From 5804e20eb4cf88424dd2b141ab7eee06ba2cf309 Mon Sep 17 00:00:00 2001
From: sidnhs <siddharth.nair1@nhs.net>
Date: Tue, 25 Aug 2026 15:06:00 +0100
Subject: [PATCH 1/9] CCM-22816: Additional Lambda Role Trust

---
 ...data_iam_policy_document_lambda_assumerole.tf | 16 ++++++++++++++++
 .../terraform/modules/lambda/variables.tf        | 11 +++++++++++
 2 files changed, 27 insertions(+)

diff --git a/infrastructure/terraform/modules/lambda/data_iam_policy_document_lambda_assumerole.tf b/infrastructure/terraform/modules/lambda/data_iam_policy_document_lambda_assumerole.tf
index bea133b2..f33d46d3 100644
--- a/infrastructure/terraform/modules/lambda/data_iam_policy_document_lambda_assumerole.tf
+++ b/infrastructure/terraform/modules/lambda/data_iam_policy_document_lambda_assumerole.tf
@@ -16,4 +16,20 @@ data "aws_iam_policy_document" "lambda_assumerole" {
       "sts:AssumeRole",
     ]
   }
+
+  dynamic "statement" {
+    for_each = var.additional_assume_role_policy_statements
+
+    content {
+      sid    = statement.value.sid
+      effect = statement.value.effect
+
+      principals {
+        type        = statement.value.principal_type
+        identifiers = statement.value.principal_identifiers
+      }
+
+      actions = statement.value.actions
+    }
+  }
 }
diff --git a/infrastructure/terraform/modules/lambda/variables.tf b/infrastructure/terraform/modules/lambda/variables.tf
index a39fe109..d15ebb66 100644
--- a/infrastructure/terraform/modules/lambda/variables.tf
+++ b/infrastructure/terraform/modules/lambda/variables.tf
@@ -400,3 +400,14 @@ variable "reserved_concurrent_executions" {
   description = "The reserved concurrency for the Lambda function. Set to -1 to remove the concurrency limit, or 0 to prevent the Lambda from being invoked."
   default     = -1
 }
+
+variable "additional_assume_role_policy_statements" {
+  type        = list(object({
+    sid       = string
+    effect    = string
+    actions   = list(string)
+    resources = list(string)
+  }))
+  description = "Additional IAM policy statements to attach to the Lambda execution role"
+  default     = []
+}

From 7086747dfcb78fc7975e94a702aeb53f8dfb5f50 Mon Sep 17 00:00:00 2001
From: sidnhs <siddharth.nair1@nhs.net>
Date: Tue, 25 Aug 2026 15:06:17 +0100
Subject: [PATCH 2/9] CCM-22816: Additional Lambda Role Trust

---
 infrastructure/terraform/modules/lambda/variables.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/infrastructure/terraform/modules/lambda/variables.tf b/infrastructure/terraform/modules/lambda/variables.tf
index d15ebb66..ce03b921 100644
--- a/infrastructure/terraform/modules/lambda/variables.tf
+++ b/infrastructure/terraform/modules/lambda/variables.tf
@@ -402,7 +402,7 @@ variable "reserved_concurrent_executions" {
 }
 
 variable "additional_assume_role_policy_statements" {
-  type        = list(object({
+  type = list(object({
     sid       = string
     effect    = string
     actions   = list(string)

From bf9b20aa542b8ba438f1d2dc94c2253d429c9018 Mon Sep 17 00:00:00 2001
From: sidnhs <siddharth.nair1@nhs.net>
Date: Tue, 25 Aug 2026 15:46:03 +0100
Subject: [PATCH 3/9] CCM-22816: Additional Lambda Role Trust

---
 .../lambda/data_iam_policy_document_lambda_assumerole.tf  | 8 +++++---
 infrastructure/terraform/modules/lambda/variables.tf      | 6 ++++--
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/infrastructure/terraform/modules/lambda/data_iam_policy_document_lambda_assumerole.tf b/infrastructure/terraform/modules/lambda/data_iam_policy_document_lambda_assumerole.tf
index f33d46d3..41ddcb4c 100644
--- a/infrastructure/terraform/modules/lambda/data_iam_policy_document_lambda_assumerole.tf
+++ b/infrastructure/terraform/modules/lambda/data_iam_policy_document_lambda_assumerole.tf
@@ -25,11 +25,13 @@ data "aws_iam_policy_document" "lambda_assumerole" {
       effect = statement.value.effect
 
       principals {
-        type        = statement.value.principal_type
-        identifiers = statement.value.principal_identifiers
+        type        = statement.value.principal.type
+        identifiers = statement.value.principal.identifiers
       }
 
-      actions = statement.value.actions
+      actions = [
+        "sts:AssumeRole",
+      ]
     }
   }
 }
diff --git a/infrastructure/terraform/modules/lambda/variables.tf b/infrastructure/terraform/modules/lambda/variables.tf
index ce03b921..5f0c0390 100644
--- a/infrastructure/terraform/modules/lambda/variables.tf
+++ b/infrastructure/terraform/modules/lambda/variables.tf
@@ -405,8 +405,10 @@ variable "additional_assume_role_policy_statements" {
   type = list(object({
     sid       = string
     effect    = string
-    actions   = list(string)
-    resources = list(string)
+    principal = object({
+      type        = string
+      identifiers = list(string)
+    })
   }))
   description = "Additional IAM policy statements to attach to the Lambda execution role"
   default     = []

