@izara_project/izara-core-generate-service-code 1.0.85 → 1.0.87

package/src/emit/rbac/templates/GetTargetRole_Main.ejs

@@ -0,0 +1,62 @@
+/*
+Copyright (C) 2020 Sven Mason <http://izara.io>
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import dynamodbSharedLib from '@izara_project/izara-core-library-dynamodb';
+import snsSharedLib from '@izara_project/izara-core-library-sns';
+import { sns } from '@izara_project/izara-core-library-external-request';
+import { NoRetryError } from '@izara_project/izara-core-library-core';
+
+export default async function GetTargetRole(_izContext, requestParams) {
+  try {
+    const { identifiersConcat, roleIdKey } = requestParams;
+    if (!roleIdKey) {
+      throw new NoRetryError('roleIdKey is required');
+    }
+
+    const targetRolesTable = dynamodbSharedLib.tableName(_izContext, 'TargetRoles');
+    const rolePermissionsTable = dynamodbSharedLib.tableName(_izContext, 'RolePermissions');
+    const roleUsersTable = dynamodbSharedLib.tableName(_izContext, 'RoleUsers');
+
+    const role = identifiersConcat
+      ? await dynamodbSharedLib.getItem(_izContext, targetRolesTable, { identifiersConcat, roleIdKey })
+      : null;
+
+    const [permsResult, usersResult] = await Promise.all([
+      dynamodbSharedLib.query(_izContext, rolePermissionsTable, { roleIdKey }),
+      dynamodbSharedLib.query(_izContext, roleUsersTable, { roleIdKey })
+    ]);
+
+    const result = {
+      role,
+      roleIdKey,
+      permissions: permsResult?.Items || [],
+      users: usersResult?.Items || []
+    };
+
+    await sns.publishMessage(_izContext, {
+      message: { returnResult: result },
+      TopicArn: snsSharedLib.snsTopicArnByFlowSchema(
+        _izContext,
+        'GetTargetRole_Out'
+      )
+    });
+    return result;
+  } catch (error) {
+    _izContext.logger.error(`[${process.env.iz_serviceTag}:GetTargetRole] error:`, error);
+    throw error;
+  }
+}

package/src/emit/rbac/templates/ReservedDynamicUsage_Main.ejs

@@ -35,21 +35,25 @@ export default async function ReservedDynamicUsage(_izContext, requestParams) {
     } = requestParams;
 
     const targetIdentifiers = requestParams.targetIdentifiers;
-    let identifiersConcat = requestParams.identifiersConcat;
+    let identifiersConcat =
+      requestParams.identifiersConcat || requestParams.identifierConcat;
     if (!identifiersConcat && targetIdentifiers && typeof targetIdentifiers === 'object') {
-      if (targetIdentifiers.identifierConcat) {
-        identifiersConcat = targetIdentifiers.identifierConcat;
+      if (targetIdentifiers.identifiersConcat || targetIdentifiers.identifierConcat) {
+        identifiersConcat =
+          targetIdentifiers.identifiersConcat || targetIdentifiers.identifierConcat;
       } else {
-        const sortedKeys = Object.keys(targetIdentifiers).sort();
+        const sortedKeys = Object.keys(targetIdentifiers)
+          .filter(
+            (k) =>
+              k !== 'submittedByUserId' &&
+              k !== 'identifierConcat' &&
+              k !== 'identifiersConcat'
+          )
+          .sort();
         const parts = [];
         for (const key of sortedKeys) {
           const value = targetIdentifiers[key];
-          if (
-            key !== 'submittedByUserId' &&
-            key !== 'identifierConcat' &&
-            value !== undefined &&
-            value !== null
-          ) {
+          if (value !== undefined && value !== null) {
             parts.push(`${key}#${value}`);
           }
         }
@@ -70,41 +74,79 @@ export default async function ReservedDynamicUsage(_izContext, requestParams) {
     }
 
     const uniqueIdentify = `${usedTimestamp}_${_izContext.uniqueRequestId || Date.now()}`;
-    const roleLimitKeys = Array.isArray(requestParams.roleLimitIds)
-      ? requestParams.roleLimitIds
-      : [roleLimitId || `${identifiersConcat}_${flowTypeConcat}`];
 
