Merge Dev into Master

infrastructure/parameters/dev.parameters.json

@@ -57,10 +57,10 @@
       "value": "data.dev.explore-education-statistics.service.gov.uk"
     },
     "publicApiUrl": {
-      "value": "dev.statistics.api.education.gov.uk"
+      "value": "pp-api.education.gov.uk/statistics-dev"
     },
     "publicApiDocsUrl": {
-      "value": "dev.statistics.api.education.gov.uk/docs"
+      "value": "pp-api.education.gov.uk/statistics-dev/docs"
     },
     "detailedErrors": {
       "value": true

infrastructure/parameters/pre-prod.parameters.json

@@ -48,10 +48,10 @@
       "value": "data.pre-production.explore-education-statistics.service.gov.uk"
     },
     "publicApiUrl": {
-      "value": "pre-production.statistics.api.education.gov.uk"
+      "value": "pp-api.education.gov.uk/statistics-preprod"
     },
     "publicApiDocsUrl": {
-      "value": "pre-production.statistics.api.education.gov.uk/docs"
+      "value": "pp-api.education.gov.uk/statistics-preprod/docs"
     },
     "publicAppGATrackingId": {
       "value": "G-8FSLWXTV2W"
@@ -91,9 +91,6 @@
     },
     "immediatePublicationOfScheduledReleaseVersionsEnabled": {
       "value": true
-    },
-    "publicDataDbExists": {
-      "value": false
     }
   }
 }

infrastructure/parameters/prod.parameters.json

@@ -51,10 +51,10 @@
       "value": "data.explore-education-statistics.service.gov.uk"
     },
     "publicApiUrl": {
-      "value": "statistics.api.education.gov.uk"
+      "value": "api.education.gov.uk/statistics"
     },
     "publicApiDocsUrl": {
-      "value": "statistics.api.education.gov.uk/docs"
+      "value": "api.education.gov.uk/statistics/docs"
     },
     "publicAppGATrackingId": {
       "value": "G-9YG8ESXR5Y"

infrastructure/parameters/test.parameters.json

@@ -48,10 +48,10 @@
       "value": "data.test.explore-education-statistics.service.gov.uk"
     },
     "publicApiUrl": {
-      "value": "test.statistics.api.education.gov.uk"
+      "value": "pp-api.education.gov.uk/statistics-test"
     },
     "publicApiDocsUrl": {
-      "value": "test.statistics.api.education.gov.uk/docs"
+      "value": "pp-api.education.gov.uk/statistics-test/docs"
     },
     "detailedErrors": {
       "value": true

infrastructure/templates/public-api/application/public-api/publicApiApp.bicep

@@ -159,7 +159,7 @@ module apiContainerAppModule '../../components/containerApp.bicep' = {
     memoryGis: resourceAndScalingConfig.memoryGis
     minReplicas: resourceAndScalingConfig.minReplicas
     maxReplicas: resourceAndScalingConfig.maxReplicas
-    scaleAtConcurrentHttpRequests: resourceAndScalingConfig.scaleAtConcurrentHttpRequests
+    scaleAtConcurrentHttpRequests: resourceAndScalingConfig.?scaleAtConcurrentHttpRequests
     workloadProfileName: resourceAndScalingConfig.workloadProfileName
     alerts: deployAlerts ? {
       restarts: true
@@ -175,6 +175,15 @@ module apiContainerAppModule '../../components/containerApp.bicep' = {
   }
 }
 
+module storePublicApiContainerAppPrivateUrl '../../components/keyVaultSecret.bicep' = {
+  name: 'storePublicApiContainerAppPrivateUrl'
+  params: {
+    keyVaultName: resourceNames.existingResources.keyVault
+    secretName: 'ees-publicapi-public-api-containerapp-private-url'
+    secretValue: 'https://${apiContainerAppModule.outputs.containerAppFqdn}'
+  }
+}
+
 output containerAppFqdn string = apiContainerAppModule.outputs.containerAppFqdn
 output containerAppName string = apiContainerAppModule.outputs.containerAppName
 output healthProbePath string = '/health'

infrastructure/templates/public-api/application/public-api/publicApiWafPolicy.bicep

@@ -0,0 +1,62 @@
+import { ResourceNames } from '../../types.bicep'
+
+@description('Specifies common resource naming variables.')
+param resourceNames ResourceNames
+
+@description('Specifies the location for all resources.')
+param location string
+
+@description('Secret header value from FUAPI.')
+@secure()
+param fuapiSecretValue string
+
+@description('Specifies a set of tags with which to tag the resource in Azure.')
+param tagValues object
+
+var policyName = '${resourceNames.sharedResources.appGateway}-public-api-afwp'
+
+module wafPolicyModule '../../components/appGatewayWafPolicy.bicep' = {
+  name: 'wafPolicy'
+  params: {
+    name: policyName
+    location: location
+    // Do not define any managed rulesets for this WAF policy. The global WAF policy
+    // will cover these cases.
+    managedRuleSets: []
+    // Add a custom rule to only allow traffic that contains a correct secret 
+    // header value that is included from FUAPI.
+    customRules: [
+      {
+        name: 'fuapisecretnotpresent'
+        action: 'Block'
+        matchConditions: [
+          {
+            type: 'RequestHeaders'
+            selector: 'X-FUAPI-Secret'
+            operator: 'Any'
+            negateOperator: true
+          }
+        ]
+      }
+      {
+        name: 'fuapisecretincorrect'
+        action: 'Block'
+        matchConditions: [
+          {
+            type: 'RequestHeaders'
+            selector: 'X-FUAPI-Secret'
+            operator: 'Equal'
+            negateOperator: true
+            matchValues: [
+              fuapiSecretValue
+            ]
+          }
+        ]
+      }
+    ]
+    tagValues: tagValues
+  }
+}
+
+output id string = wafPolicyModule.outputs.id
+output name string = policyName

infrastructure/templates/public-api/application/shared/appGateway.bicep

@@ -39,6 +39,15 @@ resource subnet 'Microsoft.Network/virtualNetworks/subnets@2023-11-01' existing
   parent: vNet
 }
 
