adam/payments-dashboard
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/payments-dashboard.git synced 2026-10-03 17:53:17 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
payments-dashboard/template.yaml

397 lines
12 KiB
YAML
Raw Normal View History

Initial SAM stack: payments CSV to Slack App Home Two Lambda functions: - processPaymentCsv: S3 trigger, parses CSV, stores dashboard in DynamoDB - slackAppHome: API Gateway endpoint for Slack events, publishes Home tab view
2026-04-09 13:29:28 -04:00
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Payments Dashboard - S3 CSV ingestion to Slack App Home
Globals:
Function:
Runtime: nodejs20.x
Timeout: 30
MemorySize: 256
Environment:
Variables:
TABLE_NAME: !Ref DashboardTable
Resources:
Add VPC/NAT for static IP, dedup payments by check number, SSM token - VPC with NAT Gateway for static outbound IP (52.86.95.107) for BoA API - Payments stored as individual DynamoDB items keyed by check number - Slack bot token fetched from SSM at runtime instead of CF parameter - Slack Lambda scans payment items instead of reading single blob
2026-04-09 14:27:34 -04:00
# VPC with private subnet + NAT Gateway for static outbound IP
Vpc:
Type: AWS::EC2::VPC
Properties:
CidrBlock: 10.20.0.0/16
EnableDnsSupport: true
EnableDnsHostnames: true
Tags:
- Key: Name
Value: payments-dashboard-vpc
PrivateSubnet:
Type: AWS::EC2::Subnet
Properties:
VpcId: !Ref Vpc
CidrBlock: 10.20.1.0/24
AvailabilityZone: !Select [0, !GetAZs ""]
Tags:
- Key: Name
Value: payments-dashboard-private
PublicSubnet:
Type: AWS::EC2::Subnet
Properties:
VpcId: !Ref Vpc
CidrBlock: 10.20.2.0/24
AvailabilityZone: !Select [0, !GetAZs ""]
Tags:
- Key: Name
Value: payments-dashboard-public
InternetGateway:
Type: AWS::EC2::InternetGateway
VpcGatewayAttachment:
Type: AWS::EC2::VPCGatewayAttachment
Properties:
VpcId: !Ref Vpc
InternetGatewayId: !Ref InternetGateway
NatEip:
Type: AWS::EC2::EIP
Properties:
Domain: vpc
NatGateway:
Type: AWS::EC2::NatGateway
Properties:
AllocationId: !GetAtt NatEip.AllocationId
SubnetId: !Ref PublicSubnet
PublicRouteTable:
Type: AWS::EC2::RouteTable
Properties:
VpcId: !Ref Vpc
PublicRoute:
Type: AWS::EC2::Route
DependsOn: VpcGatewayAttachment
Properties:
RouteTableId: !Ref PublicRouteTable
DestinationCidrBlock: 0.0.0.0/0
GatewayId: !Ref InternetGateway
PublicSubnetRouteTableAssociation:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
SubnetId: !Ref PublicSubnet
RouteTableId: !Ref PublicRouteTable
Add Aurora Serverless v2 PostgreSQL for Gusto payroll ingestion via Dataddo Adds public subnet in second AZ, Aurora security group, DB subnet group, and Serverless v2 cluster with Data API enabled and Secrets Manager credentials.
2026-04-24 15:05:43 -04:00
PublicSubnetB:
Type: AWS::EC2::Subnet
Properties:
VpcId: !Ref Vpc
CidrBlock: 10.20.3.0/24
AvailabilityZone: !Select [1, !GetAZs ""]
MapPublicIpOnLaunch: true
Tags:
- Key: Name
Value: payments-dashboard-public-b
PublicSubnetBRouteTableAssociation:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
SubnetId: !Ref PublicSubnetB
RouteTableId: !Ref PublicRouteTable
Add VPC/NAT for static IP, dedup payments by check number, SSM token - VPC with NAT Gateway for static outbound IP (52.86.95.107) for BoA API - Payments stored as individual DynamoDB items keyed by check number - Slack bot token fetched from SSM at runtime instead of CF parameter - Slack Lambda scans payment items instead of reading single blob
2026-04-09 14:27:34 -04:00
PrivateRouteTable:
Type: AWS::EC2::RouteTable
Properties:
VpcId: !Ref Vpc
PrivateRoute:
Type: AWS::EC2::Route
Properties:
RouteTableId: !Ref PrivateRouteTable
DestinationCidrBlock: 0.0.0.0/0
NatGatewayId: !Ref NatGateway
PrivateSubnetRouteTableAssociation:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
SubnetId: !Ref PrivateSubnet
RouteTableId: !Ref PrivateRouteTable
LambdaSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Payments Dashboard Lambda outbound access
VpcId: !Ref Vpc
SecurityGroupEgress:
- IpProtocol: "-1"
CidrIp: 0.0.0.0/0
Add Aurora Serverless v2 PostgreSQL for Gusto payroll ingestion via Dataddo Adds public subnet in second AZ, Aurora security group, DB subnet group, and Serverless v2 cluster with Data API enabled and Secrets Manager credentials.
