PRMDR-698 create new feature flag config file with flags disabled

Co-authored-by: abbas-khan10 <[email protected]>
nhsconnect · Feb 22, 2024 · e78c8ce · e78c8ce
1 parent 0781d80
commit e78c8ce
Show file tree

Hide file tree

Showing 25 changed files with 177 additions and 66 deletions.
diff --git a/infrastructure/README.md b/infrastructure/README.md
@@ -8,7 +8,7 @@
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.30.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.12.0 |
 
 ## Modules
 
@@ -136,7 +136,6 @@
 | [aws_ecs_cluster.mesh-forwarder-ecs-cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_cluster) | resource |
 | [aws_ecs_service.mesh_forwarder](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_service) | resource |
 | [aws_ecs_task_definition.forwarder](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_task_definition) | resource |
-| [aws_iam_policy.app_config_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
 | [aws_iam_policy.copy_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
 | [aws_iam_policy.dynamodb_policy_scan_bulk_report](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
 | [aws_iam_policy.lambda_audit_splunk_sqs_queue_send_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |

diff --git a/infrastructure/lambda-authoriser.tf b/infrastructure/lambda-authoriser.tf
@@ -7,10 +7,14 @@ module "authoriser-lambda" {
     "arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy",
     aws_iam_policy.ssm_policy_authoriser.arn,
     module.auth_session_dynamodb_table.dynamodb_policy,
+    module.ndr-app-config.app_config_policy_arn
   ]
   rest_api_id       = aws_api_gateway_rest_api.ndr_doc_store_api.id
   api_execution_arn = aws_api_gateway_rest_api.ndr_doc_store_api.execution_arn
   lambda_environment_variables = {
+    APPCONFIG_APPLICATION          = module.ndr-app-config.app_config_application_id
+    APPCONFIG_ENVIRONMENT          = module.ndr-app-config.app_config_environment_id
+    APPCONFIG_CONFIGURATION        = module.ndr-app-config.app_config_configuration_profile_id
     WORKSPACE                      = terraform.workspace
     SSM_PARAM_JWT_TOKEN_PUBLIC_KEY = "jwt_token_public_key"
     AUTH_SESSION_TABLE_NAME        = "${terraform.workspace}_${var.auth_session_dynamodb_table_name}"
@@ -22,7 +26,8 @@ module "authoriser-lambda" {
   depends_on = [
     aws_iam_policy.ssm_policy_authoriser,
     module.auth_session_dynamodb_table,
-    aws_api_gateway_rest_api.ndr_doc_store_api
+    aws_api_gateway_rest_api.ndr_doc_store_api,
+    module.ndr-app-config
   ]
 }
 

diff --git a/infrastructure/lambda-back-channel-logout.tf b/infrastructure/lambda-back-channel-logout.tf
@@ -26,13 +26,17 @@ module "back_channel_logout_lambda" {
     "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
     "arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy",
     aws_iam_policy.ssm_policy_oidc.arn,
-    module.auth_session_dynamodb_table.dynamodb_policy
+    module.auth_session_dynamodb_table.dynamodb_policy,
+    module.ndr-app-config.app_config_policy_arn
   ]
   rest_api_id       = aws_api_gateway_rest_api.ndr_doc_store_api.id
   resource_id       = module.back-channel-logout-gateway.gateway_resource_id
   http_method       = "POST"
   api_execution_arn = aws_api_gateway_rest_api.ndr_doc_store_api.execution_arn
   lambda_environment_variables = {
+    APPCONFIG_APPLICATION          = module.ndr-app-config.app_config_application_id
+    APPCONFIG_ENVIRONMENT          = module.ndr-app-config.app_config_environment_id
+    APPCONFIG_CONFIGURATION        = module.ndr-app-config.app_config_configuration_profile_id
     WORKSPACE                      = terraform.workspace
     ENVIRONMENT                    = var.environment
     AUTH_DYNAMODB_NAME             = "${terraform.workspace}_${var.auth_session_dynamodb_table_name}"
@@ -43,7 +47,9 @@ module "back_channel_logout_lambda" {
     aws_api_gateway_rest_api.ndr_doc_store_api,
     aws_iam_policy.ssm_policy_oidc,
     module.auth_session_dynamodb_table,
-  module.back-channel-logout-gateway]
+    module.back-channel-logout-gateway,
+    module.ndr-app-config
+  ]
 }
 
