Step Functionsを使わずLambda Durable FunctionsでSlackの承認ボタン待ちを実装してみた

import * as cdk from "aws-cdk-lib";
import * as lambda from "aws-cdk-lib/aws-lambda";
import * as nodejs from "aws-cdk-lib/aws-lambda-nodejs";
import * as iam from "aws-cdk-lib/aws-iam";
import * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
import { Construct } from "constructs";
import * as path from "path";

const BOT_TOKEN_SECRET_NAME = "dev/blog-verify/slack-bot-token";

export class DurableSlackApprovalStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const botTokenSecret = secretsmanager.Secret.fromSecretNameV2(
      this,
      "BotTokenSecret",
      BOT_TOKEN_SECRET_NAME,
    );

    // 承認フロー本体（durable function）
    const approvalFlowFn = new nodejs.NodejsFunction(this, "ApprovalFlowFn", {
      entry: path.join(__dirname, "../lambda/approval-flow.ts"),
      runtime: lambda.Runtime.NODEJS_22_X,
      timeout: cdk.Duration.seconds(60),
      durableConfig: {
        executionTimeout: cdk.Duration.hours(1),
        retentionPeriod: cdk.Duration.days(7),
      },
      environment: {
        BOT_TOKEN_SECRET: BOT_TOKEN_SECRET_NAME,
      },
    });
    botTokenSecret.grantRead(approvalFlowFn);

    // Slackのボタン押下を受けてコールバックを完了させるLambda
    const slackCallbackFn = new nodejs.NodejsFunction(this, "SlackCallbackFn", {
      entry: path.join(__dirname, "../lambda/slack-callback.ts"),
      runtime: lambda.Runtime.NODEJS_22_X,
      timeout: cdk.Duration.seconds(10),
    });
    // durable execution のARNは「関数ARN:バージョン/durable-execution/...」形式のため
    // Resource には :* までを含めたパターンが必要
    slackCallbackFn.addToRolePolicy(
      new iam.PolicyStatement({
        actions: [
          "lambda:SendDurableExecutionCallbackSuccess",
          "lambda:SendDurableExecutionCallbackFailure",
        ],
        resources: [`${approvalFlowFn.functionArn}:*`],
      }),
    );

    const fnUrl = slackCallbackFn.addFunctionUrl({
      authType: lambda.FunctionUrlAuthType.NONE,
    });

    new cdk.CfnOutput(this, "CallbackUrl", { value: fnUrl.url });
    new cdk.CfnOutput(this, "ApprovalFlowFunctionName", {
      value: approvalFlowFn.functionName,
    });
  }
}

import {
  withDurableExecution,
  DurableContext,
  CallbackTimeoutError,
} from "@aws/durable-execution-sdk-js";
import {
  SecretsManagerClient,
  GetSecretValueCommand,
} from "@aws-sdk/client-secrets-manager";

const secretsManager = new SecretsManagerClient({});

interface ApprovalEvent {
  channel: string;
  summary: string;
  timeoutMinutes?: number;
}

interface Decision {
  approved: boolean;
  user: string;
}

// トークンはSecrets Managerから都度取得し、チェックポイントには永続化しない
async function getBotToken(): Promise<string> {
  const res = await secretsManager.send(
    new GetSecretValueCommand({ SecretId: process.env.BOT_TOKEN_SECRET! }),
  );
  return res.SecretString!;
}

async function postSlackMessage(body: unknown): Promise<void> {
  const token = await getBotToken();
  const res = await fetch("https://slack.com/api/chat.postMessage", {
    method: "POST",
    headers: {
      "Content-Type": "application/json; charset=utf-8",
      Authorization: `Bearer ${token}`,
    },
    body: JSON.stringify(body),
  });
  const data = (await res.json()) as { ok: boolean; error?: string };
  if (!data.ok) {
    throw new Error(`Slack API error: ${data.error}`);
  }
}

export const handler = withDurableExecution(
  async (event: ApprovalEvent, context: DurableContext) => {
    let decision: Decision;
    try {
      // Slackに承認ボタン付きメッセージを投稿し、ボタン押下まで待機する
      const result = await context.waitForCallback<string>(
        "wait-for-slack-approval",
        async (callbackId) => {
          await postSlackMessage({
            channel: event.channel,
            text: `承認リクエスト: ${event.summary}`,
            blocks: [
              {
                type: "section",
                text: {
                  type: "mrkdwn",
                  text: `*承認リクエスト*\n${event.summary}`,
                },
              },
              {
                type: "actions",
                elements: [
                  {
                    type: "button",
                    text: { type: "plain_text", text: "承認" },
                    style: "primary",
                    action_id: "approve",
                    value: callbackId,
                  },
                  {
                    type: "button",
                    text: { type: "plain_text", text: "却下" },
                    style: "danger",
                    action_id: "reject",
                    value: callbackId,
                  },
                ],
              },
            ],
          });
        },
        { timeout: { minutes: event.timeoutMinutes ?? 5 } },
      );
      decision = JSON.parse(result) as Decision;
    } catch (err) {
      if (err instanceof CallbackTimeoutError) {
        // 期限までに誰も押さなかった場合は自動却下として扱う
        await context.step("notify-timeout", async () => {
          await postSlackMessage({
            channel: event.channel,
            text: `承認リクエストは期限切れになりました（自動却下）: ${event.summary}`,
          });
        });
        return { status: "timeout" };
      }
      throw err;
    }

