audit-writer-lambda

Overview ¶

Command audit-writer-lambda is the write path as an AWS Lambda function behind an SQS event source mapping.

It is the same writer as audit-writer's: the package writer, opened over the same archive with the same profiles under the same `require: archived` guard, and a record is acknowledged only once it is in the bucket. What differs is everything around it, and all of it follows from there being no process that stays up:

• the input is the SQS event, with partial batch responses (ReportBatchItemFailures), so a message that failed goes back to the queue and the ones that did not are deleted by the platform;
• there is no database, so the deduplication table is DynamoDB (dedupe/dynamodbdedupe), shared by every concurrent invocation environment;
• there is no listener, no registry, no stream: the catalogues the writer runs with are files in the package;
• configuration is a file in the package (docs/decisions/0021): the Pulumi library renders it from the stack's own outputs and ships it in the zip, so there is nothing to fetch at cold start and nothing in the environment that is a secret;
• telemetry is OTEL_* and nothing else, sent to the extension's loopback proxy (docs/explanation/aws-lambda.md), and flushed at the end of every invocation because an environment is frozen between them, and again on SIGTERM.

This is not deployed by this repository; deploy/pulumi is the library that builds it into a stack.