-    let maxLimit = Infinity;
-    const limitRecords = [];
-
-    for (const key of roleLimitKeys) {
-      const record = await dynamodbSharedLib.getItem(
+    let targetPlanTier = requestParams.planTier || null;
+    if (!targetPlanTier && identifiersConcat) {
+      const targetRolesResult = await dynamodbSharedLib.query(
         _izContext,
-        dynamodbSharedLib.tableName(_izContext, 'RoleLimit'),
-        { roleLimitId: key, limitType: 'runningTotal' }
+        dynamodbSharedLib.tableName(_izContext, 'TargetRoles'),
+        { identifiersConcat }
       );
-      if (record && typeof record.limitValue === 'number') {
-        limitRecords.push(record);
+      let targetRoleItems = [];
+      if (Array.isArray(targetRolesResult)) {
+        targetRoleItems = targetRolesResult;
+      } else if (targetRolesResult && targetRolesResult.Items) {
+        targetRoleItems = targetRolesResult.Items;
+      }
+      for (const roleItem of targetRoleItems) {
+        if (roleItem.roleType === 'plan_tier') {
+          targetPlanTier = roleItem.roleIdKey;
+          break;
+        }
+      }
+    }
+    if (!targetPlanTier) {
+      targetPlanTier = 'tier-free';
+    }
+
+    const limitRecords = [];
+    const tierPermission = await dynamodbSharedLib.getItem(
+      _izContext,
+      dynamodbSharedLib.tableName(_izContext, 'RolePermissions'),
+      { roleIdKey: targetPlanTier, flowTypeConcat }
+    );
+    if (tierPermission && typeof tierPermission.limitValue === 'number') {
+      limitRecords.push(tierPermission);
+    }
+
+    if (Array.isArray(requestParams.roleIdKeys)) {
+      for (const rKey of requestParams.roleIdKeys) {
+        const perm = await dynamodbSharedLib.getItem(
+          _izContext,
+          dynamodbSharedLib.tableName(_izContext, 'RolePermissions'),
+          { roleIdKey: rKey, flowTypeConcat }
+        );
+        if (perm && typeof perm.limitValue === 'number') {
+          limitRecords.push(perm);
+        }
       }
     }
 
+    let maxLimit = Infinity;
     if (limitRecords.length > 0) {
-      const isDecrease = (rec) =>
-        rec.effect === 'decrease' ||
-        rec.actionType === 'decrease' ||
-        rec.action === 'decrease';
+      const isDecrease = function (rec) {
+        if (
+          rec.effect === 'decrease' ||
+          rec.actionType === 'decrease' ||
+          rec.action === 'decrease'
+        ) {
+          return true;
+        }
+        return false;
+      };
 
       const increaseLimits = limitRecords.filter((rec) => !isDecrease(rec));
       const decreaseLimits = limitRecords.filter((rec) => isDecrease(rec));
 
-      const maxIncrease =
-        increaseLimits.length > 0
-          ? Math.max(...increaseLimits.map((r) => r.limitValue))
-          : Infinity;
-      const minDecrease =
-        decreaseLimits.length > 0
-          ? Math.min(...decreaseLimits.map((r) => r.limitValue))
-          : Infinity;
+      let maxIncrease = Infinity;
+      if (increaseLimits.length > 0) {
+        maxIncrease = Math.max(...increaseLimits.map((r) => r.limitValue));
+      }
+
+      let minDecrease = Infinity;
+      if (decreaseLimits.length > 0) {
+        minDecrease = Math.min(...decreaseLimits.map((r) => r.limitValue));
+      }
 