    await context.step("notify-result", async () => {
      await postSlackMessage({
        channel: event.channel,
        text: decision.approved
          ? `${decision.user} さんが承認しました。後続処理を実行します: ${event.summary}`
          : `${decision.user} さんが却下しました: ${event.summary}`,
      });
    });

    return {
      status: decision.approved ? "approved" : "rejected",
      by: decision.user,
    };
  },
);

import {
  LambdaClient,
  SendDurableExecutionCallbackSuccessCommand,
} from "@aws-sdk/client-lambda";
import type {
  LambdaFunctionURLEvent,
  LambdaFunctionURLResult,
} from "aws-lambda";

const lambda = new LambdaClient({});

interface SlackInteractionPayload {
  user: { id: string; username?: string };
  actions: { action_id: string; value: string }[];
  response_url: string;
}

export const handler = async (
  event: LambdaFunctionURLEvent,
): Promise<LambdaFunctionURLResult> => {
  const rawBody = event.isBase64Encoded
    ? Buffer.from(event.body ?? "", "base64").toString()
    : (event.body ?? "");
  const params = new URLSearchParams(rawBody);

  // Request URL保存時にSlackが送るssl_check検証POSTには200を返す
  // （payloadフィールドを持たないPOSTに200を返さないとURLの保存に失敗する）
  const payloadStr = params.get("payload");
  if (!payloadStr) {
    return { statusCode: 200, body: "" };
  }
  const payload = JSON.parse(payloadStr) as SlackInteractionPayload;

  const action = payload.actions[0];
  const decision = {
    approved: action.action_id === "approve",
    user: payload.user.username ?? payload.user.id,
  };

  try {
    await lambda.send(
      new SendDurableExecutionCallbackSuccessCommand({
        CallbackId: action.value,
        // ResultはUint8Array型のためBufferで渡す
        Result: Buffer.from(JSON.stringify(decision)),
      }),
    );
  } catch (err) {
    // 期限切れ・処理済みのコールバックに対する押下はSlack上で通知する
    await fetch(payload.response_url, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({
        replace_original: true,
        text: `この承認リクエストは既に処理済みか、期限切れです（${(err as Error).name}）`,
      }),
    });
    return { statusCode: 200, body: "" };
  }

  // 元のメッセージを押下結果に差し替える（ボタンの二度押し防止）
  await fetch(payload.response_url, {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
      replace_original: true,
      text: decision.approved
        ? `${decision.user} さんが承認しました`
        : `${decision.user} さんが却下しました`,
    }),
  });

  return { statusCode: 200, body: "" };
};

aws secretsmanager create-secret \
  --name dev/blog-verify/slack-bot-token \
  --secret-string "xoxb-（Bot User OAuth Token）"

pnpm add aws-cdk-lib constructs @aws/durable-execution-sdk-js \
  @aws-sdk/client-lambda @aws-sdk/client-secrets-manager
pnpm add -D aws-cdk tsx typescript esbuild @types/node @types/aws-lambda
pnpm exec cdk deploy

aws lambda invoke \
  --function-name "$FUNCTION_NAME:\$LATEST" \
  --invocation-type Event \
  --cli-binary-format raw-in-base64-out \
  --payload '{"channel":"C0XXXXXXXXX","summary":"本番環境へのデプロイ（release v1.2.3）","timeoutMinutes":30}' \
  /dev/null

{"summary":"本番環境へのデプロイ...","Status":"RUNNING","Started":"2026-07-30T09:02:36.386Z"}

# 直近メッセージからcallbackIdを抽出（要 channels:history スコープ）
curl -s -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
  "https://slack.com/api/conversations.history?channel=$CHANNEL_ID&limit=5" \
  -o hist.json
CALLBACK_ID=$(jq -r '.messages[0].blocks[] | select(.type=="actions") | .elements[] | select(.action_id=="approve") | .value' hist.json)

# ボタン押下相当のpayloadをPOST
jq -nc --arg v "$CALLBACK_ID" \
  '{type:"block_actions",user:{id:"UTEST",username:"curl-test"},actions:[{action_id:"approve",value:$v}],response_url:"https://example.com/dummy"}' \
  > payload.json
curl -s -o /dev/null -w "HTTP %{http_code}\n" -X POST "$FUNCTION_URL" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "payload@payload.json"

ExecutionStarted     09:02:37
CallbackStarted      09:02:38   ← waitForCallback 開始
StepStarted          09:02:38   ← submitter（Slack投稿）
StepSucceeded        09:02:40
InvocationCompleted  09:02:40   ← ここで1回目の呼び出しが終了（サスペンド）
CallbackTimedOut     09:07:38   ← 5分後にコールバックが期限切れ
StepStarted          09:07:39   ← notify-timeout step（リプレイで再開）
StepSucceeded        09:07:40
ExecutionSucceeded   09:07:40   ← ハンドリングされたので実行自体は成功

10:35:43  billed: 3642ms  ← 1回目（Slack投稿してサスペンドするまで）
10:36:57  billed: 1478ms  ← 2回目（コールバック受信後のリプレイ・完了処理）