 module "back_channel_logout_alarm" {

diff --git a/infrastructure/lambda-bulk-upload-metadata.tf b/infrastructure/lambda-bulk-upload-metadata.tf
@@ -8,10 +8,14 @@ module "bulk-upload-metadata-lambda" {
     "arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy",
     module.ndr-bulk-staging-store.s3_object_access_policy,
     module.sqs-lg-bulk-upload-metadata-queue.sqs_policy,
+    module.ndr-app-config.app_config_policy_arn
   ]
   rest_api_id       = aws_api_gateway_rest_api.ndr_doc_store_api.id
   api_execution_arn = aws_api_gateway_rest_api.ndr_doc_store_api.execution_arn
   lambda_environment_variables = {
+    APPCONFIG_APPLICATION     = module.ndr-app-config.app_config_application_id
+    APPCONFIG_ENVIRONMENT     = module.ndr-app-config.app_config_environment_id
+    APPCONFIG_CONFIGURATION   = module.ndr-app-config.app_config_configuration_profile_id
     WORKSPACE                 = terraform.workspace
     STAGING_STORE_BUCKET_NAME = "${terraform.workspace}-${var.staging_store_bucket_name}"
     METADATA_SQS_QUEUE_URL    = module.sqs-lg-bulk-upload-metadata-queue.sqs_url
@@ -24,6 +28,7 @@ module "bulk-upload-metadata-lambda" {
     aws_api_gateway_rest_api.ndr_doc_store_api,
     module.ndr-bulk-staging-store,
     module.sqs-lg-bulk-upload-metadata-queue,
+    module.ndr-app-config
   ]
 }
 

diff --git a/infrastructure/lambda-bulk-upload-report.tf b/infrastructure/lambda-bulk-upload-report.tf
@@ -7,11 +7,15 @@ module "bulk-upload-report-lambda" {
     "arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy",
     module.ndr-bulk-staging-store.s3_object_access_policy,
     module.bulk_upload_report_dynamodb_table.dynamodb_policy,
-    aws_iam_policy.dynamodb_policy_scan_bulk_report.arn
+    aws_iam_policy.dynamodb_policy_scan_bulk_report.arn,
+    module.ndr-app-config.app_config_policy_arn
   ]
   rest_api_id       = aws_api_gateway_rest_api.ndr_doc_store_api.id
   api_execution_arn = aws_api_gateway_rest_api.ndr_doc_store_api.execution_arn
   lambda_environment_variables = {
+    APPCONFIG_APPLICATION     = module.ndr-app-config.app_config_application_id
+    APPCONFIG_ENVIRONMENT     = module.ndr-app-config.app_config_environment_id
+    APPCONFIG_CONFIGURATION   = module.ndr-app-config.app_config_configuration_profile_id
     WORKSPACE                 = terraform.workspace
     STAGING_STORE_BUCKET_NAME = "${terraform.workspace}-${var.staging_store_bucket_name}"
     BULK_UPLOAD_DYNAMODB_NAME = "${terraform.workspace}_${var.bulk_upload_report_dynamodb_table_name}"
@@ -24,7 +28,8 @@ module "bulk-upload-report-lambda" {
   depends_on = [
     aws_api_gateway_rest_api.ndr_doc_store_api,
     module.ndr-bulk-staging-store,
-    module.bulk_upload_report_dynamodb_table
+    module.bulk_upload_report_dynamodb_table,
+    module.ndr-app-config
   ]
 }
 

diff --git a/infrastructure/lambda-bulk-upload.tf b/infrastructure/lambda-bulk-upload.tf
@@ -11,12 +11,16 @@ module "bulk-upload-lambda" {
     module.bulk_upload_report_dynamodb_table.dynamodb_policy,
     module.sqs-lg-bulk-upload-metadata-queue.sqs_policy,
     module.sqs-lg-bulk-upload-invalid-queue.sqs_policy,
-    aws_iam_policy.ssm_policy_pds.arn
+    aws_iam_policy.ssm_policy_pds.arn,
+    module.ndr-app-config.app_config_policy_arn
   ]
   rest_api_id       = null
   api_execution_arn = null
 
   lambda_environment_variables = {
+    APPCONFIG_APPLICATION      = module.ndr-app-config.app_config_application_id
+    APPCONFIG_ENVIRONMENT      = module.ndr-app-config.app_config_environment_id
+    APPCONFIG_CONFIGURATION    = module.ndr-app-config.app_config_configuration_profile_id
     WORKSPACE                  = terraform.workspace
     STAGING_STORE_BUCKET_NAME  = "${terraform.workspace}-${var.staging_store_bucket_name}"
     LLOYD_GEORGE_BUCKET_NAME   = "${terraform.workspace}-${var.lloyd_george_bucket_name}"
@@ -40,7 +44,8 @@ module "bulk-upload-lambda" {
     module.ndr-lloyd-george-store,
     module.lloyd_george_reference_dynamodb_table,
     module.bulk_upload_report_dynamodb_table,
-    aws_iam_policy.ssm_policy_pds
+    aws_iam_policy.ssm_policy_pds,
+    module.ndr-app-config
   ]
 }
 