       maxLimit = Math.min(maxIncrease, minDecrease);
     }

package/src/emit/rbac/templates/UpdateTargetRole_Main.ejs

@@ -0,0 +1,107 @@
+/*
+Copyright (C) 2020 Sven Mason <http://izara.io>
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import dynamodbSharedLib from '@izara_project/izara-core-library-dynamodb';
+import snsSharedLib from '@izara_project/izara-core-library-sns';
+import { sns } from '@izara_project/izara-core-library-external-request';
+import { consts, NoRetryError } from '@izara_project/izara-core-library-core';
+
+export default async function UpdateTargetRole(_izContext, requestParams) {
+  try {
+    const submittedByUserId =
+      requestParams.submittedByUserId ||
+      _izContext.correlationIds?.get(consts.SUBMITTED_BY_USER_ID);
+
+    const {
+      identifiersConcat,
+      roleIdKey,
+      roleName,
+      permissions
+    } = requestParams;
+
+    if (!roleIdKey) {
+      throw new NoRetryError('roleIdKey is required');
+    }
+
+    if (roleIdKey.endsWith('_owner')) {
+      throw new NoRetryError('Cannot modify system owner role');
+    }
+
+    const targetRolesTable = dynamodbSharedLib.tableName(_izContext, 'TargetRoles');
+    const rolePermissionsTable = dynamodbSharedLib.tableName(_izContext, 'RolePermissions');
+
+    if (roleName && identifiersConcat) {
+      const existingRole = await dynamodbSharedLib.getItem(_izContext, targetRolesTable, {
+        identifiersConcat,
+        roleIdKey
+      });
+      if (existingRole) {
+        await dynamodbSharedLib.putItem(_izContext, targetRolesTable, {
+          ...existingRole,
+          roleName
+        });
+      }
+    }
+
+    if (Array.isArray(permissions)) {
+      const currentPermsQuery = await dynamodbSharedLib.query(_izContext, rolePermissionsTable, {
+        roleIdKey
+      });
+      const currentPerms = currentPermsQuery?.Items || [];
+      const currentFlowMap = new Map(currentPerms.map((p) => [p.flowTypeConcat, p]));
+
+      const newFlowSet = new Set();
+      for (const perm of permissions) {
+        const flowTypeConcat = typeof perm === 'string' ? perm : perm.flowTypeConcat;
+        if (flowTypeConcat) {
+          newFlowSet.add(flowTypeConcat);
+          const permission =
+            typeof perm === 'object' && perm.permission !== undefined
+              ? perm.permission
+              : true;
+          const parameterGroups = (typeof perm === 'object' && perm.parameterGroups) || {};
+          await dynamodbSharedLib.putItem(_izContext, rolePermissionsTable, {
+            roleIdKey,
+            flowTypeConcat,
+            permission,
+            parameterGroups
+          });
+        }
+      }
+
+      for (const [oldFlow] of currentFlowMap.entries()) {
+        if (!newFlowSet.has(oldFlow)) {
+          await dynamodbSharedLib.deleteItem(_izContext, rolePermissionsTable, {
+            roleIdKey,
+            flowTypeConcat: oldFlow
+          });
+        }
+      }
+    }
+
+    await sns.publishMessage(_izContext, {
+      message: { returnResult: { roleIdKey, status: 'updated' } },
+      TopicArn: snsSharedLib.snsTopicArnByFlowSchema(
+        _izContext,
+        'UpdateTargetRole_Out'
+      )
+    });
+  } catch (error) {
+    _izContext.logger.error(`[${process.env.iz_serviceTag}:UpdateTargetRole] error:`, error);
+    throw error;
+  }
+}

