Add Search API with OpenSearch Domain and VPC Resources

backend/common-cdk/common_constructs/stack.py

@@ -122,6 +122,12 @@ def state_api_domain_name(self) -> str | None:
             return f'state-api.{self.hosted_zone.zone_name}'
         return None
 
+    @property
+    def search_api_domain_name(self) -> str | None:
+        if self.hosted_zone is not None:
+            return f'search.{self.hosted_zone.zone_name}'
+        return None
+
     @property
     def ui_domain_name(self) -> str | None:
         if self.hosted_zone is not None:

backend/compact-connect/app_clients/README.md

@@ -66,7 +66,7 @@ jurisdiction.
 
 
 ```bash
-python3 bin/create_app_client.py -e <environment> -u <user_pool_id>
+python3 bin/create_app_client.py -u <user_pool_id>
 ```
 
 **Interactive Process:**

backend/compact-connect/bin/compile_requirements.sh

@@ -21,6 +21,8 @@ pip-compile --no-emit-index-url --upgrade --no-strip-extras lambdas/python/provi
 # avoid installation failures
 # pip-compile --no-emit-index-url --upgrade --no-strip-extras lambdas/python/purchases/requirements-dev.in
 # pip-compile --no-emit-index-url --upgrade --no-strip-extras lambdas/python/purchases/requirements.in
+pip-compile --no-emit-index-url --upgrade --no-strip-extras lambdas/python/search/requirements-dev.in
+pip-compile --no-emit-index-url --upgrade --no-strip-extras lambdas/python/search/requirements.in
 pip-compile --no-emit-index-url --upgrade --no-strip-extras lambdas/python/staff-user-pre-token/requirements-dev.in
 pip-compile --no-emit-index-url --upgrade --no-strip-extras lambdas/python/staff-user-pre-token/requirements.in
 pip-compile --no-emit-index-url --upgrade --no-strip-extras lambdas/python/staff-users/requirements-dev.in

backend/compact-connect/bin/download_oas30.py

@@ -106,6 +106,8 @@ def update_server_urls(spec: dict, api_name: str) -> None:
         base_url = 'https://state-api.beta.compactconnect.org'
     elif api_name == 'LicenseApi':
         base_url = 'https://api.beta.compactconnect.org'
+    elif api_name == 'SearchApi':
+        base_url = 'https://search.beta.compactconnect.org'
     else:
         # Keep original URL if API name is not recognized
         return
@@ -155,6 +157,7 @@ def main():
     parser = argparse.ArgumentParser(description='Download OpenAPI v3 specifications from AWS API Gateway')
     parser.add_argument('--state-api-only', action='store_true', help='Download only the StateApi specification')
     parser.add_argument('--license-api-only', action='store_true', help='Download only the LicenseApi specification')
+    parser.add_argument('--search-api-only', action='store_true', help='Download only the SearchApi specification')
 
     args = parser.parse_args()
 
@@ -165,17 +168,23 @@ def main():
     # Define output paths
     state_api_path = os.path.join(workspace_dir, 'docs', 'api-specification', 'latest-oas30.json')
     license_api_path = os.path.join(workspace_dir, 'docs', 'internal', 'api-specification', 'latest-oas30.json')
+    search_api_path = os.path.join(workspace_dir, 'docs', 'search-internal', 'api-specification', 'latest-oas30.json')
 
     # Download StateApi (external API)
-    if not args.license_api_only:
+    if not args.license_api_only and not args.search_api_only:
         sys.stdout.write('\n=== Downloading StateApi specification ===\n')
         download_api_spec('StateApi', state_api_path)
 
     # Download LicenseApi (internal API)
-    if not args.state_api_only:
+    if not args.state_api_only and not args.search_api_only:
         sys.stdout.write('\n=== Downloading LicenseApi specification ===\n')
         download_api_spec('LicenseApi', license_api_path)
 
