pulumi/aws: update dependencies and runtime to nodejs24 (#53)

Author: clstokes

.gitignore

@@ -1,3 +1,5 @@
+**/.claude
+
 # Terraform-related files
 *.tfstate
 *.tfstate.*

pulumi/aws/aws-lambda-device-approval-handler/README.md

@@ -4,16 +4,20 @@ This example creates the following:
 
 - a API Gateway REST API
 - a Lambda function to receive [Tailscale webhooks](https://tailscale.com/kb/1213/webhooks) and approve devices based on device details and attributes
+- a Tailscale [webhook](https://tailscale.com/kb/1213/webhooks) that sends `nodeNeedsApproval` events to the deployed Lambda's API Gateway URL
 
 ## To use
 
+### Configure
+
 Follow the documentation to configure the Pulumi providers:
 
 - [AWS](https://www.pulumi.com/registry/packages/aws/installation-configuration/)
+- [Tailscale](https://www.pulumi.com/registry/packages/tailscale/installation-configuration/) — set the `TAILSCALE_OAUTH_CLIENT_ID` / `TAILSCALE_OAUTH_CLIENT_SECRET` environment variables before you run `pulumi up`. Pulumi uses these to authenticate the Tailscale provider that manages the webhook.
 
 ### Deploy
 
-Create a [Tailscale OAuth Client](https://tailscale.com/kb/1215/oauth-clients#setting-up-an-oauth-client) with scope `all` and provide the client ID and client secret with `pulumi config set ...` as shown below.
+Create a [Tailscale OAuth Client](https://tailscale.com/kb/1215/oauth-clients#setting-up-an-oauth-client) with scope `all`. Set the client ID and client secret for the Lambda function with `pulumi config set ...` as shown below. Also export them as the `TAILSCALE_OAUTH_CLIENT_ID` / `TAILSCALE_OAUTH_CLIENT_SECRET` environment variables, for the Tailscale provider.
 
 ```shell
 pulumi stack init
@@ -22,6 +26,16 @@ pulumi config set tailscaleOauthClientSecret --secret
 pulumi up
 ```
 
+`pulumi up` creates the Lambda function and API Gateway, then registers the Tailscale webhook that points at the API Gateway URL.
+
+### Outputs
+
+| Output | Description |
+| --- | --- |
+| `url` | The API Gateway invoke URL. This is also the endpoint the Tailscale webhook is configured to call. |
+| `lambdaFunctionName` | The name of the deployed Lambda function, for finding it in the AWS console or `aws logs`. |
+| `webhookSecret` | The secret Tailscale generates when the webhook is created, for verifying the `Tailscale-Webhook-Signature` header as described in [Verifying an event signature](https://tailscale.com/kb/1213/webhooks#verifying-an-event-signature) (see the `TODO` in [`handler.ts`](./handler.ts)). This output is marked secret, so use `pulumi stack output webhookSecret --show-secrets` to view it. |
+
 ## To destroy
 
 ```shell

pulumi/aws/aws-lambda-device-approval-handler/index.ts

@@ -1,34 +1,48 @@
 import * as pulumi from "@pulumi/pulumi";
 import * as aws from "@pulumi/aws";
 import * as apigateway from "@pulumi/aws-apigateway";
+import * as tailscale from "@pulumi/tailscale";
 import * as path from "path";
 
 import * as handler from "./handler";
 
 const name = `example-${path.basename(process.cwd())}`;
 const pulumiConfig = new pulumi.Config();
+const tailscaleOauthClientId = pulumiConfig.require("tailscaleOauthClientId");
+const tailscaleOauthClientSecret = pulumiConfig.requireSecret("tailscaleOauthClientSecret");
+
+const fn = new aws.lambda.CallbackFunction(`${name}-fn`, {
+    environment: {
+        variables: {
+            [handler.ENV_TAILSCALE_OAUTH_CLIENT_ID]: tailscaleOauthClientId,
+            [handler.ENV_TAILSCALE_OAUTH_CLIENT_SECRET]: tailscaleOauthClientSecret,
+        },
+    },
+    runtime: "nodejs24.x",
+    callback: async (ev: any, ctx) => {
+        return handler.lambdaHandler(ev);
+    },
+});
 
 const api = new apigateway.RestAPI(name, {
-    stageName: "tailscale-device-approval",
+    stageName: `${name}`,
     binaryMediaTypes: ["application/json"],
     routes: [
         {
             path: "/",
             method: "POST",
-            eventHandler: new aws.lambda.CallbackFunction(`${name}-fn`, {
-                environment: {
-                    variables: {
-                        [handler.ENV_TAILSCALE_OAUTH_CLIENT_ID]: pulumiConfig.require("tailscaleOauthClientId"),
-                        [handler.ENV_TAILSCALE_OAUTH_CLIENT_SECRET]: pulumiConfig.requireSecret("tailscaleOauthClientSecret"),
-                    },
-                },
-                runtime: "nodejs20.x",
-                callback: async (ev: any, ctx) => {
-                    return handler.lambdaHandler(ev);
-                },
-            }),
+            eventHandler: fn,
         },
     ],
 });
 
 export const url = api.url;
+export const lambdaFunctionName = fn.name;
+
+const webhook = new tailscale.Webhook(`${name}-webhook`, {
+    endpointUrl: api.url,
+    subscriptions: ["nodeNeedsApproval"],
+});
+
+// Only set at creation. Store it if you plan to verify webhook signatures in the handler.
+export const webhookSecret = pulumi.secret(webhook.secret);