package/src/emit/rbac/templates/UserRbacFlow_Main.ejs

@@ -52,7 +52,7 @@ async function _getL2Cache(_izContext, submittedByUserId, cacheSubKey) {
   try {
     const tableName = dynamodbSharedLib.tableName(_izContext, 'RbacPermissionCaches');
     const result = await dynamodbSharedLib.getItem(_izContext, tableName, {
-      submittedByUserId,
+      userId: submittedByUserId,
       cacheKey: cacheSubKey
     });
     if (result && result.ttlTimestamp && result.ttlTimestamp > Math.floor(Date.now() / 1000)) {
@@ -77,7 +77,7 @@ async function _setL2Cache(_izContext, submittedByUserId, cacheSubKey, value) {
     const tableName = dynamodbSharedLib.tableName(_izContext, 'RbacPermissionCaches');
     const ttlTimestamp = Math.floor(Date.now() / 1000) + L2_TTL_SECONDS;
     await dynamodbSharedLib.putItem(_izContext, tableName, {
-      submittedByUserId,
+      userId: submittedByUserId,
       cacheKey: cacheSubKey,
       permission: value.returnValue ? value.returnValue.permission : value.permission,
       roleIdKey: value.returnValue ? value.returnValue.roleIdKey : value.roleIdKey,
@@ -101,19 +101,22 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
     if (typeof targetIdentifiers === 'string') {
       targetId = targetIdentifiers;
     } else if (typeof targetIdentifiers === 'object') {
-      if (targetIdentifiers.identifierConcat) {
-        targetId = targetIdentifiers.identifierConcat;
+      if (targetIdentifiers.identifiersConcat || targetIdentifiers.identifierConcat) {
+        targetId =
+          targetIdentifiers.identifiersConcat || targetIdentifiers.identifierConcat;
       } else {
-        const sortedKeys = Object.keys(targetIdentifiers).sort();
+        const sortedKeys = Object.keys(targetIdentifiers)
+          .filter(
+            (k) =>
+              k !== 'submittedByUserId' &&
+              k !== 'identifierConcat' &&
+              k !== 'identifiersConcat'
+          )
+          .sort();
         const parts = [];
         for (const key of sortedKeys) {
           const value = targetIdentifiers[key];
-          if (
-            key !== 'submittedByUserId' &&
-            key !== 'identifierConcat' &&
-            value !== undefined &&
-            value !== null
-          ) {
+          if (value !== undefined && value !== null) {
             parts.push(`${key}#${value}`);
           }
         }
@@ -133,7 +136,7 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
     throw new Error('Missing flowTypeConcat in requestParams');
   }
 
-  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] requestParams:', {
+  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] requestParams:`, {
     submittedByUserId,
     targetId,
     flowTypeConcat,
@@ -175,7 +178,7 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
   // 1. Check L1 In-Memory Cache
   const l1Hit = _getL1Cache(fullCacheKey);
   if (l1Hit) {
-    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] L1 Cache hit:', l1Hit);
+    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] L1 Cache hit:`, l1Hit);
     await _publicMessageOut(_izContext, { ...l1Hit, parentFlowId });
     return;
   }
@@ -183,19 +186,19 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
   // 2. Check L2 Shared DynamoDB Cache
   const l2Hit = await _getL2Cache(_izContext, submittedByUserId, cacheSubKey);
   if (l2Hit) {
-    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] L2 Cache hit:', l2Hit);
+    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] L2 Cache hit:`, l2Hit);
     _setL1Cache(fullCacheKey, l2Hit);
     await _publicMessageOut(_izContext, { ...l2Hit, parentFlowId });
     return;
   }
 
-  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] Cache miss — querying DynamoDB');
+  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] Cache miss — querying DynamoDB`);
 
   // 3. Fallback to DB Query
   const userRolesResult = await dynamodbSharedLib.query(
     _izContext,
     dynamodbSharedLib.tableName(_izContext, 'UserRoles'),
-    { submittedByUserId }
+    { userId: submittedByUserId }
   );
 
   let userRoles = [];
@@ -205,7 +208,7 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
     userRoles = userRolesResult.Items;
   }
 
-  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] userRoles fetched:', { userRoles });
+  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] userRoles fetched:`, { userRoles });
 
   const targetIdPrefix = `${targetId}_`;
   const targetRoles = [];
@@ -215,13 +218,13 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
     }
   }
 
-  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] targetRoles filtered:', {
+  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] targetRoles filtered:`, {
     targetIdPrefix,
     targetRoles
   });
 
   if (targetRoles.length === 0) {
-    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] no targetRoles found, permission denied');
+    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] no targetRoles found, permission denied`);
     const result = {
       returnValue: {
         permission: false,
@@ -250,7 +253,7 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
     })
   );
 
-  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] rolePermissions fetched:', {
+  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] rolePermissions fetched:`, {
     rolePermissions
   });
 
@@ -278,7 +281,7 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
     status: 'Completed'
   };
 
-  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] validation result:', cacheResult);
+  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] validation result:`, cacheResult);
 
