adam/payments-dashboard
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/payments-dashboard.git synced 2026-09-30 07:43:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
payments-dashboard/template.yaml

474 lines
15 KiB
YAML
Raw Normal View History

Initial SAM stack: payments CSV to Slack App Home Two Lambda functions: - processPaymentCsv: S3 trigger, parses CSV, stores dashboard in DynamoDB - slackAppHome: API Gateway endpoint for Slack events, publishes Home tab view
2026-04-09 13:29:28 -04:00
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Payments Dashboard - S3 CSV ingestion to Slack App Home
Globals:
Function:
Fix Lambda compliance and rename SQS queue - Switch runtime to nodejs22.x and architecture to arm64 - Add explicit CloudWatch log groups with 60-day retention for all Lambdas - Rename SQS queue from payments-contractor-batch to payments-payroll-batch (now handles both employee and contractor batching) - Remove stale comment
2026-04-30 14:15:05 -04:00
Runtime: nodejs22.x
Architectures:
- arm64
Initial SAM stack: payments CSV to Slack App Home Two Lambda functions: - processPaymentCsv: S3 trigger, parses CSV, stores dashboard in DynamoDB - slackAppHome: API Gateway endpoint for Slack events, publishes Home tab view
2026-04-09 13:29:28 -04:00
Timeout: 30
MemorySize: 256
Environment:
Variables:
TABLE_NAME: !Ref DashboardTable
Add API access logging + throttling (audit Day 3: M-18) (#32) Implicit HTTP API: access logging to /aws/apigateway/payments-dashboard (90d) + default route throttling (100 rps / 50 burst) via Globals.HttpApi.
2026-06-02 17:36:59 -04:00
# Access logging + default throttling on the implicit HTTP API (audit M-18).
HttpApi:
AccessLogSettings:
DestinationArn: !GetAtt ApiAccessLogGroup.Arn
Format: '{"requestId":"$context.requestId","ip":"$context.identity.sourceIp","requestTime":"$context.requestTime","method":"$context.httpMethod","routeKey":"$context.routeKey","status":"$context.status","protocol":"$context.protocol","responseLength":"$context.responseLength","integrationError":"$context.integrationErrorMessage"}'
DefaultRouteSettings:
ThrottlingBurstLimit: 50
ThrottlingRateLimit: 100
Initial SAM stack: payments CSV to Slack App Home Two Lambda functions: - processPaymentCsv: S3 trigger, parses CSV, stores dashboard in DynamoDB - slackAppHome: API Gateway endpoint for Slack events, publishes Home tab view
2026-04-09 13:29:28 -04:00
Resources:
Add API access logging + throttling (audit Day 3: M-18) (#32) Implicit HTTP API: access logging to /aws/apigateway/payments-dashboard (90d) + default route throttling (100 rps / 50 burst) via Globals.HttpApi.
2026-06-02 17:36:59 -04:00
ApiAccessLogGroup:
Type: AWS::Logs::LogGroup
Properties:
LogGroupName: /aws/apigateway/payments-dashboard
RetentionInDays: 90
Add VPC/NAT for static IP, dedup payments by check number, SSM token - VPC with NAT Gateway for static outbound IP (52.86.95.107) for BoA API - Payments stored as individual DynamoDB items keyed by check number - Slack bot token fetched from SSM at runtime instead of CF parameter - Slack Lambda scans payment items instead of reading single blob
2026-04-09 14:27:34 -04:00
# VPC with private subnet + NAT Gateway for static outbound IP
Vpc:
Type: AWS::EC2::VPC
Properties:
CidrBlock: 10.20.0.0/16
EnableDnsSupport: true
EnableDnsHostnames: true
Tags:
- Key: Name
Value: payments-dashboard-vpc
PrivateSubnet:
Type: AWS::EC2::Subnet
Properties:
VpcId: !Ref Vpc
CidrBlock: 10.20.1.0/24
AvailabilityZone: !Select [0, !GetAZs ""]
Tags:
- Key: Name
Value: payments-dashboard-private
PublicSubnet:
Type: AWS::EC2::Subnet
Properties:
VpcId: !Ref Vpc
CidrBlock: 10.20.2.0/24
AvailabilityZone: !Select [0, !GetAZs ""]
Tags:
- Key: Name
Value: payments-dashboard-public
InternetGateway:
Type: AWS::EC2::InternetGateway
VpcGatewayAttachment:
Type: AWS::EC2::VPCGatewayAttachment
Properties:
VpcId: !Ref Vpc
InternetGatewayId: !Ref InternetGateway
NatEip:
Type: AWS::EC2::EIP
Properties:
Domain: vpc
NatGateway:
Type: AWS::EC2::NatGateway
Properties:
AllocationId: !GetAtt NatEip.AllocationId
SubnetId: !Ref PublicSubnet
PublicRouteTable:
Type: AWS::EC2::RouteTable
Properties:
VpcId: !Ref Vpc
PublicRoute:
Type: AWS::EC2::Route
DependsOn: VpcGatewayAttachment
Properties:
RouteTableId: !Ref PublicRouteTable
DestinationCidrBlock: 0.0.0.0/0
GatewayId: !Ref InternetGateway
PublicSubnetRouteTableAssociation:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
SubnetId: !Ref PublicSubnet
RouteTableId: !Ref PublicRouteTable
PrivateRouteTable:
Type: AWS::EC2::RouteTable
Properties:
VpcId: !Ref Vpc
PrivateRoute:
Type: AWS::EC2::Route
Properties:
RouteTableId: !Ref PrivateRouteTable
DestinationCidrBlock: 0.0.0.0/0
NatGatewayId: !Ref NatGateway
PrivateSubnetRouteTableAssociation:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
SubnetId: !Ref PrivateSubnet
RouteTableId: !Ref PrivateRouteTable
LambdaSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Payments Dashboard Lambda outbound access
VpcId: !Ref Vpc
SecurityGroupEgress:
- IpProtocol: "-1"
CidrIp: 0.0.0.0/0
Initial SAM stack: payments CSV to Slack App Home Two Lambda functions: - processPaymentCsv: S3 trigger, parses CSV, stores dashboard in DynamoDB - slackAppHome: API Gateway endpoint for Slack events, publishes Home tab view
2026-04-09 13:29:28 -04:00
PaymentsCsvBucket:
Type: AWS::S3::Bucket
Properties:
BucketName: !Sub seahaven-payments-csv-${AWS::AccountId}
DashboardTable:
Type: AWS::DynamoDB::Table
Properties:
TableName: PaymentsDashboard
BillingMode: PAY_PER_REQUEST
AttributeDefinitions:
- AttributeName: pk
AttributeType: S
KeySchema:
- AttributeName: pk
KeyType: HASH
Log BoA submissions to DDB and surface in Slack App Home Capture response headers, body, and transactionId on every check-issue API call; persist as boa_txn#<ts>#<action> records with 90-day TTL. Add "Recent BoA Submissions" section to App Home showing the last 10 with click-to-copy transactionId. Motivation: BoA support asked for a transactionId from a past successful call and we had no way to recover it from CloudWatch summary logs alone. Also adds simulate-csv.cjs (dry-run preview) and stampli-uploader.sh (launchd-invoked S3 uploader), and gitignores debug artifacts.
2026-04-20 17:40:55 -04:00
TimeToLiveSpecification:
AttributeName: ttl
Enabled: true
Initial SAM stack: payments CSV to Slack App Home Two Lambda functions: - processPaymentCsv: S3 trigger, parses CSV, stores dashboard in DynamoDB - slackAppHome: API Gateway endpoint for Slack events, publishes Home tab view
2026-04-09 13:29:28 -04:00
Replace Dataddo/Aurora payroll pipeline with email-triggered notifications SES receives Gusto payroll emails at payroll@int.seahaven.com, stores to S3, Lambda parses and posts a combined Slack notification (employee payroll + contractor payments in one message) after a 10-minute SQS batching window. Removes Aurora Serverless, notifyPayroll Lambda, and @aws-sdk/client-rds-data. Adds mailparser, SQS delay queue, and processPayrollEmail Lambda.
2026-04-30 14:04:48 -04:00
PayrollEmailBucket:
Type: AWS::S3::Bucket
Properties:
BucketName: !Sub seahaven-payroll-emails-${AWS::AccountId}
LifecycleConfiguration:
Rules:
- Id: ExpireEmails
Status: Enabled
ExpirationInDays: 30
PayrollEmailBucketPolicy:
Type: AWS::S3::BucketPolicy
Properties:
Bucket: !Ref PayrollEmailBucket
PolicyDocument:
Version: "2012-10-17"
Statement:
- Sid: AllowSESPut
Effect: Allow
Principal:
Service: ses.amazonaws.com
Action: s3:PutObject
Resource: !Sub arn:aws:s3:::seahaven-payroll-emails-${AWS::AccountId}/*
Condition:
StringEquals:
AWS:SourceAccount: !Ref AWS::AccountId
PayrollEmailRule:
Type: AWS::SES::ReceiptRule
DependsOn: PayrollEmailBucketPolicy
Properties:
RuleSetName: INBOUND_MAIL
After: ExistingRuleSetWorkorderEmailRuleEA29F845-okepxcVarTfu
Rule:
Name: store-payroll-emails
Enabled: true
ScanEnabled: true
Recipients:
- payroll@int.seahaven.com
Actions:
- S3Action:
BucketName: !Ref PayrollEmailBucket
ObjectKeyPrefix: inbound/
Fix Lambda compliance and rename SQS queue - Switch runtime to nodejs22.x and architecture to arm64 - Add explicit CloudWatch log groups with 60-day retention for all Lambdas - Rename SQS queue from payments-contractor-batch to payments-payroll-batch (now handles both employee and contractor batching) - Remove stale comment
2026-04-30 14:15:05 -04:00
PayrollBatchQueue:
Replace Dataddo/Aurora payroll pipeline with email-triggered notifications SES receives Gusto payroll emails at payroll@int.seahaven.com, stores to S3, Lambda parses and posts a combined Slack notification (employee payroll + contractor payments in one message) after a 10-minute SQS batching window. Removes Aurora Serverless, notifyPayroll Lambda, and @aws-sdk/client-rds-data. Adds mailparser, SQS delay queue, and processPayrollEmail Lambda.
2026-04-30 14:04:48 -04:00
Type: AWS::SQS::Queue
Properties:
Fix Lambda compliance and rename SQS queue - Switch runtime to nodejs22.x and architecture to arm64 - Add explicit CloudWatch log groups with 60-day retention for all Lambdas - Rename SQS queue from payments-contractor-batch to payments-payroll-batch (now handles both employee and contractor batching) - Remove stale comment
2026-04-30 14:15:05 -04:00
QueueName: payments-payroll-batch
Replace Dataddo/Aurora payroll pipeline with email-triggered notifications SES receives Gusto payroll emails at payroll@int.seahaven.com, stores to S3, Lambda parses and posts a combined Slack notification (employee payroll + contractor payments in one message) after a 10-minute SQS batching window. Removes Aurora Serverless, notifyPayroll Lambda, and @aws-sdk/client-rds-data. Adds mailparser, SQS delay queue, and processPayrollEmail Lambda.
2026-04-30 14:04:48 -04:00
DelaySeconds: 600
MessageRetentionPeriod: 86400
VisibilityTimeout: 60
Fix Lambda compliance and rename SQS queue - Switch runtime to nodejs22.x and architecture to arm64 - Add explicit CloudWatch log groups with 60-day retention for all Lambdas - Rename SQS queue from payments-contractor-batch to payments-payroll-batch (now handles both employee and contractor batching) - Remove stale comment
2026-04-30 14:15:05 -04:00
ProcessPayrollEmailLogGroup:
Type: AWS::Logs::LogGroup
Properties:
LogGroupName: /aws/lambda/payments-processPayrollEmail
RetentionInDays: 60
ProcessPaymentCsvLogGroup:
Type: AWS::Logs::LogGroup
Properties:
LogGroupName: /aws/lambda/payments-processPaymentCsv
RetentionInDays: 60
SlackAppHomeLogGroup:
Type: AWS::Logs::LogGroup
Properties:
LogGroupName: /aws/lambda/payments-slackAppHome
RetentionInDays: 60
FetchBoaTransactionsLogGroup:
Type: AWS::Logs::LogGroup
Properties:
LogGroupName: /aws/lambda/payments-fetchBoaTransactions
RetentionInDays: 60
Merge expense-approval-bot into payments-dashboard (#28) * Merge expense-approval-bot into payments-dashboard Port the Slack reaction-driven expense routing workflow (receiver + processor) from expense-approval-bot into this stack as JavaScript ESM. Secrets copied to payments-dashboard/ prefix in Secrets Manager. * Fix review findings from PR #28 - Add length check before timingSafeEqual to prevent RangeError on malformed signatures (returns 401 instead of 500) - Check event.type === reaction_added to prevent reaction_removed from advancing expenses - Move getPermalink call behind isOrigin check to skip unnecessary API call on non-origin stage transitions
2026-05-12 13:08:42 -04:00
ExpenseReceiverLogGroup:
Type: AWS::Logs::LogGroup
Properties:
LogGroupName: /aws/lambda/payments-expenseReceiver
RetentionInDays: 60
ExpenseProcessorLogGroup:
Type: AWS::Logs::LogGroup
Properties:
LogGroupName: /aws/lambda/payments-expenseProcessor
RetentionInDays: 60
Replace Dataddo/Aurora payroll pipeline with email-triggered notifications SES receives Gusto payroll emails at payroll@int.seahaven.com, stores to S3, Lambda parses and posts a combined Slack notification (employee payroll + contractor payments in one message) after a 10-minute SQS batching window. Removes Aurora Serverless, notifyPayroll Lambda, and @aws-sdk/client-rds-data. Adds mailparser, SQS delay queue, and processPayrollEmail Lambda.
2026-04-30 14:04:48 -04:00
ProcessPayrollEmailFunction:
Type: AWS::Serverless::Function
Properties:
FunctionName: payments-processPayrollEmail
Handler: src/processPayrollEmail.handler
Timeout: 60
Environment:
Variables:
SLACK_BOT_TOKEN_PARAM: /payments-dashboard/slack-bot-token
PAYROLL_CHANNEL_ID: C0AV5RBMYKU
Fix Lambda compliance and rename SQS queue - Switch runtime to nodejs22.x and architecture to arm64 - Add explicit CloudWatch log groups with 60-day retention for all Lambdas - Rename SQS queue from payments-contractor-batch to payments-payroll-batch (now handles both employee and contractor batching) - Remove stale comment
2026-04-30 14:15:05 -04:00
PAYROLL_BATCH_QUEUE_URL: !Ref PayrollBatchQueue
Replace Dataddo/Aurora payroll pipeline with email-triggered notifications SES receives Gusto payroll emails at payroll@int.seahaven.com, stores to S3, Lambda parses and posts a combined Slack notification (employee payroll + contractor payments in one message) after a 10-minute SQS batching window. Removes Aurora Serverless, notifyPayroll Lambda, and @aws-sdk/client-rds-data. Adds mailparser, SQS delay queue, and processPayrollEmail Lambda.
2026-04-30 14:04:48 -04:00
Events:
EmailReceived:
Type: S3
Properties:
Bucket: !Ref PayrollEmailBucket
Events: s3:ObjectCreated:*
Filter:
S3Key:
Rules:
- Name: prefix
Value: inbound/
Fix Lambda compliance and rename SQS queue - Switch runtime to nodejs22.x and architecture to arm64 - Add explicit CloudWatch log groups with 60-day retention for all Lambdas - Rename SQS queue from payments-contractor-batch to payments-payroll-batch (now handles both employee and contractor batching) - Remove stale comment
2026-04-30 14:15:05 -04:00
PayrollBatch:
Replace Dataddo/Aurora payroll pipeline with email-triggered notifications SES receives Gusto payroll emails at payroll@int.seahaven.com, stores to S3, Lambda parses and posts a combined Slack notification (employee payroll + contractor payments in one message) after a 10-minute SQS batching window. Removes Aurora Serverless, notifyPayroll Lambda, and @aws-sdk/client-rds-data. Adds mailparser, SQS delay queue, and processPayrollEmail Lambda.
2026-04-30 14:04:48 -04:00
Type: SQS
Properties:
Fix Lambda compliance and rename SQS queue - Switch runtime to nodejs22.x and architecture to arm64 - Add explicit CloudWatch log groups with 60-day retention for all Lambdas - Rename SQS queue from payments-contractor-batch to payments-payroll-batch (now handles both employee and contractor batching) - Remove stale comment
2026-04-30 14:15:05 -04:00
Queue: !GetAtt PayrollBatchQueue.Arn
Replace Dataddo/Aurora payroll pipeline with email-triggered notifications SES receives Gusto payroll emails at payroll@int.seahaven.com, stores to S3, Lambda parses and posts a combined Slack notification (employee payroll + contractor payments in one message) after a 10-minute SQS batching window. Removes Aurora Serverless, notifyPayroll Lambda, and @aws-sdk/client-rds-data. Adds mailparser, SQS delay queue, and processPayrollEmail Lambda.
2026-04-30 14:04:48 -04:00
BatchSize: 1
Policies:
- S3ReadPolicy:
BucketName: !Sub seahaven-payroll-emails-${AWS::AccountId}
- DynamoDBCrudPolicy:
TableName: !Ref DashboardTable
- SSMParameterReadPolicy:
ParameterName: payments-dashboard/slack-bot-token
- SQSSendMessagePolicy:
Fix Lambda compliance and rename SQS queue - Switch runtime to nodejs22.x and architecture to arm64 - Add explicit CloudWatch log groups with 60-day retention for all Lambdas - Rename SQS queue from payments-contractor-batch to payments-payroll-batch (now handles both employee and contractor batching) - Remove stale comment
2026-04-30 14:15:05 -04:00
QueueName: !GetAtt PayrollBatchQueue.QueueName
Replace Dataddo/Aurora payroll pipeline with email-triggered notifications SES receives Gusto payroll emails at payroll@int.seahaven.com, stores to S3, Lambda parses and posts a combined Slack notification (employee payroll + contractor payments in one message) after a 10-minute SQS batching window. Removes Aurora Serverless, notifyPayroll Lambda, and @aws-sdk/client-rds-data. Adds mailparser, SQS delay queue, and processPayrollEmail Lambda.
2026-04-30 14:04:48 -04:00
- SQSPollerPolicy:
Fix Lambda compliance and rename SQS queue - Switch runtime to nodejs22.x and architecture to arm64 - Add explicit CloudWatch log groups with 60-day retention for all Lambdas - Rename SQS queue from payments-contractor-batch to payments-payroll-batch (now handles both employee and contractor batching) - Remove stale comment
2026-04-30 14:15:05 -04:00
QueueName: !GetAtt PayrollBatchQueue.QueueName
Replace Dataddo/Aurora payroll pipeline with email-triggered notifications SES receives Gusto payroll emails at payroll@int.seahaven.com, stores to S3, Lambda parses and posts a combined Slack notification (employee payroll + contractor payments in one message) after a 10-minute SQS batching window. Removes Aurora Serverless, notifyPayroll Lambda, and @aws-sdk/client-rds-data. Adds mailparser, SQS delay queue, and processPayrollEmail Lambda.
2026-04-30 14:04:48 -04:00
Initial SAM stack: payments CSV to Slack App Home Two Lambda functions: - processPaymentCsv: S3 trigger, parses CSV, stores dashboard in DynamoDB - slackAppHome: API Gateway endpoint for Slack events, publishes Home tab view
2026-04-09 13:29:28 -04:00
ProcessPaymentCsvFunction:
Type: AWS::Serverless::Function
Properties:
FunctionName: payments-processPaymentCsv
Handler: src/processPaymentCsv.handler
Add CashPro check issue/cancel on CSV upload - CSV processor detects new checks and submits add_issue to CashPro - Checks updated to voided/cancelled trigger cancel_issue to CashPro - Added SSM params for boa-api-token, boa-account-number, boa-company-id to both processPaymentCsv and fetchBoaTransactions Lambdas - Increased CSV processor timeout to 120s for API calls
2026-04-09 15:14:51 -04:00
Timeout: 120
Environment:
Variables:
Update integration code with correct BoA CashPro API specs and add README - Add OAuth client-credentials token exchange to both Lambda handlers - Fix sandbox/prod base URL (api-sb.bofa.com / api.bofa.com) - Fix issueAction casing to add_Issue / cancel_Issue per API docs - Fix transaction inquiry response parsing (accountTransactions array) - Move all BoA config (app IDs, bank ID) from env vars to SSM params - Update template.yaml with correct SSM param names and policies - Add project README with architecture, API details, and SSM param reference
2026-04-13 16:24:20 -04:00
BOA_BASE_URL: https://api.bofa.com
BOA_CHECK_MGMT_APP_ID_PARAM: /payments-dashboard/boa-check-mgmt-app-id
BOA_CHECK_MGMT_CLIENT_ID_PARAM: /payments-dashboard/boa-check-mgmt-client-id
BOA_CHECK_MGMT_SECRET_PARAM: /payments-dashboard/boa-check-mgmt-token
Add CashPro check issue/cancel on CSV upload - CSV processor detects new checks and submits add_issue to CashPro - Checks updated to voided/cancelled trigger cancel_issue to CashPro - Added SSM params for boa-api-token, boa-account-number, boa-company-id to both processPaymentCsv and fetchBoaTransactions Lambdas - Increased CSV processor timeout to 120s for API calls
2026-04-09 15:14:51 -04:00
BOA_ACCOUNT_NUMBER_PARAM: /payments-dashboard/boa-account-number
BOA_COMPANY_ID_PARAM: /payments-dashboard/boa-company-id
Add VPC/NAT for static IP, dedup payments by check number, SSM token - VPC with NAT Gateway for static outbound IP (52.86.95.107) for BoA API - Payments stored as individual DynamoDB items keyed by check number - Slack bot token fetched from SSM at runtime instead of CF parameter - Slack Lambda scans payment items instead of reading single blob
2026-04-09 14:27:34 -04:00
VpcConfig:
SubnetIds:
- !Ref PrivateSubnet
SecurityGroupIds:
- !Ref LambdaSecurityGroup
Initial SAM stack: payments CSV to Slack App Home Two Lambda functions: - processPaymentCsv: S3 trigger, parses CSV, stores dashboard in DynamoDB - slackAppHome: API Gateway endpoint for Slack events, publishes Home tab view
2026-04-09 13:29:28 -04:00
Events:
CsvUpload:
Type: S3
Properties:
Bucket: !Ref PaymentsCsvBucket
Events: s3:ObjectCreated:*
Filter:
S3Key:
Rules:
- Name: suffix
Value: .csv
Policies:
- S3ReadPolicy:
BucketName: !Sub seahaven-payments-csv-${AWS::AccountId}
- DynamoDBCrudPolicy:
TableName: !Ref DashboardTable
Add CashPro check issue/cancel on CSV upload - CSV processor detects new checks and submits add_issue to CashPro - Checks updated to voided/cancelled trigger cancel_issue to CashPro - Added SSM params for boa-api-token, boa-account-number, boa-company-id to both processPaymentCsv and fetchBoaTransactions Lambdas - Increased CSV processor timeout to 120s for API calls
2026-04-09 15:14:51 -04:00
- SSMParameterReadPolicy:
Update integration code with correct BoA CashPro API specs and add README - Add OAuth client-credentials token exchange to both Lambda handlers - Fix sandbox/prod base URL (api-sb.bofa.com / api.bofa.com) - Fix issueAction casing to add_Issue / cancel_Issue per API docs - Fix transaction inquiry response parsing (accountTransactions array) - Move all BoA config (app IDs, bank ID) from env vars to SSM params - Update template.yaml with correct SSM param names and policies - Add project README with architecture, API details, and SSM param reference
2026-04-13 16:24:20 -04:00
ParameterName: payments-dashboard/boa-check-mgmt-app-id
- SSMParameterReadPolicy:
ParameterName: payments-dashboard/boa-check-mgmt-client-id
- SSMParameterReadPolicy:
ParameterName: payments-dashboard/boa-check-mgmt-token
Add CashPro check issue/cancel on CSV upload - CSV processor detects new checks and submits add_issue to CashPro - Checks updated to voided/cancelled trigger cancel_issue to CashPro - Added SSM params for boa-api-token, boa-account-number, boa-company-id to both processPaymentCsv and fetchBoaTransactions Lambdas - Increased CSV processor timeout to 120s for API calls
2026-04-09 15:14:51 -04:00
- SSMParameterReadPolicy:
ParameterName: payments-dashboard/boa-account-number
- SSMParameterReadPolicy:
ParameterName: payments-dashboard/boa-company-id
Add VPC/NAT for static IP, dedup payments by check number, SSM token - VPC with NAT Gateway for static outbound IP (52.86.95.107) for BoA API - Payments stored as individual DynamoDB items keyed by check number - Slack bot token fetched from SSM at runtime instead of CF parameter - Slack Lambda scans payment items instead of reading single blob
2026-04-09 14:27:34 -04:00
- Version: "2012-10-17"
Statement:
- Effect: Allow
Action:
- ec2:CreateNetworkInterface
- ec2:DescribeNetworkInterfaces
- ec2:DeleteNetworkInterface
Resource: "*"
Initial SAM stack: payments CSV to Slack App Home Two Lambda functions: - processPaymentCsv: S3 trigger, parses CSV, stores dashboard in DynamoDB - slackAppHome: API Gateway endpoint for Slack events, publishes Home tab view
2026-04-09 13:29:28 -04:00
SlackAppHomeFunction:
Type: AWS::Serverless::Function
Properties:
FunctionName: payments-slackAppHome
Handler: src/slackAppHome.handler
Add VPC/NAT for static IP, dedup payments by check number, SSM token - VPC with NAT Gateway for static outbound IP (52.86.95.107) for BoA API - Payments stored as individual DynamoDB items keyed by check number - Slack bot token fetched from SSM at runtime instead of CF parameter - Slack Lambda scans payment items instead of reading single blob
2026-04-09 14:27:34 -04:00
VpcConfig:
SubnetIds:
- !Ref PrivateSubnet
SecurityGroupIds:
- !Ref LambdaSecurityGroup
Initial SAM stack: payments CSV to Slack App Home Two Lambda functions: - processPaymentCsv: S3 trigger, parses CSV, stores dashboard in DynamoDB - slackAppHome: API Gateway endpoint for Slack events, publishes Home tab view
2026-04-09 13:29:28 -04:00
Environment:
Variables:
Add VPC/NAT for static IP, dedup payments by check number, SSM token - VPC with NAT Gateway for static outbound IP (52.86.95.107) for BoA API - Payments stored as individual DynamoDB items keyed by check number - Slack bot token fetched from SSM at runtime instead of CF parameter - Slack Lambda scans payment items instead of reading single blob
2026-04-09 14:27:34 -04:00
SLACK_BOT_TOKEN_PARAM: /payments-dashboard/slack-bot-token
Initial SAM stack: payments CSV to Slack App Home Two Lambda functions: - processPaymentCsv: S3 trigger, parses CSV, stores dashboard in DynamoDB - slackAppHome: API Gateway endpoint for Slack events, publishes Home tab view
2026-04-09 13:29:28 -04:00
Events:
SlackEvent:
Type: HttpApi
Properties:
Path: /slack/events
Method: POST
Policies:
- DynamoDBReadPolicy:
TableName: !Ref DashboardTable
Add VPC/NAT for static IP, dedup payments by check number, SSM token - VPC with NAT Gateway for static outbound IP (52.86.95.107) for BoA API - Payments stored as individual DynamoDB items keyed by check number - Slack bot token fetched from SSM at runtime instead of CF parameter - Slack Lambda scans payment items instead of reading single blob
2026-04-09 14:27:34 -04:00
- SSMParameterReadPolicy:
ParameterName: payments-dashboard/slack-bot-token
- Version: "2012-10-17"
Statement:
- Effect: Allow
Action:
- ec2:CreateNetworkInterface
- ec2:DescribeNetworkInterfaces
- ec2:DeleteNetworkInterface
Resource: "*"
Initial SAM stack: payments CSV to Slack App Home Two Lambda functions: - processPaymentCsv: S3 trigger, parses CSV, stores dashboard in DynamoDB - slackAppHome: API Gateway endpoint for Slack events, publishes Home tab view
2026-04-09 13:29:28 -04:00
Add BoA CashPro integration and payment status tracking - New fetchBoaTransactions Lambda: daily 9am ET schedule (disabled until API key set) Calls CashPro Previous Day Transaction Inquiry, filters for codes 255/475, matches bankReference to check_number, updates clear_status in DynamoDB - CSV processor switched to UpdateCommand to preserve clearing data on re-upload - Slack dashboard now shows Scheduled, Outstanding, Cleared, and Returned sections - ACH payments auto-assumed cleared once past due date
2026-04-09 14:59:39 -04:00
FetchBoaTransactionsFunction:
Type: AWS::Serverless::Function
Properties:
FunctionName: payments-fetchBoaTransactions
Handler: src/fetchBoaTransactions.handler
Timeout: 60
VpcConfig:
SubnetIds:
- !Ref PrivateSubnet
SecurityGroupIds:
- !Ref LambdaSecurityGroup
Environment:
Variables:
Update integration code with correct BoA CashPro API specs and add README - Add OAuth client-credentials token exchange to both Lambda handlers - Fix sandbox/prod base URL (api-sb.bofa.com / api.bofa.com) - Fix issueAction casing to add_Issue / cancel_Issue per API docs - Fix transaction inquiry response parsing (accountTransactions array) - Move all BoA config (app IDs, bank ID) from env vars to SSM params - Update template.yaml with correct SSM param names and policies - Add project README with architecture, API details, and SSM param reference
2026-04-13 16:24:20 -04:00
BOA_BASE_URL: https://api.bofa.com
BOA_REPORTING_APP_ID_PARAM: /payments-dashboard/boa-reporting-app-id
BOA_REPORTING_CLIENT_ID_PARAM: /payments-dashboard/boa-account-info-client-id
BOA_REPORTING_SECRET_PARAM: /payments-dashboard/boa-account-info-token
Add BoA CashPro integration and payment status tracking - New fetchBoaTransactions Lambda: daily 9am ET schedule (disabled until API key set) Calls CashPro Previous Day Transaction Inquiry, filters for codes 255/475, matches bankReference to check_number, updates clear_status in DynamoDB - CSV processor switched to UpdateCommand to preserve clearing data on re-upload - Slack dashboard now shows Scheduled, Outstanding, Cleared, and Returned sections - ACH payments auto-assumed cleared once past due date
2026-04-09 14:59:39 -04:00
BOA_ACCOUNT_NUMBER_PARAM: /payments-dashboard/boa-account-number
Update integration code with correct BoA CashPro API specs and add README - Add OAuth client-credentials token exchange to both Lambda handlers - Fix sandbox/prod base URL (api-sb.bofa.com / api.bofa.com) - Fix issueAction casing to add_Issue / cancel_Issue per API docs - Fix transaction inquiry response parsing (accountTransactions array) - Move all BoA config (app IDs, bank ID) from env vars to SSM params - Update template.yaml with correct SSM param names and policies - Add project README with architecture, API details, and SSM param reference
2026-04-13 16:24:20 -04:00
BOA_BANK_ID_PARAM: /payments-dashboard/boa-bank-id
Add BoA CashPro integration and payment status tracking - New fetchBoaTransactions Lambda: daily 9am ET schedule (disabled until API key set) Calls CashPro Previous Day Transaction Inquiry, filters for codes 255/475, matches bankReference to check_number, updates clear_status in DynamoDB - CSV processor switched to UpdateCommand to preserve clearing data on re-upload - Slack dashboard now shows Scheduled, Outstanding, Cleared, and Returned sections - ACH payments auto-assumed cleared once past due date
2026-04-09 14:59:39 -04:00
Events:
DailySchedule:
Type: Schedule
Properties:
Schedule: cron(0 13 ? * MON-FRI *)
Description: Fetch BoA previous day transactions at 9am ET (13:00 UTC)
