add lookup

enrollments-events/app/events/issue_cert.py

@@ -69,11 +69,15 @@ def lambda_handler(event: EventBridgeEvent, context: LambdaContext) -> bool:
     update_expr = 'SET cert = :cert, updated_at = :now'
     expr_attr_values = {
         ':now': now_,
-        ':cert': {'issued_at': now_} | ({'s3_uri': s3_uri} if s3_uri else {}),
+        ':cert': {'issued_at': now_}
+        | ({'expires_at': expires_at} if expires_at else {})
+        | ({'s3_uri': s3_uri} if s3_uri else {}),
     }
 
+    # Post-migration: remove the following lines
     if expires_at:
-        update_expr = 'SET cert = :cert, cert_expires_at = :cert_expires_at, \
+        update_expr = 'SET cert = :cert, \
+                           cert_expires_at = :cert_expires_at, \
                            updated_at = :now'
         expr_attr_values[':cert_expires_at'] = expires_at
 

enrollments-events/template.yaml

@@ -41,9 +41,9 @@ Globals:
         POSTGRES_DB: saladeaula.digital
         POSTGRES_HOST: sp-node01.saladeaula.digital
         POSTGRES_PORT: 5432
-        POSTGRES_USER: "{{resolve:ssm:/saladeaula/postgres_user}}"
-        POSTGRES_PASSWORD: "{{resolve:ssm:/saladeaula/postgres_password}}"
-        DOCUSEAL_KEY: "{{resolve:ssm:/saladeaula/docuseal_key}}"
+        POSTGRES_USER: '{{resolve:ssm:/saladeaula/postgres_user}}'
+        POSTGRES_PASSWORD: '{{resolve:ssm:/saladeaula/postgres_password}}'
+        DOCUSEAL_KEY: '{{resolve:ssm:/saladeaula/docuseal_key}}'
 
 Resources:
   EventLog:
@@ -60,7 +60,7 @@ Resources:
     Type: AWS::Serverless::HttpApi
     Properties:
       CorsConfiguration:
-        AllowOrigins: ["*"]
+        AllowOrigins: ['*']
         AllowMethods: [POST, OPTIONS]
         AllowHeaders: [Content-Type, X-Requested-With]
 
@@ -104,7 +104,7 @@ Resources:
               detail-type: [INSERT]
               detail:
                 new_image:
-                  sk: ["0"]
+                  sk: ['0']
                   org_id:
                     - exists: true
 
@@ -128,7 +128,7 @@ Resources:
               detail-type: [INSERT]
               detail:
                 new_image:
-                  sk: ["0"]
+                  sk: ['0']
                   access_expires_at:
                     - exists: false
 
@@ -154,7 +154,7 @@ Resources:
               detail-type: [INSERT]
               detail:
                 new_image:
-                  sk: ["0"]
+                  sk: ['0']
 
   EventEnrollFunction:
     Type: AWS::Serverless::Function
@@ -185,6 +185,27 @@ Resources:
                   scope: [SINGLE_USER]
                   status: [PENDING]
 
+  EventEnrollScheduledFunction:
+    Type: AWS::Serverless::Function
+    Properties:
+      Handler: events.enroll_scheduled.lambda_handler
+      LoggingConfig:
+        LogGroup: !Ref EventLog
+      Policies:
+        - DynamoDBCrudPolicy:
+            TableName: !Ref EnrollmentTable
+      Events:
+        DynamoDBEvent:
+          Type: EventBridgeRule
+          Properties:
+            Pattern:
+              resources: [!Ref EnrollmentTable]
+              detail-type: [EXPIRE]
+              detail:
+                keys:
+                  id:
+                    - prefix: SCHEDULED#ORG#
+
   EventReenrollIfFailedFunction:
     Type: AWS::Serverless::Function
     Properties:
@@ -204,10 +225,10 @@ Resources:
               detail:
                 changes: [status]
                 new_image:
-                  sk: ["0"]
+                  sk: ['0']
                   status: [FAILED]
                   score:
-                    - numeric: ["<", 70]
+                    - numeric: ['<', 70]
                 old_image:
                   status: [IN_PROGRESS]
 
@@ -298,9 +319,10 @@ Resources:
               detail-type: [INSERT]
               detail:
                 new_image:
-                  sk: ["0"]
+                  sk: ['0']
                   status: [PENDING]
 
+  # Deprecated
   EventSetAccessExpiredFunction:
     Type: AWS::Serverless::Function
     Properties:
@@ -321,6 +343,7 @@ Resources:
                 keys:
                   sk: [SCHEDULE#SET_ACCESS_EXPIRED, SCHEDULE#SET_AS_EXPIRED]
 
+  # Deprecated
   EventSetCertExpiredFunction:
     Type: AWS::Serverless::Function
     Properties:
@@ -364,7 +387,7 @@ Resources:
               resources: [!Ref EnrollmentTable]
               detail:
                 keys:
-                  sk: ["0"]
+                  sk: ['0']
                 new_image:
                   status: [COMPLETED]
                 old_image:
@@ -389,7 +412,7 @@ Resources:
               resources: [!Ref EnrollmentTable]
               detail:
                 keys:
-                  sk: ["0"]
+                  sk: ['0']
                 new_image:
                   status: [COMPLETED]
                   cert:
@@ -417,7 +440,7 @@ Resources:
               detail-type: [MODIFY]
               detail:
                 keys:
-                  sk: ["0"]
+                  sk: ['0']
                 new_image:
                   status: [COMPLETED]
                   cert_expires_at:
@@ -463,7 +486,7 @@ Outputs:
   HttpApiUrl:
     Description: URL of your API endpoint
     Value:
-      Fn::Sub: "https://${HttpApi}.execute-api.${AWS::Region}.${AWS::URLSuffix}"
+      Fn::Sub: 'https://${HttpApi}.execute-api.${AWS::Region}.${AWS::URLSuffix}'
   HttpApiId:
     Description: Api ID of HttpApi
     Value: