Configuration and secrets

Configuration has three layers:

  1. samconfig.toml picks the stack, the environment and whether triggers are on.

  2. template.yaml, mapping EnvironmentSettings, holds per-environment values and passes them to every function as environment variables.

  3. The common/crm secret in Secrets Manager holds credentials. It is shared with other applications.

Changing any of them is a pull request; the deploy workflow applies it.

samconfig.toml

Setting [dev] [prod]

stack_name

eventlogger-rules-dev

eventlogger-rules-prod

EnvironmentName

stage

prod

EnableTriggers

true

false until the cutover

Both deploy to us-east-1 with resolve_s3 = true (the SAM managed artifact bucket) and CAPABILITY_IAM. [dev.local_start_api] sets EnableTriggers=false for make run-local.

EnableTriggers

EnableTriggers controls every event consumer of the stack:

Resource true false

Kinesis event source mapping

created

not created

CRM SNS subscription and invoke permission

created

not created

Watchdog schedule

ENABLED

DISABLED

RulesApi

serves requests

serves requests

 
stateDiagram-v2
  direction LR
  Dark: EnableTriggers=false (API only)
  Live: EnableTriggers=true (API + consumers)
  [*] --> Dark: first deploy
  Dark --> Live: old consumers stopped, start position set
  Live --> Dark: rollback

Turn it on only once the deployment it replaces no longer consumes the same sources. Otherwise every rule action runs twice. See Zappa to SAM cutover.

Kinesis start position

EnvironmentSettings sets KinesisStartingPosition (LATEST, AT_TIMESTAMP or TRIM_HORIZON) and KinesisStartingTimestamp (Unix seconds, used with AT_TIMESTAMP). They are read only when the mapping is created, that is when EnableTriggers goes from false to true.

Don’t change them while the mapping exists. The change replaces the mapping, and Lambda allows only one mapping per function and stream, so the deploy fails and rolls back. To restart at another position, deploy with EnableTriggers=false, then with true and the new values.

Environment variables

Set on every function from EnvironmentSettings:

Variable Production Staging

ENV_NAME

production

staging

API_BASE_PREFIX

/eventlogger_v2

empty

PAYABILITY_INTERNAL_API_URL

https://api.payability.com/v1/internal

https://staging.dev.payability.com/database_v2/internal

ACTION_TOOLS_URL

https://api.payability.com/actionstools

staging action tools API

MESSAGING_URL

https://api.payability.com/messaging

staging messaging API

EVENTLOGGER_URL

https://api.payability.com/eventlogger/

staging EventLogger API

SNS_TOPIC_EVENTS

em_events topic ARN

em_events_staging topic ARN

ES_EVENTS_URL

empty (search off)

empty (search off)

EVENT_RULE_LIMIT

100

100

LOG_LEVEL

WARNING

WARNING

SENTRY_DSN

shared DSN

shared DSN

AWS_SECRETS_MANAGER

True

True

settings.get_settings() reads them once per process. Trailing slashes on URLs are optional.

The common/crm secret

settings.get_secret(key) reads a key from common/crm. With AWS_SECRETS_MANAGER=False (local development, tests), pyb-flask-utils reads the same key from an environment variable instead.

Key Used for

AUTH_JWT_RSA_PUBLIC_KEY

Verifying RSA-signed JWTs on /es/…​ and /es-changelog

INTERNAL_JWT

Calling the internal API and the action tools API

8001

EventLogger key of instance 8001, used for CRM events by WorkerFunction

SEGMENT_WRITE_KEY

Segment analytics

EVENTLOGGER_URL

Optional; overrides the environment variable of the same name

The secret is cached per process, so a new value reaches a function on its next cold start.

put-secret-value replaces the whole secret; merge new keys into the current value instead. The command is in the cutover runbook.