@izara_project/izara-market-library-service-schemas 1.0.18 → 1.0.20

package/src/TemplateManager/src/RelationshipPerAction/UpdateRelationshipSchema/updateRelationship/functionYaml/HdrSqs/template.ejs

@@ -6,20 +6,7 @@
     - sqs:
         arn: arn:aws:sqs:${self:custom.iz_region}:${self:custom.iz_accountId}:${self:custom.iz_resourcePrefix}<%- firstLetterUpperCase(functionName) %><%- firstLetterUpperCase(handlerType) %>
         batchSize: 10
-  iamRoleStatements:
-    <%_ additionalResourcePermission.forEach(resourcePermission => { _%>
-    - Effect: <%- resourcePermission.effect %>
-      Action:
-        <%_ Object.keys(resourcePermission.action).forEach(resourcePerAction => { _%>
-        <%_ resourcePermission.action[resourcePerAction].forEach(permission => { _%>
-        - <%- resourcePerAction %>:<%- permission %>
-        <%_}) _%>
-        <%_ }) _%>
-      Resource:
-        <%_ resourcePermission.resource.forEach(resource => { _%>
-        - <%- resource %>
-        <%_ }) _%>
-    <%_}) _%>
+  role: <%- roleName %>Role
     #<#<%- functionName %><%- handlerType %>IamRole#>
     #<#/<%- functionName %><%- handlerType %>IamRole#>
 <%_ function firstLetterUpperCase(text){

