admin_aco_deny

The ACO Deny administrative task lambda will add an existing ACO to our deny list. It should be called via AWS's lambda interface (see: https://confluence.cms.gov/display/BCDA/How+To+deny+an+ACO+From+Generating+Credentials).

Payload Specification

The Lambda expects a JSON payload with the following fields:

Example Payloads

1. Immediate Deny (default behavior)

{
  "deny_aco_ids": ["A9994", "A9995"]
}

2. Scheduled Future Cutoff Date

{
  "deny_aco_ids": ["A9994"],
  "cutoff_date": "2026-12-31T23:59:59Z"
}

3. Custom Termination and Cutoff Dates

{
  "deny_aco_ids": ["A9994"],
  "termination_date": "2026-10-01T00:00:00Z",
  "cutoff_date": "2026-12-31T23:59:59Z"
}

Testing & Deployment

You can run the unit test suite from the base dir (bcda-app) using the following command:

make test-path TEST_PATH="bcda/lambda/admin_aco_deny/*.go"

(You might have to make load-fixtures first). It also has an integration test run via github actions (see .github/workflows/admin-aco-deny-integration-test.yml).

The lambda is deployed (or promoted in the case of prod) using github actions (see .github/workflows/admin-aco-deny-lambda-{env}-deploy.yml files).