+    # Download SearchApi (search internal API)
+    if not args.state_api_only and not args.license_api_only:
+        sys.stdout.write('\n=== Downloading SearchApi specification ===\n')
+        download_api_spec('SearchApi', search_api_path)
+
     sys.stdout.write('\nAll specifications downloaded successfully!\n')
     sys.exit(0)
 

backend/compact-connect/bin/sync_deps.sh

@@ -20,6 +20,8 @@ pip-sync \
   lambdas/python/disaster-recovery/requirements.txt \
   lambdas/python/provider-data-v1/requirements-dev.txt \
   lambdas/python/provider-data-v1/requirements.txt \
+  lambdas/python/search/requirements-dev.txt \
+  lambdas/python/search/requirements.txt \
   lambdas/python/staff-user-pre-token/requirements-dev.txt \
   lambdas/python/staff-user-pre-token/requirements.txt \
   lambdas/python/staff-users/requirements-dev.txt \

backend/compact-connect/bin/trim_oas30.py

@@ -35,19 +35,21 @@ def strip_options_endpoints(oas30: dict) -> dict:
     parser.add_argument(
         '-i', '--internal', action='store_true', help='Use internal API specification files instead of regular ones'
     )
+    parser.add_argument('-s', '--search', action='store_true', help='Use search API specification files')
 
     args = parser.parse_args()
 
     # Get script directory and workspace directory
     script_dir = os.path.dirname(os.path.abspath(__file__))
     workspace_dir = os.path.dirname(script_dir)
 
-    # Determine the base directory based on the internal flag
-    base_dir = (
-        os.path.join('docs', 'internal', 'api-specification')
-        if args.internal
-        else os.path.join('docs', 'api-specification')
-    )
+    # Determine the base directory based on the flags
+    if args.search:
+        base_dir = os.path.join('docs', 'search-internal', 'api-specification')
+    elif args.internal:
+        base_dir = os.path.join('docs', 'internal', 'api-specification')
+    else:
+        base_dir = os.path.join('docs', 'api-specification')
     file_path = os.path.join(workspace_dir, base_dir, 'latest-oas30.json')
 
     with open(file_path) as f:

backend/compact-connect/bin/update_api_docs.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 
 # Update API documentation workflow
-# Downloads, trims, and updates Postman collections for both StateApi and LicenseApi
+# Downloads, trims, and updates Postman collections for StateApi, LicenseApi, and SearchApi
 
 set -e  # Exit immediately if any command fails
 
@@ -99,6 +99,14 @@ trim_specs() {
         exit 1
     fi
     print_success "LicenseApi specification trimmed"
+
+    # Trim search API spec
+    print_status "Trimming SearchApi specification..."
+    if ! python3 bin/trim_oas30.py --search; then
+        print_error "Failed to trim SearchApi specification"
+        exit 1
+    fi
+    print_success "SearchApi specification trimmed"
 }
 
 # Function to update Postman collections
@@ -120,6 +128,14 @@ update_postman() {
         exit 1
     fi
     print_success "LicenseApi Postman collection updated"
+
+    # Update search Postman collection
+    print_status "Updating SearchApi Postman collection..."
+    if ! python3 bin/update_postman_collection.py --search; then
+        print_error "Failed to update SearchApi Postman collection"
+        exit 1
+    fi
+    print_success "SearchApi Postman collection updated"
 }
 
 # Function to verify files exist
@@ -129,8 +145,10 @@ verify_files() {
     local files=(
         "docs/api-specification/latest-oas30.json"
         "docs/internal/api-specification/latest-oas30.json"
+        "docs/search-internal/api-specification/latest-oas30.json"
         "docs/postman/postman-collection.json"
         "docs/internal/postman/postman-collection.json"
+        "docs/search-internal/postman/postman-collection.json"
     )
 
     for file in "${files[@]}"; do
@@ -174,8 +192,10 @@ main() {
     print_status "Updated files:"
     echo "  - docs/api-specification/latest-oas30.json"
     echo "  - docs/internal/api-specification/latest-oas30.json"
+    echo "  - docs/search-internal/api-specification/latest-oas30.json"
     echo "  - docs/postman/postman-collection.json"
     echo "  - docs/internal/postman/postman-collection.json"
+    echo "  - docs/search-internal/postman/postman-collection.json"
 }
 
 # Handle script interruption

backend/compact-connect/bin/update_postman_collection.py

@@ -196,16 +196,24 @@ def main():
     parser.add_argument(
         '-i', '--internal', action='store_true', help='Use internal API specification files instead of regular ones'
     )
+    parser.add_argument('-s', '--search', action='store_true', help='Use search API specification files')
 
     args = parser.parse_args()
 
