refactor: reorganize ElastiCache KMS key handling in midaz configuration

[guimoreirar]

• Moved ElastiCacheKMSKeyArn parameter back to application.yaml for consistency.
• Added a function in helm.yaml to download and return the AWS CA certificate as a base64-encoded string for ElastiCache TLS connections.
• Updated environment variables in helm.yaml to include the new REDIS_CA_CERT for secure Redis connections.

[coderabbitai]

Walkthrough

The changes touch two files. In application.yaml the ElastiCacheKMSKeyArn nested-stack parameter mapping is reordered from the "Database connections" section to the "KMS keys for secret decryption" section without changing the imported export name or value. In helm.yaml a new helper get_aws_ca_cert_base64() fetches Amazon’s global root CA PEM over HTTPS and returns it base64-encoded; its output is injected into the Helm values as REDIS_CA_CERT. MongoDB connection parameter strings were adjusted to remove leading ? characters.

Sequence Diagram(s)

mermaid
sequenceDiagram
participant Generator as Helm values generator (Lambda)
participant Truststore as Amazon truststore (HTTPS)
participant Values as Generated Helm values.yaml
participant Helm as Helm chart / deploy

Generator->>Truststore: HTTPS GET fetch global root CA PEM
Truststore-->>Generator: PEM bundle (PEM text)
Generator->>Generator: base64-encode PEM (get_aws_ca_cert_base64)
Generator->>Values: set REDIS_CA_CERT = base64(PEM)
Generator->>Values: update MongoDB params (remove leading '?')
Values->>Helm: provide values.yaml for chart render/deploy
Helm->>Helm: render chart using REDIS_CA_CERT and MongoDB params

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title focuses on reorganizing ElastiCache KMS key handling, but the PR also makes significant changes to helm.yaml including CA certificate handling and MongoDB connection parameters, which are not mentioned in the title.
Description check	✅ Passed	The description covers all three main changes: reorganizing ElastiCacheKMSKeyArn in application.yaml, adding AWS CA certificate function in helm.yaml, and updating REDIS_CA_CERT environment variable.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[lerian-studio]

Consider updating CHANGELOG.md to document this change. If this change doesn't need a changelog entry, add the skip-changelog label.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@products/midaz/helm.yaml`:
- Around line 487-500: The get_aws_ca_cert_base64 function uses
urllib.request.urlretrieve without a timeout and returns an empty string on
failure; update it to perform the download with a bounded timeout (e.g., use
urllib.request.urlopen or requests with a timeout parameter against ca_url) and
read the response into ca_pem, and change the error handling to log the full
exception and fail loudly (raise the exception or return a clear error) instead
of returning an empty string so REDIS_CA_CERT consumers don't get a silent empty
value; ensure ca_path/temporary file handling is safe and cleaned up if you keep
file-based logic.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 8cc73ee7-aea2-43dc-99fb-d20693d0882b

📥 Commits

Reviewing files that changed from the base of the PR and between 9a9d8ab and e2a9f91.

📒 Files selected for processing (2)

• products/midaz/application.yaml
• products/midaz/helm.yaml

[lerian-studio]

Consider updating CHANGELOG.md to document this change. If this change doesn't need a changelog entry, add the skip-changelog label.

[coderabbitai]

♻️ Duplicate comments (1)

products/midaz/helm.yaml (1)

487-498: 🧹 Nitpick | 🔵 Trivial

Use context manager for proper resource cleanup.

The urlopen response should be properly closed to avoid resource leaks. Without a context manager, the connection may not be released promptly.

♻️ Proposed fix using context manager

          def get_aws_ca_cert_base64():
              """Download Amazon root CA bundle and return as base64-encoded string.
              Required for ElastiCache TLS connections (REDIS_CA_CERT expects base64-encoded PEM)."""
              ca_url = 'https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem'
              try:
-                 resp = urllib.request.urlopen(ca_url, timeout=30)
-                 ca_pem = resp.read()
+                 with urllib.request.urlopen(ca_url, timeout=30) as resp:
+                     ca_pem = resp.read()
                  return base64.b64encode(ca_pem).decode('utf-8')
              except Exception as e:
                  logger.error(f"Failed to download AWS CA bundle: {e}")
                  raise

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@products/midaz/helm.yaml` around lines 487 - 498, The get_aws_ca_cert_base64
function leaves the urlopen response open; change the implementation to use a
context manager so the response is always closed (e.g., "with
urllib.request.urlopen(ca_url, timeout=30) as resp:"), read resp inside that
block to produce ca_pem, then base64-encode and return; keep the existing
exception handling (logger.error and re-raise) but ensure resource cleanup via
the with statement around urllib.request.urlopen.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@products/midaz/helm.yaml`:
- Around line 487-498: The get_aws_ca_cert_base64 function leaves the urlopen
response open; change the implementation to use a context manager so the
response is always closed (e.g., "with urllib.request.urlopen(ca_url,
timeout=30) as resp:"), read resp inside that block to produce ca_pem, then
base64-encode and return; keep the existing exception handling (logger.error and
re-raise) but ensure resource cleanup via the with statement around
urllib.request.urlopen.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: dc46437d-b4f2-4a3d-8f76-455f80d8b05b

📥 Commits

Reviewing files that changed from the base of the PR and between e2a9f91 and 22ec2be.

📒 Files selected for processing (1)

• products/midaz/helm.yaml