2026-04-24 15:05:43 -04:00
# Aurora Serverless v2 PostgreSQL (Dataddo → payroll data)
AuroraSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Aurora PostgreSQL access
VpcId: !Ref Vpc
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 5432
ToPort: 5432
SourceSecurityGroupId: !Ref LambdaSecurityGroup
- IpProtocol: tcp
FromPort: 5432
ToPort: 5432
CidrIp: 0.0.0.0/0
AuroraSubnetGroup:
Type: AWS::RDS::DBSubnetGroup
Properties:
DBSubnetGroupDescription: Public subnets for Aurora PostgreSQL
SubnetIds:
- !Ref PublicSubnet
- !Ref PublicSubnetB
AuroraCluster:
Type: AWS::RDS::DBCluster
Properties:
Engine: aurora-postgresql
EngineVersion: "16.4"
DatabaseName: payroll
MasterUsername: payroll_admin
ManageMasterUserPassword: true
ServerlessV2ScalingConfiguration:
MinCapacity: 0.5
MaxCapacity: 2
VpcSecurityGroupIds:
- !Ref AuroraSecurityGroup
DBSubnetGroupName: !Ref AuroraSubnetGroup
EnableHttpEndpoint: true
StorageEncrypted: true
AuroraInstance:
Type: AWS::RDS::DBInstance
Properties:
DBClusterIdentifier: !Ref AuroraCluster
DBInstanceClass: db.serverless
Engine: aurora-postgresql
PubliclyAccessible: true
Initial SAM stack: payments CSV to Slack App Home Two Lambda functions: - processPaymentCsv: S3 trigger, parses CSV, stores dashboard in DynamoDB - slackAppHome: API Gateway endpoint for Slack events, publishes Home tab view
2026-04-09 13:29:28 -04:00
PaymentsCsvBucket:
Type: AWS::S3::Bucket
Properties:
BucketName: !Sub seahaven-payments-csv-${AWS::AccountId}
DashboardTable:
Type: AWS::DynamoDB::Table
Properties:
TableName: PaymentsDashboard
BillingMode: PAY_PER_REQUEST
AttributeDefinitions:
- AttributeName: pk
AttributeType: S
KeySchema:
- AttributeName: pk
KeyType: HASH
Log BoA submissions to DDB and surface in Slack App Home Capture response headers, body, and transactionId on every check-issue API call; persist as boa_txn#<ts>#<action> records with 90-day TTL. Add "Recent BoA Submissions" section to App Home showing the last 10 with click-to-copy transactionId. Motivation: BoA support asked for a transactionId from a past successful call and we had no way to recover it from CloudWatch summary logs alone. Also adds simulate-csv.cjs (dry-run preview) and stampli-uploader.sh (launchd-invoked S3 uploader), and gitignores debug artifacts.
2026-04-20 17:40:55 -04:00
TimeToLiveSpecification:
AttributeName: ttl
Enabled: true
Initial SAM stack: payments CSV to Slack App Home Two Lambda functions: - processPaymentCsv: S3 trigger, parses CSV, stores dashboard in DynamoDB - slackAppHome: API Gateway endpoint for Slack events, publishes Home tab view
2026-04-09 13:29:28 -04:00
ProcessPaymentCsvFunction:
Type: AWS::Serverless::Function
Properties:
FunctionName: payments-processPaymentCsv
Handler: src/processPaymentCsv.handler
Add CashPro check issue/cancel on CSV upload - CSV processor detects new checks and submits add_issue to CashPro - Checks updated to voided/cancelled trigger cancel_issue to CashPro - Added SSM params for boa-api-token, boa-account-number, boa-company-id to both processPaymentCsv and fetchBoaTransactions Lambdas - Increased CSV processor timeout to 120s for API calls
2026-04-09 15:14:51 -04:00
Timeout: 120
Environment:
Variables:
Update integration code with correct BoA CashPro API specs and add README - Add OAuth client-credentials token exchange to both Lambda handlers - Fix sandbox/prod base URL (api-sb.bofa.com / api.bofa.com) - Fix issueAction casing to add_Issue / cancel_Issue per API docs - Fix transaction inquiry response parsing (accountTransactions array) - Move all BoA config (app IDs, bank ID) from env vars to SSM params - Update template.yaml with correct SSM param names and policies - Add project README with architecture, API details, and SSM param reference
2026-04-13 16:24:20 -04:00
BOA_BASE_URL: https://api.bofa.com
BOA_CHECK_MGMT_APP_ID_PARAM: /payments-dashboard/boa-check-mgmt-app-id
BOA_CHECK_MGMT_CLIENT_ID_PARAM: /payments-dashboard/boa-check-mgmt-client-id
BOA_CHECK_MGMT_SECRET_PARAM: /payments-dashboard/boa-check-mgmt-token
Add CashPro check issue/cancel on CSV upload - CSV processor detects new checks and submits add_issue to CashPro - Checks updated to voided/cancelled trigger cancel_issue to CashPro - Added SSM params for boa-api-token, boa-account-number, boa-company-id to both processPaymentCsv and fetchBoaTransactions Lambdas - Increased CSV processor timeout to 120s for API calls
2026-04-09 15:14:51 -04:00
BOA_ACCOUNT_NUMBER_PARAM: /payments-dashboard/boa-account-number
BOA_COMPANY_ID_PARAM: /payments-dashboard/boa-company-id
Add VPC/NAT for static IP, dedup payments by check number, SSM token - VPC with NAT Gateway for static outbound IP (52.86.95.107) for BoA API - Payments stored as individual DynamoDB items keyed by check number - Slack bot token fetched from SSM at runtime instead of CF parameter - Slack Lambda scans payment items instead of reading single blob
2026-04-09 14:27:34 -04:00
VpcConfig:
SubnetIds:
- !Ref PrivateSubnet
SecurityGroupIds:
- !Ref LambdaSecurityGroup
Initial SAM stack: payments CSV to Slack App Home Two Lambda functions: - processPaymentCsv: S3 trigger, parses CSV, stores dashboard in DynamoDB - slackAppHome: API Gateway endpoint for Slack events, publishes Home tab view
2026-04-09 13:29:28 -04:00
Events:
CsvUpload:
Type: S3
Properties:
Bucket: !Ref PaymentsCsvBucket
Events: s3:ObjectCreated:*
Filter:
S3Key:
Rules:
- Name: suffix
Value: .csv
Policies:
- S3ReadPolicy:
BucketName: !Sub seahaven-payments-csv-${AWS::AccountId}
- DynamoDBCrudPolicy:
TableName: !Ref DashboardTable
Add CashPro check issue/cancel on CSV upload - CSV processor detects new checks and submits add_issue to CashPro - Checks updated to voided/cancelled trigger cancel_issue to CashPro - Added SSM params for boa-api-token, boa-account-number, boa-company-id to both processPaymentCsv and fetchBoaTransactions Lambdas - Increased CSV processor timeout to 120s for API calls
2026-04-09 15:14:51 -04:00
- SSMParameterReadPolicy:
Update integration code with correct BoA CashPro API specs and add README - Add OAuth client-credentials token exchange to both Lambda handlers - Fix sandbox/prod base URL (api-sb.bofa.com / api.bofa.com) - Fix issueAction casing to add_Issue / cancel_Issue per API docs - Fix transaction inquiry response parsing (accountTransactions array) - Move all BoA config (app IDs, bank ID) from env vars to SSM params - Update template.yaml with correct SSM param names and policies - Add project README with architecture, API details, and SSM param reference