From 8cee254d1b402bc7ba60e64ed2899f9340405171 Mon Sep 17 00:00:00 2001
From: sidnhs <siddharth.nair1@nhs.net>
Date: Tue, 25 Aug 2026 15:46:11 +0100
Subject: [PATCH 4/9] CCM-22816: Additional Lambda Role Trust

---
 infrastructure/terraform/modules/lambda/variables.tf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/infrastructure/terraform/modules/lambda/variables.tf b/infrastructure/terraform/modules/lambda/variables.tf
index 5f0c0390..593478fd 100644
--- a/infrastructure/terraform/modules/lambda/variables.tf
+++ b/infrastructure/terraform/modules/lambda/variables.tf
@@ -403,8 +403,8 @@ variable "reserved_concurrent_executions" {
 
 variable "additional_assume_role_policy_statements" {
   type = list(object({
-    sid       = string
-    effect    = string
+    sid    = string
+    effect = string
     principal = object({
       type        = string
       identifiers = list(string)

From 23c50d14afbcbb34360ecbc3bc8857817635b94b Mon Sep 17 00:00:00 2001
From: sidnhs <siddharth.nair1@nhs.net>
Date: Tue, 25 Aug 2026 17:00:41 +0100
Subject: [PATCH 5/9] CCM-22816: Additional Lambda Role Trust

---
 infrastructure/terraform/modules/lambda/variables.tf | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/infrastructure/terraform/modules/lambda/variables.tf b/infrastructure/terraform/modules/lambda/variables.tf
index 593478fd..ec48842c 100644
--- a/infrastructure/terraform/modules/lambda/variables.tf
+++ b/infrastructure/terraform/modules/lambda/variables.tf
@@ -409,6 +409,11 @@ variable "additional_assume_role_policy_statements" {
       type        = string
       identifiers = list(string)
     })
+    condition = optional(object({
+      test     = string
+      variable = string
+      values   = list(string)
+    }))
   }))
   description = "Additional IAM policy statements to attach to the Lambda execution role"
   default     = []

From 300a94ef786dfb05b421c21c7a244caba09580b3 Mon Sep 17 00:00:00 2001
From: sidnhs <siddharth.nair1@nhs.net>
Date: Tue, 25 Aug 2026 17:06:30 +0100
Subject: [PATCH 6/9] CCM-22816: Additional Lambda Role Trust

---
 .../lambda/data_iam_policy_document_lambda_assumerole.tf | 9 +++++++++
 infrastructure/terraform/modules/lambda/variables.tf     | 4 ++--
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/infrastructure/terraform/modules/lambda/data_iam_policy_document_lambda_assumerole.tf b/infrastructure/terraform/modules/lambda/data_iam_policy_document_lambda_assumerole.tf
index 41ddcb4c..8f6bc98c 100644
--- a/infrastructure/terraform/modules/lambda/data_iam_policy_document_lambda_assumerole.tf
+++ b/infrastructure/terraform/modules/lambda/data_iam_policy_document_lambda_assumerole.tf
@@ -32,6 +32,15 @@ data "aws_iam_policy_document" "lambda_assumerole" {
       actions = [
         "sts:AssumeRole",
       ]
+      dynamic "condition" {
+        for_each = statement.value.condition != null ? statement.value.condition : []
+
+        content {
+          test     = condition.value.test
+          variable = condition.value.variable
+          values   = condition.value.values
+        }
+      }
     }
   }
 }
diff --git a/infrastructure/terraform/modules/lambda/variables.tf b/infrastructure/terraform/modules/lambda/variables.tf
index ec48842c..cb09d025 100644
--- a/infrastructure/terraform/modules/lambda/variables.tf
+++ b/infrastructure/terraform/modules/lambda/variables.tf
@@ -409,11 +409,11 @@ variable "additional_assume_role_policy_statements" {
       type        = string
       identifiers = list(string)
     })
-    condition = optional(object({
+    condition = optional(list(object({
       test     = string
       variable = string
       values   = list(string)
-    }))
+    })))
   }))
   description = "Additional IAM policy statements to attach to the Lambda execution role"
   default     = []

From da5d29cae83db3b821ca390094aa7f068a6b0cb4 Mon Sep 17 00:00:00 2001
From: sidnhs <siddharth.nair1@nhs.net>
Date: Tue, 25 Aug 2026 17:08:06 +0100
Subject: [PATCH 7/9] CCM-22816: Additional Lambda Role Trust

---
 .../lambda/data_iam_policy_document_lambda_assumerole.tf      | 2 +-
 infrastructure/terraform/modules/lambda/variables.tf          | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/infrastructure/terraform/modules/lambda/data_iam_policy_document_lambda_assumerole.tf b/infrastructure/terraform/modules/lambda/data_iam_policy_document_lambda_assumerole.tf
index 8f6bc98c..f5345566 100644
--- a/infrastructure/terraform/modules/lambda/data_iam_policy_document_lambda_assumerole.tf
+++ b/infrastructure/terraform/modules/lambda/data_iam_policy_document_lambda_assumerole.tf
@@ -33,7 +33,7 @@ data "aws_iam_policy_document" "lambda_assumerole" {
         "sts:AssumeRole",
       ]
       dynamic "condition" {
-        for_each = statement.value.condition != null ? statement.value.condition : []
+        for_each = statement.value.condition != null ? statement.value.condition : {}
 
         content {
           test     = condition.value.test
diff --git a/infrastructure/terraform/modules/lambda/variables.tf b/infrastructure/terraform/modules/lambda/variables.tf
index cb09d025..ec48842c 100644
--- a/infrastructure/terraform/modules/lambda/variables.tf
+++ b/infrastructure/terraform/modules/lambda/variables.tf
@@ -409,11 +409,11 @@ variable "additional_assume_role_policy_statements" {
       type        = string
       identifiers = list(string)
     })
-    condition = optional(list(object({
+    condition = optional(object({
       test     = string
       variable = string
       values   = list(string)
-    })))
+    }))
   }))
   description = "Additional IAM policy statements to attach to the Lambda execution role"
   default     = []

From 1344558851c944c29a15057ae40c6d99f942b6ea Mon Sep 17 00:00:00 2001
From: sidnhs <siddharth.nair1@nhs.net>
Date: Tue, 25 Aug 2026 17:10:56 +0100
Subject: [PATCH 8/9] CCM-22816: Additional Lambda Role Trust

---
 .../lambda/data_iam_policy_document_lambda_assumerole.tf      | 2 +-
 infrastructure/terraform/modules/lambda/variables.tf          | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/infrastructure/terraform/modules/lambda/data_iam_policy_document_lambda_assumerole.tf b/infrastructure/terraform/modules/lambda/data_iam_policy_document_lambda_assumerole.tf
index f5345566..99c9c039 100644
--- a/infrastructure/terraform/modules/lambda/data_iam_policy_document_lambda_assumerole.tf
+++ b/infrastructure/terraform/modules/lambda/data_iam_policy_document_lambda_assumerole.tf
@@ -33,7 +33,7 @@ data "aws_iam_policy_document" "lambda_assumerole" {
         "sts:AssumeRole",
       ]
       dynamic "condition" {
-        for_each = statement.value.condition != null ? statement.value.condition : {}
+        for_each = statement.value.condition
 
         content {
           test     = condition.value.test
diff --git a/infrastructure/terraform/modules/lambda/variables.tf b/infrastructure/terraform/modules/lambda/variables.tf
index ec48842c..cb09d025 100644
--- a/infrastructure/terraform/modules/lambda/variables.tf
+++ b/infrastructure/terraform/modules/lambda/variables.tf
@@ -409,11 +409,11 @@ variable "additional_assume_role_policy_statements" {
       type        = string
       identifiers = list(string)
     })
-    condition = optional(object({
+    condition = optional(list(object({
       test     = string
       variable = string
       values   = list(string)
-    }))
+    })))
   }))
   description = "Additional IAM policy statements to attach to the Lambda execution role"
   default     = []

From a506ea4bad6107181e43b1ea7f37188171aa5acb Mon Sep 17 00:00:00 2001
From: sidnhs <siddharth.nair1@nhs.net>
Date: Thu, 27 Aug 2026 15:02:42 +0100
Subject: [PATCH 9/9] CCM-22816: Additional Lambda Role Trust

---
 infrastructure/terraform/modules/lambda/README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/infrastructure/terraform/modules/lambda/README.md b/infrastructure/terraform/modules/lambda/README.md
index d99cb527..b259c4f8 100644
--- a/infrastructure/terraform/modules/lambda/README.md
+++ b/infrastructure/terraform/modules/lambda/README.md
@@ -30,6 +30,7 @@ output "processor_lambda_error_rate_alarm_arn" {
 
 | Name | Description | Type | Default | Required |
 | ---- | ----------- | ---- | ------- | :------: |
+| <a name="input_additional_assume_role_policy_statements"></a> [additional\_assume\_role\_policy\_statements](#input\_additional\_assume\_role\_policy\_statements) | Additional IAM policy statements to attach to the Lambda execution role | <pre>list(object({<br/>    sid    = string<br/>    effect = string<br/>    principal = object({<br/>      type        = string<br/>      identifiers = list(string)<br/>    })<br/>    condition = optional(list(object({<br/>      test     = string<br/>      variable = string<br/>      values   = list(string)<br/>    })))<br/>  }))</pre> | `[]` | no |
 | <a name="input_application_log_level"></a> [application\_log\_level](#input\_application\_log\_level) | The detail level of the logs the application sends to CloudWatch | `string` | `"INFO"` | no |
 | <a name="input_aws_account_id"></a> [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes |
 | <a name="input_component"></a> [component](#input\_component) | The name of the tfscaffold component | `string` | n/a | yes |