@izara_project/izara-core-generate-service-code 1.0.97 → 1.0.99

package/src/emit/application/rbac/emitRbacApplicationArtifacts.js

@@ -3,6 +3,7 @@ import { readFile } from 'node:fs/promises';
 
 import {
   renderApiFunctionYaml,
+  renderDssFunctionYaml,
   renderInvFunctionYaml,
   renderSqsFunctionYaml,
   renderWbsFunctionYaml
@@ -53,7 +54,10 @@ export async function emitRbacApplicationArtifacts(objects) {
 
   const limitHandlers = await Promise.all(
     hasSelfRbac
-      ? ACCOUNT_LIMIT_HANDLERS.map(createAccountLimitHandler)
+      ? [
+          ...ACCOUNT_LIMIT_HANDLERS.map(createAccountLimitHandler),
+          createReservedUsageTtlExpiredHandler()
+        ]
       : []
   );
 
@@ -173,9 +177,12 @@ const STATIC_LIMIT_APPLICATION_PATHS = [
   ...ACCOUNT_LIMIT_HANDLERS.flatMap((flowTag) => [
     `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_Main.js`,
     `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_HdrSqs.js`,
+    `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_HdrInv.js`,
+    `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_HdrApi.js`,
     `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_WbsMain.js`,
     `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_HdrWbs.js`
   ]),
+  'app/src/generatedCode/FlowLimit/ReservedUsageTtlExpired/source/ReservedUsageTtlExpired_HdrDss.js',
   FLOW_LIMITS_YAML_PATH
 ];
 
@@ -210,6 +217,12 @@ async function createAccountLimitHandler(flowTag) {
     sourcePath,
     handlerPath
   );
+  const shared = {
+    flowTag,
+    flowStepName: '',
+    mainFileName: `${flowTag}_Main`,
+    functionName: flowTag
+  };
   return {
     artifacts: [
       {
@@ -220,6 +233,14 @@ async function createAccountLimitHandler(flowTag) {
         path: `${sourcePath}/${flowTag}_HdrSqs.js`,
         content: await renderRbacTemplate('ListRbac_HdrSqs.ejs', { flowTag })
       },
+      {
+        path: `${sourcePath}/${flowTag}_HdrInv.js`,
+        content: await renderSharedTemplate('FlowHandler_HdrInv.ejs', shared)
+      },
+      {
+        path: `${sourcePath}/${flowTag}_HdrApi.js`,
+        content: await renderSharedTemplate('FlowHandler_HdrApi.ejs', shared)
+      },
       ...webSocket.artifacts
     ],
     functions: [
@@ -232,11 +253,64 @@ async function createAccountLimitHandler(flowTag) {
         flowTag: flowTag,
         flowStepName: ''
       },
+      {
+        type: 'inv',
+        functionName: `${flowTag}HdrInv`,
+        handlerPath: `${handlerPath}/${flowTag}_HdrInv.main`,
+        roleName: 'FlowRbacRole',
+        flowTag: flowTag,
+        flowStepName: ''
+      },
+      {
+        type: 'api',
+        functionName: `${flowTag}HdrApi`,
+        handlerPath: `${handlerPath}/${flowTag}_HdrApi.main`,
+        roleName: 'FlowRbacRole',
+        flowTag: flowTag,
+        flowStepName: ''
+      },
       ...webSocket.functions
     ]
   };
 }
 
