feat(integrations): connect an AWS account as a source

.env.example

@@ -199,6 +199,13 @@ INGEST_REQUIRE_TLS=false
 # the IAM Service Account Credentials API enabled.
 # MAPLE_GCP_SERVICE_ACCOUNT_KEY=
 
+# AWS integration (an administrator deploys a generated CloudFormation stack from CloudShell).
+# Maple's own IAM user, whose only permission is sts:AssumeRole on arn:aws:iam::*:role/MapleIntegration-*.
+# Customer roles trust it with their connection's external id. All three unset: AWS is unavailable.
+# MAPLE_AWS_PRINCIPAL_ARN=arn:aws:iam::<maple-account>:user/maple-integrations
+# MAPLE_AWS_ACCESS_KEY_ID=
+# MAPLE_AWS_SECRET_ACCESS_KEY=
+
 # OpenTelemetry (API self-observability) — read by @maple-dev/effect-sdk
 # MAPLE_ENVIRONMENT=local                  # "local" = no export; any other value enables OTLP
 # MAPLE_ENDPOINT=http://127.0.0.1:3474     # Ingest gateway endpoint (enriches with org_id)

apps/alerting/src/schedule.ts

@@ -36,7 +36,10 @@ export const ALERTING_SCHEDULE = {
 	},
 	// `supabase_insights` reads top queries every tick and advisors hourly (it tracks the hour itself).
 	"*/15 * * * *": { lanes: ["digest", "supabase_insights"], deadline: "10 minutes" },
-	"0 * * * *": { lanes: ["service_map_rollup", "supabase_discovery"], deadline: "15 minutes" },
+	"0 * * * *": {
+		lanes: ["service_map_rollup", "supabase_discovery", "aws_connections"],
+		deadline: "15 minutes",
+	},
 } as const satisfies Record<string, CronSchedule>
 
 export type AlertingCron = keyof typeof ALERTING_SCHEDULE

apps/alerting/src/scheduled.test.ts

@@ -18,7 +18,7 @@ const cronCases = [
 		],
 	],
 	["*/15 * * * *", ["digest", "supabaseInsights"]],
-	["0 * * * *", ["serviceMapRollup", "supabaseDiscovery"]],
+	["0 * * * *", ["serviceMapRollup", "supabaseDiscovery", "awsConnections"]],
 	["* * * * *", ["alert", "error", "escalation", "fixVerification", "supabaseLogs"]],
 ] as const
 
@@ -31,6 +31,7 @@ const recordingTicks = (
 	return {
 		alert: tick("alert"),
 		anomaly: tick("anomaly"),
+		awsConnections: tick("awsConnections"),
 		cloudflareAnalytics: tick("cloudflareAnalytics"),
 		digest: tick("digest"),
 		error: tick("error"),

apps/alerting/src/scheduled.ts

@@ -22,6 +22,7 @@ import { PullRequestLookupLive } from "@maple/backend/services/errors/pull-reque
 import { PlanetScaleService } from "@maple/backend/services/integrations/PlanetScaleService"
 import { PrReviewPostMergeService } from "@maple/backend/services/pr-review/PrReviewPostMergeService"
 import { RailwayMetricsService } from "@maple/backend/services/integrations/RailwayMetricsService"
+import { AwsConnectionService } from "@maple/backend/services/integrations/AwsConnectionService"
 import { SupabaseConnectionService } from "@maple/backend/services/integrations/SupabaseConnectionService"
 import { SupabaseInsightsService } from "@maple/backend/services/integrations/SupabaseInsightsService"
 import { SupabaseLogsService } from "@maple/backend/services/integrations/SupabaseLogsService"
@@ -56,6 +57,7 @@ export const layerTick = (
 		GcpMetricsService.layer,
 		PlanetScaleService.layer,
 		RailwayMetricsService.layer,
+		AwsConnectionService.layer,
 		SupabaseConnectionService.layer,
 		SupabaseLogsService.layer,
 		SupabaseInsightsService.layer,
@@ -291,6 +293,19 @@ const planetScaleTick = makeTick(
 			: undefined,
 )
 
