From e77930bacb666192e9b44544f9b77ee401fc96d8 Mon Sep 17 00:00:00 2001 From: Steve Buxton Date: Thu, 9 Jul 2026 10:02:05 +0100 Subject: [PATCH 1/5] CCM-21851: Add missing pack specification to dev config --- .../notify-admail-colour-whitemail.json | 55 +++++++++++++++++++ 1 file changed, 55 insertions(+) create mode 100644 config/suppliers/pack-specification/notify-admail-colour-whitemail.json diff --git a/config/suppliers/pack-specification/notify-admail-colour-whitemail.json b/config/suppliers/pack-specification/notify-admail-colour-whitemail.json new file mode 100644 index 000000000..dd735faec --- /dev/null +++ b/config/suppliers/pack-specification/notify-admail-colour-whitemail.json @@ -0,0 +1,55 @@ +{ + "assembly": { + "duplex": true, + "envelopeId": "economy-c5", + "features": [ + "ADMAIL" + ], + "paper": { + "colour": "WHITE", + "id": "paper-std-white-80", + "name": "Standard White 80gsm", + "recycled": true, + "size": "A4", + "weightGSM": 80 + }, + "printColour": "COLOUR" + }, + "billingId": "insert-admail-colour", + "constraints": { + "blackCoveragePercentage": { + "operator": "LESS_THAN", + "value": 20 + }, + "colourCoveragePercentage": { + "operator": "LESS_THAN", + "value": 10 + }, + "deliveryDays": { + "operator": "LESS_THAN", + "value": 2 + }, + "sheets": { + "operator": "LESS_THAN", + "value": 5 + }, + "sides": { + "operator": "LESS_THAN", + "value": 10 + } + }, + "createdAt": "2026-01-12T00:00:00.000Z", + "description": "Admail economy tariff with whitemail envelope and colour printing", + "id": "notify-admail-colour-whitemail", + "name": "Admail (colour whitemail)", + "postage": { + "deliveryDays": 4, + "id": "admail-economy", + "maxThicknessMm": 5, + "maxWeightGrams": 100, + "size": "STANDARD" + }, + "status": "PROD", + "updatedAt": "2026-01-12T00:00:00.000Z", + "version": 1 +} From 36b3b33a34b0fbc7ec1729d2aee0e57b25346b41 Mon Sep 17 00:00:00 2001 From: Steve Buxton Date: Thu, 9 Jul 2026 10:31:01 +0100 Subject: [PATCH 2/5] Add supplier pack too --- .../supplier1-notify-admail-colour-whitemail.json | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 config/suppliers/supplier-pack/supplier1-notify-admail-colour-whitemail.json diff --git a/config/suppliers/supplier-pack/supplier1-notify-admail-colour-whitemail.json b/config/suppliers/supplier-pack/supplier1-notify-admail-colour-whitemail.json new file mode 100644 index 000000000..859848c3a --- /dev/null +++ b/config/suppliers/supplier-pack/supplier1-notify-admail-colour-whitemail.json @@ -0,0 +1,7 @@ +{ + "approval": "APPROVED", + "id": "supplier1-notify-admail-colour-whitemail", + "packSpecificationId": "notify-admail-colour-whitemail", + "status": "PROD", + "supplierId": "supplier1" +} From b673cb4962db04c26a18f66a5fa807b233f488b7 Mon Sep 17 00:00:00 2001 From: Steve Buxton Date: Fri, 10 Jul 2026 15:03:04 +0100 Subject: [PATCH 3/5] Revert "CCM-14114: set TLS version on Rest API to be 1.2, to match domain name (#491)" This reverts commit 9b1e49c44fb3b0a0bb8c477f889622a38099c319. --- .../terraform/components/api/api_gateway_rest_api.tf | 4 ---- .../components/api/api_gateway_rest_api_tls.tf | 11 ----------- infrastructure/terraform/components/api/locals.tf | 2 -- .../terraform/components/api/resources/spec.tmpl.json | 4 +--- 4 files changed, 1 insertion(+), 20 deletions(-) delete mode 100644 infrastructure/terraform/components/api/api_gateway_rest_api_tls.tf diff --git a/infrastructure/terraform/components/api/api_gateway_rest_api.tf b/infrastructure/terraform/components/api/api_gateway_rest_api.tf index 1b259235e..aadbc0be8 100644 --- a/infrastructure/terraform/components/api/api_gateway_rest_api.tf +++ b/infrastructure/terraform/components/api/api_gateway_rest_api.tf @@ -3,8 +3,4 @@ resource "aws_api_gateway_rest_api" "main" { body = local.openapi_spec description = "Suppliers API" disable_execute_api_endpoint = var.disable_gateway_execute_endpoint - - lifecycle { - replace_triggered_by = [terraform_data.rest_api_security_policy] - } } diff --git