⚠️ Deprecating legacy issuer credentials AWS org

[JFWooten4]

Now that the plaintext access rules are firmly outdated, we don't need to make the CCCs, PMACs, etc. for issuer credentials. This documentation issue should start the process of migrating the old database as it's used on py-TAD operations. It'll need to bring the identity-provider authorization keys into 241263263086 or defer to our own programmatic filer delegations. If it's the latter, we need to finish the parent before moving the data ¹

Footnotes

1. And this site is a decent forum for it, but still should consider the TAD3 docs moving to the DRS side since all agents will go through EDGAR Next. ↩

[JFWooten4]

The organization has two main Lambda functions:

changeCreds (last modified 2023-08-25T10:11:41.000Z)

This is only a rudimentary function. Here is the flow in pseudocode:

# setCreds <external caller>
# See if CIK exists.
# Deny if so.
# Set creds for CIK.

# updateCreds - for when they manage their own permanent creds.
# Prevent modification of permanent fields.

# set[PermanentFields]
# See if permanent field exists.
# Set if not.

# NOTE: Do not allow modification of permanent info - PMAC, etc.

The IAM role k7nqk75e is mostly just log creation, grouping, and streaming.

rotateCreds (last modified 2023-09-25T17:13:01.000Z)

The Lambda development here is much more rudimentary and relies on manual monthly batches based on email confirmations of issuer plaintext tokens.

The IAM role does not even access the database:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "logs:CreateLogGroup",
            "Resource": "arn:aws:logs:us-east-2:517147173424:*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": [
                "arn:aws:logs:us-east-2:517147173424:log-group:/aws/lambda/rotateCreds:*"
            ]
        }
    ]
}

Dynamo database table/SEC

• AWS KMS
• Has PITR (35 days)
• Deletion protection
• Maintains the two initial issuers indexed by CIK [CCC, passphrase, password, & PMAC]