+async function createReservedUsageTtlExpiredHandler() {
+  const sourcePath =
+    'app/src/generatedCode/FlowLimit/ReservedUsageTtlExpired/source';
+  const handlerPath =
+    'src/generatedCode/FlowLimit/ReservedUsageTtlExpired/source';
+  return {
+    artifacts: [
+      {
+        path: `${sourcePath}/ReservedUsageTtlExpired_HdrDss.js`,
+        content: await renderRbacTemplate('ReservedUsageTtlExpired_HdrDss.ejs')
+      }
+    ],
+    functions: [
+      {
+        type: 'dss',
+        functionName: 'ReservedUsageTtlExpiredHdrDss',
+        handlerPath: `${handlerPath}/ReservedUsageTtlExpired_HdrDss.main`,
+        roleName: 'FlowRbacRole',
+        tableName: 'RunningTotalReservedUsage',
+        batchSize: 100,
+        startingPosition: 'TRIM_HORIZON',
+        filterPatterns: [
+          {
+            eventName: ['REMOVE'],
+            userIdentity: {
+              type: ['Service'],
+              principalId: ['dynamodb.amazonaws.com']
+            }
+          }
+        ],
+        flowTag: 'ReservedUsageTtlExpired',
+        flowStepName: ''
+      }
+    ]
+  };
+}
+
 
 async function createCustomRbacOwnTopicHandler(flowTag, mainTemplateName) {
   const sourcePath = `app/src/generatedCode/FlowRbac/${flowTag}/source`;
@@ -523,6 +597,7 @@ function renderFunctionYaml(descriptor) {
   if (descriptor.type === 'api') return renderApiFunctionYaml(descriptor);
   if (descriptor.type === 'inv') return renderInvFunctionYaml(descriptor);
   if (descriptor.type === 'wbs') return renderWbsFunctionYaml(descriptor);
+  if (descriptor.type === 'dss') return renderDssFunctionYaml(descriptor);
   return renderSqsFunctionYaml(descriptor);
 }
 

package/src/emit/application/rbac/templates/ReservedDynamicUsage_Main.ejs

@@ -169,6 +169,8 @@ export default async function ReservedDynamicUsage(_izContext, requestParams) {
         {
           runningTotalReservedId: `${identifiersConcat}_${flowTypeConcat}`,
           usedTimestampId: uniqueIdentify,
+          identifiersConcat,
+          flowTypeConcat,
           usageCount: value,
           runningTotalUsageStatus: 'reserved',
           ttlTimestamp

package/src/emit/application/rbac/templates/ReservedUsageTtlExpired_HdrDss.ejs

@@ -0,0 +1,176 @@
+/*
+Copyright (C) 2020 Sven Mason <http://izara.io>
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import { middlewareHandler as middleware } from '@izara_project/izara-middleware';
+import Logger from '@izara_project/izara-core-library-logger';
+import dynamodbSharedLib from '@izara_project/izara-core-library-dynamodb';
+
+/**
+ * DynamoDB Stream handler for TTL expired records in RunningTotalReservedUsage.
+ * Automatically refunds abandoned reservations with atomic decrement.
+ */
+export const main = middleware.wrap(async (event, context) => {
+  try {
+    if (!event || !Array.isArray(event.Records)) {
+      Logger.debug('No records in DynamoDB stream event');
+      return;
+    }
+
+    let _izContext = event._izContext;
+    if (!_izContext) {
+      _izContext = {
+        logger: Logger,
+        correlationIds: new Map()
+      };
+    }
+
+    for (const record of event.Records) {
+      let recordContext = record._izContext;
+      if (!recordContext) {
+        recordContext = _izContext;
+      }
+      let recordLogger = recordContext.logger;
+      if (!recordLogger) {
+        recordLogger = Logger;
+      }
+
+      const isTtlDelete =
+        record.eventName === 'REMOVE' &&
+        record.userIdentity &&
+        record.userIdentity.type === 'Service' &&
+        record.userIdentity.principalId === 'dynamodb.amazonaws.com';
+
+      if (!isTtlDelete) {
+        continue;
+      }
+
+      const oldImage = record.dynamodb && record.dynamodb.OldImage;
+      if (!oldImage) {
+        continue;
+      }
+
+      let oldStatus = null;
+      if (oldImage.runningTotalUsageStatus && oldImage.runningTotalUsageStatus.S) {
+        oldStatus = oldImage.runningTotalUsageStatus.S;
+      }
+
+      if (oldStatus !== 'reserved') {
+        continue;
+      }
+
+      let identifiersConcat = null;
+      if (oldImage.identifiersConcat && oldImage.identifiersConcat.S) {
+        identifiersConcat = oldImage.identifiersConcat.S;
+      }
+      let flowTypeConcat = null;
+      if (oldImage.flowTypeConcat && oldImage.flowTypeConcat.S) {
+        flowTypeConcat = oldImage.flowTypeConcat.S;
+      }
+
+      if ((!identifiersConcat || !flowTypeConcat) && oldImage.runningTotalReservedId && oldImage.runningTotalReservedId.S) {
+        const reservedId = oldImage.runningTotalReservedId.S;
+        const lastUnderscoreIndex = reservedId.lastIndexOf('_');
+        if (lastUnderscoreIndex > 0) {
+          if (!identifiersConcat) {
+            identifiersConcat = reservedId.substring(0, lastUnderscoreIndex);
+          }
+          if (!flowTypeConcat) {
+            flowTypeConcat = reservedId.substring(lastUnderscoreIndex + 1);
+          }
+        }
+      }
+
+      let usageCount = 1;
+      if (oldImage.usageCount && oldImage.usageCount.N) {
+        usageCount = Number(oldImage.usageCount.N);
+      }
+
+      if (identifiersConcat && flowTypeConcat && usageCount > 0) {
+        const usageTable = dynamodbSharedLib.tableName(
+          recordContext,
+          'RunningTotalUsage'
+        );
+
+        const usageRecord = await dynamodbSharedLib.getItem(
+          recordContext,
+          usageTable,
+          {
+            identifiersConcat: identifiersConcat,
+            flowTypeConcat: flowTypeConcat
+          }
+        );
+
+        if (usageRecord) {
+          let currentTotal = 0;
+          if (typeof usageRecord.totalCount === 'number') {
+            currentTotal = usageRecord.totalCount;
+          }
+          const newTotal = Math.max(0, currentTotal - usageCount);
+          const updateUuid = recordContext.uniqueRequestId || `${Date.now()}`;
+
+          const queryElementsWhenUpdate = {
+            additionalAttributes: { currentUuid: usageRecord.updateUuid },
+            logicalElements: [
+              {
+                type: 'logical',
+                comparison: 'equals',
+                lhsAttribute: 'updateUuid',
+                rhsReference: 'currentUuid'
+              }
+            ],
+            returnValues: 'ALL_NEW'
+          };
+
+          const updateAttributes = [
+            { attributeName: 'totalCount', action: 'set', value: newTotal },
+            { attributeName: 'updateUuid', action: 'set', value: updateUuid }
+          ];
+
+          await dynamodbSharedLib.updateItem(
+            recordContext,
+            usageTable,
+            {
+              identifiersConcat: identifiersConcat,
+              flowTypeConcat: flowTypeConcat
+            },
+            updateAttributes,
+            queryElementsWhenUpdate,
+            {
+              complexAttributes: true,
+              errorOnConditionalExpNotPass: false
+            }
+          ).catch(() => null);
+
+          recordLogger.info({
+            message: '[ReservedUsageTtlExpired] Auto-refunded expired reservation',
+            identifiersConcat: identifiersConcat,
+            flowTypeConcat: flowTypeConcat,
+            usageCount: usageCount,
+            previousTotal: currentTotal,
+            newTotal: newTotal
+          });
+        }
+      }
+    }
+  } catch (err) {
+    Logger.error({
+      message: 'Unhandled error in ReservedUsageTtlExpired_HdrDss',
+      error: err
+    });
+    throw err;
+  }
+});

package/src/emit/application/relationship/templates/ChangeRelationship_Main.ejs

@@ -29,14 +29,15 @@ import { sns } from '@izara_project/izara-core-library-external-request';
 
 import {
   getObjectSchema,
+  getRelSchema,
   utils,
   serviceConfig,
   consts,
   relSchemaLib
 } from '@izara_project/izara-core-library-service-schemas';
 
