Deploy to AWS Lambda #9

Workflow file for this run

.github/workflows/aws-deploy.yml at fdcb9ae

	# INFO: THIS WORKFLOW DEPLOYS MINIMAL API TO AWS LAMBDA AND CONFIGURES API GATEWAY WITH AWS CLI
	# INFO: IAM USER REQUIRES PERMISSIONS TO EXECUTE THIS WORKFLOW (SEE IN FILE '.github/aws/iam-user-policy.json' AND 'README.md' FOR DETAILS)
	# INFO: ROLES CREATED BY THIS WORKFLOW ARE USED BY LAMBDA AND API GATEWAY FOR THEIR OPERATIONS (OPTIMIZED FOR SECURITY)
	# INFO: THIS WORKFLOW PRESERVES API GATEWAY ID ACROSS RUNS TO MAINTAIN CONSISTENT API ENDPOINTS
	# INFO: USAGE PLANS AND API KEYS ARE REUSED WHEN THEY ALREADY EXIST TO PREVENT CONFLICTS
	# INFO: PROPER ERROR HANDLING IS IMPLEMENTED TO ENSURE SMOOTH DEPLOYMENT EVEN WHEN RESOURCES ALREADY EXIST
	# INFO: GITHUB ACTIONS ANNOTATIONS ARE USED TO DISPLAY IMPORTANT INFORMATION LIKE API GATEWAY URL
	# INFO: ENHANCED SECURITY MEASURES ARE IN PLACE INCLUDING LEAST PRIVILEGE ACCESS AND RESOURCE MASKING
	# INFO: API GATEWAY CONFIGURED WITH UNIVERSAL CORS FOR MICROSERVICE USAGE ACROSS MULTIPLE PROJECTS

	# WARN: THERE IS DUPLICATION BETWEEN IAM USER PERMISSIONS AND THOSE OF CREATED ROLES
	# WARN: THIS DUPLICATION MAKES SOME PERMISSIONS IN ROLES REDUNDANT BECAUSE IAM USER ALREADY HAS THESE PERMISSIONS
	# WARN: THIS APPROACH IS NOT OPTIMAL FROM A SECURITY PERSPECTIVE (PRINCIPLE OF LEAST PRIVILEGE)
	# WARN: API GATEWAY ID IS VISIBLE IN LOGS BECAUSE URL ARE PUBLIC BUT API KEY IS PROPERLY MASKED FOR SECURITY
	# WARN: USAGE PLAN ASSOCIATION MIGHT FAIL IF THE API STAGE IS ALREADY ASSOCIATED WITH ANOTHER USAGE PLAN

	# TODO FIX: TO OPTIMIZE SECURITY, CONSIDER:
	# FIX: 1. LIMITING IAM USER TO ONLY PERMISSIONS NECESSARY TO CREATE/MANAGE ROLES
	# FIX: 2. ENSURING THAT CREATED ROLES HAVE SPECIFIC PERMISSIONS FOR THEIR RESPECTIVE TASKS
	# FIX: 3. USING SPECIFIC ARNS IN POLICIES RATHER THAN "*" TO LIMIT SCOPE OF PERMISSIONS
	# FIX: 4. IMPLEMENTING PROPER CLEANUP OF UNUSED RESOURCES TO PREVENT ACCUMULATION

	name: Deploy to AWS Lambda

	on:
	workflow_dispatch:
	inputs:
	run_tests:
	description: "Run tests before deployment"
	type: boolean
	default: true
	required: true

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	env:
	# PROJECT-SPECIFIC SETTINGS
	DEFAULT_FUNCTION_NAME: "ContactFormCsharp"
	DEFAULT_RESOURCE_PREFIX: "ContactFormCsharp-"
	DEFAULT_PROJECT_PATH: "ContactForm.MinimalAPI"
	DEFAULT_TESTS_PATH: "ContactForm.Tests"
	DEFAULT_LAMBDA_HANDLER: "ContactForm.MinimalAPI::ContactForm.MinimalAPI.LambdaEntryPoint::FunctionHandlerAsync"
	DEFAULT_API_GATEWAY_TYPE: "REST"

	# PROJECT ENVIRONMENT VARIABLES
	DEFAULT_PROJECT_ENV: >-
	SMTP_1_PASSWORD=${{ secrets.SMTP_1_PASSWORD }};
	SMTP_1_PASSWORD_TEST=${{ secrets.SMTP_1_PASSWORD_TEST }};
	SMTP_2_PASSWORD=${{ secrets.SMTP_2_PASSWORD }};
	SMTP_2_PASSWORD_TEST=${{ secrets.SMTP_2_PASSWORD_TEST }};

	# APPLICATION SETTINGS
	DEFAULT_ASPNETCORE_ENVIRONMENT: "Production"
	DEFAULT_LAMBDA_DEBUG: "true"

	# AWS DEPLOYMENT CONFIGURATION - ADJUST THESE FOR PERFORMANCE/COST BALANCE
	DEFAULT_REGION: "us-east-1"
	DEFAULT_DOTNET_VERSION: "8.0.x"
	DEFAULT_MEMORY: "512" # MEMORY IN MB
	DEFAULT_TIMEOUT: "30" # TIMEOUT IN SECONDS
	DEFAULT_THROTTLE_RATE: "10" # REQUESTS PER SECOND
	DEFAULT_THROTTLE_BURST: "20" # MAX CONCURRENT REQUESTS
	DEFAULT_QUOTA_LIMIT: "1000" # MAX REQUESTS PER PERIOD
	DEFAULT_QUOTA_PERIOD: "DAY" # QUOTA PERIOD (DAY, WEEK, MONTH)

	# DOTNET BUILD SETTINGS - TYPICALLY NO NEED TO MODIFY
	DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
	DOTNET_CLI_TELEMETRY_OPTOUT: true

	run-name: "Deploy to AWS Lambda"
	permissions:
	id-token: write
	contents: read
	packages: read

	jobs:
	create-github-role:
	name: Create GitHub OIDC role
	runs-on: ubuntu-latest
	timeout-minutes: 5
	outputs:
	role_arn: ${{ steps.create-oidc-role.outputs.role_arn }}
	role_exists: ${{ steps.check-role-exists.outputs.exists }}

	steps:
	- name: Set variables
	run: \|
	# SET VARIABLES DIRECTLY FROM DEFAULTS
	echo "FUNCTION_NAME=$DEFAULT_FUNCTION_NAME" >> $GITHUB_ENV
	echo "RESOURCE_PREFIX=$DEFAULT_RESOURCE_PREFIX" >> $GITHUB_ENV
	echo "AWS_REGION=$DEFAULT_REGION" >> $GITHUB_ENV

