clean up and fix permission error for calling tenant mgmt from tenant…

… reg service

resources/functions/tenant-registrations/index.py

@@ -64,8 +64,6 @@ def create_tenant_registration():
     # that the tenant registration is created without issue
     __update_tenant_registration(tenant_registration_id, {"tenantId": tenant_id})
 
-    # __create_control_plane_event(
-    #     json.dumps(input_details), onboarding_detail_type)
     __create_control_plane_event(
         json.dumps(
             tenant_registration_data

scripts/sbt-aws.sh

@@ -168,7 +168,6 @@ create_tenant_registration() {
         "tenantName": $tenantName,
         "email": $tenantEmail,
         "tier": "basic",
-        "tenantStatus": "In progress",
         "prices": [
           {
             "id": "price_123456789Example",
@@ -270,51 +269,6 @@ delete_tenant_registration() {
 }
 
 
-# create_tenant() {
-#   source_config
-#   TENANT_NAME="tenant$RANDOM"
-#   TENANT_EMAIL="${EMAIL_USERNAME}+${TENANT_NAME}@${EMAIL_DOMAIN}"
-
-#   if $DEBUG; then
-#     echo "Creating tenant with:"
-#     echo "TENANT_NAME: $TENANT_NAME"
-#     echo "TENANT_EMAIL: $TENANT_EMAIL"
-#   fi
-
-#   DATA=$(jq --null-input \
-#     --arg tenantName "$TENANT_NAME" \
-#     --arg tenantEmail "$TENANT_EMAIL" \
-#     '{
-#       "tenantName": $tenantName,
-#       "email": $tenantEmail,
-#       "tier": "basic",
-#       "tenantStatus": "In progress",
-#       "prices": [
-#         {
-#           "id": "price_123456789Example",
-#           "metricName": "productsSold"
-#         },
-#         {
-#           "id": "price_123456789AnotherExample",
-#           "metricName": "plusProductsSold"
-#         }
-#       ]
-#     }')
-
-#   RESPONSE=$(curl --request POST \
-#     --url "${CONTROL_PLANE_API_ENDPOINT}tenants" \
-#     --header "Authorization: Bearer ${ACCESS_TOKEN}" \
-#     --header 'content-type: application/json' \
-#     --data "$DATA" \
-#     --silent)
-
-#   if $DEBUG; then
-#     echo "Response: $RESPONSE"
-#   else
-#     echo "$RESPONSE"
-#   fi
-# }
-
 get_tenant() {
   source_config
   TENANT_ID="$1"
@@ -358,27 +312,6 @@ get_all_tenants() {
   fi
 }
 
-# delete_tenant() {
-#   source_config
-#   TENANT_ID="$1"
-
-#   if $DEBUG; then
-#     echo "Deleting tenant with ID: $TENANT_ID"
-#   fi
-
-#   RESPONSE=$(curl --request DELETE \
-#     --url "${CONTROL_PLANE_API_ENDPOINT}tenants/$TENANT_ID" \
-#     --header "Authorization: Bearer $ACCESS_TOKEN" \
-#     --header 'content-type: application/json' \
-#     --silent)
-
-#   if $DEBUG; then
-#     echo "Response: $RESPONSE"
-#   else
-#     echo "$RESPONSE"
-#   fi
-# }
-
 create_user() {
   source_config
   USER_NAME="user$RANDOM"
@@ -507,35 +440,6 @@ delete_user() {
   fi
 }
 
-# update_tenant() {
-#   source_config
-#   TENANT_ID="$1"
-#   KEY="$2"
-#   VALUE="$3"
-
-#   DATA=$(jq --null-input \
-#     --arg key "$KEY" \
-#     --arg value "$VALUE" \
-#     '{($key): $value}')
-
-#   if $DEBUG; then
-#     echo "Updating tenant with ID: $TENANT_ID with DATA: $DATA"
-#   fi
-
-#   RESPONSE=$(curl --request PUT \
-#     --url "${CONTROL_PLANE_API_ENDPOINT}tenants/$TENANT_ID" \
-#     --header "Authorization: Bearer $ACCESS_TOKEN" \
-#     --header 'content-type: application/json' \
-#     --data "$DATA" \
-#     --silent)
-
-#   if $DEBUG; then
-#     echo "Response: $RESPONSE"
-#   else
-#     echo "$RESPONSE"
-#   fi
-# }
-
 # Main
 DEBUG=false
 if [ "$1" = "--debug" ]; then
@@ -586,10 +490,6 @@ case "$1" in
   delete_tenant_registration "$2"
   ;;
 