+module globalWafPolicyModule '../../components/appGatewayWafPolicy.bicep' = {
+  name: 'wafPolicy'
+  params: {
+    name: '${resourceNames.sharedResources.appGateway}-global-afwp'
+    location: location
+    tagValues: tagValues
+  }
+}
+
 module appGatewayModule '../../components/appGateway.bicep' = {
   name: 'appGatewayDeploy'
   params: {
@@ -51,6 +60,7 @@ module appGatewayModule '../../components/appGateway.bicep' = {
     backends: backends
     routes: routes
     rewrites: rewrites
+    globalWafPolicyId: globalWafPolicyModule.outputs.id
     alerts: deployAlerts ? {
       health: true
       responseTime: true

infrastructure/templates/public-api/application/shared/coreStorage.bicep

@@ -18,10 +18,8 @@ module storeCoreStorageConnectionString '../../components/keyVaultSecret.bicep'
   name: 'storeCoreStorageConnectionString'
   params: {
     keyVaultName: resourceNames.existingResources.keyVault
-    isEnabled: true
     secretName: coreStorageConnectionStringSecretKey
     secretValue: coreStorageConnectionString
-    contentType: 'text/plain'
   }
 }
 

infrastructure/templates/public-api/application/shared/postgreSqlFlexibleServer.bicep

@@ -1,4 +1,5 @@
 import { ResourceNames, IpRange, PrincipalNameAndId, PostgreSqlFlexibleServerConfig } from '../../types.bicep'
+import { replaceMultiple } from '../../functions.bicep'
 
 @description('Specifies common resource naming variables.')
 param resourceNames ResourceNames
@@ -36,6 +37,12 @@ var formattedFirewallRules = map(firewallRules, rule => {
   cidr: rule.cidr
 })
 
+func createManagedIdentityConnectionString(templateString string, identityName string) string =>
+  replaceMultiple(templateString, {
+    '[database_name]': 'public_data'
+    '[managed_identity_name]': identityName
+  })
+
 module postgreSqlServerModule '../../components/postgreSqlFlexibleServer.bicep' = {
   name: 'postgreSQLDatabaseDeploy'
   params: {
@@ -67,18 +74,19 @@ module postgreSqlServerModule '../../components/postgreSqlFlexibleServer.bicep'
   }
 }
 
-var managedIdentityConnectionStringTemplate = postgreSqlServerModule.outputs.managedIdentityConnectionStringTemplate
+var connectionStringTemplate = postgreSqlServerModule.outputs.managedIdentityConnectionStringTemplate
 
 var dataProcessorPsqlConnectionStringSecretKey = 'ees-publicapi-data-processor-connectionstring-publicdatadb'
 
 module storeDataProcessorPsqlConnectionString '../../components/keyVaultSecret.bicep' = {
   name: 'storeDataProcessorPsqlConnectionString'
   params: {
     keyVaultName: resourceNames.existingResources.keyVault
-    isEnabled: true
     secretName: dataProcessorPsqlConnectionStringSecretKey
-    secretValue: replace(replace(managedIdentityConnectionStringTemplate, '[database_name]', 'public_data'), '[managed_identity_name]', resourceNames.publicApi.dataProcessorIdentity)
-    contentType: 'text/plain'
+    secretValue: createManagedIdentityConnectionString(
+      connectionStringTemplate,
+      resourceNames.publicApi.dataProcessorIdentity
+    )
   }
 }
 
@@ -88,10 +96,11 @@ module storePublisherPsqlConnectionString '../../components/keyVaultSecret.bicep
   name: 'storePublisherPsqlConnectionString'
   params: {
     keyVaultName: resourceNames.existingResources.keyVault
-    isEnabled: true
     secretName: publisherPsqlConnectionStringSecretKey
-    secretValue: replace(replace(managedIdentityConnectionStringTemplate, '[database_name]', 'public_data'), '[managed_identity_name]', resourceNames.existingResources.publisherFunction)
-    contentType: 'text/plain'
+    secretValue: createManagedIdentityConnectionString(
+      connectionStringTemplate,
+      resourceNames.existingResources.publisherFunction
+    )
   }
 }
 
@@ -101,11 +110,12 @@ module storeAdminPsqlConnectionString '../../components/keyVaultSecret.bicep' =
   name: 'storeAdminPsqlConnectionString'
   params: {
     keyVaultName: resourceNames.existingResources.keyVault
-    isEnabled: true
     secretName: adminPsqlConnectionStringSecretKey
-    secretValue: replace(replace(managedIdentityConnectionStringTemplate, '[database_name]', 'public_data'), '[managed_identity_name]', resourceNames.existingResources.adminApp)
-    contentType: 'text/plain'
+    secretValue: createManagedIdentityConnectionString(
+      connectionStringTemplate,
+      resourceNames.existingResources.adminApp
+    ) 
   }
 }
 
-output managedIdentityConnectionStringTemplate string = managedIdentityConnectionStringTemplate
+output managedIdentityConnectionStringTemplate string = connectionStringTemplate