1#!/bin/bash
2set -euo pipefail
3
4# AWS Marketplace SaaS Metering Integration - Deploy Script
5#
6# Usage:
7#   ./deploy.sh events-only                              Deploy shared events stack only
8#   ./deploy.sh <PRODUCT_CODE> <REGION>                  Deploy events + main stack
9#   ./deploy.sh <PRODUCT_CODE> <REGION> <PREFIX>         Custom stack prefix
10#
11# Examples:
12#   STAGE_NAME=v1 ./deploy.sh events-only
13#   STAGE_NAME=v1 ./deploy.sh abc123def us-west-2
14#   STAGE_NAME=beta METERING_MODE=dry-run TEST_ACCOUNT_ALLOWLIST=111122223333 ./deploy.sh abc123def us-west-2 myapp-abc123def-beta

deploy.sh on GitHub

#

# Stack names (stage-scoped; STAGE_NAME is mandatory):

# Events stack (shared per stage): awsmp-events-<STAGE_NAME>-stack (us-east-1)

# Main stack (per-product): <PREFIX>-metering, default awsmp-<PRODUCT_CODE>-<STAGE_NAME>-metering (<REGION>)

# ─── Cleanup trap ────────────────────────────────────────────────────────────

cleanup() {

local exit_code=$?

if [ $exit_code -ne 0 ]; then

echo ""

echo "⚠️ Deployment failed (exit code: $exit_code)"

echo " Check the CloudFormation console for stack events."

echo " No automatic rollback — review and fix before retrying."

fi

# Clean up SAM build artifacts if they exist

if [ -d ".aws-sam" ]; then

rm -rf .aws-sam

fi

exit $exit_code

}

trap cleanup EXIT

# ─── Version checks ─────────────────────────────────────────────────────────

check_prerequisites() {

local errors=0

# AWS CLI v2 required

if ! command -v aws &>/dev/null; then

echo "ERROR: AWS CLI not found. Install from https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html"

errors=$((errors + 1))

else

local aws_version

aws_version=$(aws --version 2>&1 | sed -n 's/.*aws-cli\/$[0-9]*$.*/\1/p')

if [ "${aws_version:-0}" -lt 2 ]; then

echo "ERROR: AWS CLI v2 required (found v${aws_version}). Update: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html"

errors=$((errors + 1))

fi

# SAM CLI required

if ! command -v sam &>/dev/null; then

echo "ERROR: SAM CLI not found. Install from https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/install-sam-cli.html"

errors=$((errors + 1))

fi

# Python 3.9+ required (for Lambda runtime compatibility)

if ! command -v python3 &>/dev/null; then

echo "ERROR: Python 3 not found."

errors=$((errors + 1))

else

local py_version

py_version=$(python3 -c "import sys; print(f'{sys.version_info.major}.{sys.version_info.minor}')")

local py_minor

py_minor=$(echo "$py_version" | cut -d. -f2)

if [ "${py_minor:-0}" -lt 9 ]; then

echo "WARNING: Python 3.9+ recommended (found $py_version). Lambda uses 3.12."

fi

if [ $errors -gt 0 ]; then

echo ""

echo "Fix the above errors before proceeding."

exit 1

fi

}

# ─── Input validation ─────────────────────────────────────────────

# Validate caller-supplied values against a strict allowlist charset BEFORE use, so a

# value containing spaces/shell metacharacters cannot inject extra CloudFormation

# parameter overrides or arguments. Product code / prefix: alphanumeric, dash, underscore.

# Region: AWS region format.

validate_inputs() {

local product_code="$1"

local region="$2"

local prefix="$3"

if ! [[ "$product_code" =~ ^[A-Za-z0-9_-]+$ ]]; then

echo "ERROR: invalid PRODUCT_CODE '$product_code' (allowed: A-Z a-z 0-9 _ -)."

exit 1

fi

if ! [[ "$region" =~ ^[a-z]{2}-[a-z]+-[0-9]$ ]]; then

echo "ERROR: invalid REGION '$region' (expected e.g. us-east-1)."

exit 1

fi

if ! [[ "$prefix" =~ ^[A-Za-z0-9_-]+$ ]]; then

echo "ERROR: invalid PREFIX '$prefix' (allowed: A-Z a-z 0-9 _ -)."