-const { getRelationshipSchemaWithCache, getObjSchemaS3WithHierarchy } =
-  getObjectSchema;
+const { getRelationshipSchemaWithCache } = getRelSchema;
+const { getObjSchemaS3WithHierarchy } = getObjectSchema;
 
 const { createLinkTypeId } = utils;
 

package/src/emit/application/relationship/templates/CreateRelationship_Main.ejs

@@ -29,6 +29,7 @@ import dynamodbSharedLib from '@izara_project/izara-core-library-dynamodb';
 import { sns } from '@izara_project/izara-core-library-external-request';
 import {
   getObjectSchema,
+  getRelSchema,
   utils,
   serviceConfig,
   consts,
@@ -36,8 +37,8 @@ import {
   identifiersObject
 } from '@izara_project/izara-core-library-service-schemas';
 const { findLinksByObjTypes } = relSchemaLib;
-const { getRelationshipSchemaWithCache, getObjSchemaS3WithHierarchy } =
-  getObjectSchema;
+const { getRelationshipSchemaWithCache } = getRelSchema;
+const { getObjSchemaS3WithHierarchy } = getObjectSchema;
 
 const { createLinkTypeId } = utils;
 

package/src/emit/application/relationship/templates/DeleteRelationship_Main.ejs

@@ -29,14 +29,15 @@ import dynamodbSharedLib from '@izara_project/izara-core-library-dynamodb';
 import { sns } from '@izara_project/izara-core-library-external-request';
 import {
   getObjectSchema,
+  getRelSchema,
   utils,
   serviceConfig,
   consts,
   identifiersObject
 } from '@izara_project/izara-core-library-service-schemas';
 
-const { getRelationshipSchemaWithCache, getObjSchemaS3WithHierarchy } =
-  getObjectSchema;
+const { getRelationshipSchemaWithCache } = getRelSchema;
+const { getObjSchemaS3WithHierarchy } = getObjectSchema;
 
 const { createLinkTypeId } = utils;
 

package/src/emit/application/relationship/templates/GetRelationship_Main.ejs

@@ -27,6 +27,7 @@ import {
 } from '@izara_project/izara-core-library-external-request';
 import {
   getObjectSchema,
+  getRelSchema,
   utils,
   serviceConfig,
   consts,
@@ -36,8 +37,8 @@ import {
 import { consts as coreConsts } from '@izara_project/izara-core-library-core';
 
 const { findLinksByObjTypes } = relSchemaLib;
-const { getRelationshipSchemaWithCache, getObjSchemaS3WithHierarchy } =
-  getObjectSchema;
+const { getRelationshipSchemaWithCache } = getRelSchema;
+const { getObjSchemaS3WithHierarchy } = getObjectSchema;
 const { createLinkTypeId } = utils;
 const { getGraphServiceTagWithCache } = serviceConfig;
 const { PREFIX, TOPIC_NAME_GENERATE_CODE, TOPIC_NAME_GRAPH_HANDLER } = consts;

package/src/emit/application/relationship/templates/MoveRelationship_Main.ejs

@@ -33,6 +33,7 @@ import {
 
 import {
   getObjectSchema,
+  getRelSchema,
   utils,
   serviceConfig,
   consts,
@@ -41,8 +42,8 @@ import {
 } from '@izara_project/izara-core-library-service-schemas';
 const { findLinksByObjTypes } = relSchemaLib;
 
-const { getRelationshipSchemaWithCache, getObjSchemaS3WithHierarchy } =
-  getObjectSchema;
+const { getRelationshipSchemaWithCache } = getRelSchema;
+const { getObjSchemaS3WithHierarchy } = getObjectSchema;
 
 const { createLinkTypeId } = utils;
 

package/src/emit/application/relationship/templates/UpdateRelationship_Main.ejs

@@ -30,14 +30,15 @@ import { sns } from '@izara_project/izara-core-library-external-request';
 
 import {
   getObjectSchema,
+  getRelSchema,
   utils,
   serviceConfig,
   consts,
   identifiersObject
 } from '@izara_project/izara-core-library-service-schemas';
 
