From d0a58c4da0703e013d720e176ea26df09335e796 Mon Sep 17 00:00:00 2001 From: Dat Date: Sun, 7 Jun 2026 16:40:38 +0700 Subject: [PATCH] fix(lambdas): write main data file under data/ prefix to match IAM grant MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Lambdas upload their main output to S3_KEY at the bucket root ("gh-trending.json", "hn-digest.json", "release-radar.json"), but the IAM policy only grants s3:PutObject on the `data/*` prefix (tech-bytes-stack.ts:180). Every main-file write therefore failed with AccessDenied — confirmed in CloudWatch logs: AccessDenied ... s3:PutObject on .../gh-trending.json because no identity-based policy allows the s3:PutObject action Only the archive copies (already under data/archive/) ever persisted. This is the actual reason the site content was stale: the files the site reads (data/*.json) and email_digest reads (data/*.json) were never successfully written — the site fell back to the committed seed files. The deploy.yml sync (s3://BUCKET/data/) also never saw the root-level files. Prefix S3_KEY with `data/` in all three handlers so the write path matches the IAM grant, the email_digest read keys, the site read path, and the deploy sync. No infra change needed — data/* is already granted. --- lambdas/gh_trending/handler.py | 2 +- lambdas/hn_digest/handler.py | 2 +- lambdas/release_radar/handler.py | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/lambdas/gh_trending/handler.py b/lambdas/gh_trending/handler.py index 5bdaa22..d41704b 100644 --- a/lambdas/gh_trending/handler.py +++ b/lambdas/gh_trending/handler.py @@ -29,7 +29,7 @@ setup_logging() logger = logging.getLogger(__name__) -S3_KEY = "gh-trending.json" +S3_KEY = "data/gh-trending.json" GITHUB_BASE = "https://github.com" GITHUB_API = "https://api.github.com" diff --git a/lambdas/hn_digest/handler.py b/lambdas/hn_digest/handler.py index d194a11..46c2942 100644 --- a/lambdas/hn_digest/handler.py +++ b/lambdas/hn_digest/handler.py @@ -14,7 +14,7 @@ setup_logging() logger = logging.getLogger(__name__) -S3_KEY = "hn-digest.json" +S3_KEY = "data/hn-digest.json" HN_API = "https://hacker-news.firebaseio.com/v0" TOP_STORIES_URL = f"{HN_API}/topstories.json" diff --git a/lambdas/release_radar/handler.py b/lambdas/release_radar/handler.py index d270986..3e26ae6 100644 --- a/lambdas/release_radar/handler.py +++ b/lambdas/release_radar/handler.py @@ -16,7 +16,7 @@ setup_logging() logger = logging.getLogger(__name__) -S3_KEY = "release-radar.json" +S3_KEY = "data/release-radar.json" _CONFIG_FILENAME = "config/technologies.yml"