exit 1

fi

}

# ─── SAM artifact bucket (no --resolve-s3) ──────────────────────────

# The least-privilege deployer policy scopes cloudformation:* to stack/awsmp-*, so

# `sam deploy --resolve-s3` (which bootstraps the non-awsmp aws-sam-cli-managed-default

# CFN stack) is DENIED. Provision the artifact bucket DIRECTLY instead — the policy's

# S3DeploymentArtifacts grant already allows this on aws-sam-cli-managed-default-*.

# Echoes the bucket name for use with `sam deploy --s3-bucket`.

ensure_sam_bucket() {

local region="$1"

local bucket="aws-sam-cli-managed-default-${ACCOUNT_ID}-${region}"

if ! aws s3api head-bucket --bucket "$bucket" --region "$region" >/dev/null 2>&1; then

if [ "$region" = "us-east-1" ]; then

aws s3api create-bucket --bucket "$bucket" --region "$region" >/dev/null

else

aws s3api create-bucket --bucket "$bucket" --region "$region" \

--create-bucket-configuration "LocationConstraint=${region}" >/dev/null

fi

aws s3api put-bucket-encryption --bucket "$bucket" \

--server-side-encryption-configuration \

'{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"AES256"}}]}' >/dev/null

aws s3api put-bucket-versioning --bucket "$bucket" \

--versioning-configuration Status=Enabled >/dev/null

fi

echo "$bucket"

}

# ─── Per-region API Gateway CloudWatch Logs account role ────────────

# A logging-enabled API stage (AccessLogSetting) requires a per-region,

# account-level CloudWatch Logs role set via `apigateway update-account`. Granting the

# permission is not enough — the role/account setting must actually be provisioned per

# region, or the first region "just works" and every additional region fails with

# "CloudWatch Logs role ARN must be set in account settings to enable logging".

# Idempotent: creates the (region-agnostic) role once, then sets the account setting for

# THIS region if not already set.

ensure_apigw_cw_role() {

local region="$1"

local role_name="awsmp-apigw-cloudwatch-logs"

local role_arn="arn:aws:iam::${ACCOUNT_ID}:role/${role_name}"

if ! aws iam get-role --role-name "$role_name" >/dev/null 2>&1; then

aws iam create-role --role-name "$role_name" \

--assume-role-policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"apigateway.amazonaws.com"},"Action":"sts:AssumeRole"}]}' \

>/dev/null

aws iam attach-role-policy --role-name "$role_name" \

--policy-arn arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs \

>/dev/null

# IAM role propagation to API Gateway can lag a few seconds.

sleep 10

fi

local current

current=$(aws apigateway get-account --region "$region" \

--query cloudwatchRoleArn --output text 2>/dev/null || echo "None")

if [ "$current" = "None" ] || [ -z "$current" ]; then

echo "Setting API Gateway account CloudWatch Logs role for ${region} (account-global for that region)..."

aws apigateway update-account --region "$region" \

--patch-operations "op=replace,path=/cloudwatchRoleArn,value=${role_arn}" >/dev/null

fi

}

# ─── Failed-deploy recovery preflight (detect-and-guide only) ────────

# After a failed deploy/rollback, DeletionPolicy: Retain resources (usage/subscribers

# tables, subscription role, /aws/lambda/awsmp-* log groups) and an orphaned baseline

# WebACL can survive and collide on retry (ResourceExistenceCheck / WebACL AlreadyExists).

# This is READ-ONLY: it DETECTS likely collisions and prints guidance, then continues.

# It NEVER auto-deletes; the seller removes reviewed resources with their own credentials

# (a data-bearing table requires explicit confirmation).

warn_retained_resources() {

local prefix="$1"

local region="$2"

local found=0

# Log groups are the easy-to-miss case (not shown in the rollback resource summary).

local lg

lg=$(aws logs describe-log-groups --region "$region" \

--log-group-name-prefix "/aws/lambda/${prefix}-" \

--query 'logGroups[].logGroupName' --output text 2>/dev/null || true)

if [ -n "$lg" ] && [ "$lg" != "None" ]; then

echo "NOTE: pre-existing log group(s) may collide on re-create: $lg"

found=1

fi

if aws dynamodb describe-table --table-name "${prefix}-usage" --region "$region" >/dev/null 2>&1; then

echo "NOTE: usage table '${prefix}-usage' already exists (retained). If this is a"

echo " re-deploy after a FAILED first deploy the table is empty and can be removed;"

echo " if it holds billable usage do NOT delete it. Deleting requires your explicit"

echo " action with your own credentials — this script will not delete it."

found=1

fi

if [ $found -eq 1 ]; then

echo " Review and remove the reviewed leftover resource(s), then retry."

fi

}

# ─── Materialize-then-deploy parity preflight ────────────────────────────────

# This script deploys the on-disk SAM template(s) the skill materialized into the

# workspace (`sam build --template-file <name>` below), so the deployed stack always

# matches the source the seller can see and further develop. Fail fast (READ-ONLY, no

# mutation) if the template we are about to build is missing or renamed — that would

# mean a drift between "what was generated" and "what gets deployed". We do NOT recreate

# or relocate it; the seller/skill regenerates it in place.

require_template() {

local tmpl="$1"

if [ ! -f "$tmpl" ]; then

echo "ERROR: expected on-disk template '$tmpl' not found in $(pwd)." >&2

echo " deploy.sh deploys the materialized template so the stack matches your" >&2

echo " source. Generate/restore '$tmpl' (and its Lambda handlers) here," >&2

echo " then re-run — do not deploy a template that is not left in the workspace." >&2

exit 1

fi

}

# ─── Deploy events stack (shared, us-east-1) ─────────────────────────────────

# ─── Permissions-boundary preflight ──────────────────────────────────────────

# SAM auto-generates the Lambda execution roles; the deployer role only allows

# iam:CreateRole when a matching permissions boundary is attached. Fail fast with a

# clear message (instead of an opaque AccessDenied mid-deploy) if the boundary policy

# named by BOUNDARY_NAME does not exist in the target account.

BOUNDARY_NAME="${BOUNDARY_NAME:-awsmp-metering-boundary}"

verify_boundary_exists() {

local acct boundary_arn err

# Validate the account id before building the ARN — an empty/None value would produce a

# malformed ARN and a misleading "not found" message. `|| true` so a failing STS call

# falls through to the guard below instead of aborting the script under `set -e`.

acct=$(aws sts get-caller-identity --query Account --output text 2>/dev/null || true)

if [ -z "$acct" ] || [ "$acct" = "None" ]; then

echo "ERROR: unable to resolve AWS account id (check credentials/region)."

exit 1

fi

boundary_arn="arn:aws:iam::${acct}:policy/${BOUNDARY_NAME}"

# Capture stderr so we can distinguish a genuinely-missing policy (NoSuchEntity) from

# a permissions gap (AccessDenied). Collapsing every failure into "not found" would

# block deploys when the deployer merely lacks iam:GetPolicy — the opaque failure this

# preflight is meant to prevent.

if err=$(aws iam get-policy --policy-arn "$boundary_arn" 2>&1 >/dev/null); then

echo "Permissions boundary: ${boundary_arn}"

return 0

fi

case "$err" in

*NoSuchEntity*)

echo "ERROR: permissions boundary '${BOUNDARY_NAME}' not found (${boundary_arn})."

echo " Create it before deploying (see references/iam-credentials.md):"

echo " aws iam create-policy --policy-name ${BOUNDARY_NAME} --policy-document file://boundary.json"

echo " The deployer role's iam:CreateRole is gated on this exact boundary, so"

echo " SAM role creation would otherwise fail with AccessDenied."

exit 1

;;

*AccessDenied*|*not\ authorized*)

echo "WARN: cannot verify boundary '${boundary_arn}' (iam:GetPolicy denied); continuing."

echo " Grant iam:GetPolicy on the boundary ARN to enable this preflight, or"

echo " ensure the boundary policy exists before deploying."

return 0

;;

*)

echo "ERROR: failed to verify boundary '${boundary_arn}': ${err}"

exit 1

;;

esac

}

# ─── Deploy events stack (shared, us-east-1) ─────────────────────────────────

deploy_events_stack() {

echo ""

# The (stage-scoped) events stack is always deployed here. `sam deploy` is idempotent

# (`--no-fail-on-empty-changeset` makes an unchanged stack a no-op change set), and a

# requested MeteringMode / TestAccountAllowlist / EventSource change MUST be applied — so

# there is deliberately NO existence-skip / SKIP_EVENTS flag (an existence-skip would

# silently suppress those updates). The deploy role needs cloudformation:GetTemplateSummary

# for the re-deploy of an existing stack.

echo "=== Deploying events stack ${EVENTS_STACK_NAME} to us-east-1 (shared across all products for this stage) ==="

verify_boundary_exists

local ev_bucket

ev_bucket=$(ensure_sam_bucket us-east-1)

require_template template-events.yaml

sam build --template-file template-events.yaml --region us-east-1

sam deploy \

--template-file .aws-sam/build/template.yaml \

--stack-name "$EVENTS_STACK_NAME" \

--region us-east-1 \

--capabilities CAPABILITY_NAMED_IAM \

--s3-bucket "$ev_bucket" \

--no-confirm-changeset \

--no-fail-on-empty-changeset \

--parameter-overrides "StackPrefix=$EVENTS_PREFIX" "PermissionsBoundaryName=${BOUNDARY_NAME}" "CreateDashboard=${CREATE_DASHBOARD:-true}" "MeteringMode=$METERING_MODE" "TestAccountAllowlist=$TEST_ACCOUNT_ALLOWLIST" "EventSource=$EVENT_SOURCE"

# NOTE: ProductCode is deliberately NOT passed to the SHARED events stack — the dry-run test

# publisher takes productCode PER INVOCATION (payload), so a second product's deploy cannot

# overwrite a shared per-product value (the events-stack ProductCode param stays empty).

echo "✅ Events stack deployed"

}

# ─── Deploy main stack (per-product, seller's region) ─────────────────────────

deploy_main_stack() {

local product_code="$1"

local region="$2"

local prefix="$3"

# Get subscribers table name from events stack

local subscribers_table

subscribers_table=$(aws cloudformation describe-stacks \

--stack-name "$EVENTS_STACK_NAME" \

--region us-east-1 \

--query 'Stacks[0].Outputs[?OutputKey==`SubscribersTableName`].OutputValue' \

--output text)

if [ -z "$subscribers_table" ] || [ "$subscribers_table" = "None" ]; then

echo "ERROR: Could not get SubscribersTableName from events stack."

echo " Deploy the events stack first: ./deploy.sh events-only"

exit 1

fi

echo "Subscribers table: $subscribers_table"

echo ""

echo "=== Deploying main stack to $region ==="

verify_boundary_exists

# read-only recovery preflight — detect retained/orphaned resources that

# would collide on retry and print guidance (never auto-deletes).

warn_retained_resources "$prefix" "$region"

# ensure the per-region API Gateway CloudWatch Logs account role/setting

# exists before deploying the logging-enabled stage (multi-region correctness).

ensure_apigw_cw_role "$region"

local main_bucket

main_bucket=$(ensure_sam_bucket "$region")

require_template template.yaml

sam build --template-file template.yaml --region "$region"

# Pass overrides as discrete, individually-quoted Key=Value tokens (array form) so a

# value containing spaces cannot inject additional overrides. Values are

# already validated by validate_inputs().

local overrides=(

"ProductCode=$product_code"

"StackPrefix=$prefix"

"SubscribersTableName=$subscribers_table"

"PermissionsBoundaryName=$BOUNDARY_NAME"

"StageName=$STAGE_NAME"

"MeteringLockHours=$METERING_LOCK_HOURS"

"UsageTableTtlDays=$USAGE_TABLE_TTL_DAYS"

"AggregatedUsageTableTtlDays=$AGGREGATED_USAGE_TTL_DAYS"

"CreateDashboard=$CREATE_DASHBOARD"

"DeploymentMode=$DEPLOYMENT_MODE"

"MeteringMode=$METERING_MODE"

"TestAccountAllowlist=$TEST_ACCOUNT_ALLOWLIST"

)

sam deploy \

--stack-name "${prefix}-metering" \

--region "$region" \

--capabilities CAPABILITY_NAMED_IAM \

--s3-bucket "$main_bucket" \

--no-confirm-changeset \

--no-fail-on-empty-changeset \

--parameter-overrides "${overrides[@]}"

echo "✅ Main stack deployed"

echo ""

echo "Stack outputs:"

aws cloudformation describe-stacks \

--stack-name "${prefix}-metering" \

--region "$region" \

--query 'Stacks[0].Outputs[*].[OutputKey,OutputValue]' \

--output table

}

# ─── Main ────────────────────────────────────────────────────────────────────

check_prerequisites

echo "=== Verifying AWS credentials ==="

ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text 2>/dev/null) || {

echo "ERROR: AWS credentials not configured. Set AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY or run 'aws configure'."

exit 1

}

echo "Account: $ACCOUNT_ID"

# CreateDashboard: whether to create the CloudWatch health dashboards (default true). Set

# CREATE_DASHBOARD=false to skip; sellers can also delete/customize post-deploy. Sourced

# before the events-only branch so both stacks honor it.

CREATE_DASHBOARD="${CREATE_DASHBOARD:-true}"

if [ "$CREATE_DASHBOARD" != "true" ] && [ "$CREATE_DASHBOARD" != "false" ]; then

echo "ERROR: invalid CREATE_DASHBOARD '$CREATE_DASHBOARD' (must be 'true' or 'false')."

exit 1

fi

# DEPLOYMENT_MODE selects full (raw pipeline: discoverer/aggregator/cleanup) or direct-submit

# (seller writes finalized records straight to aggregated_usage; only submitter + submission-

# expiry are created). Direct-submit records MUST be final before insert (any record may be

# submitted on the next 5-min run; a re-write returns DuplicateRecord).

DEPLOYMENT_MODE="${DEPLOYMENT_MODE:-full}"

if [ "$DEPLOYMENT_MODE" != "full" ] && [ "$DEPLOYMENT_MODE" != "direct-submit" ]; then

echo "ERROR: invalid DEPLOYMENT_MODE '$DEPLOYMENT_MODE' (must be 'full' or 'direct-submit')."

exit 1

fi

# Handle events-only mode

if [ "${1:-}" = "events-only" ]; then

# Events stack is stage-scoped too — require STAGE_NAME here as well.

STAGE_NAME="${STAGE_NAME:-}"

if [ -z "$STAGE_NAME" ] || ! [[ "$STAGE_NAME" =~ ^[A-Za-z0-9_-]+$ ]]; then

echo "ERROR: STAGE_NAME is required for events-only (e.g. STAGE_NAME=v1 ./deploy.sh events-only)."

exit 1

fi

EVENTS_PREFIX="awsmp-events-${STAGE_NAME}"

EVENTS_STACK_NAME="awsmp-events-${STAGE_NAME}-stack"

METERING_MODE="${METERING_MODE:-live}"

if [ "$METERING_MODE" != "live" ] && [ "$METERING_MODE" != "dry-run" ]; then

echo "ERROR: invalid METERING_MODE '$METERING_MODE' (allowed: live | dry-run)."; exit 1

fi

TEST_ACCOUNT_ALLOWLIST="${TEST_ACCOUNT_ALLOWLIST:-}"

if [ "$METERING_MODE" = "dry-run" ]; then

if [ -z "$TEST_ACCOUNT_ALLOWLIST" ]; then

echo "ERROR: METERING_MODE=dry-run requires TEST_ACCOUNT_ALLOWLIST (test buyer account ids)."; exit 1

fi

if ! [[ "$TEST_ACCOUNT_ALLOWLIST" =~ ^[0-9]{12}(,[0-9]{12})*$ ]]; then

echo "ERROR: TEST_ACCOUNT_ALLOWLIST must be comma-separated 12-digit AWS account ids."; exit 1

fi

if [ "$METERING_MODE" = "live" ] && [ -n "$TEST_ACCOUNT_ALLOWLIST" ]; then

echo "ERROR: TEST_ACCOUNT_ALLOWLIST must be EMPTY for METERING_MODE=live."; exit 1

fi

if [ "$METERING_MODE" = "dry-run" ]; then

EVENT_SOURCE="${STAGE_NAME}.agreement-marketplace"

case "$EVENT_SOURCE" in

aws.*) echo "ERROR: dry-run EVENT_SOURCE must not start with 'aws.' (STAGE_NAME='$STAGE_NAME' collides with the reserved production source)."; exit 1 ;;

esac

else

EVENT_SOURCE="aws.agreement-marketplace"

fi

PRODUCT_CODE="${PRODUCT_CODE:-}"

deploy_events_stack

echo ""

echo "Next: Deploy main stack per-product:"

echo " STAGE_NAME=$STAGE_NAME ./deploy.sh <PRODUCT_CODE> <REGION>"

exit 0

fi

# Full deployment mode

PRODUCT_CODE="${1:?Usage: ./deploy.sh events-only | ./deploy.sh <PRODUCT_CODE> <REGION> [PREFIX]}"

REGION="${2:?Usage: ./deploy.sh <PRODUCT_CODE> <REGION> [PREFIX]}"

# StageName is a MANDATORY seller-supplied answer — there is no default and no fallback

# to `prod`. Supply it via the STAGE_NAME environment variable. Deployment fails fast if

# it is empty so we never create an API with an empty/placeholder stage.

STAGE_NAME="${STAGE_NAME:-}"

if [ -z "$STAGE_NAME" ]; then

echo "ERROR: STAGE_NAME is required and has no default."

echo " Set the API Gateway stage name you want (your choice — e.g. v1, live, or prod)."

echo " Example: STAGE_NAME=v1 ./deploy.sh $PRODUCT_CODE $REGION"

exit 1

fi

if ! [[ "$STAGE_NAME" =~ ^[A-Za-z0-9_-]+$ ]]; then

echo "ERROR: invalid STAGE_NAME '$STAGE_NAME' (allowed: A-Z a-z 0-9 _ -)."

exit 1

fi

# Stage-scoped names: the stage folds into BOTH stacks so multiple stages coexist without

# collision. Main stack: awsmp-<productCode>-<stage>-metering (prefix awsmp-<productCode>-<stage>).

# Events stack: awsmp-events-<stage>-stack (prefix awsmp-events-<stage>).

PREFIX="${3:-awsmp-${PRODUCT_CODE}-${STAGE_NAME}}"

EVENTS_PREFIX="awsmp-events-${STAGE_NAME}"

EVENTS_STACK_NAME="awsmp-events-${STAGE_NAME}-stack"

# MeteringMode decides prod (live) vs non-prod (dry-run). live = real BatchMeterUsage;

# dry-run = full pipeline but NO real submit (a sandbox). Prod vs non-prod is THIS switch,

# not the free-form STAGE_NAME.

METERING_MODE="${METERING_MODE:-live}"

if [ "$METERING_MODE" != "live" ] && [ "$METERING_MODE" != "dry-run" ]; then

echo "ERROR: invalid METERING_MODE '$METERING_MODE' (allowed: live | dry-run)."

exit 1

fi

# For a non-prod (dry-run) stage a TestAccountAllowlist is REQUIRED and must be test accounts

# ONLY; a live stage must NOT set it. TEST_ACCOUNT_ALLOWLIST is comma-separated 12-digit ids.

TEST_ACCOUNT_ALLOWLIST="${TEST_ACCOUNT_ALLOWLIST:-}"

if [ "$METERING_MODE" = "dry-run" ]; then

if [ -z "$TEST_ACCOUNT_ALLOWLIST" ]; then

echo "ERROR: METERING_MODE=dry-run requires TEST_ACCOUNT_ALLOWLIST (comma-separated TEST"

echo " buyer account ids). A non-prod stage must use test accounts ONLY."

exit 1

fi

if ! [[ "$TEST_ACCOUNT_ALLOWLIST" =~ ^[0-9]{12}(,[0-9]{12})*$ ]]; then

echo "ERROR: TEST_ACCOUNT_ALLOWLIST must be comma-separated 12-digit AWS account ids."

exit 1

fi

echo "NOTE: dry-run (non-prod) stage — the submitter will NOT call BatchMeterUsage (no real"

echo " billing); use TEST accounts ONLY: $TEST_ACCOUNT_ALLOWLIST"

else

if [ -n "$TEST_ACCOUNT_ALLOWLIST" ]; then

echo "ERROR: TEST_ACCOUNT_ALLOWLIST must be EMPTY for METERING_MODE=live (production)."

exit 1

fi

# EventSource the events rule matches. dry-run uses a STAGE-SCOPED source (never the reserved

# aws.* prefix) so the test publisher's events are delivered AND are disjoint from real prod

# events (no same-account cross-match). live uses the real aws.agreement-marketplace.

if [ "$METERING_MODE" = "dry-run" ]; then

EVENT_SOURCE="${STAGE_NAME}.agreement-marketplace"

case "$EVENT_SOURCE" in

aws.*)

echo "ERROR: dry-run EVENT_SOURCE must not start with 'aws.' (STAGE_NAME='$STAGE_NAME'"

echo " collides with the reserved production source aws.agreement-marketplace)."

exit 1 ;;

esac

else

EVENT_SOURCE="aws.agreement-marketplace"

fi

# MeteringLockHours: how many hours a metering hour stays open for late usage

# before it is aggregated/submitted. Seller-configured via the METERING_LOCK_HOURS env var;

# default 1 (submit a fully-complete hour). Validated 1..20 so an hour is first submitted

# with >=4h of margin inside the 24h billable window (>=3 retries + rejection re-drive).

METERING_LOCK_HOURS="${METERING_LOCK_HOURS:-1}"

if ! [[ "$METERING_LOCK_HOURS" =~ ^[0-9]+$ ]] || [ "$METERING_LOCK_HOURS" -lt 1 ] || [ "$METERING_LOCK_HOURS" -gt 20 ]; then

echo "ERROR: invalid METERING_LOCK_HOURS '$METERING_LOCK_HOURS' (must be an integer 1..20)."

echo " This is how many hours an hour stays open for late usage before submission."

exit 1

fi

# TTL retention (days) for the RAW usage table (high-volume; RECOMMENDED on to control

# cost). 0 disables. Floor of 2 days so a row can never expire before it is metered

# (must exceed MeteringLockHours + the 24h billable window). The seller's WRITER sets the

# `ttl` attribute; enabling it here only makes DynamoDB honor it.

USAGE_TABLE_TTL_DAYS="${USAGE_TABLE_TTL_DAYS:-365}"

if ! [[ "$USAGE_TABLE_TTL_DAYS" =~ ^[0-9]+$ ]] || { [ "$USAGE_TABLE_TTL_DAYS" -ne 0 ] && [ "$USAGE_TABLE_TTL_DAYS" -lt 2 ]; } || [ "$USAGE_TABLE_TTL_DAYS" -gt 3650 ]; then

echo "ERROR: invalid USAGE_TABLE_TTL_DAYS '$USAGE_TABLE_TTL_DAYS' (0 to disable, else an integer 2..3650)."

exit 1

fi

# TTL retention (days) for the AGGREGATED usage table (small billing audit trail).

# DEFAULTS 0 (disabled = retain), which is recommended. When >0 the submitter sets `ttl`

# on finalized Success rows only.

AGGREGATED_USAGE_TTL_DAYS="${AGGREGATED_USAGE_TTL_DAYS:-0}"

if ! [[ "$AGGREGATED_USAGE_TTL_DAYS" =~ ^[0-9]+$ ]] || [ "$AGGREGATED_USAGE_TTL_DAYS" -gt 3650 ]; then

echo "ERROR: invalid AGGREGATED_USAGE_TTL_DAYS '$AGGREGATED_USAGE_TTL_DAYS' (0 to disable, else an integer 1..3650)."

exit 1

fi

# Validate all caller-supplied inputs before any AWS call.

validate_inputs "$PRODUCT_CODE" "$REGION" "$PREFIX"

echo "Product code: $PRODUCT_CODE"

echo "Region: $REGION"

echo "Stack prefix: $PREFIX"

echo "Stage name: $STAGE_NAME"

deploy_events_stack

deploy_main_stack "$PRODUCT_CODE" "$REGION" "$PREFIX"

echo ""

echo "=== Deployment complete ==="

echo ""

echo "Next steps:"

echo "1. Copy the RegistrationUrl from stack outputs above"

echo "2. Set it as the fulfillment URL in AWS Marketplace Management Portal"

echo "3. Subscribe to the product and click 'Set up your account' to test"