gen3-rems-entitlement

Reusable CDK repo that deploys the REMS entitlement sync Lambda in the Gen3 AWS account.

Overview

When a DAC approves a data access application in REMS, the Gen3 Requestor webhook handler invokes this Lambda (via boto3, IAM-authenticated). The Lambda updates Auth0 role assignments using the Management API.

REMS approval
      ↓
Requestor webhook (validates REMS event, maps resource → entitlement)
      ↓
Lambda invoke (same-account, IAM auth)
      ↓
Lambda → Auth0 Management API → role assigned/removed
      ↓
Fence access_token_updater → Arborist group membership updated

Pre-requisites

1. Auth0 M2M Application

Create a Machine-to-Machine application in Auth0:

• Applications → Create Application → Machine to Machine
• Authorize against: Auth0 Management API
• Scopes: read:roles, update:users

2. Auth0 Roles

Create roles in Auth0 with names matching REMS.GROUP_NAME_TEMPLATE in Requestor:

program1_ausdiab_readonly
program1_ausdiabsim_readonly
... (one per dataset)

3. Secrets Manager

Store Auth0 M2M credentials:

aws secretsmanager create-secret \
  --name "acdc/rems/auth0-management-api" \
  --secret-string '{
    "client_id":     "<m2m-client-id>",
    "client_secret": "<m2m-client-secret>",
    "domain":        "acdc-login.biocommons.org.au",
    "audience":      "https://acdc-login.biocommons.org.au/api/v2/"
  }' \
  --region ap-southeast-2

4. SSM Parameters

The Lambda looks up VPC and subnets via SSM:

aws ssm put-parameter --name "/acdc/uat/vpc-id" --value "vpc-0fa38629c27c164c9" --type String
aws ssm put-parameter --name "/acdc/uat/private-subnet-ids" --value "subnet-xxx,subnet-yyy" --type String

Usage

This is a reusable repo — callers reference it via GitHub Actions workflow_call.

Caller workflow (in your Gen3 platform repo)

jobs:
  deploy-entitlement-uat:
    uses: AustralianBioCommons/gen3-rems-entitlement/.github/workflows/deploy-entitlement-reusable.yml@main
    with:
      config_path: config/acdc-rems-entitlement.json
      github_environment: uat
      role_to_assume: arn:aws:iam::232870232581:role/cdk-deploy-role

Caller config (in your Gen3 platform repo)

See config/example.public.json for the full schema.

Post-deploy

After deployment, retrieve the Lambda ARN from SSM:

aws ssm get-parameter \
  --name "/acdc/ACDC/rems-entitlement/uat/entitlement-lambda-arn" \
  --query Parameter.Value --output text

Set in Requestor helm values:

requestor:
  REMS:
    ENTITLEMENT_BACKEND: lambda
    ENTITLEMENT_LAMBDA_NAME: <lambda-arn>

Also add lambda:InvokeFunction to the Requestor pod IAM role:

{
  "Effect": "Allow",
  "Action": "lambda:InvokeFunction",
  "Resource": "<lambda-arn>"
}