-# "create-tenant")
-#   create_tenant
-#   ;;
-
 "get-tenant")
   if [ $# -ne 2 ]; then
     echo "Error: get-tenant requires tenant id"
@@ -602,22 +502,6 @@ case "$1" in
   get_all_tenants "$2" "$3"
   ;;
 
-# "delete-tenant")
-#   if [ $# -ne 2 ]; then
-#     echo "Error: delete-tenant requires tenant id"
-#     exit 1
-#   fi
-#   delete_tenant "$2"
-#   ;;
-
-# "update-tenant")
-#   if [ $# -ne 4 ]; then
-#     echo "Error: update-tenant requires tenant id, key, and value"
-#     exit 1
-#   fi
-#   update_tenant "$2" "$3" "$4"
-#   ;;
-
 "create-user")
   create_user
   ;;

src/control-plane/tenant-registration/tenant-registration-funcs.ts

@@ -11,6 +11,7 @@ import { NagSuppressions } from 'cdk-nag';
 import { Construct } from 'constructs';
 import { TenantRegistrationTable } from './tenant-registration.table';
 import { DetailType, IEventManager } from '../../utils';
+import { CfnHttpApi } from 'aws-cdk-lib/aws-sam';
 
 /**
 Represents the properties required for the Tenant Management Lambda function.
@@ -78,34 +79,34 @@ export class TenantRegistrationLambda extends Construct {
       new PolicyStatement({
         actions: ['execute-api:Invoke'],
         resources: [
-          // props.api.arnForExecuteApi(
-          //   'POST',
-          //   `${props.tenantsPath}/*`,
-          //   props.api.defaultStage?.stageName
-          // ),
           props.api.arnForExecuteApi('POST', props.tenantsPath, props.api.defaultStage?.stageName),
           props.api.arnForExecuteApi(
             'DELETE',
-            props.tenantIdPath,
+            `${props.tenantsPath}/*`,
             props.api.defaultStage?.stageName
           ),
           // todo: add star (/tenants/*) and suppression for this for PUT and DELETE
           // to fix message: Forbidden issue when updating tenant
-          props.api.arnForExecuteApi('PUT', props.tenantIdPath, props.api.defaultStage?.stageName),
+          props.api.arnForExecuteApi(
+            'PUT',
+            `${props.tenantsPath}/*`,
+            props.api.defaultStage?.stageName
+          ),
         ],
       })
     );
 
     NagSuppressions.addResourceSuppressions(
       this.tenantRegistrationFunc.role!,
       [
-        // {
-        //   id: 'AwsSolutions-IAM5',
-        //   reason: 'Index name(s) not known beforehand.',
-        //   appliesTo: [
-        //     `Resource::<${Stack.of(this).getLogicalId(props.api.node.defaultChild as CfnHttpApi)}>/*/*/tenants/*`,
-        //   ],
-        // },
+        {
+          id: 'AwsSolutions-IAM5',
+          reason: 'Tenant Ids not known beforehand for PUT and DELETE endpoints.',
+          appliesTo: [
+            `Resource::arn:<AWS::Partition>:execute-api:<AWS::Region>:<AWS::AccountId>:<${Stack.of(this).getLogicalId(props.api.node.defaultChild as CfnHttpApi)}>/${props.api.defaultStage?.stageName}/DELETE/tenants/*`,
+            `Resource::arn:<AWS::Partition>:execute-api:<AWS::Region>:<AWS::AccountId>:<${Stack.of(this).getLogicalId(props.api.node.defaultChild as CfnHttpApi)}>/${props.api.defaultStage?.stageName}/PUT/tenants/*`,
+          ],
+        },
         {
           id: 'AwsSolutions-IAM4',
           reason: