cscott/hncb-fusion-deid-demo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(net): custom domain for the Fusion-facing API

Browse Source 
Fusion couldn't resolve the default *.execute-api.amazonaws.com endpoint, so front
the same HTTP API with hncb-deid.apim-apac-demo.com (ACM DNS-validated cert,
apigatewayv2 REGIONAL custom domain, root api mapping, Route53 A ALIAS). Callers
resolve our hostname straight to IPs and never touch an execute-api name; also
survives API-id churn. Point POLICY_SETUP + README demo at the custom URLs.

Verified live: resolves to IPs, 401 unauthenticated, tokenizes with the key.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Conan Scott
2026-07-02 11:04:19 +10:00
parent feb44be76b
commit b5de55d4a6
3 changed files with 91 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
fusion/POLICY_SETUP.md
View File

@@ -35,14 +35,20 @@ advisor ◀────┘
The transforms run **inside the policy boundary**; the raw name never crosses it.
## Backend the policy calls
- `TOKENIZE_URL` = `https://<api-id>.execute-api.<region>.amazonaws.com/tokenize`
— `terraform -chdir=terraform output -raw tokenize_url`
- `RESTORE_URL` = `https://<...>/restore` — `terraform ... output -raw restore_url`
Use the **custom domain** — Fusion could not resolve the default
`*.execute-api.ap-southeast-1.amazonaws.com` endpoint, so the API is fronted by a
Route53-aliased name that resolves straight to IPs (see `terraform/custom_domain.tf`).
- `TOKENIZE_URL` = `https://hncb-deid.apim-apac-demo.com/tokenize`
— `terraform -chdir=terraform output -raw tokenize_url_custom`
- `RESTORE_URL` = `https://hncb-deid.apim-apac-demo.com/restore`
— `terraform -chdir=terraform output -raw restore_url_custom`
- `AGENT_RUNTIME_ARN` (the route's upstream) = printed by `scripts/agentcore_setup.sh`
- **Auth:** public API Gateway HTTP API; send the shared secret in the **`x-api-key`**
header (`Authorization: Bearer <secret>` also works). The secret is the Terraform
`tokenize_api_key` var (gitignored `terraform/local.auto.tfvars`, never committed) —
hand it to the console operator out of band.
- *Note:* the raw `…execute-api…` URLs (`output -raw tokenize_url` / `restore_url`)
still work for anything that can resolve them; Fusion should use the custom domain.
- *Note:* a Lambda Function URL was the first choice, but this account's SCP blocks
unauthenticated Function URLs, so the public front door is API Gateway.