Fix X-Ray tracing and authorizer dependency in Lab3

Lab3/scripts/deployment.sh

@@ -7,15 +7,22 @@ if [[ "$#" -eq 0 ]]; then
   echo "Command to deploy tenant server code: deployment.sh -t"
   echo "Command to deploy bootstrap & tenant server code: deployment.sh -s" 
   echo "Command to deploy server & client code: deployment.sh -s -c"
+  echo "Command to specify admin email: deployment.sh -s -e admin@example.com"
+  echo "Command to specify tenant admin email: deployment.sh -s -te tenant-admin@example.com"
   exit 1      
 fi
 
+ADMIN_EMAIL=""
+TENANT_ADMIN_EMAIL=""
+
 while [[ "$#" -gt 0 ]]; do
     case $1 in
         -s) server=1 ;;
         -b) bootstrap=1 ;;
         -t) tenant=1 ;;
         -c) client=1 ;;
+        -e) ADMIN_EMAIL="$2"; shift ;;
+        -te) TENANT_ADMIN_EMAIL="$2"; shift ;;
         *) echo "Unknown parameter passed: $1"; exit 1 ;;
     esac
     shift
@@ -42,7 +49,15 @@ fi
 if [[ $server -eq 1 ]] || [[ $bootstrap -eq 1 ]] || [[ $tenant -eq 1 ]]; then
   echo "Validating server code using pylint"
   cd ../server
-  python3 -m pylint -E -d E0401,E1111 $(find . -iname "*.py" -not -path "./.aws-sam/*")
+
+  # Use virtual environment Python if available
+  if [ -f "../../.venv_py313/bin/python" ]; then
+    PYTHON_CMD="../../.venv_py313/bin/python"
+  else
+    PYTHON_CMD="python3"
+  fi
+
+  $PYTHON_CMD -m pylint -E -d E0401,E1111 $(find . -iname "*.py" -not -path "./.aws-sam/*")
   if [[ $? -ne 0 ]]; then
     echo "****ERROR: Please fix above code errors and then rerun script!!****"
     exit 1
@@ -54,12 +69,23 @@ if [[ $server -eq 1 ]] || [[ $bootstrap -eq 1 ]]; then
   echo "Bootstrap server code is getting deployed"
   cd ../server
   REGION=$(aws configure get region)
-  sam build -t shared-template.yaml --use-container
+  sam build -t shared-template.yaml
+
+  # Build parameter overrides
+  PARAM_OVERRIDES="EventEngineParameter=$IS_RUNNING_IN_EVENT_ENGINE"
+  if [ ! -z "$ADMIN_EMAIL" ]; then
+    PARAM_OVERRIDES="$PARAM_OVERRIDES AdminEmailParameter=$ADMIN_EMAIL"
+    echo "Using admin email: $ADMIN_EMAIL"
+  fi
+  if [ ! -z "$TENANT_ADMIN_EMAIL" ]; then
+    PARAM_OVERRIDES="$PARAM_OVERRIDES TenantAdminEmailParameter=$TENANT_ADMIN_EMAIL"
+    echo "Using tenant admin email: $TENANT_ADMIN_EMAIL"
+  fi
 
   if [ "$IS_RUNNING_IN_EVENT_ENGINE" = true ]; then
-    sam deploy --config-file shared-samconfig.toml --region=$REGION --parameter-overrides EventEngineParameter=$IS_RUNNING_IN_EVENT_ENGINE AdminUserPoolCallbackURLParameter=$ADMIN_SITE_URL TenantUserPoolCallbackURLParameter=$APP_SITE_URL
+    sam deploy --config-file shared-samconfig.toml --region=$REGION --parameter-overrides $PARAM_OVERRIDES AdminUserPoolCallbackURLParameter=$ADMIN_SITE_URL TenantUserPoolCallbackURLParameter=$APP_SITE_URL
   else
-    sam deploy --config-file shared-samconfig.toml --region=$REGION --parameter-overrides EventEngineParameter=$IS_RUNNING_IN_EVENT_ENGINE
+    sam deploy --config-file shared-samconfig.toml --region=$REGION --parameter-overrides $PARAM_OVERRIDES
   fi
   cd ../scripts
 fi  
@@ -68,26 +94,26 @@ if [[ $server -eq 1 ]] || [[ $tenant -eq 1 ]]; then
   echo "Tenant server code is getting deployed"
   cd ../server
   REGION=$(aws configure get region)
-  sam build -t tenant-template.yaml --use-container
+  sam build -t tenant-template.yaml
   sam deploy --config-file tenant-samconfig.toml --region=$REGION
   cd ../scripts
 fi
 
 
 
 if [ "$IS_RUNNING_IN_EVENT_ENGINE" = false ]; then
-  ADMIN_SITE_URL=$(aws cloudformation describe-stacks --stack-name serverless-saas --query "Stacks[0].Outputs[?OutputKey=='AdminAppSite'].OutputValue" --output text)
-  LANDING_APP_SITE_URL=$(aws cloudformation describe-stacks --stack-name serverless-saas --query "Stacks[0].Outputs[?OutputKey=='LandingApplicationSite'].OutputValue" --output text)
-  APP_SITE_BUCKET=$(aws cloudformation describe-stacks --stack-name serverless-saas --query "Stacks[0].Outputs[?OutputKey=='ApplicationSiteBucket'].OutputValue" --output text)
-  APP_SITE_URL=$(aws cloudformation describe-stacks --stack-name serverless-saas --query "Stacks[0].Outputs[?OutputKey=='ApplicationSite'].OutputValue" --output text)
+  ADMIN_SITE_URL=$(aws cloudformation describe-stacks --stack-name serverless-saas-workshop-shared-lab3 --query "Stacks[0].Outputs[?OutputKey=='AdminAppSite'].OutputValue" --output text)
+  LANDING_APP_SITE_URL=$(aws cloudformation describe-stacks --stack-name serverless-saas-workshop-shared-lab3 --query "Stacks[0].Outputs[?OutputKey=='LandingApplicationSite'].OutputValue" --output text)
+  APP_SITE_BUCKET=$(aws cloudformation describe-stacks --stack-name serverless-saas-workshop-shared-lab3 --query "Stacks[0].Outputs[?OutputKey=='ApplicationSiteBucket'].OutputValue" --output text)
+  APP_SITE_URL=$(aws cloudformation describe-stacks --stack-name serverless-saas-workshop-shared-lab3 --query "Stacks[0].Outputs[?OutputKey=='ApplicationSite'].OutputValue" --output text)
 fi
 
 if [[ $client -eq 1 ]]; then
   echo "Client code is getting deployed"
-  ADMIN_APIGATEWAYURL=$(aws cloudformation describe-stacks --stack-name serverless-saas --query "Stacks[0].Outputs[?OutputKey=='AdminApi'].OutputValue" --output text)
-  APP_APIGATEWAYURL=$(aws cloudformation describe-stacks --stack-name stack-pooled --query "Stacks[0].Outputs[?OutputKey=='TenantAPI'].OutputValue" --output text)
-  APP_APPCLIENTID=$(aws cloudformation describe-stacks --stack-name serverless-saas --query "Stacks[0].Outputs[?OutputKey=='CognitoTenantAppClientId'].OutputValue" --output text)
-  APP_USERPOOLID=$(aws cloudformation describe-stacks --stack-name serverless-saas --query "Stacks[0].Outputs[?OutputKey=='CognitoTenantUserPoolId'].OutputValue" --output text)
+  ADMIN_APIGATEWAYURL=$(aws cloudformation describe-stacks --stack-name serverless-saas-workshop-lab2 --query "Stacks[0].Outputs[?OutputKey=='AdminApi'].OutputValue" --output text)
+  APP_APIGATEWAYURL=$(aws cloudformation describe-stacks --stack-name serverless-saas-workshop-tenant-lab3 --query "Stacks[0].Outputs[?OutputKey=='TenantAPI'].OutputValue" --output text)
+  APP_APPCLIENTID=$(aws cloudformation describe-stacks --stack-name serverless-saas-workshop-shared-lab3 --query "Stacks[0].Outputs[?OutputKey=='CognitoTenantAppClientId'].OutputValue" --output text)
+  APP_USERPOOLID=$(aws cloudformation describe-stacks --stack-name serverless-saas-workshop-shared-lab3 --query "Stacks[0].Outputs[?OutputKey=='CognitoTenantUserPoolId'].OutputValue" --output text)
 
 
   # Admin UI and Landing UI are configured in Lab2 

Lab3/server/OrderService/order_service.py

@@ -9,7 +9,10 @@
 from decimal import Decimal
 from types import SimpleNamespace
 from aws_lambda_powertools import Tracer
+
 tracer = Tracer()
+# Patch AWS SDK calls for X-Ray tracing
+tracer.patch(['boto3'])
 
 @tracer.capture_lambda_handler
 def get_order(event, context):

