Feature/safo6 nrl 721 seed sandbox data by sandyforresternhs · Pull Request #1140 · NHSDigital/NRLF

sandyforresternhs · 2026-02-10T09:43:52Z

Deletes all items in a DynamoDB table and reseeds the table with X (default = 2) pointers of each type for X (default is 2) custodians
The scripts have been implemented to allow for execution either locally or via the lambda
When running locally, the delete_all_table_items.py and seed_sandbox_table.py scripts can be run independently or via the orchestrator script reset_sandbox_table.py
The lambda handles the orchestration of the delete and seed scripts (index.py), so the reset_sandbox_table.py script is not required for the lambda
The lambda is deployed account-wide to dev and/or test (since we wouldn't want to reseed prod tables) and only when a table in the account has been specified for reseeding
Logs showing the lambda working successfully can be seen here
Because it's account-wide we have needed to make the lamda layers available in the a/c wide infrastructure

github-actions · 2026-02-10T09:48:44Z

💥 Something went wrong while deploying the pull request environment.
Check Output Logs

github-actions · 2026-02-12T16:15:43Z

🚀 PR environment successfully deployed.
Commit Hash: 1c7c0abbd7cb49c7aa4d6c482f6dcd6a538d0daa
URL: https://nrl721-01ba47.api.record-locator.dev.national.nhs.uk/

github-actions · 2026-02-12T16:56:15Z

🚀 PR environment successfully deployed.
Commit Hash: 3b56521bd8cc2e70e7282738b296bbdae3c011c1
URL: https://nrl721-01ba47.api.record-locator.dev.national.nhs.uk/

github-actions · 2026-02-12T17:09:25Z

🚀 PR environment successfully deployed.
Commit Hash: 5aebcd6b07f468d3817ba67175ee537d70cc1cfe
URL: https://nrl721-01ba47.api.record-locator.dev.national.nhs.uk/

github-actions · 2026-02-17T17:16:01Z

🚀 PR environment successfully deployed.
Commit Hash: 012fa4fbf6a2a785d25f1c244be7879e01933d74
URL: https://nrl721-01ba47.api.record-locator.dev.national.nhs.uk/

mattdean3-nhs

This is EPIC 💪 nice work!

A few passing comments that I'd be happy to ignore.

Only one that we might need to address is the "*" wildcard used on the KMS key access for the new lambda - do we have an option to restrict that?

mattdean3-nhs · 2026-02-19T10:50:12Z

scripts/tests/test_delete_all_table_items.py

+            delete_all_table_items("nonexistent-table")
+
+        mock_exit.assert_called_once_with(1)
+        mock_print.assert_called_with("Error: Table 'nonexistent-table' does not exist")


oooof - nice! 💪 am liking this mocking of exit and print.... definitely going to borrow that approach 😁

mattdean3-nhs · 2026-02-19T11:00:37Z

scripts/seed_sandbox_table.py

+import boto3
+from botocore.exceptions import ClientError
+
+# Needed for when the script is run in Lambda where modules are in scripts subdirectory


I think these path/import issues could be fixed by adjusting the lambda runtime environment a little - but not a biggie for now, happy to leave as is and come back to fix later if ever needed. 👍

mattdean3-nhs · 2026-02-19T11:07:11Z

terraform/account-wide-infrastructure/dev/lambda__seed-sandbox.tf

+
+locals {
+  # take these out once development & testing is complete
+  seed_table_names = ["nhsd-nrlf--sandy-dev-pointers-table", "nhsd-nrlf--sandycopy-dev-pointers-table"]


probs remove sandycopy from list? or planning to do that after some testing?

I left those two in for the time being just so that we could see it works with multiple tables, and we can see in the logs they're both getting reseeded. I think the testers will probably want to add and remove tables, but I'm assuming that once we're all happy to merge we can remove the tables listed for dev completely, just leaving the int-sandbox table for test

mattdean3-nhs · 2026-02-19T11:08:49Z

terraform/account-wide-infrastructure/modules/seed_sandbox_lambda/eventbridge.tf

+  description = "Rule to clear and reseed sandbox data"
+  #   Set this to weekly once development and testing is complete
+  #   schedule_expression = "cron(0 2 ? * SUN *)" # 2am UTC, every Sunday
+  schedule_expression = "cron(0/15 9-17 ? * MON-FRI *)" # Every 15 minutes, 9am-5pm UTC, Monday-Friday


worth making this schedule a module var? that way we could have different schedules for dev and test if we want. Not sure if it's worth it though, up to you.

Great call, yep will do that 👍

mattdean3-nhs · 2026-02-19T11:11:03Z

terraform/account-wide-infrastructure/modules/seed_sandbox_lambda/iam.tf

+          "kms:Decrypt",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"


do we have an option to restrict this to a specific key? rather than all keys?

