From e77930bacb666192e9b44544f9b77ee401fc96d8 Mon Sep 17 00:00:00 2001 From: Steve Buxton Date: Thu, 9 Jul 2026 10:02:05 +0100 Subject: [PATCH 1/6] CCM-21851: Add missing pack specification to dev config --- .../notify-admail-colour-whitemail.json | 55 +++++++++++++++++++ 1 file changed, 55 insertions(+) create mode 100644 config/suppliers/pack-specification/notify-admail-colour-whitemail.json diff --git a/config/suppliers/pack-specification/notify-admail-colour-whitemail.json b/config/suppliers/pack-specification/notify-admail-colour-whitemail.json new file mode 100644 index 000000000..dd735faec --- /dev/null +++ b/config/suppliers/pack-specification/notify-admail-colour-whitemail.json @@ -0,0 +1,55 @@ +{ + "assembly": { + "duplex": true, + "envelopeId": "economy-c5", + "features": [ + "ADMAIL" + ], + "paper": { + "colour": "WHITE", + "id": "paper-std-white-80", + "name": "Standard White 80gsm", + "recycled": true, + "size": "A4", + "weightGSM": 80 + }, + "printColour": "COLOUR" + }, + "billingId": "insert-admail-colour", + "constraints": { + "blackCoveragePercentage": { + "operator": "LESS_THAN", + "value": 20 + }, + "colourCoveragePercentage": { + "operator": "LESS_THAN", + "value": 10 + }, + "deliveryDays": { + "operator": "LESS_THAN", + "value": 2 + }, + "sheets": { + "operator": "LESS_THAN", + "value": 5 + }, + "sides": { + "operator": "LESS_THAN", + "value": 10 + } + }, + "createdAt": "2026-01-12T00:00:00.000Z", + "description": "Admail economy tariff with whitemail envelope and colour printing", + "id": "notify-admail-colour-whitemail", + "name": "Admail (colour whitemail)", + "postage": { + "deliveryDays": 4, + "id": "admail-economy", + "maxThicknessMm": 5, + "maxWeightGrams": 100, + "size": "STANDARD" + }, + "status": "PROD", + "updatedAt": "2026-01-12T00:00:00.000Z", + "version": 1 +} From 36b3b33a34b0fbc7ec1729d2aee0e57b25346b41 Mon Sep 17 00:00:00 2001 From: Steve Buxton Date: Thu, 9 Jul 2026 10:31:01 +0100 Subject: [PATCH 2/6] Add supplier pack too --- .../supplier1-notify-admail-colour-whitemail.json | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 config/suppliers/supplier-pack/supplier1-notify-admail-colour-whitemail.json diff --git a/config/suppliers/supplier-pack/supplier1-notify-admail-colour-whitemail.json b/config/suppliers/supplier-pack/supplier1-notify-admail-colour-whitemail.json new file mode 100644 index 000000000..859848c3a --- /dev/null +++ b/config/suppliers/supplier-pack/supplier1-notify-admail-colour-whitemail.json @@ -0,0 +1,7 @@ +{ + "approval": "APPROVED", + "id": "supplier1-notify-admail-colour-whitemail", + "packSpecificationId": "notify-admail-colour-whitemail", + "status": "PROD", + "supplierId": "supplier1" +} From 5371141215afd5c574448353e33cfd8164b0b8f9 Mon Sep 17 00:00:00 2001 From: Steve Buxton Date: Fri, 10 Jul 2026 09:09:26 +0100 Subject: [PATCH 3/6] Minimal change that could work? --- .../terraform/components/api/api_gateway_rest_api.tf | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/infrastructure/terraform/components/api/api_gateway_rest_api.tf b/infrastructure/terraform/components/api/api_gateway_rest_api.tf index 1b259235e..5e4e6520a 100644 --- a/infrastructure/terraform/components/api/api_gateway_rest_api.tf +++ b/infrastructure/terraform/components/api/api_gateway_rest_api.tf @@ -3,7 +3,9 @@ resource "aws_api_gateway_rest_api" "main" { body = local.openapi_spec description = "Suppliers API" disable_execute_api_endpoint = var.disable_gateway_execute_endpoint - + endpoint_configuration { + types = ["REGIONAL"] + } lifecycle { replace_triggered_by = [terraform_data.rest_api_security_policy] } From 993a1b2272a533c5cc5942f6978a225bef48a6ee Mon Sep 17 00:00:00 2001 From: Steve Buxton Date: Fri, 10 Jul 2026 09:24:58 +0100 Subject: [PATCH 4/6] TLS1.2 --- .../terraform/components/api/api_gateway_rest_api_tls.