Added rotate-key lambda function

aws/lambdas/auth/authorizer/index.ts

@@ -6,8 +6,8 @@ import {
   StatementEffect,
 } from "aws-lambda";
 import { v4 as uuidv4 } from "uuid";
-import { getSecret } from "../../../utils/getSecret";
 import { getLogger } from "../../../utils/logger";
+import { getSecret } from "../../../utils/secretsManager";
 
 const X_ORIGIN_VERIFY_HEADER = "x-origin-verify";
 

aws/lambdas/auth/rotate-key/index.ts

@@ -0,0 +1,40 @@
+import { APIGatewayEvent, APIGatewayProxyResult, Context } from "aws-lambda";
+import { v4 as uuidv4 } from "uuid";
+import { getLogger } from "../../../utils/logger";
+import { updateSecret } from "../../../utils/secretsManager";
+
+export const handler = async (
+  event: APIGatewayEvent,
+  context: Context
+): Promise<APIGatewayProxyResult> => {
+  const correlationId: string = event.requestContext.requestId || uuidv4();
+  const logger = getLogger(correlationId);
+  const newGuid = uuidv4();
+
+  try {
+    logger.info("Rotating verifyKey.");
+    await updateSecret(
+      process.env.VERIFY_SECRET_NAME,
+      JSON.stringify({ verifyKey: newGuid })
+    );
+    logger.info("Successfully rotated verifyKey");
+
+    return {
+      statusCode: 200,
+      body: JSON.stringify({
+        message:
+          "Successfully rotated the key and restarted the ECS Service/TD",
+      }),
+    };
+  } catch (error) {
+    logger.error(error);
+
+    return {
+      statusCode: 500,
+      body: JSON.stringify({
+        message:
+          "Something went wrong when updating the key and restarting the ECS Service/TD",
+      }),
+    };
+  }
+};

aws/utils/secretsManager.ts

@@ -0,0 +1,42 @@
+import {
+  GetSecretValueCommand,
+  SecretsManagerClient,
+  UpdateSecretCommand,
+} from "@aws-sdk/client-secrets-manager";
+
+const secretsManagerClient = new SecretsManagerClient();
+
+export const getSecret = async (secretName: string): Promise<string> => {
+  try {
+    const command = new GetSecretValueCommand({ SecretId: secretName });
+    const data = await secretsManagerClient.send(command);
+
+    if (data.SecretString) {
+      return data.SecretString;
+    } else {
+      throw new Error(
+        `Secret with ID ${secretName} does not contain SecretString`
+      );
+    }
+  } catch (error) {
+    console.error(`Error retrieving secret ${secretName}:`, error);
+    throw error;
+  }
+};
+
+export const updateSecret = async (
+  secretId: string,
+  secretString: string
+): Promise<void> => {
+  try {
+    const command = new UpdateSecretCommand({
+      SecretId: secretId,
+      SecretString: secretString,
+    });
+
+    await secretsManagerClient.send(command);
+  } catch (error) {
+    console.error(`Error updating secret ${secretId}`, error);
+    throw error;
+  }
+};