Fix module import, IAM permissions, and add manual test support

- Fix three_cx_client import path for Lambda packaging
- Expand SSM policy to include parent path and KMS decrypt for SecureString
- Add force flag to bypass 8am schedule check for manual invocations
- Add override_extension payload option for ad-hoc testing
- Update .gitignore for output.json and .DS_Store

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitignore

@@ -3,3 +3,5 @@ __pycache__/
 .aws-sam/
 .env
 packaged.yaml
+output.json
+.DS_Store

src/handler.py

@@ -6,7 +6,7 @@ from datetime import datetime, timezone, timedelta
 import boto3
 import yaml
 
-from three_cx_client import ThreeCXClient
+from src.three_cx_client import ThreeCXClient
 
 logger = logging.getLogger()
 logger.setLevel(logging.INFO)
@@ -67,12 +67,13 @@ def handler(event, context):
     current_hour = now.hour
     logger.info("Running 3CX ring group scheduler at %s", now.isoformat())
 
-    if current_hour != 8:
+    force = event.get("force", False)
+    if not force and current_hour != 8:
         logger.info("Current ET hour is %d, not 8am — skipping (wrong DST rule fired)", current_hour)
         return {"skipped": True, "reason": f"ET hour is {current_hour}, not 8"}
 
     schedule = load_schedule()
-    extension = resolve_extension(schedule, now)
+    extension = event.get("override_extension") or resolve_extension(schedule, now)
 
     creds = get_3cx_credentials()
     client = ThreeCXClient(

template.yaml

@@ -25,8 +25,22 @@ Resources:
           SSM_PREFIX: /3cx-scheduler
           TZ: !Ref Timezone
       Policies:
-        - SSMParameterWithSlashPrefixReadPolicy:
+        - Statement:
-            ParameterName: 3cx-scheduler
+            - Effect: Allow
+              Action:
+                - ssm:GetParametersByPath
+                - ssm:GetParameter
+                - ssm:GetParameters
+              Resource:
+                - !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/3cx-scheduler"
+                - !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/3cx-scheduler/*"
+            - Effect: Allow
+              Action:
+                - kms:Decrypt
+              Resource: "*"
+              Condition:
+                StringEquals:
+                  "kms:ViaService": !Sub "ssm.${AWS::Region}.amazonaws.com"
       Events:
         # EST: 8am ET = 13:00 UTC (Nov-Mar)
         DailyScheduleEST: