Repository navigation
feat(aws): automatic rescans per connector (off by default) - #94
Merged
Merged
Conversation
A connector can rescan itself daily or weekly. A scheduler loop in the backend queues the same scan "Scan now" queues (trigger "scheduled"); the existing scan worker runs it. No new AWS access. - cloud_scan_schedule table (migration 139 + bootstrap), RLS-enabled - scheduler: SKIP LOCKED claim (safe on many replicas), advance-then-enqueue, per-connector jitter, pause after 3 failed scheduled scans, resume via PUT - a scan already running at the due time retries in 1h, not a full interval - PUT locks the schedule row so it cannot overwrite a slot the scheduler claimed - GET/PUT /discovery/aws/connectors/:id/schedule; revoke disables the schedule - gated by AUTHSEC_AWS_SCHEDULED_SCANS (default off) Tested against real Postgres (tests/awsschedule): replicas, pause/resume, revoked, interval limits, busy-connector retry.
An administrator can now pick when a schedule runs: a time of day on a quarter hour, a timezone, and for weekly a weekday. Omitted, behaviour is unchanged (one interval after the schedule was turned on). - migration 140 (+ bootstrap): time_of_day_minutes, timezone, day_of_week, all optional, with CHECK constraints; existing rows are untouched - internal/scanslot: pure next-slot logic. One slot per local day, correct across daylight-saving changes (a time that does not exist runs at the end of the gap, a repeated one runs once). Standalone tests across eight zones. - scheduler keeps the chosen time after each run; the connector jitter is added after it, so a scan starts within 30 minutes after the chosen time - PUT .../schedule accepts time_of_day, timezone, day_of_week; 422 names the bad parameter; weekly with a time requires day_of_week - changing only the time moves the next scan without resetting the failure streak - Put keeps its signature (PutWithTiming is the new entry point) - DB tests added (tests/awsschedule/schedule_time_db_test.go)
akashmaurya3160
force-pushed
the
feat/aws-scheduled-scans
branch
from
October 20, 2026 03:04
623946e to
18cac46
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A connected AWS account can rescan itself daily or weekly. A scheduler loop in the backend queues the same scan "Scan now" queues (
trigger = 'scheduled'); the existing scan worker runs it. No new AWS access, nothing installed in the customer's account.How
cloud_scan_schedule(migration 139 +001_bootstrap.sql, identical blocks), RLS-enabled.FOR UPDATE SKIP LOCKEDclaim (safe on many replicas), advance-then-enqueue, per-connector jitter, auto-pause after 3 failed scheduled scans, resume via PUT.GET/PUT /discovery/aws/connectors/:id/schedule. Revoking a connector disables its schedule.AUTHSEC_AWS_SCHEDULED_SCANS=true. The endpoints still read and write, and reportscheduler_active: false.PUTreads and writes under a row lock, so it cannot overwrite a slot the scheduler just claimed.Spec:
.claude/specs/SPEC-aws-scheduled-scans.md(updated to match the code).Tested
go build ./...,go vet, unit tests pass.tests/awsschedule, needsTEST_DATABASE_URL): 6/6 pass. Covers the full schedule life, 4 replicas queueing one scan, pause/resume, off and revoked, interval limits, and the busy-connector retry.check-tenant-exempt.sh: unchanged (72 / baseline 72).schema-parity.sh(needs a built binary and psql). The bootstrap block was diffed against migration 139 and is identical.Not proven (before turning it on)
Scan duration on a large account against the 1-hour role session, behaviour with many connectors due at once, AWS throttling at daily cadence, and customer CloudTrail volume. Rollout per the spec: one internal workspace at daily for a week first.
Notes