a/infrastructure/terraform/components/api/api_gateway_rest_api_tls.tf b/infrastructure/terraform/components/api/api_gateway_rest_api_tls.tf deleted file mode 100644 index efef825f1..000000000 --- a/infrastructure/terraform/components/api/api_gateway_rest_api_tls.tf +++ /dev/null @@ -1,11 +0,0 @@ -locals { - rest_api_security_policy = "SecurityPolicy_TLS12_PFS_2025_EDGE" - rest_api_endpoint_access_mode = "STRICT" -} - -resource "terraform_data" "rest_api_security_policy" { - input = { - security_policy = local.rest_api_security_policy - endpoint_access_mode = local.rest_api_endpoint_access_mode - } -} diff --git a/infrastructure/terraform/components/api/locals.tf b/infrastructure/terraform/components/api/locals.tf index 517590fa8..da1e61630 100644 --- a/infrastructure/terraform/components/api/locals.tf +++ b/infrastructure/terraform/components/api/locals.tf @@ -7,8 +7,6 @@ locals { openapi_spec = templatefile("${path.module}/resources/spec.tmpl.json", { APIG_EXECUTION_ROLE_ARN = aws_iam_role.api_gateway_execution_role.arn AWS_REGION = var.region - SECURITY_POLICY = local.rest_api_security_policy - ENDPOINT_ACCESS_MODE = local.rest_api_endpoint_access_mode AUTHORIZER_LAMBDA_ARN = module.authorizer_lambda.function_arn GET_LETTER_LAMBDA_ARN = module.get_letter.function_arn GET_LETTERS_LAMBDA_ARN = module.get_letters.function_arn diff --git a/infrastructure/terraform/components/api/resources/spec.tmpl.json b/infrastructure/terraform/components/api/resources/spec.tmpl.json index 8d6430127..51ad83dfb 100644 --- a/infrastructure/terraform/components/api/resources/spec.tmpl.json +++ b/infrastructure/terraform/components/api/resources/spec.tmpl.json @@ -357,7 +357,5 @@ } ] } - }, - "x-amazon-apigateway-endpoint-access-mode": "${ENDPOINT_ACCESS_MODE}", - "x-amazon-apigateway-security-policy": "${SECURITY_POLICY}" + } } From e2475837338732c78502d202df56c4beeda329ad Mon Sep 17 00:00:00 2001 From: Steve Buxton Date: Fri, 10 Jul 2026 15:09:40 +0100 Subject: [PATCH 4/5] Add security_policy and endpoint_access_node to aws_api_gateway_rest_api --- .../terraform/components/api/api_gateway_rest_api.tf | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/infrastructure/terraform/components/api/api_gateway_rest_api.tf b/infrastructure/terraform/components/api/api_gateway_rest_api.tf index aadbc0be8..32cfb38ca 100644 --- a/infrastructure/terraform/components/api/api_gateway_rest_api.tf +++ b/infrastructure/terraform/components/api/api_gateway_rest_api.tf @@ -1,6 +1,13 @@ +locals { + rest_api_security_policy = "SecurityPolicy_TLS12_PFS_2025_EDGE" + rest_api_endpoint_access_mode = "STRICT" +} + resource "aws_api_gateway_rest_api" "main" { name = local.csi body = local.openapi_spec description = "Suppliers API" disable_execute_api_endpoint = var.disable_gateway_execute_endpoint + security_policy = local.rest_api_security_policy + endpoint_access_mode = local.rest_api_endpoint_access_mode } From 76e8698911dd3490bcbd23accfbe0150b5c12b37 Mon Sep 17 00:00:00 2001 From: Steve Buxton Date: Mon, 13 Jul 2026 10:22:24 +0100 Subject: [PATCH 5/5] Remove STRICT and EDGE TLS version --- .../terraform/components/api/api_gateway_rest_api.tf | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/infrastructure/terraform/components/api/api_gateway_rest_api.tf b/infrastructure/terraform/components/api/api_gateway_rest_api.tf index 32cfb38ca..7fe89d71f 100644 --- a/infrastructure/terraform/components/api/api_gateway_rest_api.tf +++ b/infrastructure/terraform/components/api/api_gateway_rest_api.tf @@ -1,6 +1,5 @@ locals { - rest_api_security_policy = "SecurityPolicy_TLS12_PFS_2025_EDGE" - rest_api_endpoint_access_mode = "STRICT" + rest_api_security_policy = "1.2" } resource "aws_api_gateway_rest_api" "main" { @@ -9,5 +8,4 @@ resource "aws_api_gateway_rest_api" "main" { description = "Suppliers API" disable_execute_api_endpoint = var.disable_gateway_execute_endpoint security_policy = local.rest_api_security_policy - endpoint_access_mode = local.rest_api_endpoint_access_mode }