Revert "[PRMP-1215] Fixing test environment cert (#567)" (#630)

robg-test · web-flow · commit e612b5529574 · 2026-03-06T09:49:41.000Z
diff --git a/infrastructure/api.tf b/infrastructure/api.tf
@@ -152,7 +152,7 @@ resource "aws_api_gateway_gateway_response" "unauthorised_response" {
   }
 
   response_parameters = {
-    "gatewayresponse.header.Access-Control-Allow-Origin"      = local.base_url_with_quotes
+    "gatewayresponse.header.Access-Control-Allow-Origin"      = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
     "gatewayresponse.header.Access-Control-Allow-Methods"     = "'*'"
     "gatewayresponse.header.Access-Control-Allow-Headers"     = "'Content-Type,X-Amz-Date,Authorization,X-Auth,X-Api-Key,X-Amz-Security-Token,X-Auth-Cookie,Accept'"
     "gatewayresponse.header.Access-Control-Allow-Credentials" = "'true'"
@@ -172,7 +172,7 @@ resource "aws_api_gateway_gateway_response" "bad_gateway_response" {
   }
 
   response_parameters = {
-    "gatewayresponse.header.Access-Control-Allow-Origin"      = local.base_url_with_quotes
+    "gatewayresponse.header.Access-Control-Allow-Origin"      = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
     "gatewayresponse.header.Access-Control-Allow-Methods"     = "'*'"
     "gatewayresponse.header.Access-Control-Allow-Headers"     = "'Content-Type,X-Amz-Date,Authorization,X-Auth,X-Api-Key,X-Amz-Security-Token,X-Auth-Cookie,Accept'"
     "gatewayresponse.header.Access-Control-Allow-Credentials" = "'true'"
diff --git a/infrastructure/api_mtls.tf b/infrastructure/api_mtls.tf
@@ -137,7 +137,7 @@ EOF
   }
 
   response_parameters = {
-    "gatewayresponse.header.Access-Control-Allow-Origin"      = local.base_url_with_quotes
+    "gatewayresponse.header.Access-Control-Allow-Origin"      = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
     "gatewayresponse.header.Access-Control-Allow-Methods"     = "'*'"
     "gatewayresponse.header.Access-Control-Allow-Headers"     = "'Content-Type,X-Amz-Date,Authorization,X-Auth,X-Api-Key,X-Amz-Security-Token,X-Auth-Cookie,Accept'"
     "gatewayresponse.header.Access-Control-Allow-Credentials" = "'true'"
@@ -154,7 +154,7 @@ resource "aws_api_gateway_gateway_response" "bad_gateway_response_mtls" {
 EOF
   }
   response_parameters = {
-    "gatewayresponse.header.Access-Control-Allow-Origin"      = local.base_url_with_quotes
+    "gatewayresponse.header.Access-Control-Allow-Origin"      = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
     "gatewayresponse.header.Access-Control-Allow-Methods"     = "'*'"
     "gatewayresponse.header.Access-Control-Allow-Headers"     = "'Content-Type,X-Amz-Date,Authorization,X-Auth,X-Api-Key,X-Amz-Security-Token,X-Auth-Cookie,Accept'"
     "gatewayresponse.header.Access-Control-Allow-Credentials" = "'true'"
diff --git a/infrastructure/buckets.tf b/infrastructure/buckets.tf
@@ -18,13 +18,13 @@ module "ndr-document-store" {
     {
       allowed_headers = ["*"]
       allowed_methods = ["POST", "PUT", "DELETE"]
-      allowed_origins = [local.base_url]
+      allowed_origins = [contains(["prod"], terraform.workspace) ? "https://${var.domain}" : "https://${terraform.workspace}.${var.domain}"]
       expose_headers  = ["ETag"]
       max_age_seconds = 3000
     },
     {
       allowed_methods = ["GET"]
-      allowed_origins = [local.base_url]
+      allowed_origins = [contains(["prod"], terraform.workspace) ? "https://${var.domain}" : "https://${terraform.workspace}.${var.domain}"]
     }
   ]
 }
@@ -41,7 +41,7 @@ module "ndr-zip-request-store" {
   cors_rules = [
     {
       allowed_methods = ["GET"]
-      allowed_origins = [local.base_url]
+      allowed_origins = [contains(["prod"], terraform.workspace) ? "https://${var.domain}" : "https://${terraform.workspace}.${var.domain}"]
     }
   ]
 }
@@ -62,13 +62,13 @@ module "ndr-lloyd-george-store" {
     {
       allowed_headers = ["*"]
       allowed_methods = ["POST", "PUT", "DELETE"]
-      allowed_origins = [local.base_url]
+      allowed_origins = [contains(["prod"], terraform.workspace) ? "https://${var.domain}" : "https://${terraform.workspace}.${var.domain}"]
       expose_headers  = ["ETag"]
       max_age_seconds = 3000
     },
     {
       allowed_methods = ["GET"]
-      allowed_origins = [local.base_url]
+      allowed_origins = [contains(["prod"], terraform.workspace) ? "https://${var.domain}" : "https://${terraform.workspace}.${var.domain}"]
     }
   ]
 }
@@ -110,7 +110,7 @@ module "statistical-reports-store" {
   cors_rules = [
     {
       allowed_methods = ["GET"]
-      allowed_origins = [local.base_url]
+      allowed_origins = [contains(["prod"], terraform.workspace) ? "https://${var.domain}" : "https://${terraform.workspace}.${var.domain}"]
     }
   ]
 }
@@ -132,13 +132,13 @@ module "ndr-bulk-staging-store" {
     {
       allowed_headers = ["*"]
       allowed_methods = ["POST", "PUT", "DELETE"]
-      allowed_origins = [local.base_url]
+      allowed_origins = [contains(["prod"], terraform.workspace) ? "https://${var.domain}" : "https://${terraform.workspace}.${var.domain}"]
       expose_headers  = ["ETag"]
       max_age_seconds = 3000
     },
     {
       allowed_methods = ["GET"]
-      allowed_origins = [local.base_url]
+      allowed_origins = [contains(["prod"], terraform.workspace) ? "https://${var.domain}" : "https://${terraform.workspace}.${var.domain}"]
     }
   ]
 }
@@ -175,7 +175,7 @@ module "ndr-document-pending-review-store" {
   cors_rules = [
     {
       allowed_methods = ["GET"]
-      allowed_origins = [local.base_url]
+      allowed_origins = [contains(["prod"], terraform.workspace) ? "https://${var.domain}" : "https://${terraform.workspace}.${var.domain}"]
     }
   ]
 }
diff --git a/infrastructure/gateway-document-reference.tf b/infrastructure/gateway-document-reference.tf
@@ -19,7 +19,7 @@ module "document_reference_gateway" {
   gateway_path        = "DocumentReference"
   authorizer_id       = aws_api_gateway_authorizer.repo_authoriser.id
   require_credentials = true
-  origin              = local.base_url_with_quotes
+  origin              = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
 }
 
 module "document_reference_id_gateway" {
@@ -31,7 +31,7 @@ module "document_reference_id_gateway" {
   gateway_path        = "{id}"
   authorizer_id       = aws_api_gateway_authorizer.repo_authoriser.id
   require_credentials = true
-  origin              = local.base_url_with_quotes
+  origin              = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
 
   request_parameters = {
     "method.request.path.id" = true
diff --git a/infrastructure/gateway-review-document.tf b/infrastructure/gateway-review-document.tf
@@ -7,7 +7,7 @@ module "review_document_gateway" {
   gateway_path        = "DocumentReview"
   authorizer_id       = aws_api_gateway_authorizer.repo_authoriser.id
   require_credentials = true
-  origin              = local.base_url_with_quotes
+  origin              = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
 }
 
 resource "aws_api_gateway_resource" "review_document_id" {
@@ -25,7 +25,7 @@ module "review_document_version_gateway" {
   gateway_path        = "{version}"
   authorizer_id       = aws_api_gateway_authorizer.repo_authoriser.id
   require_credentials = true
-  origin              = local.base_url_with_quotes
+  origin              = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
 
