@decionis/aws-lambda-guard

@decionis/aws-lambda-guard

Shadow-default Decionis guard for AWS Lambda and EventBridge Pipes. It is the customer-VPC data plane for Decionis on AWS Marketplace: a thin interceptor that calls the Decionis-hosted decision graph (over AWS PrivateLink) before an irreversible action runs, and blocks/holds it when policy says so. No policy logic lives here.

Safety model

• Shadow-default. Every decision_type runs in SHADOW (evaluate + record, never block) until it is explicitly promoted to ENFORCEMENT via enforcedDecisionTypes.
• Promotion is per decision_type. The CIO reviews the would-block report, then allowlists one type at a time.
• Fail-open by default. If the decision graph is unreachable the guard allows the action; set failOpen: false (or DECIONIS_FAIL_OPEN=false) for fail-closed deployments.
• Blocking outcomes: REJECT → block, REVIEW/ESCALATE → hold, APPROVE → allow.

Usage

Gate a side-effecting Lambda

import { createLambdaGuard, resolveGuardConfigFromEnv } from "@decionis/aws-lambda-guard";

const guard = createLambdaGuard<MyEvent>({
  config: resolveGuardConfigFromEnv(),
  buildDecisionRequest: (event) => ({
    decision_type: "PIPELINE_WRITE",
    context: { table: event.table, rows: event.rows },
    idempotency_key: event.id,
  }),
});

export const handler = guard.wrapHandler(async (event) => {
  // Only runs when the action is allowed; throws GuardBlockedError otherwise.
  return writeToWarehouse(event);
});

EventBridge Pipes enrichment

import { createPipesEnrichment, resolveGuardConfigFromEnv } from "@decionis/aws-lambda-guard";

export const handler = createPipesEnrichment<PipeRecord>({
  config: resolveGuardConfigFromEnv(),
  buildDecisionRequest: (record) => ({ decision_type: record.detailType, context: record.detail }),
  onDecision: async (decision, record) => {
    if (decision.action !== "allow") await quarantine(record, decision); // route to DLQ target
  },
});

Environment contract

Set by the customer-deployed CloudFormation stack:

Var	Required	Default	Meaning
DECIONIS_BASE_URL	✓	—	PrivateLink endpoint of the hosted decision graph
DECIONIS_API_KEY	✓	—	Org-scoped API key
DECIONIS_ORG_ID	✓	—	Entitled Decionis org id
DECIONIS_ENFORCED_DECISION_TYPES		(none)	Comma list promoted to ENFORCEMENT
DECIONIS_FAIL_OPEN		true	false to fail closed
DECIONIS_TIMEOUT_MS		4000	Per-call timeout