How to setup auto deactivate license for MD Core container in AWS ECS with Lambda function?

# 1) MD Core activation key (for deactivation calls)

aws secretsmanager create-secret \

  --name mdcore/license-key \

  --secret-string '<YOUR_ACTIVATION_KEY>'

# 2) MD Core Admin API key (for /admin/license)

aws secretsmanager create-secret \

  --name mdcore/admin-apikey \

  --secret-string '<STRONG_RANDOM_APIKEY>'

aws dynamodb create-table \

  --table-name mdcore-deployments \

  --attribute-definitions AttributeName=task_arn,AttributeType=S \

  --key-schema AttributeName=task_arn,KeyType=HASH \

  --billing-mode PAY_PER_REQUEST

DDB_TABLE = mdcore-deployments

MDCORE_CONTAINER_NAME = mdcore

MDCORE_APIKEY_NAME = MDCORE_APIKEY

MDCORE_ACTIVATION_KEY_NAME = MDCORE_LICENSE_KEY

MDCORE_ADMIN_PORT = 8008

WAIT_RUNNING_SEC = 120

WAIT_STOPPED_SEC = 90

DEACTIVATE_URL = https://activation.dl.opswat.com/deactivation

import os, time, json, urllib.request, urllib.parse

import boto3

from botocore.exceptions import ClientError

​

ecs = boto3.client('ecs')

secrets = boto3.client('secretsmanager')

ddb = boto3.resource('dynamodb')

table = ddb.Table(os.environ['DDB_TABLE'])

​

MDCORE_CONTAINER = os.environ.get('MDCORE_CONTAINER_NAME', 'mdcore')

APIKEY_ENV = os.environ.get('MDCORE_APIKEY_NAME', 'MDCORE_APIKEY')

ACTKEY_ENV = os.environ.get('MDCORE_ACTIVATION_KEY_NAME', 'MDCORE_LICENSE_KEY')

ADMIN_PORT = int(os.environ.get('MDCORE_ADMIN_PORT', '8008'))

DEACTIVATE_URL = os.environ.get('DEACTIVATE_URL', 'https://activation.dl.opswat.com/deactivation')

WAIT_RUNNING_SEC = int(os.environ.get('WAIT_RUNNING_SEC', '120'))

WAIT_STOPPED_SEC = int(os.environ.get('WAIT_STOPPED_SEC', '90'))

​

def _get_secret(maybe_arn):

    if not maybe_arn:

        return None

    v = secrets.get_secret_value(SecretId=maybe_arn)

    return v.get('SecretString') or v.get('SecretBinary')

​

def _env_from_taskdef(taskdef_arn, name, container_name):

    td = ecs.describe_task_definition(taskDefinition=taskdef_arn)['taskDefinition']

    cdefs = td.get('containerDefinitions', [])

    c = next((x for x in cdefs if x.get('name') == container_name), (cdefs[0] if cdefs else {}))

    for e in c.get('environment', []):

        if e.get('name') == name:

            return e.get('value')

    for s in c.get('secrets', []):

        if s.get('name') == name:

            return _get_secret(s.get('valueFrom'))

    return None

​

def _describe_task(cluster_arn, task_arn):

    t = ecs.describe_tasks(cluster=cluster_arn, tasks=[task_arn])['tasks'][0]

    last = t.get('lastStatus')

    taskdef_arn = t.get('taskDefinitionArn')

    ip = None

    for att in t.get('attachments', []):

        if att.get('type') == 'ElasticNetworkInterface':

            for d in att.get('details', []):

                if d.get('name') == 'privateIPv4Address':

                    ip = d.get('value'); break

    return last, taskdef_arn, ip

​

def _wait_until(cluster_arn, task_arn, want_status, timeout_sec):

    t0 = time.time()

    last, taskdef, ip = None, None, None

    while time.time() - t0 < timeout_sec:

        last, taskdef, ip = _describe_task(cluster_arn, task_arn)

        if last == want_status:

            return last, taskdef, ip

        time.sleep(3)

    return last, taskdef, ip

def _call_admin_license(ip, apikey, retries=20, sleep=3):

    url = f'http://{ip}:{ADMIN_PORT}/admin/license'

    for _ in range(retries):

        try:

            req = urllib.request.Request(url, method='GET', headers={'apikey': apikey})