	- name: Checkout repository
	uses: actions/checkout@v4

	- name: Configure AWS credentials with access key
	uses: aws-actions/configure-aws-credentials@v4
	with:
	aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
	aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
	aws-region: ${{ env.AWS_REGION \|\| 'us-east-1' }}

	- name: Check if GitHub OIDC role already exists
	id: check-role-exists
	run: \|
	echo "TESTING AWS CREDENTIALS..."
	# GET ACCOUNT ID WITHOUT DISPLAYING IT
	ACCOUNT_ID=$(aws sts get-caller-identity --query 'Account' --output text)
	echo "::add-mask::$ACCOUNT_ID"
	echo "ACCOUNT_ID=$ACCOUNT_ID" >> $GITHUB_ENV

	ROLE_NAME="${{ env.RESOURCE_PREFIX }}github-actions-role"
	ROLE_ARN=$(aws iam get-role --role-name "$ROLE_NAME" --query 'Role.Arn' --output text 2>/dev/null \|\| echo "")
	echo "::add-mask::$ROLE_ARN"

	if [ -n "$ROLE_ARN" ]; then
	echo "exists=true" >> $GITHUB_OUTPUT
	echo "role_arn=$ROLE_ARN" >> $GITHUB_OUTPUT
	echo "::notice::GITHUB OIDC ROLE ALREADY EXISTS. REUSING EXISTING ROLE."
	else
	echo "exists=false" >> $GITHUB_OUTPUT
	fi

	- name: Create GitHub Actions role
	id: create-oidc-role
	if: steps.check-role-exists.outputs.exists != 'true'
	run: \|
	# CREATE TRUST POLICY
	echo '{
	"Version": "2012-10-17",
	"Statement": [
	{
	"Effect": "Allow",
	"Principal": {
	"Federated": "PROVIDER_ARN_PLACEHOLDER"
	},
	"Action": "sts:AssumeRoleWithWebIdentity",
	"Condition": {
	"StringLike": {
	"token.actions.githubusercontent.com:sub": "repo:${{ github.repository }}:*"
	}
	}
	}
	]
	}' > trust-policy-template.json

	# CREATE POLICY
	echo '{
	"Version": "2012-10-17",
	"Statement": [
	{
	"Effect": "Allow",
	"Action": [
	"iam:CreateRole",
	"iam:GetRole",
	"iam:PutRolePolicy",
	"iam:AttachRolePolicy",
	"iam:ListRolePolicies",
	"iam:ListAttachedRolePolicies"
	],
	"Resource": [
	"arn:aws:iam::${{ env.ACCOUNT_ID }}:role/${{ env.RESOURCE_PREFIX }}*"
	]
	},
	{
	"Effect": "Allow",
	"Action": [
	"lambda:CreateFunction",
	"lambda:GetFunction",
	"lambda:UpdateFunctionCode",
	"lambda:UpdateFunctionConfiguration",
	"lambda:AddPermission",
	"lambda:DeleteFunction"
	],
	"Resource": "arn:aws:lambda:${{ env.AWS_REGION }}:${{ env.ACCOUNT_ID }}:function:${{ env.FUNCTION_NAME }}"
	},
	{
	"Effect": "Allow",
	"Action": [
	"apigateway:GET",
	"apigateway:POST",
	"apigateway:PUT",
	"apigateway:DELETE"
	],
	"Resource": [
	"arn:aws:apigateway:${{ env.AWS_REGION }}::/restapis",
	"arn:aws:apigateway:${{ env.AWS_REGION }}::/restapis/*"
	]
	}
	]
	}' > policy.json

	# GET PROVIDER ARN WITHOUT DISPLAYING IT
	PROVIDER_ARN=$(aws iam list-open-id-connect-providers --query 'OpenIDConnectProviderList[?contains(Arn, `token.actions.githubusercontent.com`)].Arn' --output text)
	echo "::add-mask::$PROVIDER_ARN"

	if [ -z "$PROVIDER_ARN" ]; then
	echo "CREATING GITHUB OIDC PROVIDER..."
	THUMBPRINT=$(curl -s https://token.actions.githubusercontent.com/.well-known/openid-configuration \| jq -r '.jwks_uri' \| xargs curl -s \| jq -r '.keys[0].x5c[0]' \| base64 -d \| openssl x509 -noout -fingerprint -sha1 \| cut -d'=' -f2 \| tr -d ':')
	PROVIDER_ARN=$(aws iam create-open-id-connect-provider --url "https://token.actions.githubusercontent.com" --client-id-list "sts.amazonaws.com" --thumbprint-list "$THUMBPRINT" --query 'OpenIDConnectProviderArn' --output text)
	echo "::add-mask::$PROVIDER_ARN"
	fi

	ROLE_NAME="${{ env.RESOURCE_PREFIX }}github-actions-role"

	# DON'T DISPLAY PROVIDER ARN
	jq -n \
	--arg provider "$PROVIDER_ARN" \
	--arg repo "${{ github.repository }}" \
	'{
	Version: "2012-10-17",
	Statement: [{
	Effect: "Allow",
	Principal: {
	Federated: $provider
	},
	Action: "sts:AssumeRoleWithWebIdentity",
	Condition: {
	StringLike: {
	"token.actions.githubusercontent.com:sub": ("repo:" + $repo + ":*")
	}
	}
	}]
	}' > trust-policy.json

	ROLE_ARN=$(aws iam create-role --role-name "$ROLE_NAME" --assume-role-policy-document file://trust-policy.json --query 'Role.Arn' --output text)
	echo "::add-mask::$ROLE_ARN"

	aws iam put-role-policy --role-name "$ROLE_NAME" --policy-name "${RESOURCE_PREFIX}github-actions-policy" --policy-document file://policy.json
	echo "WAITING FOR ROLE PROPAGATION..."
	sleep 10

	echo "role_arn=$ROLE_ARN" >> $GITHUB_OUTPUT

	test:
	needs: create-github-role
	runs-on: ubuntu-latest
	timeout-minutes: 10
	if: ${{ github.event.inputs.run_tests == 'true' }}
	steps:
	- uses: actions/checkout@v4

	- name: Set variables
	run: \|
	echo "TESTS_PATH=$DEFAULT_TESTS_PATH" >> $GITHUB_ENV
	echo "DOTNET_VERSION=$DEFAULT_DOTNET_VERSION" >> $GITHUB_ENV

	- name: Setup .NET
	uses: actions/setup-dotnet@v3
	with:
	dotnet-version: ${{ env.DOTNET_VERSION }}

	- name: Cache NuGet packages
	uses: actions/cache@v3
	with:
	path: ~/.nuget/packages
	key: ${{ runner.os }}-nuget-${{ hashFiles('/packages.lock.json', '/packages.config') }}
	restore-keys: \|
	${{ runner.os }}-nuget-

	- name: Restore dependencies
	run: \|
	cd ${{ env.TESTS_PATH }}
	dotnet restore

	- name: Run tests
	run: \|
	cd ${{ env.TESTS_PATH }}
	dotnet test --no-restore --verbosity normal --collect:"XPlat Code Coverage" --logger "trx;LogFileName=test-results.trx"

	- name: Upload test results
	uses: actions/upload-artifact@v4
	if: always()
	with:
	name: test-results
	path: ${{ env.TESTS_PATH }}/TestResults
	retention-days: 30

	build:
	needs: [create-github-role, test]
	if: \|
	!failure() && !cancelled() &&
	(needs.test.result == 'success' \|\| needs.test.result == 'skipped')
	runs-on: ubuntu-latest
	timeout-minutes: 15
	outputs:
	package_path: ${{ steps.package.outputs.package_path }}

	steps:
	- name: Check skipped jobs status
	run: \|
	if [[ "${{ needs.test.result }}" == "skipped" ]]; then
	echo "::notice::TEST JOB WAS SKIPPED BECAUSE RUN_TESTS IS SET TO FALSE."
	fi

	- uses: actions/checkout@v4

	- name: Set remaining variables
	run: \|
	echo "PROJECT_PATH=$DEFAULT_PROJECT_PATH" >> $GITHUB_ENV
	echo "TESTS_PATH=$DEFAULT_TESTS_PATH" >> $GITHUB_ENV
	echo "LAMBDA_HANDLER=$DEFAULT_LAMBDA_HANDLER" >> $GITHUB_ENV

	# ENVIRONMENT VARIABLES JSON
	echo "ASPNETCORE_ENVIRONMENT=$DEFAULT_ASPNETCORE_ENVIRONMENT" >> $GITHUB_ENV
	echo "LAMBDA_DEBUG=$DEFAULT_LAMBDA_DEBUG" >> $GITHUB_ENV

	# BOOLEAN FLAGS
	echo "RUN_TESTS=${{ github.event.inputs.run_tests }}" >> $GITHUB_ENV
	echo "ENABLE_CORS=true" >> $GITHUB_ENV

	# SET Lambda config values
	echo "DOTNET_VERSION=$DEFAULT_DOTNET_VERSION" >> $GITHUB_ENV
	echo "LAMBDA_MEMORY=$DEFAULT_MEMORY" >> $GITHUB_ENV
	echo "LAMBDA_TIMEOUT=$DEFAULT_TIMEOUT" >> $GITHUB_ENV

	# SET API Gateway config values
	echo "API_THROTTLE_RATE=$DEFAULT_THROTTLE_RATE" >> $GITHUB_ENV
	echo "API_THROTTLE_BURST=$DEFAULT_THROTTLE_BURST" >> $GITHUB_ENV
	echo "API_QUOTA_LIMIT=$DEFAULT_QUOTA_LIMIT" >> $GITHUB_ENV
	echo "API_QUOTA_PERIOD=$DEFAULT_QUOTA_PERIOD" >> $GITHUB_ENV
	echo "API_GATEWAY_TYPE=$DEFAULT_API_GATEWAY_TYPE" >> $GITHUB_ENV

	- name: Setup .NET
	uses: actions/setup-dotnet@v3
	with:
	dotnet-version: ${{ env.DOTNET_VERSION }}

	- name: Debug Environment Variables
	run: \|
	echo "ENVIRONMENT VARIABLES:"
	echo "PROJECT_PATH=${{ env.PROJECT_PATH }}"
	echo "DOTNET_VERSION=${{ env.DOTNET_VERSION }}"
	ls -la

	- name: Cache NuGet packages
	uses: actions/cache@v3
	with:
	path: ~/.nuget/packages
	key: ${{ runner.os }}-nuget-${{ hashFiles('/packages.lock.json', '/packages.config') }}
	restore-keys: \|
	${{ runner.os }}-nuget-

	- name: Install Amazon.Lambda.Tools
	run: dotnet tool install -g Amazon.Lambda.Tools

	- name: Build and Package
	id: package
	run: \|
	PROJECT_DIR="${PROJECT_PATH:-$DEFAULT_PROJECT_PATH}"
	echo "USING PROJECT DIRECTORY: $PROJECT_DIR"

	cd $PROJECT_DIR
	dotnet restore
	dotnet build -c Release --no-restore
	dotnet publish -c Release -o ./publish --no-restore
	dotnet lambda package --configuration Release --framework net8.0 --output-package bin/Release/net8.0/lambda-package.zip
	echo "package_path=bin/Release/net8.0/lambda-package.zip" >> $GITHUB_OUTPUT

	- name: Upload artifact
	uses: actions/upload-artifact@v4
	with:
	name: lambda-package
	path: ${{ env.PROJECT_PATH }}/bin/Release/net8.0/lambda-package.zip

	create-iam-roles:
	needs: build
	runs-on: ubuntu-latest
	timeout-minutes: 10
	if: ${{ !failure() && !cancelled() }}
	outputs:
	lambda_role_arn: ${{ steps.create-lambda-role.outputs.role_arn }}
	role_exists: ${{ steps.check-lambda-role-exists.outputs.exists }}

	steps:
	- name: Set variables
	run: \|
	# SET variables directly from defaults
	echo "FUNCTION_NAME=$DEFAULT_FUNCTION_NAME" >> $GITHUB_ENV
	echo "RESOURCE_PREFIX=$DEFAULT_RESOURCE_PREFIX" >> $GITHUB_ENV
	echo "AWS_REGION=$DEFAULT_REGION" >> $GITHUB_ENV

	- name: Configure AWS credentials
	uses: aws-actions/configure-aws-credentials@v4
	with:
	aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
	aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
	aws-region: ${{ env.AWS_REGION \|\| 'us-east-1' }}

	- name: Check if Lambda role already exists
	id: check-lambda-role-exists
	run: \|
	# GET AWS ACCOUNT ID
	ACCOUNT_ID=$(aws sts get-caller-identity --query 'Account' --output text)
	echo "::add-mask::$ACCOUNT_ID"
	echo "ACCOUNT_ID=$ACCOUNT_ID" >> $GITHUB_ENV

	# CHECK IF LAMBDA ROLE EXISTS
	ROLE_NAME="${{ env.RESOURCE_PREFIX }}lambda-exec-role"
	ROLE_ARN=$(aws iam get-role --role-name "$ROLE_NAME" --query 'Role.Arn' --output text 2>/dev/null \|\| echo "")
	echo "::add-mask::$ROLE_ARN"

	if [ -n "$ROLE_ARN" ]; then
	echo "exists=true" >> $GITHUB_OUTPUT
	echo "role_arn=$ROLE_ARN" >> $GITHUB_OUTPUT
	echo "::notice::LAMBDA EXECUTION ROLE ALREADY EXISTS. REUSING EXISTING ROLE."
	else
	echo "exists=false" >> $GITHUB_OUTPUT
	fi

	- name: Create Lambda execution role
	id: create-lambda-role
	if: steps.check-lambda-role-exists.outputs.exists != 'true'
	run: \|
	ROLE_NAME="${{ env.RESOURCE_PREFIX }}lambda-exec-role"
	echo "CREATING LAMBDA EXECUTION ROLE..."
	echo '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"lambda.amazonaws.com"},"Action":"sts:AssumeRole"}]}' > trust-policy.json
	ROLE_ARN=$(aws iam create-role --role-name "$ROLE_NAME" --assume-role-policy-document file://trust-policy.json --query 'Role.Arn' --output text)
	echo "::add-mask::$ROLE_ARN"
	aws iam attach-role-policy --role-name "$ROLE_NAME" --policy-arn "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" > /dev/null

	# LEAST PRIVILEGED POLICY (SPECIFIC ARNS)
	echo '{
	"Version": "2012-10-17",
	"Statement": [
	{
	"Effect": "Allow",
	"Action": [
	"logs:CreateLogGroup",
	"logs:CreateLogStream",
	"logs:PutLogEvents"
	],
	"Resource": [
	"arn:aws:logs:${{ env.AWS_REGION }}:${{ env.ACCOUNT_ID }}:log-group:/aws/lambda/${{ env.FUNCTION_NAME }}:*"
	]
	}
	]
	}' > lambda-policy.json

	aws iam put-role-policy --role-name "$ROLE_NAME" --policy-name "${{ env.RESOURCE_PREFIX }}lambda-policy" --policy-document file://lambda-policy.json > /dev/null
	echo "WAITING FOR ROLE PROPAGATION..."
	sleep 10

	# STORE ROLE ARN IN OUTPUT WITHOUT DISPLAYING IT
	echo "role_arn=$ROLE_ARN" >> $GITHUB_OUTPUT

	deploy:
	runs-on: ubuntu-latest
	timeout-minutes: 20
	needs: [build, create-iam-roles]
	if: ${{ !failure() && !cancelled() }}
	env:
	LAMBDA_PACKAGE_PATH: lambda-package.zip

	steps:
	- name: Set variables
	run: \|
	# SET variables directly from defaults
	echo "FUNCTION_NAME=$DEFAULT_FUNCTION_NAME" >> $GITHUB_ENV
	echo "RESOURCE_PREFIX=$DEFAULT_RESOURCE_PREFIX" >> $GITHUB_ENV
	echo "PROJECT_PATH=$DEFAULT_PROJECT_PATH" >> $GITHUB_ENV
	echo "TESTS_PATH=$DEFAULT_TESTS_PATH" >> $GITHUB_ENV
	echo "LAMBDA_HANDLER=$DEFAULT_LAMBDA_HANDLER" >> $GITHUB_ENV

	# APPLICATION ENVIRONMENT VARIABLES
	echo "ASPNETCORE_ENVIRONMENT=$DEFAULT_ASPNETCORE_ENVIRONMENT" >> $GITHUB_ENV
	echo "LAMBDA_DEBUG=$DEFAULT_LAMBDA_DEBUG" >> $GITHUB_ENV

	# BOOLEAN flags
	echo "RUN_TESTS=${{ github.event.inputs.run_tests }}" >> $GITHUB_ENV
	echo "ENABLE_CORS=true" >> $GITHUB_ENV

	# SET CONFIG VALUES
	echo "AWS_REGION=$DEFAULT_REGION" >> $GITHUB_ENV
	echo "DOTNET_VERSION=$DEFAULT_DOTNET_VERSION" >> $GITHUB_ENV
	echo "LAMBDA_MEMORY=$DEFAULT_MEMORY" >> $GITHUB_ENV
	echo "LAMBDA_TIMEOUT=$DEFAULT_TIMEOUT" >> $GITHUB_ENV

	# SET API GATEWAY CONFIG VALUES
	echo "API_THROTTLE_RATE=$DEFAULT_THROTTLE_RATE" >> $GITHUB_ENV
	echo "API_THROTTLE_BURST=$DEFAULT_THROTTLE_BURST" >> $GITHUB_ENV
	echo "API_QUOTA_LIMIT=$DEFAULT_QUOTA_LIMIT" >> $GITHUB_ENV
	echo "API_QUOTA_PERIOD=$DEFAULT_QUOTA_PERIOD" >> $GITHUB_ENV
	echo "API_GATEWAY_TYPE=$DEFAULT_API_GATEWAY_TYPE" >> $GITHUB_ENV

	- name: Debug Info
	run: \|
	echo "JOB DEPLOY IS RUNNING!"
	echo "AWS_REGION=${{ env.AWS_REGION }}"
	echo "AWS_ACCESS_KEY_ID EXISTS: ${{ secrets.AWS_ACCESS_KEY_ID != '' }}"
	echo "AWS_SECRET_ACCESS_KEY EXISTS: ${{ secrets.AWS_SECRET_ACCESS_KEY != '' }}"

	- uses: actions/checkout@v4

	- name: Configure AWS credentials
	uses: aws-actions/configure-aws-credentials@v4
	with:
	aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
	aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
	aws-region: ${{ env.AWS_REGION \|\| 'us-east-1' }}

	- name: Get Lambda Execution Role
	run: \|
	ROLE_ARN="${{ needs.create-iam-roles.outputs.lambda_role_arn }}"
	if [ -z "$ROLE_ARN" ]; then
	echo "ROLE ARN WAS NOT CORRECTLY PASSED FROM THE CREATE-IAM-ROLES JOB, GETTING IT DIRECTLY..."
	ROLE_NAME="${{ env.RESOURCE_PREFIX }}lambda-exec-role"
	ROLE_ARN=$(aws iam get-role --role-name "$ROLE_NAME" --query 'Role.Arn' --output text)
	if [[ "${{ needs.create-iam-roles.result }}" == "skipped" ]]; then
	echo "::notice::IAM ROLES JOB WAS SKIPPED BECAUSE LAMBDA EXECUTION ROLE ALREADY EXISTS AND IS BEING REUSED."
	fi
	fi
	echo "::add-mask::$ROLE_ARN"
	echo "LAMBDA_ROLE_ARN=$ROLE_ARN" >> $GITHUB_ENV

	- name: Setup .NET
	uses: actions/setup-dotnet@v3
	with:
	dotnet-version: ${{ env.DOTNET_VERSION }}

	- name: Get AWS Account ID
	run: \|
	ACCOUNT_ID=$(aws sts get-caller-identity --query 'Account' --output text)
	echo "::add-mask::$ACCOUNT_ID"
	echo "ACCOUNT_ID=$ACCOUNT_ID" >> $GITHUB_ENV

	- name: Install Amazon.Lambda.Tools
	run: dotnet tool install -g Amazon.Lambda.Tools

	- name: Download artifact
	uses: actions/download-artifact@v4
	with:
	name: lambda-package
	path: ${{ env.PROJECT_PATH }}/

	- name: Verify package exists
	run: \|
	if [ ! -f "$PROJECT_PATH/${{ env.LAMBDA_PACKAGE_PATH }}" ]; then
	echo "PACKAGE NOT FOUND AT $PROJECT_PATH/${{ env.LAMBDA_PACKAGE_PATH }}"
	ls -la $PROJECT_PATH/
	exit 1
	fi

	- name: Deploy Lambda function
	run: \|
	cd ${{ env.PROJECT_PATH }}

	# DEPLOYING WITH THE RETRIEVED ROLE ARN
	echo "DEPLOYING WITH AWS CREDENTIALS..."
	dotnet lambda deploy-function ${{ env.FUNCTION_NAME }} \
	--region ${{ env.AWS_REGION }} \
	--function-role "${{ env.LAMBDA_ROLE_ARN }}" \
	--function-handler ${{ env.LAMBDA_HANDLER }} \
	--package ${{ env.LAMBDA_PACKAGE_PATH }} \
	--function-memory-size ${{ env.LAMBDA_MEMORY }} \
	--function-timeout ${{ env.LAMBDA_TIMEOUT }} \
	--function-runtime dotnet8 \
	--function-url ${{ env.FUNCTION_URL }} \
	--function-role ${{ env.LAMBDA_ROLE_ARN }} \
	--function-environment-variables "ASPNETCORE_ENVIRONMENT=${{ env.ASPNETCORE_ENVIRONMENT }};LAMBDA_DEBUG=${{ env.LAMBDA_DEBUG }};${{ env.DEFAULT_PROJECT_ENV }}" \
	${{ env.PROJECT_PATH }}

	- name: Ensure environment variables are set with AWS CLI
	run: \|
	echo "WAITING FOR LAMBDA FUNCTION TO BECOME ACTIVE..."
	# WAIT FOR FUNCTION TO BECOME ACTIVE
	MAX_WAIT=60
	WAIT_TIME=0
	DELAY=5

	while [ $WAIT_TIME -lt $MAX_WAIT ]; do
	FUNCTION_STATE=$(aws lambda get-function --function-name ${{ env.FUNCTION_NAME }} --query 'Configuration.State' --output text 2>/dev/null \|\| echo "")
	echo "Current function state: $FUNCTION_STATE"

	if [ "$FUNCTION_STATE" = "Active" ]; then
	echo "LAMBDA FUNCTION IS ACTIVE, PROCEEDING WITH ENVIRONMENT VARIABLE UPDATE..."
	break
	fi

	echo "WAITING FOR FUNCTION TO BECOME ACTIVE, WAITED ${WAIT_TIME}s SO FAR..."
	sleep $DELAY
	WAIT_TIME=$((WAIT_TIME + DELAY))
	done

	if [ $WAIT_TIME -ge $MAX_WAIT ]; then
	echo "WARNING: TIMED OUT WAITING FOR FUNCTION TO BECOME ACTIVE, ATTEMPTING UPDATE ANYWAY..."
	fi

	echo "SETTING ENVIRONMENT VARIABLES DIRECTLY WITH AWS CLI..."
	# Parse DEFAULT_PROJECT_ENV into variables
	# Create base ENV_VARS with non-DEFAULT_PROJECT_ENV variables
	ENV_VARS_JSON='{
	"Variables": {
	"ASPNETCORE_ENVIRONMENT": "'$ASPNETCORE_ENVIRONMENT'",
	"LAMBDA_DEBUG": "'$LAMBDA_DEBUG'"
	}
	}'

	# PARSE SMTP VARIABLES FROM DEFAULT_PROJECT_ENV
	IFS=';' read -ra ENV_VARS_ARRAY <<< "${{ env.DEFAULT_PROJECT_ENV }}"
	for VAR in "${ENV_VARS_ARRAY[@]}"; do
	if [ -n "$VAR" ]; then
	VAR=$(echo "$VAR" \| xargs) # Trim whitespace
	if [ -n "$VAR" ]; then
	KEY=$(echo "$VAR" \| cut -d'=' -f1)
	VALUE=$(echo "$VAR" \| cut -d'=' -f2-)

	# ADD TO THE JSON USING JQ
	ENV_VARS_JSON=$(echo "$ENV_VARS_JSON" \| jq --arg key "$KEY" --arg value "$VALUE" '.Variables[$key] = $value')
	fi
	fi
	done

	# CONVERT TO PROPER FORMAT FOR AWS CLI
	ENV_VARS=$(echo "$ENV_VARS_JSON")

	# UPDATE THE FUNCTION CONFIGURATION WITH THE ENVIRONMENT VARIABLES
	MAX_RETRIES=5
	RETRY=0
	RETRY_DELAY=10

	while [ $RETRY -lt $MAX_RETRIES ]; do
	if aws lambda update-function-configuration \
	--function-name ${{ env.FUNCTION_NAME }} \
	--environment "$ENV_VARS" \
	--region ${{ env.AWS_REGION }}; then
	echo "SUCCESSFULLY UPDATED ENVIRONMENT VARIABLES"
	break
	else
	RETRY=$((RETRY + 1))
	if [ $RETRY -ge $MAX_RETRIES ]; then
	echo "FAILED TO UPDATE ENVIRONMENT VARIABLES AFTER MAXIMUM RETRIES"
	echo "PLEASE CHECK LAMBDA FUNCTION CONFIGURATION MANUALLY"
	exit 1
	fi
	echo "UPDATE FAILED, RETRYING IN ${RETRY_DELAY}s (ATTEMPT $RETRY OF $MAX_RETRIES)..."
	sleep $RETRY_DELAY
	fi
	done

	echo "VERIFYING ENVIRONMENT VARIABLES..."
	aws lambda get-function-configuration \
	--function-name ${{ env.FUNCTION_NAME }} \
	--region ${{ env.AWS_REGION }} \
	--query "Environment.Variables.ASPNETCORE_ENVIRONMENT" \
	--output text

	echo "ENVIRONMENT VARIABLES CONFIGURATION COMPLETED."

	- name: Set API Gateway variables
	run: \|
	# API GATEWAY ID/name variables
	echo "API_NAME=${{ env.RESOURCE_PREFIX }}api" >> $GITHUB_ENV
	echo "API_DESCRIPTION=API for ${{ env.FUNCTION_NAME }}" >> $GITHUB_ENV

	# USAGE PLAN VARIABLES
	echo "USAGE_PLAN_NAME=${{ env.RESOURCE_PREFIX }}usage-plan" >> $GITHUB_ENV
	echo "USAGE_PLAN_DESCRIPTION=Usage plan for ${{ env.FUNCTION_NAME }}" >> $GITHUB_ENV

	# API KEY VARIABLES
	echo "API_KEY_NAME=${{ env.RESOURCE_PREFIX }}api-key" >> $GITHUB_ENV
	echo "API_KEY_DESCRIPTION=API key for ${{ env.FUNCTION_NAME }}" >> $GITHUB_ENV

	- name: Check if API Gateway exists
	id: check-api-exists
	run: \|
	# CHECK IF API ALREADY EXISTS BY LISTING ALL APIS AND FILTERING BY NAME
	API_ID=$(aws apigateway get-rest-apis --query "items[?name=='${{ env.API_NAME }}'].id" --output text)

	if [ -n "$API_ID" ]; then
	echo "API_ID=$API_ID" >> $GITHUB_ENV
	echo "::notice::REUSING EXISTING API GATEWAY WITH ID: $API_ID"
	echo "api_exists=true" >> $GITHUB_OUTPUT
	else
	echo "api_exists=false" >> $GITHUB_OUTPUT
	fi

	- name: Create API Gateway
	if: steps.check-api-exists.outputs.api_exists != 'true'
	run: \|
	echo "CREATING NEW API GATEWAY..."
	API_RESULT=$(aws apigateway create-rest-api \
	--name "${{ env.API_NAME }}" \
	--description "${{ env.API_DESCRIPTION }}" \
	--endpoint-configuration "types=REGIONAL")

	API_ID=$(echo $API_RESULT \| jq -r '.id')
	echo "API_ID=$API_ID" >> $GITHUB_ENV
	echo "::notice::CREATED NEW API GATEWAY WITH ID: $API_ID"

	- name: Configure API Gateway
	run: \|
	# GET ROOT RESOURCE ID
	echo "Getting API Gateway root resource ID"
	ROOT_RESOURCE_ID=$(aws apigateway get-resources \
	--rest-api-id $API_ID \
	--query 'items[?path==`/`].id' \
	--output text)
	echo "Root resource ID: $ROOT_RESOURCE_ID"

	# CHECK IF PROXY RESOURCE EXISTS
	echo "Checking if proxy resource exists"
	PROXY_RESOURCE_ID=$(aws apigateway get-resources \
	--rest-api-id $API_ID \
	--query 'items[?path==`/{proxy+}`].id' \
	--output text)

	# CREATE PROXY RESOURCE IF IT DOESN'T EXIST
	if [ -z "$PROXY_RESOURCE_ID" ] \|\| [ "$PROXY_RESOURCE_ID" = "None" ]; then
	echo "Creating proxy resource"
	PROXY_RESOURCE_RESULT=$(aws apigateway create-resource \
	--rest-api-id $API_ID \
	--parent-id $ROOT_RESOURCE_ID \
	--path-part "{proxy+}")
	PROXY_RESOURCE_ID=$(echo $PROXY_RESOURCE_RESULT \| jq -r '.id')
	echo "Created proxy resource with ID: $PROXY_RESOURCE_ID"
	else
	echo "Proxy resource already exists with ID: $PROXY_RESOURCE_ID"
	fi

	# CHECK IF ANY METHOD EXISTS FOR PROXY RESOURCE
	echo "Checking if ANY method exists for proxy resource"
	PROXY_ANY_METHOD=$(aws apigateway get-method \
	--rest-api-id $API_ID \
	--resource-id $PROXY_RESOURCE_ID \
	--http-method ANY 2>/dev/null \|\| echo "")

	# CREATE ANY METHOD FOR PROXY RESOURCE IF IT DOESN'T EXIST
	if [ -z "$PROXY_ANY_METHOD" ]; then
	echo "Creating ANY method for proxy resource"
	aws apigateway put-method \
	--rest-api-id $API_ID \
	--resource-id $PROXY_RESOURCE_ID \
	--http-method ANY \
	--authorization-type NONE
	else
	echo "ANY method for proxy resource already exists"
	fi

	# CHECK IF INTEGRATION EXISTS FOR PROXY RESOURCE
	echo "Checking if integration exists for proxy resource"
	PROXY_INTEGRATION=$(aws apigateway get-integration \
	--rest-api-id $API_ID \
	--resource-id $PROXY_RESOURCE_ID \
	--http-method ANY 2>/dev/null \|\| echo "")