-const { getRelationshipSchemaWithCache, getObjSchemaS3WithHierarchy } =
-  getObjectSchema;
+const { getRelationshipSchemaWithCache } = getRelSchema;
+const { getObjSchemaS3WithHierarchy } = getObjectSchema;
 
 const { createLinkTypeId } = utils;
 

package/src/emit/application/system/templates/RegisterComplete_Main.ejs

@@ -1,6 +1,10 @@
 import { NoRetryError } from '@izara_project/izara-core-library-core';
 import { objectHash as hash } from '@izara_project/izara-shared-core';
-import { getObjectSchema, identifiersObject } from '@izara_project/izara-core-library-service-schemas';
+import {
+  getObjectSchema,
+  getFlowSchema,
+  identifiersObject
+} from '@izara_project/izara-core-library-service-schemas';
 import dynamodbSharedLib from '@izara_project/izara-core-library-dynamodb';
 import lambdaSharedLib from '@izara_project/izara-core-library-lambda';
 import { lambda, webSocket } from '@izara_project/izara-core-library-external-request';
@@ -29,7 +33,7 @@ export default async function registerCompleteMain(
     }
 
     let topicName = topicArn.split(':')[5].split('_');
-    let flowSchema = await getObjectSchema.getFlowSchemaS3WithCache(_izContext, {
+    let flowSchema = await getFlowSchema.getFlowSchemaS3WithCache(_izContext, {
       flowTag: topicName[2],
       serviceTag: topicName[0]
     });

package/src/emit/application/system/templates/Register_Main.ejs

@@ -1,5 +1,9 @@
 import { objectHash as hash } from '@izara_project/izara-shared-core';
-import { getObjectSchema, identifiersObject } from '@izara_project/izara-core-library-service-schemas';
+import {
+  getObjectSchema,
+  getFlowSchema,
+  identifiersObject
+} from '@izara_project/izara-core-library-service-schemas';
 import dynamodbSharedLib from '@izara_project/izara-core-library-dynamodb';
 import lambdaSharedLib from '@izara_project/izara-core-library-lambda';
 import { lambda, webSocket } from '@izara_project/izara-core-library-external-request';
@@ -20,7 +24,7 @@ export default async function registerMain(
 ) {
   try {
     let connectionId = _izContext.correlationIds.get(consts.CONNECTION_ID);
-    let flowSchema = await getObjectSchema.getFlowSchemaS3WithCache(_izContext, {
+    let flowSchema = await getFlowSchema.getFlowSchemaS3WithCache(_izContext, {
       flowTag: requestParams.flowTag,
       serviceTag: process.env.iz_serviceTag
     });

package/src/emit/application/system/templates/WebSocketComplete_Main.ejs

@@ -1,7 +1,7 @@
 import { NoRetryError } from '@izara_project/izara-core-library-core';
 import { consts } from '@izara_project/izara-middleware';
 import {
-  getObjectSchema,
+  getFlowSchema,
   utils
 } from '@izara_project/izara-core-library-service-schemas';
 import dynamodbSharedLib from '@izara_project/izara-core-library-dynamodb';
@@ -30,7 +30,7 @@ export default async function WebSocketComplete(
       throw new NoRetryError('not have TopicArn for get FlowSchemas');
     const topicName = topicArn.split(':')[5].split('_');
     let flowTag = topicName[2];
-    let flowSchema = await getObjectSchema.getFlowSchemaS3WithCache(
+    let flowSchema = await getFlowSchema.getFlowSchemaS3WithCache(
       _izContext,
       { flowTag, serviceTag: topicName[0] }
     );
@@ -40,7 +40,7 @@ export default async function WebSocketComplete(
           'Could not find flowSchema from topicArn or requestParams.flowTag'
         );
       flowTag = requestParams.flowTag;
-      flowSchema = await getObjectSchema.getFlowSchemaS3WithCache(_izContext, {
+      flowSchema = await getFlowSchema.getFlowSchemaS3WithCache(_izContext, {
         flowTag,
         serviceTag: process.env.iz_serviceTag
       });