            with urllib.request.urlopen(req, timeout=5) as resp:

                if resp.status == 200:

                    return json.loads(resp.read().decode())

        except Exception:

            time.sleep(sleep)

    raise RuntimeError("Cannot query /admin/license (timeout)")

def _put_mapping(task_arn, container_name, cluster_arn, taskdef_arn, ip, deployment):

    table.put_item(Item={

        'task_arn': task_arn,

        'container_name': container_name,

        'cluster_arn': cluster_arn,

        'taskdef_arn': taskdef_arn,

        'private_ip': ip or '',

        'deployment': deployment,

        'created_at': int(time.time()),

        'status': 'ACTIVE',

        'ttl': int(time.time()) + 14*24*3600

    })

def _get_mapping(task_arn):

    r = table.get_item(Key={'task_arn': task_arn})

    return r.get('Item')

def _mark_deactivated(task_arn):

    table.update_item(

        Key={'task_arn': task_arn},

        UpdateExpression="SET #s=:s, deactivated_at=:t",

        ExpressionAttributeNames={'#s': 'status'},

        ExpressionAttributeValues={':s': 'DEACTIVATED', ':t': int(time.time())}

    )

def _deactivate(activation_key, deployment):

    q = f"{DEACTIVATE_URL}?key={urllib.parse.quote(activation_key)}&deployment={urllib.parse.quote(deployment)}"

    req = urllib.request.Request(q, method='GET')

    with urllib.request.urlopen(req, timeout=10) as resp:

        if resp.status not in (200, 204):

            body = resp.read().decode()

            raise RuntimeError(f"Deactivate failed: {resp.status} {body}")

def handler(event, _ctx):

    d = event.get('detail', {})

    desired = d.get('desiredStatus')

    cluster_arn = d.get('clusterArn')

    task_arn = d.get('taskArn')

    if not (cluster_arn and task_arn and desired):

        return {"skipped": True, "reason": "missing fields"}

    last, taskdef_arn, ip = _describe_task(cluster_arn, task_arn)

    if desired == 'RUNNING':

        last, taskdef_arn, ip = _wait_until(cluster_arn, task_arn, 'RUNNING', WAIT_RUNNING_SEC)

        apikey = _env_from_taskdef(taskdef_arn, APIKEY_ENV, MDCORE_CONTAINER)

        if not apikey:

            raise RuntimeError(f"Missing API key env {APIKEY_ENV}")

        t0 = time.time()

        while not ip and time.time() - t0 < 60:

            time.sleep(3)

            _, _, ip = _describe_task(cluster_arn, task_arn)

        if not ip:

            raise RuntimeError("No private IP; cannot reach admin port")

        lic = _call_admin_license(ip, apikey)

        dep = lic.get('deployment')

        if not dep:

            raise RuntimeError("No 'deployment' in /admin/license")

        _put_mapping(task_arn, MDCORE_CONTAINER, cluster_arn, taskdef_arn, ip, dep)

        return {"status": "mapped", "desired": desired, "last": last, "deployment": dep}

​

    if desired == 'STOPPED':

        item = _get_mapping(task_arn)

        if not item or not item.get('deployment'):

            return {"status": "no-mapping", "desired": desired, "last": last}

        dep = item['deployment']

        act_key = _env_from_taskdef(taskdef_arn, ACTKEY_ENV, MDCORE_CONTAINER)

        if not act_key:

            raise RuntimeError(f"Missing activation key env {ACTKEY_ENV}")

        last, _, _ = _wait_until(cluster_arn, task_arn, 'STOPPED', WAIT_STOPPED_SEC)

        _deactivate(act_key, dep)

        _mark_deactivated(task_arn)

        return {"status": "deactivated", "desired": desired, "last": last}

​

    return {"skipped": True, "reason": f"desired={desired}"}

{

  "source": ["aws.ecs"],

  "detail-type": ["ECS Task State Change"],

  "detail": {

    "clusterArn": ["arn:aws:ecs:<region>:<acct>:cluster/<your-cluster>"],

    "group": ["service:<your-mdcore-service>"],

    "desiredStatus": ["RUNNING","STOPPED"]

  }

}

curl -H "apikey: $MDCORE_APIKEY" http://localhost:8008/admin/license