package/src/TemplateManager/src/Role/createSharedResource.js

@@ -0,0 +1,270 @@
+/*
+Copyright (C) 2020 Sven Mason <http://izara.io>
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+'use strict';
+const { SOURCE_GENERATE_IAM_ROLE, SOURCE_PATH, SAVE_FILE_NAME } = require('../libs/Consts');
+const { firstLetterUpperCase: upperCase } = require("../../../MainLibs/src/Utils")
+const path = require('path');
+
+/**
+ * Process additional resource permissions for an object type
+ * @param {Array} resourcePermissions - Array of resource permissions to process
+ * @param {Object} targetResources - Resources object to update
+ */
+const processResourcePermissions = (resourcePermissions, targetResources) => {
+  if (!Array.isArray(resourcePermissions)) return;
+  resourcePermissions.forEach(resourcePermission => {
+    if (!resourcePermission.action) return;
+    const [key, value] = Object.entries(resourcePermission.action)[0];
+    if (!targetResources[key]) {
+      targetResources[key] = [];
+    }
+    const actionsList = Array.isArray(value) ? value : [value];
+    const resourcesList = Array.isArray(resourcePermission.resource)
+      ? resourcePermission.resource
+      : [resourcePermission.resource];
+    // Check if entry with same actions exists
+    const existingEntry = targetResources[key].find(entry =>
+      JSON.stringify(entry.actions) === JSON.stringify(actionsList)
+    );
+    if (existingEntry) {
+      // Merge resources without duplicates
+      existingEntry.resource = [
+        ...new Set([...existingEntry.resource, ...resourcesList])
+      ];
+    } else {
+      // Add new entry
+      targetResources[key].push({
+        actions: actionsList,
+        resource: resourcesList
+      });
+    }
+  });
+};
+/**
+ * Check if an item should be skipped based on templateData content
+ * @param {Object} templateData - Template data to check
+ * @returns {Boolean} True if item should be skipped
+ */
+const shouldSkipItem = (templateData) => {
+  return !templateData ||
+    Object.keys(templateData).length === 0 ||
+    !templateData.additionalResourcePermission;
+};
+/**
+ * Initialize object type structure if it doesn't exist
+ * @param {Object} groupedByObjectType - The grouped object
+ * @param {String} objectType - Object type to initialize
+ * @param {Array} objectTypeList - List to track object types
+ */
+const initializeObjectType = (groupedByObjectType, objectType, objectTypeList) => {
+  if (!groupedByObjectType[objectType]) {
+    groupedByObjectType[objectType] = {
+      functionNames: [],
+      actions: [],
+      resources: {},
+      actionHandler: []
+    };
+    objectTypeList.push(objectType);
+  }
+};
+module.exports.createSharedResource = (_izContext, createSourceParams, srcPath) => {
+  // Initialize data structure
+  const groupedByObjectType = {
+    [SOURCE_GENERATE_IAM_ROLE.ProcessFindDataRole]: {
+      handlerType: [],
+      resources: {}
+    },
+    [SOURCE_GENERATE_IAM_ROLE.ObjectCompleteRole]: {
+      functionNames: [],
+      handlerType: [],
+      resources: {}
+    },
+    [SOURCE_GENERATE_IAM_ROLE.RelationshipRole]: {
+      handlerType: [],
+      resources: {}
+    },
+    [SOURCE_GENERATE_IAM_ROLE.RelationshipCompleteRole]: {
+      handlerType: [],
+      resources: []
+    },
+    Other: []
+  };
+  const objectTypeList = [];
+  // Ensure data is defined - assuming it comes from createSourceParams
+  const data = createSourceParams || [];
+  // Process each item in data
+  data.map((item) => {
+    const templateData = item.templateData;
+    if (shouldSkipItem(templateData)) return;
+    if (templateData.objectType) {
+      // Handle items with objectType
+      initializeObjectType(groupedByObjectType, templateData.objectType, objectTypeList);
+      // Add function name if it doesn't exist
+      if (templateData.functionName &&
+        !groupedByObjectType[templateData.objectType].functionNames?.includes(templateData.functionName)) {
+        groupedByObjectType[templateData.objectType].functionNames.push(templateData.functionName);
+      }
+      // Add action if it doesn't exist
+      if (templateData.action !== null &&
+        !groupedByObjectType[templateData.objectType].actions.includes(templateData.action)) {
+        groupedByObjectType[templateData.objectType].actions.push(templateData.action);
+      }
+      // Process additionalResourcePermission
+      processResourcePermissions(
+        templateData.additionalResourcePermission,
+        groupedByObjectType[templateData.objectType].resources
+      );
+    }
+    else if (templateData.functionName &&
+      (templateData.functionName.includes('ObjectComplete') ||
+        templateData.functionName.includes('NodeComplete'))) {
+      // Handle ObjectComplete items
+      groupedByObjectType[SOURCE_GENERATE_IAM_ROLE.ObjectCompleteRole].functionNames.push(templateData.functionName);
+      groupedByObjectType[SOURCE_GENERATE_IAM_ROLE.ObjectCompleteRole].handlerType.push(templateData.handlerType);
+      processResourcePermissions(
+        templateData.additionalResourcePermission,
+        groupedByObjectType[SOURCE_GENERATE_IAM_ROLE.ObjectCompleteRole].resources
+      );
+    }
+    else if (templateData.functionName && templateData.functionName.includes([SOURCE_GENERATE_IAM_ROLE.RelationshipRole])) {