+const awsConnectionsTick = makeTick(
+	AwsConnectionService.use((aws) => aws.checkDue()),
+	"aws_connections",
+	(result) =>
+		result.due > 0
+			? {
+					due: result.due,
+					checked: result.checked,
+					failures: result.failures,
+				}
+			: undefined,
+)
+
 const railwayMetricsTick = makeTick(
 	RailwayMetricsService.use((railway) => railway.pollAllOrgs()),
 	"railway_metrics",
@@ -366,6 +381,7 @@ const prReviewPostMergeTick = makeTick(
 export interface ScheduledTickPrograms<R = never> {
 	readonly alert: Effect.Effect<void, never, R>
 	readonly anomaly: Effect.Effect<void, never, R>
+	readonly awsConnections: Effect.Effect<void, never, R>
 	readonly cloudflareAnalytics: Effect.Effect<void, never, R>
 	readonly digest: Effect.Effect<void, never, R>
 	readonly error: Effect.Effect<void, never, R>
@@ -398,6 +414,7 @@ const laneProgram = <R>(lane: TickLane, ticks: ScheduledTickPrograms<R>): Effect
 		Match.when("pr_review_post_merge", () => ticks.prReviewPostMerge),
 		Match.when("digest", () => ticks.digest),
 		Match.when("service_map_rollup", () => ticks.serviceMapRollup),
+		Match.when("aws_connections", () => ticks.awsConnections),
 		Match.when("supabase_discovery", () => ticks.supabaseDiscovery),
 		Match.when("supabase_logs", () => ticks.supabaseLogs),
 		Match.when("supabase_insights", () => ticks.supabaseInsights),
@@ -439,6 +456,7 @@ export const selectLaneProgram = <R>(
 type ScheduledServices =
 	| AlertsService
 	| AnomalyDetectionService
+	| AwsConnectionService
 	| CloudflareAnalyticsService
 	| DigestService
 	| WebAnalyticsDigestService
@@ -457,6 +475,7 @@ type ScheduledServices =
 export const scheduledTicks: ScheduledTickPrograms<ScheduledServices> = {
 	alert: alertTick,
 	anomaly: anomalyTick,
+	awsConnections: awsConnectionsTick,
 	cloudflareAnalytics: cloudflareAnalyticsTick,
 	digest: digestTick,
 	error: errorTick,

apps/alerting/src/worker.ts

@@ -72,6 +72,10 @@ const configuredEnv = (stage: MapleStage, region: MapleRegion, domains: MapleDom
 		supabaseOAuthEnv,
 		// Sign-in for the Google Cloud metrics poller; unset leaves its tick a no-op.
 		optionalSecret("MAPLE_GCP_SERVICE_ACCOUNT_KEY"),
+		// Maple's AWS identity for the hourly connection check; unset leaves its tick a no-op.
+		optionalPlain("MAPLE_AWS_PRINCIPAL_ARN"),
+		optionalPlain("MAPLE_AWS_ACCESS_KEY_ID"),
+		optionalSecret("MAPLE_AWS_SECRET_ACCESS_KEY"),
 		// Ticks post pull-request replies through the GitHub App; without it each one fails.
 		githubAppSourceEnv,
 		// Outbound config for `chat` destinations' connectors.

apps/api/src/resources/env.ts

@@ -85,4 +85,8 @@ export const apiConfiguredEnv = (stage: MapleStage, region: MapleRegion, domains
 		planetScaleOAuthEnv,
 		supabaseOAuthEnv,
 		optionalPlain("MAPLE_GCP_SERVICE_ACCOUNT_EMAIL"),
+		// Maple's AWS identity: assumes customer roles. Unset leaves AWS unavailable.
+		optionalPlain("MAPLE_AWS_PRINCIPAL_ARN"),
+		optionalPlain("MAPLE_AWS_ACCESS_KEY_ID"),
+		optionalSecret("MAPLE_AWS_SECRET_ACCESS_KEY"),
 	)