Documentation
¶
Overview ¶
Command audit-notary-lambda is the notary as an AWS Lambda function invoked hourly by an EventBridge Scheduler schedule.
It is audit-notary's own logic (internal/cli.Notary): for each profile and tenant, every hour that has closed and settled and has no seal gets one, signed ES384 by a KMS key and chained to the one before (ADR 0019). A run is idempotent, so the schedule's retry, an overlapping invocation and a missed hour are all harmless: the next run seals what is missing, and an hour that is already sealed is read and left alone.
What differs from the Job is the shell around it. The configuration is the same file (schemas/config/audit-notary.schema.json), in the package at /var/task/audit.yaml, with `signer.kms` naming the seal key; the credentials are the function role's, which is not the writer's; the report is a log line and not standard output; a run that could not seal a tenant FAILS the invocation, which is what the Errors alarm is on; and telemetry is flushed before the invocation returns, because the environment is frozen after it.
The notary does not record `audit.seal.written` through a writer here unless the file's `sink` names one this function can reach: a function outside a VPC cannot reach an in-cluster writer, so the seals themselves, which are in the bucket and verifiable, are the record.
Source Files