   // Store in L1 & L2 Cache
   _setL1Cache(fullCacheKey, cacheResult);

package/src/emit/rbac/templates/UserRoleMutation_Main.ejs

@@ -26,6 +26,18 @@ import { sns } from '@izara_project/izara-core-library-external-request';
 export default async function <%- flowTag %>(_izContext, requestParams) {
   try {
     const { roleIdKey, userId } = requestParams;
+<% if (operation === 'Delete') { -%>
+    if (roleIdKey && roleIdKey.endsWith('_owner')) {
+      const remainingUsers = await dynamodbSharedLib.query(
+        _izContext,
+        dynamodbSharedLib.tableName(_izContext, 'RoleUsers'),
+        { roleIdKey }
+      );
+      if (remainingUsers?.Items?.length <= 1) {
+        throw new Error('Cannot remove the last remaining owner');
+      }
+    }
+<% } -%>
     await dynamodbSharedLib.transactWriteItems(_izContext, [
       {
         action: '<%- action %>',

package/src/emit/resource/emitResourceArtifacts.js

@@ -31,18 +31,18 @@ const RELATIONSHIP_ACTIONS = [
 ];
 const RBAC_ACTIONS = [
   'CreateTargetRole',
-  'ListTargetRole',
+  'UpdateTargetRole',
   'DeleteTargetRole',
+  'GetTargetRole',
+  'ListTargetRole',
   'CreateRolePermissions',
   'ListRolePermissions',
   'DeleteRolePermissions',
   'CreateUserRole',
   'ListUserInRoles',
   'DeleteUserFromRole',
+  'GetMyPermissions',
   'ValidatorRbac',
-  'CreateRoleLimit',
-  'ListRoleLimits',
-  'DeleteRoleLimit',
   'ReservedDynamicUsage',
   'ConfirmUsage',
   'CancelUsage'
@@ -59,12 +59,12 @@ const SYSTEM_TABLES = [
   'AwaitingStep'
 ];
 const RBAC_TABLES = [
+  'Roles',
   'TargetRoles',
   'RolePermissions',
   'RoleUsers',
   'UserRoles',
   'RbacPermissionCaches',
-  'RoleLimit',
   'RunningTotalUsage',
   'RunningTotalReservedUsage',
   'WebSocketTask'
@@ -414,12 +414,12 @@ function createResourceState({ objects, relationships, flows }) {
   const systemTables = [...SYSTEM_TABLES];
   if (rbac) {
     systemTables.push(
+      'Roles',
       'TargetRoles',
       'RolePermissions',
       'RoleUsers',
       'UserRoles',
       'RbacPermissionCaches',
-      'RoleLimit',
       'RunningTotalUsage',
       'RunningTotalReservedUsage'
     );
@@ -728,7 +728,15 @@ function roleStatements(state, roleName) {
   addStatement(
     statements,
     ['sns:Publish'],
-    topicArns(roleTopicNames(state, roleName))
+    [
+      ...topicArns(roleTopicNames(state, roleName)),
+      ...roleExternalTopicArns(state, roleName)
+    ]
+  );
+  addStatement(
+    statements,
+    ['lambda:InvokeFunction'],
+    roleExternalLambdaArns(state, roleName)
   );
   if (state.webSocketRoles.has(roleName)) {
     statements.push({
@@ -765,10 +773,11 @@ function roleTableNames(state, roleName) {
       'WebSocketTask',
       ...(state.rbac
         ? [
+            'Roles',
             'TargetRoles',
+            'RolePermissions',
             'RoleUsers',
             'UserRoles',
-            'RoleLimit',
             'RunningTotalUsage',
             'RunningTotalReservedUsage'
           ]
@@ -925,6 +934,9 @@ function roleTopicNames(state, roleName) {
         topics.push(`${action}_In`, `${action}_Out`);
       }
     }
+    if (state.rbac) {
+      topics.push('ValidatorRbac_In');
+    }
     return topics;
   }
   if (roleName === 'FlowRelationshipRole') {
@@ -937,6 +949,9 @@ function roleTopicNames(state, roleName) {
         topics.push(`${action}_In`, `${action}_Out`);
       }
     }
+    if (state.rbac) {
+      topics.push('ValidatorRbac_In');
+    }
     return topics;
   }
   if (roleName === 'FlowRbacRole') {
@@ -1023,6 +1038,58 @@ function roleExternalDynamoTables(state, roleName) {
   return [];
 }
 