	# CREATE INTEGRATION FOR PROXY RESOURCE IF IT DOESN'T EXIST
	if [ -z "$PROXY_INTEGRATION" ]; then
	echo "Creating integration for proxy resource"
	aws apigateway put-integration \
	--rest-api-id $API_ID \
	--resource-id $PROXY_RESOURCE_ID \
	--http-method ANY \
	--type AWS_PROXY \
	--integration-http-method POST \
	--uri arn:aws:apigateway:${{ env.AWS_REGION }}:lambda:path/2015-03-31/functions/arn:aws:lambda:${{ env.AWS_REGION }}:${{ env.ACCOUNT_ID }}:function:${{ env.FUNCTION_NAME }}/invocations
	else
	echo "Integration for proxy resource already exists"
	fi

	# CHECK IF ANY METHOD EXISTS FOR ROOT RESOURCE
	echo "Checking if ANY method exists for root resource"
	ROOT_ANY_METHOD=$(aws apigateway get-method \
	--rest-api-id $API_ID \
	--resource-id $ROOT_RESOURCE_ID \
	--http-method ANY 2>/dev/null \|\| echo "")

	# CREATE ANY METHOD FOR ROOT RESOURCE IF IT DOESN'T EXIST
	if [ -z "$ROOT_ANY_METHOD" ]; then
	echo "Creating ANY method for root resource"
	aws apigateway put-method \
	--rest-api-id $API_ID \
	--resource-id $ROOT_RESOURCE_ID \
	--http-method ANY \
	--authorization-type NONE
	else
	echo "ANY method for root resource already exists"
	fi

	# CHECK IF INTEGRATION EXISTS FOR ROOT RESOURCE
	echo "Checking if integration exists for root resource"
	ROOT_INTEGRATION=$(aws apigateway get-integration \
	--rest-api-id $API_ID \
	--resource-id $ROOT_RESOURCE_ID \
	--http-method ANY 2>/dev/null \|\| echo "")

	# CREATE INTEGRATION FOR ROOT RESOURCE IF IT DOESN'T EXIST
	if [ -z "$ROOT_INTEGRATION" ]; then
	echo "Creating integration for root resource"
	aws apigateway put-integration \
	--rest-api-id $API_ID \
	--resource-id $ROOT_RESOURCE_ID \
	--http-method ANY \
	--type AWS_PROXY \
	--integration-http-method POST \
	--uri arn:aws:apigateway:${{ env.AWS_REGION }}:lambda:path/2015-03-31/functions/arn:aws:lambda:${{ env.AWS_REGION }}:${{ env.ACCOUNT_ID }}:function:${{ env.FUNCTION_NAME }}/invocations
	else
	echo "Integration for root resource already exists"
	fi

	- name: Configure Lambda Permissions
	run: \|
	# ADD LAMBDA PERMISSION FOR API GATEWAY
	echo "Checking for existing Lambda permission"
	STATEMENT_ID="${{ env.RESOURCE_PREFIX }}api-gateway-permission"

	# ALWAYS CHECK FOR EXISTING PERMISSION THROUGH THE ERROR MESSAGE
	# THIS IS MORE RELIABLE THAN CHECKING THE POLICY
	ADD_PERMISSION_RESULT=$(aws lambda add-permission \
	--function-name ${{ env.FUNCTION_NAME }} \
	--statement-id "$STATEMENT_ID" \
	--action lambda:InvokeFunction \
	--principal apigateway.amazonaws.com \
	--source-arn "arn:aws:execute-api:${{ env.AWS_REGION }}:${{ env.ACCOUNT_ID }}:$API_ID//" 2>&1 \|\| true)

	# Check if the error indicates the permission already exists
	if echo "$ADD_PERMISSION_RESULT" \| grep -q "ResourceConflictException"; then
	echo "Lambda permission already exists with statement ID $STATEMENT_ID"
	elif echo "$ADD_PERMISSION_RESULT" \| grep -q "Statement"; then
	echo "Lambda permission successfully added with statement ID $STATEMENT_ID"
	else
	echo "Unexpected error when adding Lambda permission: $ADD_PERMISSION_RESULT"
	exit 1
	fi

	- name: Deploy API
	run: \|
	# CREATE DEPLOYMENT
	DEPLOYMENT_RESULT=$(aws apigateway create-deployment \
	--rest-api-id $API_ID \
	--stage-name prod \
	--description "Deployed from GitHub Actions")

	# CONFIGURE CORS IF ENABLED
	if [[ "${{ env.ENABLE_CORS }}" == "true" ]]; then
	echo "CONFIGURING CORS FOR API GATEWAY..."

	# GET ALL RESOURCES
	RESOURCES=$(aws apigateway get-resources \
	--rest-api-id $API_ID \
	--query 'items[].id' \
	--output text)

	for RESOURCE_ID in $RESOURCES; do
	# ADD OPTIONS METHOD
	aws apigateway put-method \
	--rest-api-id $API_ID \
	--resource-id $RESOURCE_ID \
	--http-method OPTIONS \
	--authorization-type NONE 2>/dev/null \|\| echo "Method likely exists"

	# CONFIGURE OPTIONS RESPONSE
	aws apigateway put-method-response \
	--rest-api-id $API_ID \
	--resource-id $RESOURCE_ID \
	--http-method OPTIONS \
	--status-code 200 \
	--response-models '{"application/json":"Empty"}' \
	--response-parameters '{
	"method.response.header.Access-Control-Allow-Headers":true,
	"method.response.header.Access-Control-Allow-Methods":true,
	"method.response.header.Access-Control-Allow-Origin":true
	}' 2>/dev/null \|\| echo "Method response likely exists"

	# CONFIGURE OPTIONS MOCK INTEGRATION
	aws apigateway put-integration \
	--rest-api-id $API_ID \
	--resource-id $RESOURCE_ID \
	--http-method OPTIONS \
	--type MOCK \
	--integration-http-method OPTIONS \
	--request-templates '{"application/json":"{\"statusCode\": 200}"}' 2>/dev/null \|\| echo "Integration likely exists"