2026-04-13 16:24:20 -04:00
ParameterName: payments-dashboard/boa-check-mgmt-app-id
- SSMParameterReadPolicy:
ParameterName: payments-dashboard/boa-check-mgmt-client-id
- SSMParameterReadPolicy:
ParameterName: payments-dashboard/boa-check-mgmt-token
Add CashPro check issue/cancel on CSV upload - CSV processor detects new checks and submits add_issue to CashPro - Checks updated to voided/cancelled trigger cancel_issue to CashPro - Added SSM params for boa-api-token, boa-account-number, boa-company-id to both processPaymentCsv and fetchBoaTransactions Lambdas - Increased CSV processor timeout to 120s for API calls
2026-04-09 15:14:51 -04:00
- SSMParameterReadPolicy:
ParameterName: payments-dashboard/boa-account-number
- SSMParameterReadPolicy:
ParameterName: payments-dashboard/boa-company-id
Add VPC/NAT for static IP, dedup payments by check number, SSM token - VPC with NAT Gateway for static outbound IP (52.86.95.107) for BoA API - Payments stored as individual DynamoDB items keyed by check number - Slack bot token fetched from SSM at runtime instead of CF parameter - Slack Lambda scans payment items instead of reading single blob
2026-04-09 14:27:34 -04:00
- Version: "2012-10-17"
Statement:
- Effect: Allow
Action:
- ec2:CreateNetworkInterface
- ec2:DescribeNetworkInterfaces
- ec2:DeleteNetworkInterface
Resource: "*"
Initial SAM stack: payments CSV to Slack App Home Two Lambda functions: - processPaymentCsv: S3 trigger, parses CSV, stores dashboard in DynamoDB - slackAppHome: API Gateway endpoint for Slack events, publishes Home tab view
2026-04-09 13:29:28 -04:00
SlackAppHomeFunction:
Type: AWS::Serverless::Function
Properties:
FunctionName: payments-slackAppHome
Handler: src/slackAppHome.handler
Add VPC/NAT for static IP, dedup payments by check number, SSM token - VPC with NAT Gateway for static outbound IP (52.86.95.107) for BoA API - Payments stored as individual DynamoDB items keyed by check number - Slack bot token fetched from SSM at runtime instead of CF parameter - Slack Lambda scans payment items instead of reading single blob
2026-04-09 14:27:34 -04:00
VpcConfig:
SubnetIds:
- !Ref PrivateSubnet
SecurityGroupIds:
- !Ref LambdaSecurityGroup
Initial SAM stack: payments CSV to Slack App Home Two Lambda functions: - processPaymentCsv: S3 trigger, parses CSV, stores dashboard in DynamoDB - slackAppHome: API Gateway endpoint for Slack events, publishes Home tab view
2026-04-09 13:29:28 -04:00
Environment:
Variables:
Add VPC/NAT for static IP, dedup payments by check number, SSM token - VPC with NAT Gateway for static outbound IP (52.86.95.107) for BoA API - Payments stored as individual DynamoDB items keyed by check number - Slack bot token fetched from SSM at runtime instead of CF parameter - Slack Lambda scans payment items instead of reading single blob
2026-04-09 14:27:34 -04:00
SLACK_BOT_TOKEN_PARAM: /payments-dashboard/slack-bot-token
Initial SAM stack: payments CSV to Slack App Home Two Lambda functions: - processPaymentCsv: S3 trigger, parses CSV, stores dashboard in DynamoDB - slackAppHome: API Gateway endpoint for Slack events, publishes Home tab view
2026-04-09 13:29:28 -04:00
Events:
SlackEvent:
Type: HttpApi
Properties:
Path: /slack/events
Method: POST
Policies:
- DynamoDBReadPolicy:
TableName: !Ref DashboardTable
Add VPC/NAT for static IP, dedup payments by check number, SSM token - VPC with NAT Gateway for static outbound IP (52.86.95.107) for BoA API - Payments stored as individual DynamoDB items keyed by check number - Slack bot token fetched from SSM at runtime instead of CF parameter - Slack Lambda scans payment items instead of reading single blob
2026-04-09 14:27:34 -04:00
- SSMParameterReadPolicy:
ParameterName: payments-dashboard/slack-bot-token
- Version: "2012-10-17"
Statement:
- Effect: Allow
Action:
- ec2:CreateNetworkInterface
- ec2:DescribeNetworkInterfaces
- ec2:DeleteNetworkInterface
Resource: "*"
Initial SAM stack: payments CSV to Slack App Home Two Lambda functions: - processPaymentCsv: S3 trigger, parses CSV, stores dashboard in DynamoDB - slackAppHome: API Gateway endpoint for Slack events, publishes Home tab view
