feat: add support for provisioning cdn logs infra for onboarding

Author: akshaymagapu

docs/index.html

@@ -49,6 +49,8 @@ tags:
     description: APIs for scraping web pages
   - name: llmo
     description: LLMO (Large Language Model Optimizer) operations
+  - name: cdn-logs
+    description: CDN logs infrastructure provisioning for organizations
 
 paths:
   /audits/latest/{auditType}:
@@ -215,6 +217,8 @@ paths:
     $ref: './tools-api.yaml#/import-job-progress'
   /tools/import/jobs/{jobId}/result:
     $ref: './tools-api.yaml#/import-job-result'
+  /tools/cdn-logs/buckets/{imsOrgName}/{imsOrgId}:
+    $ref: './tools-api.yaml#/cdn-logs-buckets'
   /sites/{siteId}/llmo/sheet-data/{dataSource}:
     $ref: './llmo-api.yaml#/llmo-sheet-data'
   /sites/{siteId}/llmo/sheet-data/{sheetType}/{dataSource}:

docs/openapi/api.yaml

@@ -3490,3 +3490,64 @@ LlmoConfig:
       description: The customer intent configuration containing key-value pairs
       $ref: '#/LlmoCustomerIntent'
   additionalProperties: false
+
+CdnLogsBucketResponse:
+  type: object
+  description: Response from CDN logs bucket provisioning operation
+  required:
+    - message
+    - imsOrgName
+    - imsOrgId
+    - bucketName
+    - bucketArn
+    - bucketExists
+    - configuration
+  properties:
+    message:
+      type: string
+      description: Descriptive message about what was created or retrieved
+      example: "Successfully created CDN logs bucket and credentials for organization: adobe (ID: 1234567890ABCDEF12345678@AdobeOrg)"
+    imsOrgName:
+      type: string
+      description: Organization name
+      example: "adobe"
+    imsOrgId:
+      type: string
+      description: Organization identifier
+      example: "1234567890ABCDEF12345678@AdobeOrg"
+    bucketName:
+      type: string
+      description: Generated CDN logs bucket name
+      example: "cdn-logs-adobe-1234567890"
+    bucketArn:
+      type: string
+      description: CDN logs bucket ARN
+      example: "arn:aws:s3:::cdn-logs-adobe-1234567890"
+    bucketExists:
+      type: boolean
+      description: Whether the bucket already existed before this request
+      example: false
+    credentials:
+      type: object
+      description: CDN logs access credentials
+      properties:
+        accessKey:
+          type: string
+          description: AWS access key ID for CDN logs
+          example: "AKIAIOSFODNN7EXAMPLE"
+        secretKey:
+          type: string
+          description: AWS secret access key for CDN logs (only returned during creation)
+          example: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
+        secretArn:
+          type: string
+          description: AWS Secrets Manager ARN where CDN logs credentials are stored
+          example: "arn:aws:secretsmanager:us-east-1:123456789012:secret:adobe-1234567890-AbCdEf"
+        secretPath:
+          type: string
+          description: AWS Secrets Manager path for CDN logs credentials
+          example: "/helix-deploy/spacecat-services/customer-secrets/adobe_1234567890/latest"
+      additionalProperties: false
+  additionalProperties: false
+
+

docs/openapi/schemas.yaml

@@ -362,3 +362,62 @@ file-download:
         $ref: './responses.yaml#/500'
     security:
       - scoped_api_key: [ ]
+
+cdn-logs-buckets:
+  put:
+    tags:
+      - cdn-logs
+    summary: Create or return CDN logs bucket for organization
+    description: |
+      Creates a new CDN logs S3 bucket with full configuration for an organization, or returns existing bucket details.
+      
+      The CDN logs bucket name is generated from the organization name and ID using AWS naming conventions.
+      Organization names must contain only letters, numbers, and hyphens.
+      Organization IDs must contain only uppercase letters, numbers, and optionally end with @AdobeOrg.
+      
+      For new CDN logs infrastructure, creates:
+      - S3 bucket with encryption and security settings optimized for CDN logs
+      - IAM policy and user for CDN logs access
+      - CDN logs access credentials stored in AWS Secrets Manager
+      
+      If the CDN logs bucket already exists, returns the existing bucket information.
+    operationId: provisionCdnLogsBucket
+    security:
+      - ims_key: [ ]
+      - scoped_api_key: [ ]
+    parameters:
+      - name: imsOrgName
+        in: path
+        required: true
+        description: IMS Organization name (letters, numbers, and hyphens only)
+        schema:
+          type: string
+          pattern: '^[a-zA-Z0-9-]+$'
+        example: "adobe"
+      - name: imsOrgId
+        in: path
+        required: true
+        description: IMS Organization identifier (uppercase letters, numbers, optionally ending with @AdobeOrg)
+        schema:
+          type: string
+          pattern: '^[A-Z0-9]+(@AdobeOrg)?$'
+        example: "1234567890ABCDEF12345678@AdobeOrg"
+    responses:
+      '200':
+        description: CDN logs bucket and/or credentials already exist, returning details
+        content:
+          application/json:
+            schema:
+              $ref: './schemas.yaml#/CdnLogsBucketResponse'
+      '201':
+        description: CDN logs bucket and/or credentials created successfully
+        content:
+          application/json:
+            schema:
+              $ref: './schemas.yaml#/CdnLogsBucketResponse'
+      '400':
+        $ref: './responses.yaml#/400'
+      '500':
+        $ref: './responses.yaml#/500'
+
+