ensureApiKeyForCustomer = async ({ userId, identityId }) => {
  console.log(`Ensuring API key for customer with userId=[${userId}]`)
  let updatedApiKey

  try {
    const [existingApiKeys, isRegistered] = await Promise.all([
      apigateway
        .getApiKeys({
          nameQuery: identityId,
          limit: 1
        })
        .promise(),
      isCognitoUserInGroup({
        userId,
        groupName: getEnv('RegisteredGroupName')
      })
    ])
    const existingApiKey = existingApiKeys.items[0]
    if (existingApiKey && existingApiKey.enabled !== isRegistered) {
      console.log(
        `Found API key with enabled=${existingApiKey.enabled}` +
        ` but isRegistered=${isRegistered}`
      )
      updatedApiKey = await updateApiKeyEnabled({
        apiKeyId: existingApiKey.id,
        enabled: isRegistered
      })
    } else if (existingApiKey === undefined) {
      console.log(`No API key found; creating one with enabled=${isRegistered}`)
      updatedApiKey = await __createApiKey({
        identityId,
        userId,
        enabled: isRegistered
      })
    } else {
      console.log(
        `Found API key with isRegistered = enabled = ${existingApiKey.enabled}`
      )
      updatedApiKey = existingApiKey
    }
  } catch (error) {
    console.error('Failed to ensure API key:', error)
    throw error
  }
  console.log('Ensured API key for customer')
  return updatedApiKey
}
Create or update an API key for the given Cognito userId and identityId,
which is enabled iff the customer's account is in the RegisteredGroup.