   request_parameters = {
     "method.request.path.id"      = true
@@ -42,5 +42,5 @@ module "review_document_status_gateway" {
   require_credentials = true
   authorization       = "CUSTOM"
   authorizer_id       = aws_api_gateway_authorizer.repo_authoriser.id
-  origin              = local.base_url_with_quotes
+  origin              = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
 }
diff --git a/infrastructure/lambda-access-audit.tf b/infrastructure/lambda-access-audit.tf
@@ -7,7 +7,7 @@ module "access-audit-gateway" {
   gateway_path        = "AccessAudit"
   authorizer_id       = aws_api_gateway_authorizer.repo_authoriser.id
   require_credentials = true
-  origin              = local.base_url_with_quotes
+  origin              = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
 }
 
 module "access-audit-alarm" {
diff --git a/infrastructure/lambda-back-channel-logout.tf b/infrastructure/lambda-back-channel-logout.tf
@@ -6,7 +6,7 @@ module "back-channel-logout-gateway" {
   authorization       = "NONE"
   gateway_path        = "BackChannelLogout"
   require_credentials = false
-  origin              = local.base_url_with_quotes
+  origin              = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
 }
 
 module "back_channel_logout_lambda" {
@@ -32,7 +32,7 @@ module "back_channel_logout_lambda" {
     ENVIRONMENT                    = var.environment
     AUTH_DYNAMODB_NAME             = "${terraform.workspace}_${var.auth_session_dynamodb_table_name}"
     SSM_PARAM_JWT_TOKEN_PUBLIC_KEY = "jwt_token_public_key"
-    OIDC_CALLBACK_URL              = local.oidc_callback_url
+    OIDC_CALLBACK_URL              = contains(["prod"], terraform.workspace) ? "https://${var.domain}/auth-callback" : "https://${terraform.workspace}.${var.domain}/auth-callback"
   }
   depends_on = [
     aws_api_gateway_rest_api.ndr_doc_store_api,
diff --git a/infrastructure/lambda-delete-doc-ref.tf b/infrastructure/lambda-delete-doc-ref.tf
@@ -7,7 +7,7 @@ module "delete-doc-ref-gateway" {
   gateway_path        = "DocumentDelete"
   authorizer_id       = aws_api_gateway_authorizer.repo_authoriser.id
   require_credentials = true
-  origin              = local.base_url_with_quotes
+  origin              = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
 }
 
 module "delete_doc_alarm" {
diff --git a/infrastructure/lambda-document-manifest-job.tf b/infrastructure/lambda-document-manifest-job.tf
@@ -7,7 +7,7 @@ module "document-manifest-job-gateway" {
   gateway_path        = "DocumentManifest"
   authorizer_id       = aws_api_gateway_authorizer.repo_authoriser.id
   require_credentials = true
-  origin              = local.base_url_with_quotes
+  origin              = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
 }
 
 module "document_manifest_alarm" {
diff --git a/infrastructure/lambda-document-status-check-result.tf b/infrastructure/lambda-document-status-check-result.tf
@@ -7,7 +7,7 @@ module "document-status-check-gateway" {
   gateway_path        = "DocumentStatus"
   authorizer_id       = aws_api_gateway_authorizer.repo_authoriser.id
   require_credentials = true
-  origin              = local.base_url_with_quotes
+  origin              = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
 }
 
 module "document-status-check-alarm" {
diff --git a/infrastructure/lambda-feature-flags.tf b/infrastructure/lambda-feature-flags.tf
@@ -7,7 +7,7 @@ module "feature-flags-gateway" {
   gateway_path        = "FeatureFlags"
   authorizer_id       = aws_api_gateway_authorizer.repo_authoriser.id
   require_credentials = true
-  origin              = local.base_url_with_quotes
+  origin              = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
 }
 