2026-04-09 13:29:28 -04:00
Add BoA CashPro integration and payment status tracking - New fetchBoaTransactions Lambda: daily 9am ET schedule (disabled until API key set) Calls CashPro Previous Day Transaction Inquiry, filters for codes 255/475, matches bankReference to check_number, updates clear_status in DynamoDB - CSV processor switched to UpdateCommand to preserve clearing data on re-upload - Slack dashboard now shows Scheduled, Outstanding, Cleared, and Returned sections - ACH payments auto-assumed cleared once past due date
2026-04-09 14:59:39 -04:00
FetchBoaTransactionsFunction:
Type: AWS::Serverless::Function
Properties:
FunctionName: payments-fetchBoaTransactions
Handler: src/fetchBoaTransactions.handler
Timeout: 60
VpcConfig:
SubnetIds:
- !Ref PrivateSubnet
SecurityGroupIds:
- !Ref LambdaSecurityGroup
Environment:
Variables:
Update integration code with correct BoA CashPro API specs and add README - Add OAuth client-credentials token exchange to both Lambda handlers - Fix sandbox/prod base URL (api-sb.bofa.com / api.bofa.com) - Fix issueAction casing to add_Issue / cancel_Issue per API docs - Fix transaction inquiry response parsing (accountTransactions array) - Move all BoA config (app IDs, bank ID) from env vars to SSM params - Update template.yaml with correct SSM param names and policies - Add project README with architecture, API details, and SSM param reference
2026-04-13 16:24:20 -04:00
BOA_BASE_URL: https://api.bofa.com
BOA_REPORTING_APP_ID_PARAM: /payments-dashboard/boa-reporting-app-id
BOA_REPORTING_CLIENT_ID_PARAM: /payments-dashboard/boa-account-info-client-id
BOA_REPORTING_SECRET_PARAM: /payments-dashboard/boa-account-info-token
Add BoA CashPro integration and payment status tracking - New fetchBoaTransactions Lambda: daily 9am ET schedule (disabled until API key set) Calls CashPro Previous Day Transaction Inquiry, filters for codes 255/475, matches bankReference to check_number, updates clear_status in DynamoDB - CSV processor switched to UpdateCommand to preserve clearing data on re-upload - Slack dashboard now shows Scheduled, Outstanding, Cleared, and Returned sections - ACH payments auto-assumed cleared once past due date
2026-04-09 14:59:39 -04:00
BOA_ACCOUNT_NUMBER_PARAM: /payments-dashboard/boa-account-number
Update integration code with correct BoA CashPro API specs and add README - Add OAuth client-credentials token exchange to both Lambda handlers - Fix sandbox/prod base URL (api-sb.bofa.com / api.bofa.com) - Fix issueAction casing to add_Issue / cancel_Issue per API docs - Fix transaction inquiry response parsing (accountTransactions array) - Move all BoA config (app IDs, bank ID) from env vars to SSM params - Update template.yaml with correct SSM param names and policies - Add project README with architecture, API details, and SSM param reference
2026-04-13 16:24:20 -04:00
BOA_BANK_ID_PARAM: /payments-dashboard/boa-bank-id
Add BoA CashPro integration and payment status tracking - New fetchBoaTransactions Lambda: daily 9am ET schedule (disabled until API key set) Calls CashPro Previous Day Transaction Inquiry, filters for codes 255/475, matches bankReference to check_number, updates clear_status in DynamoDB - CSV processor switched to UpdateCommand to preserve clearing data on re-upload - Slack dashboard now shows Scheduled, Outstanding, Cleared, and Returned sections - ACH payments auto-assumed cleared once past due date
2026-04-09 14:59:39 -04:00
Events:
DailySchedule:
Type: Schedule
Properties:
Schedule: cron(0 13 ? * MON-FRI *)
Description: Fetch BoA previous day transactions at 9am ET (13:00 UTC)
Fix BoA transaction matching, add status progression protection, enable daily schedule - Fix transaction code mapping (475=Cleared, 255=Returned) in fetchBoaTransactions - Match on customerReference instead of bankReference for check number matching - Add bank-confirmed protection: CSV cannot override status once bank confirms Cleared - Add status progression guard: CSV cannot regress status backward in lifecycle - Cleared status is permanent — cannot be voided, cancelled, or changed - Enable daily fetchBoaTransactions schedule (9am ET weekdays) - Add production test script and dry run simulation script
2026-04-14 17:43:13 -04:00
Enabled: true
Add BoA CashPro integration and payment status tracking - New fetchBoaTransactions Lambda: daily 9am ET schedule (disabled until API key set) Calls CashPro Previous Day Transaction Inquiry, filters for codes 255/475, matches bankReference to check_number, updates clear_status in DynamoDB - CSV processor switched to UpdateCommand to preserve clearing data on re-upload - Slack dashboard now shows Scheduled, Outstanding, Cleared, and Returned sections - ACH payments auto-assumed cleared once past due date
2026-04-09 14:59:39 -04:00
Policies:
- DynamoDBCrudPolicy:
TableName: !Ref DashboardTable
- SSMParameterReadPolicy:
Update integration code with correct BoA CashPro API specs and add README - Add OAuth client-credentials token exchange to both Lambda handlers - Fix sandbox/prod base URL (api-sb.bofa.com / api.bofa.com) - Fix issueAction casing to add_Issue / cancel_Issue per API docs - Fix transaction inquiry response parsing (accountTransactions array) - Move all BoA config (app IDs, bank ID) from env vars to SSM params - Update template.yaml with correct SSM param names and policies - Add project README with architecture, API details, and SSM param reference
2026-04-13 16:24:20 -04:00
ParameterName: payments-dashboard/boa-reporting-app-id
- SSMParameterReadPolicy:
ParameterName: payments-dashboard/boa-account-info-client-id
- SSMParameterReadPolicy:
ParameterName: payments-dashboard/boa-account-info-token
Add BoA CashPro integration and payment status tracking - New fetchBoaTransactions Lambda: daily 9am ET schedule (disabled until API key set) Calls CashPro Previous Day Transaction Inquiry, filters for codes 255/475, matches bankReference to check_number, updates clear_status in DynamoDB - CSV processor switched to UpdateCommand to preserve clearing data on re-upload - Slack dashboard now shows Scheduled, Outstanding, Cleared, and Returned sections - ACH payments auto-assumed cleared once past due date
2026-04-09 14:59:39 -04:00
- SSMParameterReadPolicy:
ParameterName: payments-dashboard/boa-account-number
Add CashPro check issue/cancel on CSV upload - CSV processor detects new checks and submits add_issue to CashPro - Checks updated to voided/cancelled trigger cancel_issue to CashPro - Added SSM params for boa-api-token, boa-account-number, boa-company-id to both processPaymentCsv and fetchBoaTransactions Lambdas - Increased CSV processor timeout to 120s for API calls
2026-04-09 15:14:51 -04:00
- SSMParameterReadPolicy:
Update integration code with correct BoA CashPro API specs and add README - Add OAuth client-credentials token exchange to both Lambda handlers - Fix sandbox/prod base URL (api-sb.bofa.com / api.bofa.com) - Fix issueAction casing to add_Issue / cancel_Issue per API docs - Fix transaction inquiry response parsing (accountTransactions array) - Move all BoA config (app IDs, bank ID) from env vars to SSM params - Update template.yaml with correct SSM param names and policies - Add project README with architecture, API details, and SSM param reference
2026-04-13 16:24:20 -04:00
ParameterName: payments-dashboard/boa-bank-id
Add BoA CashPro integration and payment status tracking - New fetchBoaTransactions Lambda: daily 9am ET schedule (disabled until API key set) Calls CashPro Previous Day Transaction Inquiry, filters for codes 255/475, matches bankReference to check_number, updates clear_status in DynamoDB - CSV processor switched to UpdateCommand to preserve clearing data on re-upload - Slack dashboard now shows Scheduled, Outstanding, Cleared, and Returned sections - ACH payments auto-assumed cleared once past due date
2026-04-09 14:59:39 -04:00
- Version: "2012-10-17"
Statement:
- Effect: Allow
Action:
- ec2:CreateNetworkInterface
- ec2:DescribeNetworkInterfaces
- ec2:DeleteNetworkInterface
Resource: "*"
Add payroll notification Lambda for Gusto payroll via Dataddo Queries Aurora for new payroll runs and contractor payments, sends formatted Slack message with gross pay breakdown and total bank withdrawal amount. Runs weekdays at 2pm ET, tracks notified payrolls in DynamoDB to avoid duplicates.
