@decionis/aws-lambda-guard

Shadow-default Decionis guard for AWS Lambda and EventBridge Pipes. It is the customer-VPC data plane for Decionis on AWS Marketplace: a thin interceptor that calls the Decionis-hosted decision graph (over AWS PrivateLink) before an irreversible action runs, and blocks/holds it when policy says so. No policy logic lives here.

Safety model

• Shadow-default. Every decision_type runs in SHADOW (evaluate + record, never block) until it is explicitly promoted to ENFORCEMENT via enforcedDecisionTypes.
• Promotion is per decision_type. The CIO reviews the would-block report, then allowlists one type at a time.
• Fail-open by default. If the decision graph is unreachable the guard allows the action; set failOpen: false (or DECIONIS_FAIL_OPEN=false) for fail-closed deployments.
• Blocking outcomes: REJECT → block, REVIEW/ESCALATE → hold, APPROVE → allow.

Usage

Gate a side-effecting Lambda

import { createLambdaGuard, resolveGuardConfigFromEnv } from "@decionis/aws-lambda-guard";

const guard = createLambdaGuard<MyEvent>({
  config: resolveGuardConfigFromEnv(),
  buildDecisionRequest: (event) => ({
    decision_type: "PIPELINE_WRITE",
    context: { table: event.table, rows: event.rows },
    idempotency_key: event.id,
  }),
});

export const handler = guard.wrapHandler(async (event) => {
  // Only runs when the action is allowed; throws GuardBlockedError otherwise.
  return writeToWarehouse(event);
});

EventBridge Pipes enrichment

import { createPipesEnrichment, resolveGuardConfigFromEnv } from "@decionis/aws-lambda-guard";

export const handler = createPipesEnrichment<PipeRecord>({
  config: resolveGuardConfigFromEnv(),
  buildDecisionRequest: (record) => ({ decision_type: record.detailType, context: record.detail }),
  onDecision: async (decision, record) => {
    if (decision.action !== "allow") await quarantine(record, decision); // route to DLQ target
  },
});

Environment contract

Set by the customer-deployed CloudFormation stack:

| Var | Required | Default | Meaning | | ---------------------------------- | -------- | -------- | ------------------------------------------------- | | DECIONIS_BASE_URL | ✓ | — | PrivateLink endpoint of the hosted decision graph | | DECIONIS_API_KEY | ✓ | — | Org-scoped API key | | DECIONIS_ORG_ID | ✓ | — | Entitled Decionis org id | | DECIONIS_ENFORCED_DECISION_TYPES | | (none) | Comma list promoted to ENFORCEMENT | | DECIONIS_FAIL_OPEN | | true | false to fail closed | | DECIONIS_TIMEOUT_MS | | 4000 | Per-call timeout |