Add GSI for Slack channel lookups and replace scan with query

.gitignore

@@ -52,6 +52,9 @@ ENV/
 env.bak/
 venv.bak/
 
+# Slack credentials
+.slack-credentials.env
+
 # Following file is added in gitignore till we start adding service_now_client event processing implementation
 tests/assets/service_now_client/test_service_now_client.py
 cdk.out/*

assets/domain/python/enhanced_dynamodb_schema.py

@@ -236,17 +236,19 @@ def find_case_by_slack_channel(self, slack_channel_id: str) -> Optional[str]:
             Optional[str]: Case ID or None if not found
         """
         try:
-            response = self.table.scan(
-                FilterExpression="slackChannelId = :channel_id",
+            response = self.table.query(
+                IndexName="slack-channel-index",
+                KeyConditionExpression="slackChannelId = :channel_id",
                 ExpressionAttributeValues={":channel_id": slack_channel_id}
             )
-            
+
             items = response.get("Items", [])
-            
+
             # Handle pagination if there are more items
             while "LastEvaluatedKey" in response:
-                response = self.table.scan(
-                    FilterExpression="slackChannelId = :channel_id",
+                response = self.table.query(
+                    IndexName="slack-channel-index",
+                    KeyConditionExpression="slackChannelId = :channel_id",
                     ExpressionAttributeValues={":channel_id": slack_channel_id},
                     ExclusiveStartKey=response["LastEvaluatedKey"],
                 )

assets/slack_command_handler/index.py

@@ -96,9 +96,10 @@ def get_case_id_from_channel(channel_id: str) -> Optional[str]:
         return None
 
     try:
-        # Query DynamoDB to find case ID by slack channel ID
-        response = incidents_table.scan(
-            FilterExpression="slackChannelId = :channel_id",
+        # Query DynamoDB to find case ID by slack channel ID using GSI
+        response = incidents_table.query(
+            IndexName="slack-channel-index",
+            KeyConditionExpression="slackChannelId = :channel_id",
             ExpressionAttributeValues={":channel_id": channel_id}
         )
 

assets/slack_events_bolt_handler/index.py

@@ -132,9 +132,10 @@ def get_case_id_from_channel(channel_id: str) -> Optional[str]:
         return None
 
     try:
-        # Query DynamoDB to find case ID by slack channel ID
-        response = incidents_table.scan(
-            FilterExpression="slackChannelId = :channel_id",
+        # Query DynamoDB to find case ID by slack channel ID using GSI
+        response = incidents_table.query(
+            IndexName="slack-channel-index",
+            KeyConditionExpression="slackChannelId = :channel_id",
             ExpressionAttributeValues={":channel_id": channel_id}
         )
 

aws_security_incident_response_sample_integrations/aws_security_incident_response_sample_integrations_common_stack.py

@@ -84,6 +84,14 @@ def __init__(
             point_in_time_recovery=True,
         )
 
+        # Add GSI for Slack channel lookups
+        self.table.add_global_secondary_index(
+            index_name="slack-channel-index",
+            partition_key=dynamodb.Attribute(
+                name="slackChannelId", type=dynamodb.AttributeType.STRING
+            ),
+        )
+
         """
         cdk for event_bus
         """

deployment.log

@@ -0,0 +1 @@
+There are expired AWS credentials in your environment. The CDK app will synth without current account information.

tests/assets/domain/test_enhanced_dynamodb_schema.py

@@ -297,21 +297,22 @@ def test_find_case_by_slack_channel_success(self):
         slack_channel_id = "C1234567890"
         items = [{"PK": "Case#12345", "SK": "latest", "slackChannelId": slack_channel_id}]
 
-        self.mock_table.scan.return_value = {"Items": items}
+        self.mock_table.query.return_value = {"Items": items}
 
         result = self.service.find_case_by_slack_channel(slack_channel_id)
 
         assert result == "12345"
-        self.mock_table.scan.assert_called_once_with(
-            FilterExpression="slackChannelId = :channel_id",
+        self.mock_table.query.assert_called_once_with(
+            IndexName="slack-channel-index",
+            KeyConditionExpression="slackChannelId = :channel_id",
             ExpressionAttributeValues={":channel_id": slack_channel_id}
         )
 
     def test_find_case_by_slack_channel_not_found(self):
         """Test case finding by Slack channel when not found"""
         slack_channel_id = "C1234567890"
 
-        self.mock_table.scan.return_value = {"Items": []}
+        self.mock_table.query.return_value = {"Items": []}
 
         result = self.service.find_case_by_slack_channel(slack_channel_id)
 
@@ -323,21 +324,21 @@ def test_find_case_by_slack_channel_with_pagination(self):
         items = [{"PK": "Case#12345", "SK": "latest", "slackChannelId": slack_channel_id}]
 
         # First call returns with LastEvaluatedKey
-        self.mock_table.scan.side_effect = [
+        self.mock_table.query.side_effect = [
             {"Items": [], "LastEvaluatedKey": {"PK": "Case#12345"}},
             {"Items": items}
         ]
 
         result = self.service.find_case_by_slack_channel(slack_channel_id)
 
         assert result == "12345"
-        assert self.mock_table.scan.call_count == 2
+        assert self.mock_table.query.call_count == 2
 
     def test_find_case_by_slack_channel_client_error(self):
         """Test case finding by Slack channel with ClientError"""
         slack_channel_id = "C1234567890"
         error_response = {"Error": {"Code": "ValidationException"}}
-        self.mock_table.scan.side_effect = ClientError(error_response, "Scan")
+        self.mock_table.query.side_effect = ClientError(error_response, "Query")
 
         result = self.service.find_case_by_slack_channel(slack_channel_id)
 

tests/assets/slack_command_handler/test_slack_command_handler.py

@@ -67,7 +67,7 @@ class TestGetCaseIdFromChannel:
     @patch('slack_command_handler_index.incidents_table')
     def test_get_case_id_success(self, mock_table):
         """Test successful case ID retrieval"""
-        mock_table.scan.return_value = {
+        mock_table.query.return_value = {
             "Items": [
                 {"PK": "Case#12345", "SK": "latest", "slackChannelId": "C1234567890"}
             ]
@@ -79,7 +79,7 @@ def test_get_case_id_success(self, mock_table):
     @patch('slack_command_handler_index.incidents_table')
     def test_get_case_id_not_found(self, mock_table):
         """Test case ID not found"""
-        mock_table.scan.return_value = {"Items": []}
+        mock_table.query.return_value = {"Items": []}
 
         result = index.get_case_id_from_channel("C1234567890")
         assert result is None