From 710f8c3a05556b89af9f60ef0316501f254fada4 Mon Sep 17 00:00:00 2001
From: KarlMoores <292835949+karlmcgi@users.noreply.github.com>
Date: Fri, 21 Aug 2026 14:20:34 +0100
Subject: [PATCH 1/2] CCM-23022: Switching sts session arn to IAM role arn in
 KMS key policy as sessions with wildcards are unsupported

---
 infrastructure/terraform/modules/aws-backup-source/kms.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/infrastructure/terraform/modules/aws-backup-source/kms.tf b/infrastructure/terraform/modules/aws-backup-source/kms.tf
index dd5a5bf..fbc96ea 100644
--- a/infrastructure/terraform/modules/aws-backup-source/kms.tf
+++ b/infrastructure/terraform/modules/aws-backup-source/kms.tf
@@ -26,7 +26,7 @@ data "aws_iam_policy_document" "backup_key_policy" {
     sid = "EnableIAMUserPermissions"
     principals {
       type        = "AWS"
-      identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root", "arn:aws:sts::${data.aws_caller_identity.current.account_id}:assumed-role/GitHub_Deploy/*"]
+      identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root", "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/service-role/GitHub_Deploy"]
     }
     actions   = ["kms:*"]
     resources = ["*"]

From 7e40ca24a5653145fa1e1e5b69b5928f509289fa Mon Sep 17 00:00:00 2001
From: KarlMoores <292835949+karlmcgi@users.noreply.github.com>
Date: Tue, 25 Aug 2026 15:50:32 +0100
Subject: [PATCH 2/2] CCM-23022: Updating reference to up to date s3bucket
 child modules from parent modules to introduce event notifications if backup
 tag present

---
 .../apim-authentication/module_s3_bucket_static_assets.tf       | 2 +-
 .../terraform/modules/eventpub/module_s3bucket_event_cache.tf   | 2 +-
 .../terraform/modules/eventsub/module_s3bucket_event_cache.tf   | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/infrastructure/terraform/modules/apim-authentication/module_s3_bucket_static_assets.tf b/infrastructure/terraform/modules/apim-authentication/module_s3_bucket_static_assets.tf
index 349246f..7e9a44c 100644
--- a/infrastructure/terraform/modules/apim-authentication/module_s3_bucket_static_assets.tf
+++ b/infrastructure/terraform/modules/apim-authentication/module_s3_bucket_static_assets.tf
@@ -1,5 +1,5 @@
 module "s3bucket_static_assets" {
-  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/5.0.7/terraform-s3bucket.zip"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/5.1.1/terraform-s3bucket.zip"
 
   name = "static-assets"
 
diff --git a/infrastructure/terraform/modules/eventpub/module_s3bucket_event_cache.tf b/infrastructure/terraform/modules/eventpub/module_s3bucket_event_cache.tf
index 88758a7..bf072af 100644
--- a/infrastructure/terraform/modules/eventpub/module_s3bucket_event_cache.tf
+++ b/infrastructure/terraform/modules/eventpub/module_s3bucket_event_cache.tf
@@ -1,5 +1,5 @@
 module "s3bucket_event_cache" {
-  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/4.0.5/terraform-s3bucket.zip"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/5.1.1/terraform-s3bucket.zip"
 
   count = var.enable_event_cache ? 1 : 0
 
diff --git a/infrastructure/terraform/modules/eventsub/module_s3bucket_event_cache.tf b/infrastructure/terraform/modules/eventsub/module_s3bucket_event_cache.tf
index 6ad0b92..42d6f49 100644
--- a/infrastructure/terraform/modules/eventsub/module_s3bucket_event_cache.tf
+++ b/infrastructure/terraform/modules/eventsub/module_s3bucket_event_cache.tf
@@ -1,5 +1,5 @@
 module "s3bucket_event_cache" {
-  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/3.1.2/terraform-s3bucket.zip"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/5.1.1/terraform-s3bucket.zip"
 
   count = var.enable_event_cache ? 1 : 0