diff --git a/infrastructure/lambda-create-doc-ref.tf b/infrastructure/lambda-create-doc-ref.tf
@@ -72,13 +72,17 @@ module "create-doc-ref-lambda" {
     module.lloyd_george_reference_dynamodb_table.dynamodb_policy,
     module.ndr-lloyd-george-store.s3_object_access_policy,
     "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
-    "arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy"
+    "arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy",
+    module.ndr-app-config.app_config_policy_arn
   ]
   rest_api_id       = aws_api_gateway_rest_api.ndr_doc_store_api.id
   resource_id       = module.create-doc-ref-gateway.gateway_resource_id
   http_method       = "POST"
   api_execution_arn = aws_api_gateway_rest_api.ndr_doc_store_api.execution_arn
   lambda_environment_variables = {
+    APPCONFIG_APPLICATION        = module.ndr-app-config.app_config_application_id
+    APPCONFIG_ENVIRONMENT        = module.ndr-app-config.app_config_environment_id
+    APPCONFIG_CONFIGURATION      = module.ndr-app-config.app_config_configuration_profile_id
     DOCUMENT_STORE_BUCKET_NAME   = "${terraform.workspace}-${var.docstore_bucket_name}"
     DOCUMENT_STORE_DYNAMODB_NAME = "${terraform.workspace}_${var.docstore_dynamodb_table_name}"
     LLOYD_GEORGE_BUCKET_NAME     = "${terraform.workspace}-${var.lloyd_george_bucket_name}"
@@ -88,6 +92,7 @@ module "create-doc-ref-lambda" {
   depends_on = [
     aws_api_gateway_rest_api.ndr_doc_store_api,
     module.document_reference_dynamodb_table,
-    module.create-doc-ref-gateway
+    module.create-doc-ref-gateway,
+    module.ndr-app-config
   ]
 }
diff --git a/infrastructure/lambda-delete-doc-ref.tf b/infrastructure/lambda-delete-doc-ref.tf
@@ -71,20 +71,25 @@ module "delete-doc-ref-lambda" {
     module.lloyd_george_reference_dynamodb_table.dynamodb_policy,
     module.ndr-lloyd-george-store.s3_object_access_policy,
     "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
-    "arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy"
+    "arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy",
+    module.ndr-app-config.app_config_policy_arn
   ]
   rest_api_id       = aws_api_gateway_rest_api.ndr_doc_store_api.id
   resource_id       = module.delete-doc-ref-gateway.gateway_resource_id
   http_method       = "DELETE"
   api_execution_arn = aws_api_gateway_rest_api.ndr_doc_store_api.execution_arn
   lambda_environment_variables = {
+    APPCONFIG_APPLICATION        = module.ndr-app-config.app_config_application_id
+    APPCONFIG_ENVIRONMENT        = module.ndr-app-config.app_config_environment_id
+    APPCONFIG_CONFIGURATION      = module.ndr-app-config.app_config_configuration_profile_id
     DOCUMENT_STORE_DYNAMODB_NAME = "${terraform.workspace}_${var.docstore_dynamodb_table_name}"
     LLOYD_GEORGE_DYNAMODB_NAME   = "${terraform.workspace}_${var.lloyd_george_dynamodb_table_name}"
     WORKSPACE                    = terraform.workspace
   }
   depends_on = [
     aws_api_gateway_rest_api.ndr_doc_store_api,
     module.document_reference_dynamodb_table,
-    module.delete-doc-ref-gateway
+    module.delete-doc-ref-gateway,
+    module.ndr-app-config
   ]
 }
diff --git a/infrastructure/lambda-document-manifest-by-nhs-number.tf b/infrastructure/lambda-document-manifest-by-nhs-number.tf
@@ -76,13 +76,17 @@ module "document-manifest-by-nhs-number-lambda" {
     module.zip_store_reference_dynamodb_table.dynamodb_policy,
     module.ndr-zip-request-store.s3_object_access_policy,
     "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
-    "arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy"
+    "arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy",
+    module.ndr-app-config.app_config_policy_arn
   ]
   rest_api_id       = aws_api_gateway_rest_api.ndr_doc_store_api.id
   resource_id       = module.document-manifest-by-nhs-gateway.gateway_resource_id
   http_method       = "GET"
   api_execution_arn = aws_api_gateway_rest_api.ndr_doc_store_api.execution_arn
   lambda_environment_variables = {
+    APPCONFIG_APPLICATION        = module.ndr-app-config.app_config_application_id
+    APPCONFIG_ENVIRONMENT        = module.ndr-app-config.app_config_environment_id
+    APPCONFIG_CONFIGURATION      = module.ndr-app-config.app_config_configuration_profile_id
     DOCUMENT_STORE_BUCKET_NAME   = "${terraform.workspace}-${var.docstore_bucket_name}"
     DOCUMENT_STORE_DYNAMODB_NAME = "${terraform.workspace}_${var.docstore_dynamodb_table_name}"
     LLOYD_GEORGE_BUCKET_NAME     = "${terraform.workspace}-${var.lloyd_george_bucket_name}"
@@ -95,7 +99,8 @@ module "document-manifest-by-nhs-number-lambda" {
   depends_on = [
     aws_api_gateway_rest_api.ndr_doc_store_api,
     module.document-manifest-by-nhs-gateway,
-    aws_iam_policy.lambda_audit_splunk_sqs_queue_send_policy[0]
+    aws_iam_policy.lambda_audit_splunk_sqs_queue_send_policy[0],
+    module.ndr-app-config
   ]
 }
 

diff --git a/infrastructure/lambda-feature-flags.tf b/infrastructure/lambda-feature-flags.tf
@@ -69,7 +69,7 @@ module "feature-flags-lambda" {
   iam_role_policies = [
     "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
     "arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy",
-    aws_iam_policy.app_config_policy.arn
+    module.ndr-app-config.app_config_policy_arn
   ]
   rest_api_id       = aws_api_gateway_rest_api.ndr_doc_store_api.id
   resource_id       = module.feature-flags-gateway.gateway_resource_id
@@ -86,33 +86,10 @@ module "feature-flags-lambda" {
     WORKSPACE               = terraform.workspace
   }
 