 module "feature_flags_alarm" {
diff --git a/infrastructure/lambda-get-document-fhir.tf b/infrastructure/lambda-get-document-fhir.tf
@@ -45,7 +45,7 @@ module "get-doc-fhir-lambda" {
     WORKSPACE               = terraform.workspace
     ENVIRONMENT             = var.environment
     PRESIGNED_ASSUME_ROLE   = aws_iam_role.get_fhir_doc_presign_url_role.arn
-    OIDC_CALLBACK_URL       = local.oidc_callback_url
+    OIDC_CALLBACK_URL       = contains(["prod"], terraform.workspace) ? "https://${var.domain}/auth-callback" : "https://${terraform.workspace}.${var.domain}/auth-callback"
     CLOUDFRONT_URL          = one(aws_cloudfront_distribution.s3_presign_mask.aliases)
     PDS_FHIR_IS_STUBBED     = local.is_sandbox
   }
diff --git a/infrastructure/lambda-get-report-by-ods.tf b/infrastructure/lambda-get-report-by-ods.tf
@@ -7,7 +7,7 @@ module "get-report-by-ods-gateway" {
   gateway_path        = "OdsReport"
   authorizer_id       = aws_api_gateway_authorizer.repo_authoriser.id
   require_credentials = true
-  origin              = local.base_url_with_quotes
+  origin              = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
 }
 
 module "get-report-by-ods-alarm" {
diff --git a/infrastructure/lambda-lloyd-george-record-stitch.tf b/infrastructure/lambda-lloyd-george-record-stitch.tf
@@ -7,7 +7,7 @@ module "lloyd-george-stitch-gateway" {
   gateway_path        = "LloydGeorgeStitch"
   authorizer_id       = aws_api_gateway_authorizer.repo_authoriser.id
   require_credentials = true
-  origin              = local.base_url_with_quotes
+  origin              = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
 }
 
 module "lloyd-george-stitch_alarm" {
diff --git a/infrastructure/lambda-login-redirect.tf b/infrastructure/lambda-login-redirect.tf
@@ -35,7 +35,7 @@ module "login_redirect_lambda" {
     APPCONFIG_ENVIRONMENT   = module.ndr-app-config.app_config_environment_id
     APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
     WORKSPACE               = terraform.workspace
-    OIDC_CALLBACK_URL       = local.oidc_callback_url
+    OIDC_CALLBACK_URL       = contains(["prod"], terraform.workspace) ? "https://${var.domain}/auth-callback" : "https://${terraform.workspace}.${var.domain}/auth-callback"
     AUTH_DYNAMODB_NAME      = "${terraform.workspace}_${var.auth_state_dynamodb_table_name}"
   }
   depends_on = [
diff --git a/infrastructure/lambda-logout.tf b/infrastructure/lambda-logout.tf
@@ -6,7 +6,7 @@ module "logout-gateway" {
   authorization       = "NONE"
   gateway_path        = "Logout"
   require_credentials = false
-  origin              = local.base_url_with_quotes
+  origin              = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
 }
 
 module "logout_lambda" {
diff --git a/infrastructure/lambda-search-doc-references.tf b/infrastructure/lambda-search-doc-references.tf
@@ -7,7 +7,7 @@ module "search-document-references-gateway" {
   gateway_path        = "SearchDocumentReferences"
   authorizer_id       = aws_api_gateway_authorizer.repo_authoriser.id
   require_credentials = true
-  origin              = local.base_url_with_quotes
+  origin              = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
 }
 
 module "search_doc_alarm" {
diff --git a/infrastructure/lambda-search-patient.tf b/infrastructure/lambda-search-patient.tf
@@ -7,7 +7,7 @@ module "search-patient-details-gateway" {
   gateway_path        = "SearchPatient"
   authorizer_id       = aws_api_gateway_authorizer.repo_authoriser.id
   require_credentials = true
-  origin              = local.base_url_with_quotes
+  origin              = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
 }
 
 module "search_patient_alarm" {
diff --git a/infrastructure/lambda-send-feedback.tf b/infrastructure/lambda-send-feedback.tf
@@ -30,7 +30,7 @@ module "send-feedback-gateway" {
   gateway_path        = "Feedback"
   authorizer_id       = aws_api_gateway_authorizer.repo_authoriser.id
   require_credentials = true
-  origin              = local.base_url_with_quotes
+  origin              = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
 }
 
 module "send-feedback-alarm" {
diff --git a/infrastructure/lambda-token.tf b/infrastructure/lambda-token.tf
@@ -6,7 +6,7 @@ module "create-token-gateway" {
   authorization       = "NONE"
   gateway_path        = "TokenRequest"
   require_credentials = false
-  origin              = local.base_url_with_quotes
+  origin              = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
 }
 
 module "create-token-lambda" {
@@ -33,7 +33,7 @@ module "create-token-lambda" {
     WORKSPACE                       = terraform.workspace
     SSM_PARAM_JWT_TOKEN_PRIVATE_KEY = "jwt_token_private_key"
 
-    OIDC_CALLBACK_URL       = local.oidc_callback_url
+    OIDC_CALLBACK_URL       = contains(["prod"], terraform.workspace) ? "https://${var.domain}/auth-callback" : "https://${terraform.workspace}.${var.domain}/auth-callback"
     AUTH_STATE_TABLE_NAME   = "${terraform.workspace}_${var.auth_state_dynamodb_table_name}"
     AUTH_SESSION_TABLE_NAME = "${terraform.workspace}_${var.auth_session_dynamodb_table_name}"
     ENVIRONMENT             = var.environment
diff --git a/infrastructure/lambda-update-upload-state.tf b/infrastructure/lambda-update-upload-state.tf
@@ -7,7 +7,7 @@ module "update-upload-state-gateway" {
   gateway_path        = "UploadState"
   authorizer_id       = aws_api_gateway_authorizer.repo_authoriser.id
   require_credentials = true
-  origin              = local.base_url_with_quotes
+  origin              = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
 }
 
 module "update_upload_state_alarm" {
diff --git a/infrastructure/lambda-virus-scan-result.tf b/infrastructure/lambda-virus-scan-result.tf
@@ -7,7 +7,7 @@ module "virus_scan_result_gateway" {
   gateway_path        = "VirusScan"
   authorizer_id       = aws_api_gateway_authorizer.repo_authoriser.id
   require_credentials = true
-  origin              = local.base_url_with_quotes
+  origin              = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
 }
 
 module "virus_scan_result_alarm" {
diff --git a/infrastructure/modules/ecs/output.tf b/infrastructure/modules/ecs/output.tf
@@ -2,10 +2,6 @@ output "dns_name" {
   value = var.is_lb_needed ? aws_lb.ecs_lb[0].dns_name : null
 }
 
-output "dns_zone_id" {
-  value = var.is_lb_needed ? aws_lb.ecs_lb[0].zone_id : null
-}
-
 output "security_group_id" {
   value = aws_security_group.ndr_ecs_sg.id
 }
@@ -31,4 +27,4 @@ output "ecs_cluster_arn" {
 
 output "task_definition_arn" {
   value = aws_ecs_task_definition.ndr_ecs_task.arn_without_revision
-}
+}
diff --git a/infrastructure/modules/route53/main.tf b/infrastructure/modules/route53/main.tf
@@ -11,28 +11,14 @@ data "aws_route53_zone" "ndr_zone" {
   count = var.using_arf_hosted_zone ? 1 : 0
 }
 
-resource "aws_route53_record" "ndr_fargate_record_cname" {
-  count   = terraform.workspace == "ndr-test" ? 0 : 1
+resource "aws_route53_record" "ndr_fargate_record" {
   name    = terraform.workspace
   type    = "CNAME"
   records = [var.dns_name]
   zone_id = local.zone_id
   ttl     = 300
 }
 
-resource "aws_route53_record" "ndr_test_fargate_record_alias" {
-  count   = terraform.workspace == "ndr-test" ? 1 : 0
-  name    = ""
-  type    = "A"
-  zone_id = local.zone_id
-
-  alias {
-    name                   = var.dns_name
-    zone_id                = var.dns_zone_id
-    evaluate_target_health = true
-  }
-}
-
 resource "aws_route53_record" "ndr_gateway_api_record" {
   name    = var.api_gateway_subdomain_name
   type    = "A"
@@ -43,4 +29,4 @@ resource "aws_route53_record" "ndr_gateway_api_record" {
     zone_id                = var.api_gateway_zone_id
     evaluate_target_health = true
   }
-}
+}
diff --git a/infrastructure/modules/route53/variable.tf b/infrastructure/modules/route53/variable.tf
@@ -3,12 +3,6 @@ variable "dns_name" {
   type        = string
 }
 
-variable "dns_zone_id" {
-  description = "The Route53 zone ID of the load balancer."
-  type        = string
-  default     = ""
-}
-
 variable "domain" {
   description = "The root domain name used to find or create the Route53 hosted zone."
   type        = string
diff --git a/infrastructure/moved-resources-v1.6.11.tf b/infrastructure/moved-resources-v1.6.11.tf
diff --git a/infrastructure/moved-resources-v1.6.14.tf b/infrastructure/moved-resources-v1.6.14.tf
diff --git a/infrastructure/route53.tf b/infrastructure/route53.tf
diff --git a/infrastructure/ses.tf b/infrastructure/ses.tf
diff --git a/infrastructure/test.tfvars b/infrastructure/test.tfvars
diff --git a/infrastructure/variable.tf b/infrastructure/variable.tf

Original file line number	Diff line number	Diff line change
`@@ -18,13 +18,13 @@ module "ndr-document-store" {`
`18`	`18`	`{`
`19`	`19`	`allowed_headers = ["*"]`
`20`	`20`	`allowed_methods = ["POST", "PUT", "DELETE"]`
`21`		`- allowed_origins = [local.base_url]`
	`21`	`+ allowed_origins = [contains(["prod"], terraform.workspace) ? "https://${var.domain}" : "https://${terraform.workspace}.${var.domain}"]`
`22`	`22`	`expose_headers = ["ETag"]`
`23`	`23`	`max_age_seconds = 3000`
`24`	`24`	`},`
`25`	`25`	`{`
`26`	`26`	`allowed_methods = ["GET"]`
`27`		`- allowed_origins = [local.base_url]`
	`27`	`+ allowed_origins = [contains(["prod"], terraform.workspace) ? "https://${var.domain}" : "https://${terraform.workspace}.${var.domain}"]`
`28`	`28`	`}`
`29`	`29`	`]`
`30`	`30`	`}`
`@@ -41,7 +41,7 @@ module "ndr-zip-request-store" {`
`41`	`41`	`cors_rules = [`
`42`	`42`	`{`
`43`	`43`	`allowed_methods = ["GET"]`
`44`		`- allowed_origins = [local.base_url]`
	`44`	`+ allowed_origins = [contains(["prod"], terraform.workspace) ? "https://${var.domain}" : "https://${terraform.workspace}.${var.domain}"]`
`45`	`45`	`}`
`46`	`46`	`]`
`47`	`47`	`}`
`@@ -62,13 +62,13 @@ module "ndr-lloyd-george-store" {`
`62`	`62`	`{`
`63`	`63`	`allowed_headers = ["*"]`
`64`	`64`	`allowed_methods = ["POST", "PUT", "DELETE"]`
`65`		`- allowed_origins = [local.base_url]`
	`65`	`+ allowed_origins = [contains(["prod"], terraform.workspace) ? "https://${var.domain}" : "https://${terraform.workspace}.${var.domain}"]`
`66`	`66`	`expose_headers = ["ETag"]`
`67`	`67`	`max_age_seconds = 3000`
`68`	`68`	`},`
`69`	`69`	`{`
`70`	`70`	`allowed_methods = ["GET"]`
`71`		`- allowed_origins = [local.base_url]`
	`71`	`+ allowed_origins = [contains(["prod"], terraform.workspace) ? "https://${var.domain}" : "https://${terraform.workspace}.${var.domain}"]`
`72`	`72`	`}`
`73`	`73`	`]`
`74`	`74`	`}`
`@@ -110,7 +110,7 @@ module "statistical-reports-store" {`
`110`	`110`	`cors_rules = [`
`111`	`111`	`{`
`112`	`112`	`allowed_methods = ["GET"]`
`113`		`- allowed_origins = [local.base_url]`
	`113`	`+ allowed_origins = [contains(["prod"], terraform.workspace) ? "https://${var.domain}" : "https://${terraform.workspace}.${var.domain}"]`
`114`	`114`	`}`
`115`	`115`	`]`
