Skip to content

AWS Lambda

One function per module: the issuer with the console and the signer, and github, slack, google, cloudflare, backup and restore, each with its own role. DynamoDB holds the State, a table per module, and S3 holds reports and directory snapshots. SSM holds the secrets. A KMS key you supply wraps the signing keys the issuer generates. The Pulumi library, github.com/truvity/sluis/deploy/pulumi, builds all of it. It exposes the HTTP API as Lambda.FrontDoor().

Start with sluis on AWS Lambda. Design: Lambda and signing on AWS. Inputs and outputs: Lambda reference and Pulumi library.

What you decide

  • DNS and certificate. The core library stops at the HTTP API and has no custom domain. An edge module adds one: behind Cloudflare, or the planned AWS edge module.

  • Keys. You supply the KMS keys by alias: Keys.Sign, and Keys.Secrets (or ParameterKeyArn) for the SSM parameters. The library looks them up, grants on them and creates none. To move from library-created keys, follow the state operation.

  • Secrets layout. secrets.layout is v5: a table, a parameter namespace and a blob prefix per module, and a function per module (module roles). It is the only layout; a v4 installation moves with v1.77.0 first (upgrade to v1.77.1). A consumer of an external/ secret reads it with ExternalReadPolicy.

  • Recovery. The library generates a recovery password and turns recovery on. You turn it off from the console or the configuration (recover on Lambda).

  • Backup. NewBackup and NewRestore write one age-encrypted backup a day to an archive bucket and restore from it, after checking it against the sealed audit trail (back up and restore on layout v5).

  • Blobs. The bucket is S3 or S3-compatible. R2 takes credentials from an internal/ address, which needs the ssm secrets source. See R2 storage.

  • Audit. LambdaArgs.Audit installs an operational audit installation beside the function by default. Audit.Presets picks S3 or R2 for each archive store. The default is one operational bucket. Audit.Use sends to an existing installation. Audit.Enabled: false keeps records in the log only. See the Pulumi library and audit deployment.

Run it

Day two, recover on Lambda and the operations index.