	# CONFIGURE INTEGRATION RESPONSE
	aws apigateway put-integration-response \
	--rest-api-id $API_ID \
	--resource-id $RESOURCE_ID \
	--http-method OPTIONS \
	--status-code 200 \
	--response-parameters '{
	"method.response.header.Access-Control-Allow-Headers":"'"'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'"'",
	"method.response.header.Access-Control-Allow-Methods":"'"'GET,POST,PUT,DELETE,OPTIONS,PATCH'"'",
	"method.response.header.Access-Control-Allow-Origin":"'"'*'"'"
	}' \
	--response-templates '{"application/json":""}' 2>/dev/null \|\| echo "Integration response likely exists"
	done
	fi

	- name: Check if Usage Plan exists
	id: check-usage-plan
	run: \|
	# CHECK IF USAGE PLAN EXISTS
	EXISTING_USAGE_PLANS=$(aws apigateway get-usage-plans --query "items[?name=='${{ env.USAGE_PLAN_NAME }}'].id" --output text)

	if [ -n "$EXISTING_USAGE_PLANS" ]; then
	echo "USAGE_PLAN_ID=$EXISTING_USAGE_PLANS" >> $GITHUB_ENV
	echo "usage_plan_exists=true" >> $GITHUB_OUTPUT
	else
	echo "usage_plan_exists=false" >> $GITHUB_OUTPUT
	fi

	- name: Create Usage Plan
	if: steps.check-usage-plan.outputs.usage_plan_exists != 'true'
	run: \|
	# CREATE USAGE PLAN
	USAGE_PLAN_RESULT=$(aws apigateway create-usage-plan \
	--name "${{ env.USAGE_PLAN_NAME }}" \
	--description "${{ env.USAGE_PLAN_DESCRIPTION }}" \
	--throttle "rateLimit=${{ env.API_THROTTLE_RATE }},burstLimit=${{ env.API_THROTTLE_BURST }}" \
	--quota "limit=${{ env.API_QUOTA_LIMIT }},period=${{ env.API_QUOTA_PERIOD }}" \
	--api-stages "apiId=$API_ID,stage=prod")

	USAGE_PLAN_ID=$(echo $USAGE_PLAN_RESULT \| jq -r '.id')
	echo "USAGE_PLAN_ID=$USAGE_PLAN_ID" >> $GITHUB_ENV

	- name: Check if API Key exists
	id: check-api-key
	run: \|
	# CHECK IF API KEY EXISTS
	EXISTING_API_KEY_ID=$(aws apigateway get-api-keys --name-query "${{ env.API_KEY_NAME }}" --include-values --query "items[0].id" --output text)

	if [ "$EXISTING_API_KEY_ID" != "None" ] && [ -n "$EXISTING_API_KEY_ID" ]; then
	echo "API_KEY=$EXISTING_API_KEY_ID" >> $GITHUB_ENV
	echo "api_key_exists=true" >> $GITHUB_OUTPUT
	echo "EXISTING_API_KEY_ID=$EXISTING_API_KEY_ID" >> $GITHUB_ENV
	else
	echo "api_key_exists=false" >> $GITHUB_OUTPUT
	fi

	- name: Create API Key
	if: steps.check-api-key.outputs.api_key_exists != 'true'
	run: \|
	# ENSURE ALL OUTPUT IS CORRECTLY MASKED
	# FIRST ADD MASKING FOR THE OUTPUT
	# THIS IS USED TO PRE-MASK OUTPUTS BEFORE THEY'RE CREATED
	echo "::add-mask::$(date +%s%N \| sha256sum \| head -c 64)"

	# CREATE API KEY WITHOUT DIRECT OUTPUT LOGGING
	# REDIRECT STDOUT TO A SECURE FILE INSTEAD OF DISPLAYING
	API_KEY_JSON=$(aws apigateway create-api-key \
	--name "${{ env.API_KEY_NAME }}" \
	--description "${{ env.API_KEY_DESCRIPTION }}" \
	--enabled \
	--output json > /tmp/api_key_result.json)

	# GET ID WITHOUT PRINTING THE FULL JSON TO LOGS
	API_KEY=$(cat /tmp/api_key_result.json \| jq -r '.id')
	echo "::add-mask::$API_KEY"
	echo "API_KEY=$API_KEY" >> $GITHUB_ENV

	# IMMEDIATELY MASK THE VALUE IN THE OUTPUT FILE
	API_KEY_VALUE=$(cat /tmp/api_key_result.json \| jq -r '.value')
	echo "::add-mask::$API_KEY_VALUE"

	# SECURELY REMOVE THE TEMP FILE WITH THE KEY DATA
	shred -u /tmp/api_key_result.json

	# ADD API KEY TO USAGE PLAN
	aws apigateway create-usage-plan-key \
	--usage-plan-id ${{ env.USAGE_PLAN_ID }} \
	--key-id $API_KEY \
	--key-type API_KEY

	- name: Output API URL
	run: \|
	# GET API URL
	API_URL="https://$API_ID.execute-api.${{ env.AWS_REGION }}.amazonaws.com/prod/"
	echo "::add-mask::$API_URL"

	# IMPORTANT: MASK THE API KEY VALUE BEFORE RETRIEVING IT
	# USE A TEMPORARY FILE TO STORE THE RESULT WITHOUT DISPLAYING IT
	aws apigateway get-api-key \
	--api-key "$API_KEY" \
	--include-value \
	--output json > /tmp/api_key_value.json

	# EXTRACT AND MASK THE API KEY VALUE
	API_KEY_VALUE=$(cat /tmp/api_key_value.json \| jq -r '.value')
	echo "::add-mask::$API_KEY_VALUE"

	# SECURELY REMOVE THE TEMP FILE
	shred -u /tmp/api_key_value.json

	# DISPLAY NOTICE WITH SECURE INSTRUCTIONS
	echo "::notice title=API Gateway Deployed::API GATEWAY HAS BEEN SUCCESSFULLY DEPLOYED WITH URL: $API_URL"

	if [ -z "$EXISTING_API_KEY_ID" ]; then
	echo "A NEW API KEY HAS BEEN GENERATED. USE THE 'X-API-KEY' HEADER WITH THIS KEY TO ACCESS THE API."
	else
	echo "EXISTING API KEY HAS BEEN REUSED. CONTINUE USING THE SAME API KEY WITH THE 'X-API-KEY' HEADER."
	fi

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Deploy to AWS Lambda #9

Workflow file

Deploy to AWS Lambda #9

Uh oh!

Workflow file for this run