`116`	`116`	`}`
`@@ -132,13 +132,13 @@ module "ndr-bulk-staging-store" {`
`132`	`132`	`{`
`133`	`133`	`allowed_headers = ["*"]`
`134`	`134`	`allowed_methods = ["POST", "PUT", "DELETE"]`
`135`		`- allowed_origins = [local.base_url]`
	`135`	`+ allowed_origins = [contains(["prod"], terraform.workspace) ? "https://${var.domain}" : "https://${terraform.workspace}.${var.domain}"]`
`136`	`136`	`expose_headers = ["ETag"]`
`137`	`137`	`max_age_seconds = 3000`
`138`	`138`	`},`
`139`	`139`	`{`
`140`	`140`	`allowed_methods = ["GET"]`
`141`		`- allowed_origins = [local.base_url]`
	`141`	`+ allowed_origins = [contains(["prod"], terraform.workspace) ? "https://${var.domain}" : "https://${terraform.workspace}.${var.domain}"]`
`142`	`142`	`}`
`143`	`143`	`]`
`144`	`144`	`}`
`@@ -175,7 +175,7 @@ module "ndr-document-pending-review-store" {`
`175`	`175`	`cors_rules = [`
`176`	`176`	`{`
`177`	`177`	`allowed_methods = ["GET"]`
`178`		`- allowed_origins = [local.base_url]`
	`178`	`+ allowed_origins = [contains(["prod"], terraform.workspace) ? "https://${var.domain}" : "https://${terraform.workspace}.${var.domain}"]`
`179`	`179`	`}`
`180`	`180`	`]`
`181`	`181`	`}`
Original file line number	Diff line number	Diff line change
`@@ -7,7 +7,7 @@ module "access-audit-gateway" {`
`7`	`7`	`gateway_path = "AccessAudit"`
`8`	`8`	`authorizer_id = aws_api_gateway_authorizer.repo_authoriser.id`
`9`	`9`	`require_credentials = true`
`10`		`- origin = local.base_url_with_quotes`
	`10`	`+ origin = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"`
`11`	`11`	`}`
`12`	`12`
`13`	`13`	`module "access-audit-alarm" {`
Original file line number	Diff line number	Diff line change
`@@ -7,7 +7,7 @@ module "delete-doc-ref-gateway" {`
`7`	`7`	`gateway_path = "DocumentDelete"`
`8`	`8`	`authorizer_id = aws_api_gateway_authorizer.repo_authoriser.id`
`9`	`9`	`require_credentials = true`
`10`		`- origin = local.base_url_with_quotes`
	`10`	`+ origin = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"`
`11`	`11`	`}`
`12`	`12`
`13`	`13`	`module "delete_doc_alarm" {`
Original file line number	Diff line number	Diff line change
`@@ -7,7 +7,7 @@ module "document-manifest-job-gateway" {`
`7`	`7`	`gateway_path = "DocumentManifest"`
`8`	`8`	`authorizer_id = aws_api_gateway_authorizer.repo_authoriser.id`
`9`	`9`	`require_credentials = true`
`10`		`- origin = local.base_url_with_quotes`
	`10`	`+ origin = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"`
`11`	`11`	`}`
`12`	`12`
`13`	`13`	`module "document_manifest_alarm" {`
Original file line number	Diff line number	Diff line change
`@@ -7,7 +7,7 @@ module "document-status-check-gateway" {`
`7`	`7`	`gateway_path = "DocumentStatus"`
`8`	`8`	`authorizer_id = aws_api_gateway_authorizer.repo_authoriser.id`
`9`	`9`	`require_credentials = true`
`10`		`- origin = local.base_url_with_quotes`
	`10`	`+ origin = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"`
`11`	`11`	`}`
`12`	`12`
`13`	`13`	`module "document-status-check-alarm" {`