-  layers = [
-    "arn:aws:lambda:${local.current_region}:282860088358:layer:AWS-AppConfig-Extension:81"
-  ]
-
   depends_on = [
     aws_api_gateway_rest_api.ndr_doc_store_api,
-    module.ndr-app-config,
     module.feature-flags-gateway,
-    aws_iam_policy.lambda_audit_splunk_sqs_queue_send_policy[0]
+    aws_iam_policy.lambda_audit_splunk_sqs_queue_send_policy[0],
+    module.ndr-app-config
   ]
 }
-
-resource "aws_iam_policy" "app_config_policy" {
-  name = "${terraform.workspace}_app_config_lambda"
-  policy = jsonencode({
-    Version = "2012-10-17",
-    Statement = [
-      {
-        Effect = "Allow",
-        Action = [
-          "appconfig:GetLatestConfiguration",
-          "appconfig:StartConfigurationSession"
-        ],
-        Resource = [
-          "arn:aws:appconfig:*:*:application/${module.ndr-app-config.app_config_application_id}/environment/${module.ndr-app-config.app_config_environment_id}/configuration/${module.ndr-app-config.app_config_configuration_profile_id}"
-        ]
-      }
-    ]
-  })
-}
diff --git a/infrastructure/lambda-lloyd-george-record-stitch.tf b/infrastructure/lambda-lloyd-george-record-stitch.tf
@@ -72,6 +72,7 @@ module "lloyd-george-stitch-lambda" {
     module.ndr-lloyd-george-store.s3_object_access_policy,
     "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
     "arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy",
+    module.ndr-app-config.app_config_policy_arn
   ]
   rest_api_id       = aws_api_gateway_rest_api.ndr_doc_store_api.id
   resource_id       = module.lloyd-george-stitch-gateway.gateway_resource_id
@@ -82,6 +83,9 @@ module "lloyd-george-stitch-lambda" {
   lambda_timeout = 450
 
   lambda_environment_variables = {
+    APPCONFIG_APPLICATION      = module.ndr-app-config.app_config_application_id
+    APPCONFIG_ENVIRONMENT      = module.ndr-app-config.app_config_environment_id
+    APPCONFIG_CONFIGURATION    = module.ndr-app-config.app_config_configuration_profile_id
     LLOYD_GEORGE_BUCKET_NAME   = "${terraform.workspace}-${var.lloyd_george_bucket_name}"
     LLOYD_GEORGE_DYNAMODB_NAME = "${terraform.workspace}_${var.lloyd_george_dynamodb_table_name}"
     SPLUNK_SQS_QUEUE_URL       = try(module.sqs-splunk-queue[0].sqs_url, null)
@@ -92,7 +96,8 @@ module "lloyd-george-stitch-lambda" {
     module.ndr-lloyd-george-store,
     module.lloyd_george_reference_dynamodb_table,
     module.lloyd-george-stitch-gateway,
-    aws_iam_policy.lambda_audit_splunk_sqs_queue_send_policy[0]
+    aws_iam_policy.lambda_audit_splunk_sqs_queue_send_policy[0],
+    module.ndr-app-config
   ]
 }
 

diff --git a/infrastructure/lambda-login-redirect.tf b/infrastructure/lambda-login-redirect.tf
@@ -19,22 +19,27 @@ module "login_redirect_lambda" {
     "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
     "arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy",
     aws_iam_policy.ssm_policy_oidc.arn,
-    module.auth_state_dynamodb_table.dynamodb_policy
+    module.auth_state_dynamodb_table.dynamodb_policy,
+    module.ndr-app-config.app_config_policy_arn
   ]
   rest_api_id       = aws_api_gateway_rest_api.ndr_doc_store_api.id
   resource_id       = aws_api_gateway_resource.login_resource.id
   http_method       = "GET"
   api_execution_arn = aws_api_gateway_rest_api.ndr_doc_store_api.execution_arn
   lambda_environment_variables = {
-    WORKSPACE          = terraform.workspace
-    OIDC_CALLBACK_URL  = "https://${terraform.workspace}.${var.domain}/auth-callback"
-    AUTH_DYNAMODB_NAME = "${terraform.workspace}_${var.auth_state_dynamodb_table_name}"
+    APPCONFIG_APPLICATION   = module.ndr-app-config.app_config_application_id
+    APPCONFIG_ENVIRONMENT   = module.ndr-app-config.app_config_environment_id
+    APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
+    WORKSPACE               = terraform.workspace
+    OIDC_CALLBACK_URL       = "https://${terraform.workspace}.${var.domain}/auth-callback"
+    AUTH_DYNAMODB_NAME      = "${terraform.workspace}_${var.auth_state_dynamodb_table_name}"
   }
   depends_on = [
     aws_api_gateway_rest_api.ndr_doc_store_api,
     aws_api_gateway_resource.login_resource,
     aws_iam_policy.ssm_policy_oidc,
-    module.auth_state_dynamodb_table
+    module.auth_state_dynamodb_table,
+    module.ndr-app-config
   ]
 }
 