+      if (templateData.functionName.includes([SOURCE_GENERATE_IAM_ROLE.RelationshipCompleteRole])) {
+        // Handle RelationshipComplete items
+        if (templateData.handlerType &&
+          !groupedByObjectType[SOURCE_GENERATE_IAM_ROLE.RelationshipCompleteRole].handlerType.includes(templateData.handlerType)) {
+          groupedByObjectType[SOURCE_GENERATE_IAM_ROLE.RelationshipCompleteRole].handlerType.push(templateData.handlerType);
+        }
+        processResourcePermissions(
+          templateData.additionalResourcePermission,
+          groupedByObjectType[SOURCE_GENERATE_IAM_ROLE.RelationshipCompleteRole].resources
+        );
+      } else {
+        // Handle regular Relationship items
+        if (templateData.handlerType &&
+          !groupedByObjectType[SOURCE_GENERATE_IAM_ROLE.RelationshipRole].handlerType.includes(templateData.handlerType)) {
+          groupedByObjectType[SOURCE_GENERATE_IAM_ROLE.RelationshipRole].handlerType.push(templateData.handlerType);
+        }
+        processResourcePermissions(
+          templateData.additionalResourcePermission,
+          groupedByObjectType[SOURCE_GENERATE_IAM_ROLE.RelationshipRole].resources
+        );
+      }
+    }
+    else if (templateData.functionName &&
+      (templateData.functionName.includes('PaginateProcessLogical') ||
+        templateData.functionName.includes('FindData') ||
+        templateData.functionName.includes('ProcessLogical'))) {
+      // Handle ProcessFindData items
+      groupedByObjectType.ProcessFindData.handlerType.push(templateData.handlerType);
+      processResourcePermissions(
+        templateData.additionalResourcePermission,
+        groupedByObjectType.ProcessFindData.resources
+      );
+    }
+    else {
+      // Handle other items
+      groupedByObjectType.Other.push(item);
+    }
+    return item;
+  });
+  // Process "Other" items that might belong to existing object types
+  groupedByObjectType.Other = groupedByObjectType.Other.filter(item => {
+    const templateData = item.templateData;
+    if (!templateData.functionName) return true;
+    // Find matching objectType
+    const matchedObjectType = objectTypeList.find(objectType =>
+      templateData.functionName.toLowerCase().includes(objectType.toLowerCase()) ||
+      templateData.functionName.includes(objectType.charAt(0).toUpperCase() + objectType.slice(1))
+    );
+    if (matchedObjectType) {
+      // Move the item to the matched object type
+      groupedByObjectType[matchedObjectType].actionHandler.push(templateData.handlerType);
+      groupedByObjectType[matchedObjectType].resources = {
+        ...groupedByObjectType[matchedObjectType].resources,
+        ...templateData.additionalResourcePermission
+      };
+      return false; // Remove from Other
+    }
+    return true; // Keep in Other
+  });
+  // Prepare results
+
+
+  // Process and prepare data for role definitions and extract any resources
+  // that might be related to object types but weren't categorized properly
+  const roles = [];
+  const otherResources = []
+  Object.entries(groupedByObjectType).forEach(([objectType, data]) => {
+    if (objectType === 'Other' || !data.resources) return;
+    // สร้าง policy statements จาก resources
+    const rolePolicyStatement = [];
+    Object.entries(data.resources).forEach(([effect, permissionList]) => {
+      if (!Array.isArray(permissionList)) {
+        // permissionList might be in a different format
+        if (typeof permissionList === 'object' && !Array.isArray(permissionList)) {
+          // Handle non-standard format
+          const actions = [];
+          if (permissionList.action) {
+            const actionObj = permissionList.action;
+            Object.entries(actionObj).forEach(([service, actionList]) => {
+              const actionArray = Array.isArray(actionList) ? actionList : [actionList];
+              actionArray.forEach(action => actions.push(`${service}:${action}`));
+            });
+          }
+          rolePolicyStatement.push({
+            Effect: permissionList.effect || 'Allow',
+            Action: actions,
+            Resource: permissionList.resource
+          });
+          return;
+        }
+        rolePolicyStatement.push({
+          Effect: permissionList.effect,
+          Action: actions,
+          Resource: permission.resource
+        });
+        return;
+      };
+      permissionList.forEach(permission => {
+        const actions = permission.actions.map(action => `${effect}:${action}`);
+        rolePolicyStatement.push({
+          Effect: 'Allow',
+          Action: actions,
+          Resource: permission.resource
+        });
+      });
+    });
+    if (rolePolicyStatement.length > 0) {
+      roles.push({
+        roleName: upperCase(objectType),
+        rolePolicyStatement
+      });
+    }
+  });
+  const reformattedData = {
+    roles,
+  };
+  const sharedResourceTemplatePath = path.join(__dirname, './sharedResourceTemplate.ejs')
+
+  return {
+    templatePath: sharedResourceTemplatePath,
+    templateData: reformattedData,
+    setting: {
+      initialData: 'Resources:\n',
+      savePath: path.join(srcPath, SOURCE_PATH.appYaml),
+      saveFileName: SAVE_FILE_NAME.sharedResourceYaml,
+      fileExtension: '.yml',
+      isAppend: true
+    }
+  }
+};