package/src/emit/infrastructure/functions/functionYamlArtifact.js

@@ -198,6 +198,34 @@ export function renderS3FunctionYaml({
   });
 }
 
+export function renderDssFunctionYaml({
+  functionName,
+  handlerPath,
+  roleName,
+  tableName,
+  batchSize = 100,
+  startingPosition = 'TRIM_HORIZON',
+  filterPatterns = [],
+  flowTag,
+  flowStepName
+}) {
+  return _renderFunctionTemplate('DssFunction_Yaml.ejs', {
+    functionName,
+    handlerPath,
+    roleName,
+    tableName,
+    batchSize,
+    startingPosition,
+    filterPatterns,
+    environmentSetting: _environmentSetting(
+      functionName,
+      flowTag,
+      flowStepName
+    ),
+    functionSetting: _functionSetting(functionName)
+  });
+}
+
 export function renderEventBridgeFunctionYaml({
   functionName,
   handlerPath,

package/src/emit/infrastructure/functions/templates/DssFunction_Yaml.ejs

@@ -0,0 +1,21 @@
+<%= functionName %>:
+  handler: <%= handlerPath %>
+  name: ${self:custom.iz_resourcePrefix}<%= functionName %>
+  role: <%= roleName %>
+<%- environmentSetting %><%- functionSetting %>
+  events:
+    - stream:
+        type: dynamodb
+        arn:
+          Fn::GetAtt: [<%= tableName %>Table, StreamArn]
+        batchSize: <%= batchSize %>
+        startingPosition: <%= startingPosition %>
+<% if (Array.isArray(filterPatterns) && filterPatterns.length > 0) { -%>
+        filterPatterns:
+<% filterPatterns.forEach(function(pattern) { -%>
+          - eventName: <%- JSON.stringify(pattern.eventName) %>
+            userIdentity:
+              type: <%- JSON.stringify(pattern.userIdentity.type) %>
+              principalId: <%- JSON.stringify(pattern.userIdentity.principalId) %>
+<% }); -%>
+<% } -%>

package/src/emit/infrastructure/resources/iamResourceArtifacts.js

@@ -96,9 +96,26 @@ export function getRbacValidatorServiceTags(state) {
 export async function renderLambdaRoleConfig(state) {
   const s3Flows = state.flows
     .filter((flow) => includesEvent(flow, 's3'))
-    .map((flow) => ({
-      roleName: upperFirst(flow.flowTag)
-    }));
+    .map((flow) => {
+      let quotaServiceTag = flow.quotaServiceTag;
+      if (!quotaServiceTag && flow.belongTo) {
+        if (Array.isArray(flow.belongTo)) {
+          quotaServiceTag = flow.belongTo[0]?.serviceTag;
+        } else if (flow.belongTo.serviceTag) {
+          quotaServiceTag = flow.belongTo.serviceTag;
+        }
+      }
+      if (!quotaServiceTag && flow.objType?.serviceTag) {
+        quotaServiceTag = flow.objType.serviceTag;
+      }
+      if (!quotaServiceTag) {
+        quotaServiceTag = state.project?.serviceTag || 'Rbac';
+      }
+      return {
+        roleName: upperFirst(flow.flowTag),
+        quotaServiceTag
+      };
+    });
   const rbacValidatorServiceTags = getRbacValidatorServiceTags(state);
   return renderResourceTemplate('GeneratedLambdaRoleServiceConfig.ejs', {
     crud: state.crud,
@@ -160,6 +177,19 @@ export function roleStatements(state, roleName) {
       ]
     });
   }
+  if (roleName === 'FlowRbacRole' && state.selfRbac) {
+    statements.push({
+      action: [
+        'dynamodb:DescribeStream',
+        'dynamodb:GetRecords',
+        'dynamodb:GetShardIterator',
+        'dynamodb:ListStreams'
+      ],
+      resource: [
+        'arn:aws:dynamodb:${self:custom.iz_region}:${self:custom.iz_accountId}:table/${self:custom.iz_resourcePrefix}RunningTotalReservedUsage/stream/*'
+      ]
+    });
+  }
   return statements;
 }
 