diff --git a/infrastructure/lambda-logout.tf b/infrastructure/lambda-logout.tf
@@ -26,13 +26,17 @@ module "logout_lambda" {
     "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
     "arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy",
     aws_iam_policy.ssm_policy_oidc.arn,
-    module.auth_session_dynamodb_table.dynamodb_policy
+    module.auth_session_dynamodb_table.dynamodb_policy,
+    module.ndr-app-config.app_config_policy_arn
   ]
   rest_api_id       = aws_api_gateway_rest_api.ndr_doc_store_api.id
   resource_id       = module.logout-gateway.gateway_resource_id
   http_method       = "GET"
   api_execution_arn = aws_api_gateway_rest_api.ndr_doc_store_api.execution_arn
   lambda_environment_variables = {
+    APPCONFIG_APPLICATION          = module.ndr-app-config.app_config_application_id
+    APPCONFIG_ENVIRONMENT          = module.ndr-app-config.app_config_environment_id
+    APPCONFIG_CONFIGURATION        = module.ndr-app-config.app_config_configuration_profile_id
     WORKSPACE                      = terraform.workspace
     AUTH_DYNAMODB_NAME             = "${terraform.workspace}_${var.auth_session_dynamodb_table_name}"
     SSM_PARAM_JWT_TOKEN_PUBLIC_KEY = "jwt_token_public_key"
@@ -41,7 +45,9 @@ module "logout_lambda" {
     aws_api_gateway_rest_api.ndr_doc_store_api,
     aws_iam_policy.ssm_policy_oidc,
     module.auth_session_dynamodb_table,
-  module.logout-gateway]
+    module.logout-gateway,
+    module.ndr-app-config
+  ]
 }
 
 module "logout_alarm" {

diff --git a/infrastructure/lambda-nems-message.tf b/infrastructure/lambda-nems-message.tf
@@ -8,11 +8,15 @@ module "nems-message-lambda" {
     "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
     "arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy",
     module.lloyd_george_reference_dynamodb_table.dynamodb_policy,
-    module.sqs-nems-queue[0].sqs_policy
+    module.sqs-nems-queue[0].sqs_policy,
+    module.ndr-app-config.app_config_policy_arn
   ]
   rest_api_id       = aws_api_gateway_rest_api.ndr_doc_store_api.id
   api_execution_arn = aws_api_gateway_rest_api.ndr_doc_store_api.execution_arn
   lambda_environment_variables = {
+    APPCONFIG_APPLICATION      = module.ndr-app-config.app_config_application_id
+    APPCONFIG_ENVIRONMENT      = module.ndr-app-config.app_config_environment_id
+    APPCONFIG_CONFIGURATION    = module.ndr-app-config.app_config_configuration_profile_id
     WORKSPACE                  = terraform.workspace
     LLOYD_GEORGE_DYNAMODB_NAME = "${terraform.workspace}_${var.lloyd_george_dynamodb_table_name}"
     NEMS_SQS_QUEUE_URL         = module.sqs-nems-queue[0].sqs_url
@@ -24,6 +28,7 @@ module "nems-message-lambda" {
     aws_api_gateway_rest_api.ndr_doc_store_api,
     module.lloyd_george_reference_dynamodb_table,
     module.sqs-nems-queue,
+    module.ndr-app-config
   ]
 }