# SLI Analyzer

## How to update Layer

1. Update the code in the `layers` directory

2. Build the layer

```
cd layers && make build
```

3. Upload the zip file to the S3 bucket or update the layer in the AWS console

4. Update the layer version in `template.yaml`

## Test on local

1. Install the dependencies

```
make install-dev-dependencies
make install-dependencies
```

2. Prepare the `.env` file. Copy `.env.example` to `.env`, update the
   non-sensitive values, and set `SLI_SECRET_NAME` to the AWS Secrets Manager
   secret used by your environment.

3. Run the python files

## Runtime secrets

Pulumi creates one AWS Secrets Manager secret per stack:

- `sli-dev-analyzer-secret`
- `sli-prod-analyzer-secret`

Populate the appropriate secret before deploying the Lambda functions. Its
`SecretString` must be a JSON object with these keys:

```json
{
  "SLI_DB_PASSWD": "...",
  "JIRA_PASSWORD": "...",
  "ACTIVITY_HUB_KEY": "...",
  "CLINIC_API_KEY": "...",
  "DEV_OPS_API_KEY": "...",
  "SENDGRID_API_KEY": "...",
  "SERVERLESS_DB_PASSWD": "..."
}
```

The application reads the JSON object once per Lambda execution environment
and caches it in memory. Secret values are not copied into Lambda environment
variables, SAM templates, GitHub Actions commands, or Pulumi state. The Lambda
roles have access only to the secret created for their stack.

For the initial rollout, deploy `infra` first, populate the new secret, then
build and publish the updated Lambda layer and deploy the SAM applications.
Update the layer version in both SAM templates before the application deploy.

When rotating a credential, update the corresponding key in Secrets Manager.
New Lambda execution environments use the new value; redeploy or restart the
functions when an immediate refresh is required.