@@ -369,7 +399,7 @@ export function roleDlqQueueNames(state, roleName) {
 export function roleTopicNames(state, roleName) {
   if (roleName === 'ProcFindDataRole') {
     return state.outTopics
-      .filter((topic) => topic === 'FindData')
+      .filter((topic) => topic === 'FindData' || topic === 'ProcessLogical')
       .map((t) => `${t}_Out`);
   }
   if (roleName === 'FlowObjectsRole') {
@@ -508,11 +538,16 @@ export function roleExternalTopicArns(state, roleName) {
       `arn:aws:sns:\${self:custom.iz_region}:\${self:custom.iz_accountId}:${tag}_\${self:custom.iz_stage}_ValidatorRbac_In`
   );
   if (roleName === 'FlowObjectsRole') {
+    const extraCrudTopics = extraTags.flatMap((tag) => [
+      `arn:aws:sns:\${self:custom.iz_region}:\${self:custom.iz_accountId}:${tag}_\${self:custom.iz_stage}_ValidatorRbac_In`,
+      `arn:aws:sns:\${self:custom.iz_region}:\${self:custom.iz_accountId}:${tag}_\${self:custom.iz_stage}_ConfirmUsage_In`,
+      `arn:aws:sns:\${self:custom.iz_region}:\${self:custom.iz_accountId}:${tag}_\${self:custom.iz_stage}_CancelUsage_In`
+    ]);
     return [
       `arn:aws:sns:\${self:custom.iz_region}:\${self:custom.iz_accountId}:Rbac_\${self:custom.iz_stage}_ValidatorRbac_In`,
       `arn:aws:sns:\${self:custom.iz_region}:\${self:custom.iz_accountId}:Rbac_\${self:custom.iz_stage}_ConfirmUsage_In`,
       `arn:aws:sns:\${self:custom.iz_region}:\${self:custom.iz_accountId}:Rbac_\${self:custom.iz_stage}_CancelUsage_In`,
-      ...extraTopics
+      ...extraCrudTopics
     ];
   }
   if (roleName === 'FlowRbacRole' || roleName === 'FlowRelationshipRole') {
@@ -536,11 +571,16 @@ export function roleExternalLambdaArns(state, roleName) {
       `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:${tag}\${self:custom.iz_stage}ValidatorRbacHdrInv`
   );
   if (roleName === 'FlowObjectsRole') {
+    const extraCrudLambdas = extraTags.flatMap((tag) => [
+      `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:${tag}\${self:custom.iz_stage}ValidatorRbacHdrInv`,
+      `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:${tag}\${self:custom.iz_stage}ConfirmUsageHdrInv`,
+      `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:${tag}\${self:custom.iz_stage}CancelUsageHdrInv`
+    ]);
     return [
       `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:Rbac\${self:custom.iz_stage}ValidatorRbacHdrInv`,
       `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:Rbac\${self:custom.iz_stage}ConfirmUsageHdrInv`,
       `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:Rbac\${self:custom.iz_stage}CancelUsageHdrInv`,
-      ...extraLambdas
+      ...extraCrudLambdas
     ];
   }
   if (roleName === 'FlowRbacRole' || roleName === 'FlowRelationshipRole') {