package/src/TemplateManager/src/Role/sharedResourceTemplate.ejs

@@ -0,0 +1,58 @@
+#IAM Role for Upload Schema functionality
+  UploadSchemaRole:
+    Type: AWS::IAM::Role
+    Properties:
+      RoleName: ${self:custom.iz_resourcePrefix}UploadSchemaRole
+      AssumeRolePolicyDocument:
+        Version: "2012-10-17"
+        Statement:
+          - Effect: Allow
+            Principal:
+              Service: "lambda.amazonaws.com"
+            Action: sts:AssumeRole
+      # this is the managed policy for lambda basic execution ex. logging to cloudwatch
+      ManagedPolicyArns:
+        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
+        - arn:aws:iam::${self:custom.iz_accountId}:policy/UploadSchemaSharedPolicy
+      Policies:
+        - PolicyName: ${self:custom.iz_resourcePrefix}UploadSchemaPolicy
+          PolicyDocument:
+            Version: "2012-10-17"
+            Statement:
+              - Effect: Allow
+                Action:
+                  - s3:PutObject
+                  - s3:GetObject
+                  - s3:ListBucket
+                Resource:
+                  - arn:aws:s3:::object-schema/*
+                  - arn:aws:s3:::object-schema/perServiceSchemas/${self:custom.iz_serviceTag}/*
+<% if (roles && roles.length > 0) { -%>
+<% roles.forEach(function(role) { %>
+  <%= role.roleName %>Role:
+    Type: AWS::IAM::Role
+    Properties:
+      RoleName: ${self:custom.iz_resourcePrefix}<%= role.roleName %>Role
+      AssumeRolePolicyDocument:
+        Version: "2012-10-17"
+        Statement:
+          - Effect: Allow
+            Principal:
+              Service: "lambda.amazonaws.com"
+            Action: sts:AssumeRole
+      ManagedPolicyArns:
+        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
+      Policies:
+        - PolicyName: ${self:custom.iz_resourcePrefix}<%= role.roleName %>Policy
+          PolicyDocument:
+            Version: "2012-10-17"
+            Statement:<% role.rolePolicyStatement.forEach(function(statement) { %>
+              - Effect: <%= statement.Effect %><%_ if (Array.isArray(statement.Action)) { %>
+                Action:<% statement.Action.forEach(function(action) { %>
+                  - <%= action %><% }); %><% } else { %>Action: <%= statement.Action %><% } -%>
+                <% if (Array.isArray(statement.Resource)) { %>
+                Resource:<% statement.Resource.forEach(function(resource) { %>
+                  - <%= resource -%><% }); %><% } else { %>
+                Resource: <%= statement.Resource %><% } %><% }); %>
+  <% }); %>
+<% } %>

package/src/TemplateManager/src/TranslateIdReq/TranslateIds/functionYaml/HdrDsq/data.js

@@ -50,7 +50,7 @@ function createTranslateIdFunctionYamlHdrDsq(srcPath) {
         ],
         [RESOURCE_CLASSES.sns]:
           [
-            SNS_RESOURCE.publish, SNS_RESOURCE.subscription
+            SNS_RESOURCE.publish, SNS_RESOURCE.subscribe
           ]
       },
       [

package/src/TemplateManager/src/TranslateIdReq/TranslateIds/functionYaml/HdrSqs/data.js