+function roleExternalTopicArns(state, roleName) {
+  if (!state.rbac) {
+    return [];
+  }
+  const extraTags = getRbacValidatorServiceTags(state).filter(
+    (tag) => tag && tag !== 'Rbac'
+  );
+  const extraTopics = extraTags.map(
+    (tag) =>
+      `arn:aws:sns:\${self:custom.iz_region}:\${self:custom.iz_accountId}:${tag}_\${self:custom.iz_stage}_ValidatorRbac_In`
+  );
+  if (roleName === 'FlowObjectsRole') {
+    return [
+      `arn:aws:sns:\${self:custom.iz_region}:\${self:custom.iz_accountId}:Rbac_\${self:custom.iz_stage}_ValidatorRbac_In`,
+      `arn:aws:sns:\${self:custom.iz_region}:\${self:custom.iz_accountId}:Rbac_\${self:custom.iz_stage}_ConfirmUsage_In`,
+      `arn:aws:sns:\${self:custom.iz_region}:\${self:custom.iz_accountId}:Rbac_\${self:custom.iz_stage}_CancelUsage_In`,
+      ...extraTopics
+    ];
+  }
+  if (roleName === 'FlowRbacRole' || roleName === 'FlowRelationshipRole') {
+    return [
+      `arn:aws:sns:\${self:custom.iz_region}:\${self:custom.iz_accountId}:Rbac_\${self:custom.iz_stage}_ValidatorRbac_In`,
+      ...extraTopics
+    ];
+  }
+  return [];
+}
+
+function roleExternalLambdaArns(state, roleName) {
+  if (!state.rbac) {
+    return [];
+  }
+  const extraTags = getRbacValidatorServiceTags(state).filter(
+    (tag) => tag && tag !== 'Rbac'
+  );
+  const extraLambdas = extraTags.map(
+    (tag) =>
+      `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:${tag}\${self:custom.iz_stage}ValidatorRbacHdrInv`
+  );
+  if (
+    roleName === 'FlowObjectsRole' ||
+    roleName === 'FlowRbacRole' ||
+    roleName === 'FlowRelationshipRole'
+  ) {
+    return [
+      `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:Rbac\${self:custom.iz_stage}ValidatorRbacHdrInv`,
+      ...extraLambdas
+    ];
+  }
+  return [];
+}
+
 function queueArns(queueNames) {
   return [...new Set(queueNames)]
     .sort()

package/src/emit/resource/templates/GeneratedLambdaRoleServiceConfig.ejs

@@ -58,7 +58,8 @@ export function generatedLambdaRole() {
           Resource: [
             `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ValidatorRbac_In', 'Rbac')}`,
             `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ConfirmUsage_In', 'Rbac')}`,
-            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'CancelUsage_In', 'Rbac')}`<% (rbacValidatorServiceTags || []).forEach(function(tag) { %>,
+            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'CancelUsage_In', 'Rbac')}`<% if (rbac) { %>,
+            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ValidatorRbac_In')}`<% } %><% (rbacValidatorServiceTags || []).forEach(function(tag) { %>,
             `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ValidatorRbac_In', '<%= tag %>')}`<% }); %>
           ]
         }<% } %>
@@ -77,7 +78,8 @@ export function generatedLambdaRole() {
           Effect: 'Allow',
           Action: ['sns:Publish'],
           Resource: [
-            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ValidatorRbac_In', 'Rbac')}`<% (rbacValidatorServiceTags || []).forEach(function(tag) { %>,
+            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ValidatorRbac_In', 'Rbac')}`,
+            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ValidatorRbac_In')}`<% (rbacValidatorServiceTags || []).forEach(function(tag) { %>,
             `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ValidatorRbac_In', '<%= tag %>')}`<% }); %>
           ]
         }