Lab3/server/ProductService/product_service.py

@@ -9,7 +9,10 @@
 from decimal import Decimal
 from aws_lambda_powertools import Tracer
 from types import SimpleNamespace
+
 tracer = Tracer()
+# Patch AWS SDK calls for X-Ray tracing
+tracer.patch(['boto3'])
 
 @tracer.capture_lambda_handler
 def get_product(event, context):
@@ -79,4 +82,4 @@ def get_products(event, context):
     logger.log_with_tenant_context(event, "Request completed to get all products")
     return utils.generate_response(response)
 
-
+

Lab3/server/layers/requirements.txt

@@ -1,4 +1,5 @@
 aws-lambda-powertools[Tracer,Logger,Metrics]
 simplejson
 jsonpickle
-aws_requests_auth
+aws_requests_auth
+python-jose[cryptography]

Lab3/server/nested_templates/cognito.yaml

@@ -12,6 +12,9 @@ Parameters:
   SystemAdminRoleNameParameter:
     Type: String
     Description: "Enter the role name for system admin"
+  TenantAdminEmailParameter:
+    Type: String
+    Description: "Enter tenant admin email address"
   AdminUserPoolCallbackURLParameter: 
     Type: String
     Description: "Enter Admin Management userpool call back url" 
@@ -22,7 +25,7 @@ Resources:
   CognitoUserPool:
     Type: "AWS::Cognito::UserPool"
     Properties:
-      UserPoolName: PooledTenant-ServerlessSaaSUserPool
+      UserPoolName: PooledTenant-ServerlessSaaS-lab3-UserPool
       AutoVerifiedAttributes:
         - "email"
       AccountRecoverySetting:
@@ -84,7 +87,7 @@ Resources:
   CognitoOperationUsersUserPool:
     Type: "AWS::Cognito::UserPool"
     Properties:
-      UserPoolName: OperationUsers-ServerlessSaaSUserPool
+      UserPoolName: OperationUsers-ServerlessSaas-lab3-UserPool
       AutoVerifiedAttributes:
         - "email"
       AccountRecoverySetting:
@@ -171,6 +174,37 @@ Resources:
         GroupName: !Ref CognitoAdminUserGroup
         Username: !Ref CognitoAdminUser
         UserPoolId: !Ref CognitoOperationUsersUserPool
+
+  CognitoTenantAdminUserGroup:
+    Type: AWS::Cognito::UserPoolGroup
+    Properties:
+      GroupName: TenantAdmins
+      Description: Tenant admin user group
+      Precedence: 0
+      UserPoolId: !Ref CognitoUserPool
+
+  CognitoTenantAdminUser:
+    Type: AWS::Cognito::UserPoolUser
+    Properties:
+      Username: tenant-admin
+      DesiredDeliveryMediums:
+        - EMAIL
+      ForceAliasCreation: true
+      UserAttributes:
+        - Name: email
+          Value: !Ref TenantAdminEmailParameter
+        - Name: custom:tenantId
+          Value: default-tenant
+        - Name: custom:userRole
+          Value: TenantAdmin
+      UserPoolId: !Ref CognitoUserPool
+
+  CognitoAddTenantAdminToGroup:
+      Type: AWS::Cognito::UserPoolUserToGroupAttachment
+      Properties:
+        GroupName: !Ref CognitoTenantAdminUserGroup
+        Username: !Ref CognitoTenantAdminUser
+        UserPoolId: !Ref CognitoUserPool
 
 Outputs:  
   CognitoUserPoolId:

Lab3/server/shared-template.yaml

@@ -10,6 +10,10 @@ Parameters:
     Type: String
     Default: "test@test.com"
     Description: "Enter system admin email address"
+  TenantAdminEmailParameter:
+    Type: String
+    Default: "tenant-admin@test.com"
+    Description: "Enter tenant admin email address"
   SystemAdminRoleNameParameter:
     Type: String
     Default: "SystemAdmin"
@@ -53,6 +57,7 @@ Resources:
       Location: nested_templates/cognito.yaml
       Parameters:
         AdminEmailParameter: !Ref AdminEmailParameter
+        TenantAdminEmailParameter: !Ref TenantAdminEmailParameter
         SystemAdminRoleNameParameter: !Ref SystemAdminRoleNameParameter
         AdminUserPoolCallbackURLParameter: !If [IsNotRunningInEventEngine, !GetAtt UserInterface.Outputs.AdminAppSite, !Ref AdminUserPoolCallbackURLParameter]
         TenantUserPoolCallbackURLParameter: !If [IsNotRunningInEventEngine, !GetAtt UserInterface.Outputs.ApplicationSite, !Ref TenantUserPoolCallbackURLParameter]