_dlq.tf

@@ -0,0 +1,34 @@
+module "supplier_config_to_supplier_api_events_dlq" {
+  count  = (var.supplier_api_data_cross_account_target != null) ? 1 : 0
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-sqs.zip"
+
+  aws_account_id  = var.aws_account_id
+  component       = var.component
+  environment     = var.environment
+  project         = var.project
+  region          = var.region
+  name            = "supplier-config-to-supplier-api-events-dlq"
+  sqs_kms_key_arn = module.kms.key_arn
+
+  sqs_policy_overload = data.aws_iam_policy_document.supplier_config_to_supplier_api_events_allow_eventbridge[0].json
+}
+
+data "aws_iam_policy_document" "supplier_config_to_supplier_api_events_allow_eventbridge" {
+  count = (var.supplier_api_data_cross_account_target != null) ? 1 : 0
+
+  statement {
+    effect = "Allow"
+    principals {
+      type        = "Service"
+      identifiers = ["events.amazonaws.com"]
+    }
+
+    actions   = ["sqs:SendMessage"]
+    resources = [module.supplier_config_to_supplier_api_events_dlq[0].sqs_queue_arn]
+    condition {
+      test     = "ArnEquals"
+      variable = "aws:SourceArn"
+      values   = [aws_cloudwatch_event_rule.supplier_config_to_supplier_api[0].arn]
+    }
+  }
+}