2026-04-24 16:39:50 -04:00
NotifyPayrollFunction:
Type: AWS::Serverless::Function
Properties:
FunctionName: payments-notifyPayroll
Handler: src/notifyPayroll.handler
Timeout: 60
VpcConfig:
SubnetIds:
- !Ref PrivateSubnet
SecurityGroupIds:
- !Ref LambdaSecurityGroup
Environment:
Variables:
AURORA_CLUSTER_ARN: !GetAtt AuroraCluster.DBClusterArn
AURORA_SECRET_ARN: !GetAtt AuroraCluster.MasterUserSecret.SecretArn
SLACK_BOT_TOKEN_PARAM: /payments-dashboard/slack-bot-token
Events:
PayrollCheck:
Type: Schedule
Properties:
Schedule: cron(0 18 ? * MON-FRI *)
Description: Check for new payroll data at 2pm ET (18:00 UTC)
Enabled: true
Policies:
- DynamoDBCrudPolicy:
TableName: !Ref DashboardTable
- SSMParameterReadPolicy:
ParameterName: payments-dashboard/slack-bot-token
- Version: "2012-10-17"
Statement:
- Effect: Allow
Action:
- ec2:CreateNetworkInterface
- ec2:DescribeNetworkInterfaces
- ec2:DeleteNetworkInterface
Resource: "*"
- Effect: Allow
Action:
- rds-data:ExecuteStatement
Resource: !GetAtt AuroraCluster.DBClusterArn
- Effect: Allow
Action:
- secretsmanager:GetSecretValue
Resource: !GetAtt AuroraCluster.MasterUserSecret.SecretArn
Initial SAM stack: payments CSV to Slack App Home Two Lambda functions: - processPaymentCsv: S3 trigger, parses CSV, stores dashboard in DynamoDB - slackAppHome: API Gateway endpoint for Slack events, publishes Home tab view
2026-04-09 13:29:28 -04:00
Outputs:
SlackEventUrl:
Description: URL to set as the Slack app Request URL
Value: !Sub https://${ServerlessHttpApi}.execute-api.${AWS::Region}.amazonaws.com/slack/events
CsvBucket:
Description: S3 bucket for CSV uploads
Value: !Ref PaymentsCsvBucket
Add VPC/NAT for static IP, dedup payments by check number, SSM token - VPC with NAT Gateway for static outbound IP (52.86.95.107) for BoA API - Payments stored as individual DynamoDB items keyed by check number - Slack bot token fetched from SSM at runtime instead of CF parameter - Slack Lambda scans payment items instead of reading single blob
2026-04-09 14:27:34 -04:00
StaticOutboundIp:
Description: Static IP for BoA API whitelist
Value: !Ref NatEip
Add Aurora Serverless v2 PostgreSQL for Gusto payroll ingestion via Dataddo Adds public subnet in second AZ, Aurora security group, DB subnet group, and Serverless v2 cluster with Data API enabled and Secrets Manager credentials.
2026-04-24 15:05:43 -04:00
AuroraEndpoint:
Description: Aurora PostgreSQL cluster endpoint
Value: !GetAtt AuroraCluster.Endpoint.Address
AuroraPort:
Description: Aurora PostgreSQL port
Value: !GetAtt AuroraCluster.Endpoint.Port
AuroraSecretArn:
Description: Secrets Manager ARN for Aurora master credentials
Value: !GetAtt AuroraCluster.MasterUserSecret.SecretArn
Reference in a new issue Copy permalink