Good catch, let's do that 👍

mattdean3-nhs · 2026-02-19T11:13:24Z

terraform/account-wide-infrastructure/test/lambda__seed-sandbox.tf

+# Only deploys if tables are specified
+
+locals {
+  seed_table_names = ["nhsd-nrlf--int-sandboxcopy-pointers-table"] # Change to int-sandbox-pointers-table when ready


change to correct table name before merge (or add the correct one and keep both for now)

Yep, I was thinking just before merge assuming we're happy for int to get cleared - not sure if we want to give customers the heads up first?

sonarqubecloud · 2026-02-19T16:34:59Z

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

github-actions · 2026-02-19T16:41:10Z

🚀 PR environment successfully deployed.
Commit Hash: 1938493df29f9fd8513c7464c47733e97bbf4fe1
URL: https://nrl721-01ba47.api.record-locator.dev.national.nhs.uk/

sandyforresternhs added 5 commits January 29, 2026 11:37

NRL-721 Create clone and delete scripts WIP

c5f0c43

NRL-721 Reseed pointer scripts and tests

8a876b3

NRL-721 Add failed attempts to output

321d709

NRL-721 Implement lambda and eventbridge

f10dba1

NRL-721 Get lambda working successfully

9dae7ae

sandyforresternhs temporarily deployed to pull-request February 10, 2026 09:44 — with GitHub Actions Inactive

sandyforresternhs had a problem deploying to pull-request February 10, 2026 09:47 — with GitHub Actions Failure

NRL-721 Make seed lambda ac wide and enable ac wide layers

1c7c0ab

sandyforresternhs temporarily deployed to pull-request February 12, 2026 16:09 — with GitHub Actions Inactive

sandyforresternhs temporarily deployed to pull-request February 12, 2026 16:12 — with GitHub Actions Inactive

sandyforresternhs temporarily deployed to pull-request February 12, 2026 16:15 — with GitHub Actions Inactive

sandyforresternhs temporarily deployed to pull-request February 12, 2026 16:17 — with GitHub Actions Inactive

sandyforresternhs had a problem deploying to account-dev February 12, 2026 16:28 — with GitHub Actions Failure

NRL-721 Add build to ac wide wf and deploy only when tables are listed

3b56521

sandyforresternhs temporarily deployed to pull-request February 12, 2026 16:48 — with GitHub Actions Inactive

sandyforresternhs temporarily deployed to pull-request February 12, 2026 16:52 — with GitHub Actions Inactive

NRL-721 Remove unused param

5aebcd6

sandyforresternhs temporarily deployed to pull-request February 12, 2026 17:02 — with GitHub Actions Inactive

sandyforresternhs temporarily deployed to pull-request February 12, 2026 17:06 — with GitHub Actions Inactive

sandyforresternhs temporarily deployed to pull-request February 12, 2026 17:09 — with GitHub Actions Inactive

sandyforresternhs temporarily deployed to pull-request February 12, 2026 17:11 — with GitHub Actions Inactive

sandyforresternhs temporarily deployed to dev February 17, 2026 16:08 — with GitHub Actions Inactive

sandyforresternhs temporarily deployed to dev February 17, 2026 16:09 — with GitHub Actions Inactive

NRL-721 Fixed batch write limit

012fa4f

sandyforresternhs temporarily deployed to pull-request February 17, 2026 17:08 — with GitHub Actions Inactive

sandyforresternhs temporarily deployed to pull-request February 17, 2026 17:12 — with GitHub Actions Inactive

sandyforresternhs temporarily deployed to pull-request February 17, 2026 17:16 — with GitHub Actions Inactive

sandyforresternhs temporarily deployed to pull-request February 17, 2026 17:17 — with GitHub Actions Inactive

sandyforresternhs temporarily deployed to account-dev February 17, 2026 17:28 — with GitHub Actions Inactive

sandyforresternhs deployed to account-dev February 17, 2026 17:31 — with GitHub Actions Active

sandyforresternhs temporarily deployed to dev February 17, 2026 17:40 — with GitHub Actions Inactive

sandyforresternhs temporarily deployed to dev February 17, 2026 17:42 — with GitHub Actions Inactive

sandyforresternhs temporarily deployed to dev February 17, 2026 17:45 — with GitHub Actions Inactive

sandyforresternhs temporarily deployed to dev February 17, 2026 17:47 — with GitHub Actions Inactive

mattdean3-nhs reviewed Feb 19, 2026

View reviewed changes

nhsd-paul-berry temporarily deployed to qa February 19, 2026 15:29 — with GitHub Actions Inactive

nhsd-paul-berry temporarily deployed to qa February 19, 2026 15:31 — with GitHub Actions Inactive

nhsd-paul-berry temporarily deployed to qa February 19, 2026 15:34 — with GitHub Actions Inactive

nhsd-paul-berry deployed to qa February 19, 2026 15:35 — with GitHub Actions Active

NRL-721 Lock down KMS arns to be table specific

1938493

sandyforresternhs temporarily deployed to pull-request February 19, 2026 16:34 — with GitHub Actions Inactive

sandyforresternhs temporarily deployed to pull-request February 19, 2026 16:37 — with GitHub Actions Inactive

sandyforresternhs temporarily deployed to pull-request February 19, 2026 16:41 — with GitHub Actions Inactive

sandyforresternhs temporarily deployed to pull-request February 19, 2026 16:42 — with GitHub Actions Inactive

sandyforresternhs deployed to pull-request February 19, 2026 16:42 — with GitHub Actions Active

Conversation

sandyforresternhs commented Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 10, 2026

Uh oh!

github-actions bot commented Feb 12, 2026

Uh oh!

github-actions bot commented Feb 12, 2026

Uh oh!

github-actions bot commented Feb 12, 2026

Uh oh!

github-actions bot commented Feb 17, 2026

Uh oh!

mattdean3-nhs left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Feb 19, 2026

Quality Gate passed

Uh oh!

github-actions bot commented Feb 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Comments

sandyforresternhs commented Feb 10, 2026 •

edited

Loading

mattdean3-nhs left a comment •

edited

Loading