@@ -50,7 +50,7 @@ function createTranslateIdFunctionYmlHdrSqs(srcPath) {
         ],
         [RESOURCE_CLASSES.sns]:
           [
-            SNS_RESOURCE.publish, SNS_RESOURCE.subscription
+            SNS_RESOURCE.publish, SNS_RESOURCE.subscribe
           ]
       },
       [

package/src/TemplateManager/src/externalService/LambdaRole/data.js

@@ -25,12 +25,12 @@ const { getGraphServiceNameFromGraphServerTagWithCache,
 } = require('@izara_project/izara-core-library-service-schemas/src/ServiceConfig')
 
 const { firstLetterLowerCase: lowerCase, firstLetterUpperCase: upperCase } = require("../../../../MainLibs/src/Utils")
-const { DEFAULT_HANDLER_PER_ACTION, createIamRole, RESOURCE_CLASSES, SOURCE_PATH, externalResourceName, externalResourceSns, getGraphServiceNameFromAllRelSchema, SAVE_FILE_NAME, LAMBDA_RESOURCE, SNS_RESOURCE, getGraphServiceNameFromObjectSchema, shortNameHandler, SHORT_FUNCTION_NAME, defaultIamRolePerAction } = require("../../libs/Consts");
+const { DEFAULT_HANDLER_PER_ACTION, createIamRole, RESOURCE_CLASSES, SOURCE_PATH, externalResourceName, getGraphServiceNameFromAllRelSchema, SAVE_FILE_NAME, LAMBDA_RESOURCE, SNS_RESOURCE, getGraphServiceNameFromObjectSchema, shortNameHandler, SHORT_FUNCTION_NAME, defaultIamRolePerAction, resourceNames } = require("../../libs/Consts");
 // const templatePath = path.join(__dirname, "./template.ejs");
 const templatePath = path.join(__dirname, "./template.ejs");
 const { getAllLocalRelationshipSchemas } = require('@izara_project/izara-core-library-service-schemas/src/GetObjectSchema')
-
-const createExternalLambdaRole = async (_izContext, allObjSchemas, allRelSchemas, srcPath) => {
+const { EXTERNAL_SERVICE_NAME } = require("../../../../GenerateCodeLibs/src/Consts")
+const createExternalLambdaRole = async (_izContext, allObjSchemas, allRelSchemas, allLocalFlowSchemas, srcPath) => {
   const allRelationshipSchemas = getAllLocalRelationshipSchemas(_izContext, srcPath)
   // console.log("allRelationshipSchemas", allRelationshipSchemas);
   const externalLambdaIamRoleArray = [];
@@ -88,7 +88,25 @@ const createExternalLambdaRole = async (_izContext, allObjSchemas, allRelSchemas
     externalLambdaIamRoleProcessLogical && externalLambdaIamRoleArray.push(externalLambdaIamRoleProcessLogical)
   }
 
-  console.log("externalLambdaIamRoleArray", externalLambdaIamRoleArray)
+  if (allLocalFlowSchemas) {
+    for (const localFlowSchema of allLocalFlowSchemas) {
+      if (localFlowSchema.hasOwnProperty("uploadS3") && localFlowSchema.uploadS3 === true) {
+        const externalLambdaIamRoleGetPresignUrl = await externalLambdaIamRoleDataGetPresignUrl(_izContext);
+        externalLambdaIamRoleGetPresignUrl && externalLambdaIamRoleArray.push(externalLambdaIamRoleGetPresignUrl);
+
+        const externalLambdaIamRoleReservedLimitComplete = await externalLambdaIamRoleDataReservedLimitComplete(_izContext);
+        externalLambdaIamRoleReservedLimitComplete && externalLambdaIamRoleArray.push(externalLambdaIamRoleReservedLimitComplete);
+
+        const externalLambdaIamRoleProcessAfterUpload = await externalLambdaIamRoleDataProcessAfterUpload(_izContext);
+        externalLambdaIamRoleProcessAfterUpload && externalLambdaIamRoleArray.push(externalLambdaIamRoleProcessAfterUpload);
+
+        const externalLambdaIamRoleConfirmReservedAfterUpload = await externalLambdaIamRoleDataConfirmReservedAfterUpload(_izContext);
+        externalLambdaIamRoleConfirmReservedAfterUpload && externalLambdaIamRoleArray.push(externalLambdaIamRoleConfirmReservedAfterUpload);
+      }
+    }
+  }
+
+  // console.log("externalLambdaIamRoleArray", externalLambdaIamRoleArray)
   // console.log("createSourceArrayIamRole", JSON.stringify(externalLambdaIamRoleArray))
   // return externalLambdaIamRoleArray
 
@@ -141,7 +159,7 @@ async function externalLambdaIamRoleDataPerAction(_izContext, objectSchema, acti
             [RESOURCE_CLASSES.sns]: [SNS_RESOURCE.publish]
           },
           graphServiceNames.map(graphServiceName =>
-            externalResourceSns("InUpdateNode", graphServiceName)
+            externalResourceName(RESOURCE_CLASSES.sns, "InUpdateNode", graphServiceName)
           )
         )
       )
@@ -153,7 +171,7 @@ async function externalLambdaIamRoleDataPerAction(_izContext, objectSchema, acti
             [RESOURCE_CLASSES.sns]: [SNS_RESOURCE.publish]
           },
           graphServiceNames.map(graphServiceName =>
-            externalResourceSns("InCreateNodeV2", graphServiceName)
+            externalResourceName(RESOURCE_CLASSES.sns, "InCreateNodeV2", graphServiceName)
           )
         )
       )
@@ -197,7 +215,7 @@ async function externalLambdaIamRoleDataUpdateRelationshipSchema(_izContext, all
         [RESOURCE_CLASSES.sns]: [SNS_RESOURCE.publish]
       },
       graphServiceNamesFromAllRelSchemas.map(graphServiceName =>
-        externalResourceSns("InUpdateRelationship", graphServiceName)
+        externalResourceName(RESOURCE_CLASSES.sns, "InUpdateRelationship", graphServiceName)
       )
     )
   )
@@ -222,7 +240,7 @@ async function externalLambdaIamRoleDataCreateRelationshipSchema(_izContext, all
         [RESOURCE_CLASSES.sns]: [SNS_RESOURCE.publish]
       },
       graphServiceNamesFromAllRelSchemas.map(graphServiceName =>
-        externalResourceSns("InCreateRelationshipV2", graphServiceName)
+        externalResourceName(RESOURCE_CLASSES.sns, "InCreateRelationshipV2", graphServiceName)
       )
     )
   )
@@ -244,7 +262,7 @@ async function externalLambdaIamRoleDataDeleteRelationshipSchema(_izContext, all
         [RESOURCE_CLASSES.sns]: [SNS_RESOURCE.publish]
       },
       graphServiceNamesFromAllRelSchemas.map(graphServiceName =>
-        externalResourceSns("InDeleteRelationshipV2", graphServiceName)
+        externalResourceName(RESOURCE_CLASSES.sns, "InDeleteRelationshipV2", graphServiceName)
       )
     )
   )
@@ -297,4 +315,96 @@ async function externalLambdaIamRoleDataProcessLogical(_izContext, allObjectSche
   }
 }
 
+function externalLambdaIamRoleDataGetPresignUrl(_izContext) {
+  let functionName = "GetPresignUrl" + upperCase(shortNameHandler(HANDLER.hdrSqs));
+  let additionalResourcePermission = [];
+
+  additionalResourcePermission.push(
+    createIamRole(
+      {
+        [RESOURCE_CLASSES.sns]: [SNS_RESOURCE.publish]
+      },
+      [
+        externalResourceName(RESOURCE_CLASSES.sns, "InReservedDynamicUsage", EXTERNAL_SERVICE_NAME.accountLimits)
+      ]
+    ),
+    createIamRole(
+      {
+        [RESOURCE_CLASSES.lambda]: [LAMBDA_RESOURCE.invokeFunction]
+      },
+      [
+        externalResourceName(RESOURCE_CLASSES.lambda, "StaticLimitProcessHdrInv", EXTERNAL_SERVICE_NAME.accountLimits)
+      ]
+    )
+  )
+  // console.log("additionalResourcePermission GetPresignUrl::", JSON.stringify(additionalResourcePermission))
+  return {
+    functionName,
+    additionalResourcePermission
+  }
+}
+
+function externalLambdaIamRoleDataReservedLimitComplete(_izContext) {
+  let functionName = "ReservedLimitComp" + upperCase(shortNameHandler(HANDLER.hdrSqs));
+  let additionalResourcePermission = [];
+
+  additionalResourcePermission.push(
+    createIamRole(
+      {
+        [RESOURCE_CLASSES.sns]: [SNS_RESOURCE.publish]
+      },
+      [
+        externalResourceName(RESOURCE_CLASSES.sns, "InCancelUsage", EXTERNAL_SERVICE_NAME.accountLimits)
+      ]
+    )
+  )
+  return {
+    functionName,
+    additionalResourcePermission
+  }
+}
+
+function externalLambdaIamRoleDataConfirmReservedAfterUpload(_izContext) {
+  let functionName = "ConfirmNewReserved" + upperCase(shortNameHandler(HANDLER.hdrSqs));
+  let additionalResourcePermission = []
+
+  additionalResourcePermission.push(
+    createIamRole(
+      {
+        [RESOURCE_CLASSES.sns]: [SNS_RESOURCE.publish]
+      },
+      [
+        externalResourceName(RESOURCE_CLASSES.sns, "OutReservedDynamicUsageComplet", EXTERNAL_SERVICE_NAME.accountLimits),
+        externalResourceName(RESOURCE_CLASSES.sns, "InConfirmUsage", EXTERNAL_SERVICE_NAME.accountLimits)
+      ]
+    ),
+  )
+  return {
+    functionName,
+    additionalResourcePermission
+  }
+}
+
+function externalLambdaIamRoleDataProcessAfterUpload(_izContext) {
+  let functionName = "ProcessAfterUploadS3" + shortNameHandler(upperCase("HdrS3"));
+  let additionalResourcePermission = []
+
+  additionalResourcePermission.push(
+    createIamRole(
+      {
+        [RESOURCE_CLASSES.sns]: [SNS_RESOURCE.publish]
+      },
+      [
+        externalResourceName(RESOURCE_CLASSES.sns, "InCancelUsage", EXTERNAL_SERVICE_NAME.accountLimits),
+        externalResourceName(RESOURCE_CLASSES.sns, "InConfirmUsage", EXTERNAL_SERVICE_NAME.accountLimits),
+        externalResourceName(RESOURCE_CLASSES.sns, "InReservedDynamicUsage", EXTERNAL_SERVICE_NAME.accountLimits),
+      ]
+    )
+  )
+  return {
+    functionName,
+    additionalResourcePermission
+  }
+}
+
 module.exports = createExternalLambdaRole;

package/src/TemplateManager/src/externalService/LambdaRole/template.ejs

@@ -41,12 +41,11 @@ module.exports.generatedLambdaRole = async () => {
             <%_ resourcePermission.action[resourcePerAction].forEach(permission => { _%>
             "<%- resourcePerAction %>:<%- permission %>",
           ],
-        "Resource":
+        "Resource":[
           <%_ resourcePermission.resource.forEach(resource => { _%>
-          [
             `<%- resource _%>`,
-          ],
-          <%_ }) _%>
+            <%_ }) _%>
+            ]
         <%_ }) _%>
         <%_ }) _%>
         }<% if(resourceIdx < data.additionalResourcePermission.length-1) {_%>, <%_} %>

package/src/TemplateManager/src/externalService/SnsTopicSubscriotions/data.js

@@ -23,14 +23,11 @@ const { ACTIONS, HANDLER, STORAGE_TYPES } = require('@izara_project/izara-core-l
 const { getGraphServiceNameFromGraphServerTagWithCache, getServiceNameWithCache } = require('@izara_project/izara-core-library-service-schemas/src/ServiceConfig')
 const { firstLetterLowerCase: lowerCase, firstLetterUpperCase: upperCase } = require("../../../../MainLibs/src/Utils")
 const { DEFAULT_HANDLER_PER_ACTION, createIamRole, resourceNames, RESOURCE_CLASSES, DEFAULT_LAMBDA_ROLE_PER_ACTION, SOURCE_PATH, externalResourceName, getGraphServiceNameFromAllRelSchema, FUNCTION_NAME, SAVE_FILE_NAME, getGraphServiceNameFromObjectSchema } = require("../../libs/Consts");
-const {
-  TOPIC_NAME_GRAPH_HANDLER,
-  TOPIC_NAME_GENERATE_CODE
-} = require('../../../../GenerateCodeLibs/src/Consts')
+const { TOPIC_NAME_GRAPH_HANDLER, TOPIC_NAME_GENERATE_CODE, EXTERNAL_SERVICE_NAME, TOPIC_NAME_EXTERNAL_SERVICE } = require('../../../../GenerateCodeLibs/src/Consts')
 const templatePath = path.join(__dirname, "./template.ejs");
 
 
-const createExternalSnsSubscriptions = async (_izContext, allObjSchemas, allRelSchemas, srcPath) => {
+const createExternalSnsSubscriptions = async (_izContext, allObjSchemas, allRelSchemas, allLocalFlowSchemas, srcPath) => {
   const snsServiceConfigArray = [];
 
   const snsServiceConfigUpdateRelationshipComplete = await snsSubScriptionUpdateRelationshipComplete(_izContext, allRelSchemas)
@@ -51,7 +48,18 @@ const createExternalSnsSubscriptions = async (_izContext, allObjSchemas, allRelS
   const snsServiceConfigDeleteNodeComplete = await snsSubscriptionDeleteNodeComplate(_izContext, allObjSchemas)
   snsServiceConfigDeleteNodeComplete && snsServiceConfigArray.push(snsServiceConfigDeleteNodeComplete);
 
+  if (allLocalFlowSchemas) {
+    for (const flowSchema of allLocalFlowSchemas) {
+      if (flowSchema.hasOwnProperty("uploadS3") && flowSchema.uploadS3 === true) {
+        const snsServiceConfigForReservedDynamicUsage = await snsSubscriptionReservedLimitCompleteForReservedDynamicUsage(_izContext);
+        snsServiceConfigForReservedDynamicUsage && snsServiceConfigArray.push(snsServiceConfigForReservedDynamicUsage);
 
+        const snsServiceConfigForConfirmReserved = await snsSubscriptionConfirmReserved(_izContext);
+        snsServiceConfigForConfirmReserved && snsServiceConfigArray.push(snsServiceConfigForConfirmReserved);
+      }
+    }
+  }
+  // console.log("snsServiceConfigArray::", snsServiceConfigArray)
 
   return {
     templatePath: templatePath,
@@ -129,7 +137,24 @@ async function snsSubscriptionDeleteRelatipnshipComplete(_izContext, allRelSchem
     sqsEndpoint: TOPIC_NAME_GENERATE_CODE.deleteRelComplete
   }
 }
-// not done yet wait for comfirmation
 
+function snsSubscriptionReservedLimitCompleteForReservedDynamicUsage(_izContext) {
+  let serviceNames = [EXTERNAL_SERVICE_NAME.accountLimits]
+  return {
+    serviceNames: serviceNames,
+    topicName: TOPIC_NAME_EXTERNAL_SERVICE.reservedDynamicUsageComplete,
+    sqsEndpoint: TOPIC_NAME_GENERATE_CODE.reservedLimitComplete + upperCase(HANDLER.hdrSqs)
+  }
+}
+
+
+function snsSubscriptionConfirmReserved(_izContext) {
+  let serviceNames = [EXTERNAL_SERVICE_NAME.accountLimits];
+  return {
+    serviceNames: serviceNames,
+    topicName: TOPIC_NAME_EXTERNAL_SERVICE.reservedDynamicUsageComplete,
+    sqsEndpoint: "ConfirmNewReserved" + upperCase(HANDLER.hdrSqs)
+  }
+}
 
 module.exports = createExternalSnsSubscriptions;