How thaikhangvip123/cloud-service works
This is a serverless, group-based Just-in-Time AWS access portal. Jira requests enter through API Gateway and the executor validates and provisions temporary Identity Center group membership, records an active session, updates Jira, and schedules expiry. Expiry removes membership and archives the session; a documented SIT-only DynamoDB TTL stream is a fallback. A separate email-approval path issues single-use signed links and updates Jira. Terraform establishes the permanent permission sets, groups, and assignments. The workflow and optional email path are documented; unsampled Terraform wiring is represented only where the README states it.
Main entry points: executor/handler.py Request executor · email_approval/handler.py Email approval handler · expiry/handler.py Expiry handler · email_notification.py Email notifier
Components 23
Request handling
- Request executor
infrastructure/lambda_functions/executor/handler.py - Webhook validation
infrastructure/shared/webhook_auth.py
JIT access domain
- JIT access manager
infrastructure/shared/jit_access.py - Access group mapping
infrastructure/shared/account_mapping.py - Identity Center client
infrastructure/shared/identity_center.py - Jira client
infrastructure/shared/jira_client.py - Email notifier
infrastructure/shared/email_notification.py
Session state and expiry
- Session repository
infrastructure/shared/dynamodb_session.py - Active sessions
- Expiry scheduler
infrastructure/shared/scheduler.py - Expiry handler
infrastructure/lambda_functions/expiry/handler.py
Email approval
- Email approval handler
infrastructure/lambda_functions/email_approval/handler.py - Approval tokens
infrastructure/shared/approval_tokens.py - Token records
AWS foundation
- Terraform access foundation
infrastructure/terraform - Permission sets and assignments
infrastructure/terraform/modules/identity-center-permission-sets/main.tf
Other components
- Jira requester
- API Gateway
- EventBridge Scheduler
- DynamoDB TTL stream
- Amazon SES
- Email approver
- Secrets Manager
Connections 30
- Jira requester → API Gateway: submits request
README.md - API Gateway → Request executor: routes webhook
README.md - Request executor → Webhook validation: validates request
infrastructure/lambda_functions/executor/handler.py - Request executor → JIT access manager: provisions access
infrastructure/lambda_functions/executor/handler.py - Request executor → Session repository: stores session
infrastructure/lambda_functions/executor/handler.py - Request executor → Jira client: updates request
README.md - Request executor → Email notifier: sends grant notice
infrastructure/lambda_functions/executor/handler.py - JIT access manager → Access group mapping: resolves group
infrastructure/shared/jit_access.py - JIT access manager → Identity Center client: changes membership
README.md - Session repository → Active sessions: reads and writes
README.md - Request executor → Expiry scheduler: schedules expiry
infrastructure/lambda_functions/executor/handler.py - Expiry scheduler → EventBridge Scheduler: creates schedule
README.md - EventBridge Scheduler → Expiry handler: invokes at expiry
README.md - DynamoDB TTL stream → Expiry handler: fallback trigger
README.md - Expiry handler → Session repository: loads and archives
infrastructure/lambda_functions/expiry/handler.py - Expiry handler → Identity Center client: removes membership
infrastructure/lambda_functions/expiry/handler.py - Expiry handler → Jira client: marks expired
infrastructure/lambda_functions/expiry/handler.py - Expiry handler → Email notifier: sends expiry notice
infrastructure/lambda_functions/expiry/handler.py - Email notifier → Amazon SES: delivers email
infrastructure/shared/email_notification.py - Jira requester → Email approval handler: requests approval
README.md - Email approval handler → Approval tokens: generates tokens
infrastructure/lambda_functions/email_approval/handler.py - Email approval handler → Session repository: stores token records
infrastructure/lambda_functions/email_approval/handler.py - Approval tokens → Token records: verifies single use
- Email approval handler → Email notifier: sends approval link
infrastructure/lambda_functions/email_approval/handler.py - Amazon SES → Email approver: delivers link
- Email approver → Email approval handler: opens action link
README.md - Email approval handler → Jira client: records decision
infrastructure/lambda_functions/email_approval/handler.py - Request executor → Secrets Manager: loads credentials
README.md - Email approval handler → Secrets Manager: loads approval secrets
README.md - Terraform access foundation → Permission sets and assignments: defines access model
README.md