     # Define paths relative to the script location
     script_dir = os.path.dirname(os.path.abspath(__file__))
     workspace_dir = os.path.dirname(script_dir)
 
-    # Determine the base directory based on the internal flag
-    base_dir = os.path.join('internal', 'api-specification') if args.internal else os.path.join('api-specification')
-    postman_dir = os.path.join('internal', 'postman') if args.internal else os.path.join('postman')
+    # Determine the base directory based on the flags
+    if args.search:
+        base_dir = os.path.join('search-internal', 'api-specification')
+        postman_dir = os.path.join('search-internal', 'postman')
+    elif args.internal:
+        base_dir = os.path.join('internal', 'api-specification')
+        postman_dir = os.path.join('internal', 'postman')
+    else:
+        base_dir = os.path.join('api-specification')
+        postman_dir = os.path.join('postman')
 
     openapi_path = os.path.join(workspace_dir, 'docs', base_dir, 'latest-oas30.json')
     tmp_path = os.path.join(workspace_dir, 'tmp.json')
@@ -215,7 +223,7 @@ def main():
     generate_postman_collection(openapi_path, tmp_path)
 
     try:
-        # Load the generated and existing collections
+        # Load the generated collection
         with open(tmp_path) as f:
             new_collection = json.load(f)
         with open(postman_path) as f:

backend/compact-connect/common_constructs/constants.py

@@ -0,0 +1,2 @@
+PROD_ENV_NAME = 'prod'
+BETA_ENV_NAME = 'beta'

backend/compact-connect/common_constructs/python_function.py

@@ -5,7 +5,7 @@
 from aws_cdk import Duration
 from aws_cdk.aws_cloudwatch import Alarm, ComparisonOperator, Stats, TreatMissingData
 from aws_cdk.aws_cloudwatch_actions import SnsAction
-from aws_cdk.aws_iam import IRole, Role, ServicePrincipal
+from aws_cdk.aws_iam import IRole, ManagedPolicy, Role, ServicePrincipal
 from aws_cdk.aws_lambda import ILayerVersion, Runtime
 from aws_cdk.aws_lambda_python_alpha import PythonFunction as CdkPythonFunction
 from aws_cdk.aws_logs import ILogGroup, LogGroup, RetentionDays
@@ -81,6 +81,25 @@ def __init__(
                 assumed_by=ServicePrincipal('lambda.amazonaws.com'),
             )
             log_group.grant_write(role)
+
+        if 'vpc' in kwargs:
+            # if the function is being created in a VPC, add the AWSLambdaVPCAccessExecutionRole policy to the role
+            role.add_managed_policy(
+                ManagedPolicy.from_aws_managed_policy_name('service-role/AWSLambdaVPCAccessExecutionRole')
+            )
+            NagSuppressions.add_resource_suppressions(
+                role,
+                suppressions=[
+                    {
+                        'id': 'AwsSolutions-IAM4',
+                        'appliesTo': [
+                            'Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole'
+                        ],
+                        'reason': 'Lambdas deployed within a VPC require this policy to access the VPC.',
+                    },
+                ],
+            )
+
         # We can't directly grant a provided role permission to log to our log group, since that could create a
         # circular dependency with the stack the role came from. The role creator will have to be responsible for
         # setting its permissions.

backend/compact-connect/common_constructs/queued_lambda_processor.py

@@ -29,6 +29,7 @@ def __init__(
         encryption_key: IKey,
         alarm_topic: ITopic,
         dlq_count_alarm_threshold: int = 10,
+        dlq_retention_period: Duration | None = None,
     ):
         super().__init__(scope, construct_id)
 
@@ -39,6 +40,7 @@ def __init__(
             encryption=QueueEncryption.KMS,
             encryption_master_key=encryption_key,
             enforce_ssl=True,
+            retention_period=dlq_retention_period,
         )
 
         self.queue = Queue(

backend/compact-connect/common_constructs/user_pool.py

@@ -216,7 +216,7 @@ def add_custom_app_client_domain(
             suppressions=[
                 {
                     'id': 'AwsSolutions-L1',
-                    'reason': 'We do not maintain this lambda runtime. It will be updated with future CDK versions'
+                    'reason': 'We do not maintain this lambda runtime. It will be updated with future CDK versions',
                 },
                 {
                     'id': 'HIPAA.Security-LambdaDLQ',