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/terraform/components/api/api_gateway_rest_api_tls.tf b/infrastructure/terraform/components/api/api_gateway_rest_api_tls.tf index efef825f1..8934a1158 100644 --- a/infrastructure/terraform/components/api/api_gateway_rest_api_tls.tf +++ b/infrastructure/terraform/components/api/api_gateway_rest_api_tls.tf @@ -1,5 +1,5 @@ locals { - rest_api_security_policy = "SecurityPolicy_TLS12_PFS_2025_EDGE" + rest_api_security_policy = "TLS_1_2" rest_api_endpoint_access_mode = "STRICT" } From 8fbc93ef3f5d9323a57b07da7ceb00da5d09f620 Mon Sep 17 00:00:00 2001 From: Steve Buxton Date: Thu, 9 Jul 2026 15:05:30 +0100 Subject: [PATCH 5/6] Terraform sequencing fix --- .../components/api/api_gateway_base_path_mapping.tf | 9 +++++++++ .../terraform/components/api/api_gateway_stage.tf | 4 ++++ 2 files changed, 13 insertions(+) diff --git a/infrastructure/terraform/components/api/api_gateway_base_path_mapping.tf b/infrastructure/terraform/components/api/api_gateway_base_path_mapping.tf index 30e418030..5b3f4760d 100644 --- a/infrastructure/terraform/components/api/api_gateway_base_path_mapping.tf +++ b/infrastructure/terraform/components/api/api_gateway_base_path_mapping.tf @@ -2,4 +2,13 @@ resource "aws_api_gateway_base_path_mapping" "main" { api_id = aws_api_gateway_rest_api.main.id stage_name = aws_api_gateway_stage.main.stage_name domain_name = aws_api_gateway_domain_name.main.domain_name + + depends_on = [ + aws_api_gateway_stage.main, + aws_api_gateway_domain_name.main + ] + + lifecycle { + replace_triggered_by = [aws_api_gateway_rest_api.main] + } } diff --git a/infrastructure/terraform/components/api/api_gateway_stage.tf b/infrastructure/terraform/components/api/api_gateway_stage.tf index 2940443d1..40ee2082c 100644 --- a/infrastructure/terraform/components/api/api_gateway_stage.tf +++ b/infrastructure/terraform/components/api/api_gateway_stage.tf @@ -61,4 +61,8 @@ resource "aws_api_gateway_stage" "main" { "status" : "$context.status" }) } + + lifecycle { + replace_triggered_by = [aws_api_gateway_rest_api.main] + } } From 6f0706c5ba74a70ad9455c962a83bed4ff77053b Mon Sep 17 00:00:00 2001 From: Steve Buxton Date: Fri, 10 Jul 2026 10:34:08 +0100 Subject: [PATCH 6/6] Fixes --- .../terraform/components/api/api_gateway_rest_api_tls.tf | 9 +++++---- infrastructure/terraform/components/api/locals.tf | 2 -- .../terraform/components/api/resources/spec.tmpl.json | 7 +++++-- 3 files changed, 10 insertions(+), 8 deletions(-) diff --git a/infrastructure/terraform/components/api/api_gateway_rest_api_tls.tf b/infrastructure/terraform/components/api/api_gateway_rest_api_tls.tf index 8934a1158..ecec65656 100644 --- a/infrastructure/terraform/components/api/api_gateway_rest_api_tls.tf +++ b/infrastructure/terraform/components/api/api_gateway_rest_api_tls.tf @@ -1,11 +1,12 @@ locals { - rest_api_security_policy = "TLS_1_2" - rest_api_endpoint_access_mode = "STRICT" + # Endpoint type for the REST API + # Security policy is managed at the custom domain level (see api_gateway_domain.tf: security_policy = "TLS_1_2") + # STRICT endpoint access mode is not supported with REGIONAL endpoints + rest_api_endpoint_type = "REGIONAL" } resource "terraform_data" "rest_api_security_policy" { input = { - security_policy = local.rest_api_security_policy - endpoint_access_mode = local.rest_api_endpoint_access_mode + endpoint_type = local.rest_api_endpoint_type } } diff --git a/infrastructure/terraform/components/api/locals.tf b/infrastructure/terraform/components/api/locals.tf index 517590fa8..da1e61630 100644 --- a/infrastructure/terraform/components/api/locals.tf +++ b/infrastructure/terraform/components/api/locals.tf @@ -7,8 +7,6 @@ locals { openapi_spec = templatefile("${path.module}/resources/spec.tmpl.json", { APIG_EXECUTION_ROLE_ARN = aws_iam_role.api_gateway_execution_role.arn AWS_REGION = var.region - SECURITY_POLICY = local.rest_api_security_policy - ENDPOINT_ACCESS_MODE = local.rest_api_endpoint_access_mode AUTHORIZER_LAMBDA_ARN = module.authorizer_lambda.function_arn GET_LETTER_LAMBDA_ARN = module.get_letter.function_arn GET_LETTERS_LAMBDA_ARN = module.get_letters.function_arn diff --git a/infrastructure/terraform/components/api/resources/spec.tmpl.json b/infrastructure/terraform/components/api/resources/spec.tmpl.json index 8d6430127..161d8b639 100644 --- a/infrastructure/terraform/components/api/resources/spec.tmpl.json +++ b/infrastructure/terraform/components/api/resources/spec.tmpl.json @@ -358,6 +358,9 @@ ] } }, - "x-amazon-apigateway-endpoint-access-mode": "${ENDPOINT_ACCESS_MODE}", - "x-amazon-apigateway-security-policy": "${SECURITY_POLICY}" + "x-amazon-apigateway-endpoint-configuration": { + "types": [ + "REGIONAL" + ] + } }