Fix BoA transaction matching, add status progression protection, enable daily schedule - Fix transaction code mapping (475=Cleared, 255=Returned) in fetchBoaTransactions - Match on customerReference instead of bankReference for check number matching - Add bank-confirmed protection: CSV cannot override status once bank confirms Cleared - Add status progression guard: CSV cannot regress status backward in lifecycle - Cleared status is permanent — cannot be voided, cancelled, or changed - Enable daily fetchBoaTransactions schedule (9am ET weekdays) - Add production test script and dry run simulation script
2026-04-14 17:43:13 -04:00
Enabled: true
Add BoA CashPro integration and payment status tracking - New fetchBoaTransactions Lambda: daily 9am ET schedule (disabled until API key set) Calls CashPro Previous Day Transaction Inquiry, filters for codes 255/475, matches bankReference to check_number, updates clear_status in DynamoDB - CSV processor switched to UpdateCommand to preserve clearing data on re-upload - Slack dashboard now shows Scheduled, Outstanding, Cleared, and Returned sections - ACH payments auto-assumed cleared once past due date
2026-04-09 14:59:39 -04:00
Policies:
- DynamoDBCrudPolicy:
TableName: !Ref DashboardTable
- SSMParameterReadPolicy:
Update integration code with correct BoA CashPro API specs and add README - Add OAuth client-credentials token exchange to both Lambda handlers - Fix sandbox/prod base URL (api-sb.bofa.com / api.bofa.com) - Fix issueAction casing to add_Issue / cancel_Issue per API docs - Fix transaction inquiry response parsing (accountTransactions array) - Move all BoA config (app IDs, bank ID) from env vars to SSM params - Update template.yaml with correct SSM param names and policies - Add project README with architecture, API details, and SSM param reference
2026-04-13 16:24:20 -04:00
ParameterName: payments-dashboard/boa-reporting-app-id
- SSMParameterReadPolicy:
ParameterName: payments-dashboard/boa-account-info-client-id
- SSMParameterReadPolicy:
ParameterName: payments-dashboard/boa-account-info-token
Add BoA CashPro integration and payment status tracking - New fetchBoaTransactions Lambda: daily 9am ET schedule (disabled until API key set) Calls CashPro Previous Day Transaction Inquiry, filters for codes 255/475, matches bankReference to check_number, updates clear_status in DynamoDB - CSV processor switched to UpdateCommand to preserve clearing data on re-upload - Slack dashboard now shows Scheduled, Outstanding, Cleared, and Returned sections - ACH payments auto-assumed cleared once past due date
2026-04-09 14:59:39 -04:00
- SSMParameterReadPolicy:
ParameterName: payments-dashboard/boa-account-number
Add CashPro check issue/cancel on CSV upload - CSV processor detects new checks and submits add_issue to CashPro - Checks updated to voided/cancelled trigger cancel_issue to CashPro - Added SSM params for boa-api-token, boa-account-number, boa-company-id to both processPaymentCsv and fetchBoaTransactions Lambdas - Increased CSV processor timeout to 120s for API calls
2026-04-09 15:14:51 -04:00
- SSMParameterReadPolicy:
Update integration code with correct BoA CashPro API specs and add README - Add OAuth client-credentials token exchange to both Lambda handlers - Fix sandbox/prod base URL (api-sb.bofa.com / api.bofa.com) - Fix issueAction casing to add_Issue / cancel_Issue per API docs - Fix transaction inquiry response parsing (accountTransactions array) - Move all BoA config (app IDs, bank ID) from env vars to SSM params - Update template.yaml with correct SSM param names and policies - Add project README with architecture, API details, and SSM param reference
2026-04-13 16:24:20 -04:00
ParameterName: payments-dashboard/boa-bank-id
Add BoA CashPro integration and payment status tracking - New fetchBoaTransactions Lambda: daily 9am ET schedule (disabled until API key set) Calls CashPro Previous Day Transaction Inquiry, filters for codes 255/475, matches bankReference to check_number, updates clear_status in DynamoDB - CSV processor switched to UpdateCommand to preserve clearing data on re-upload - Slack dashboard now shows Scheduled, Outstanding, Cleared, and Returned sections - ACH payments auto-assumed cleared once past due date
2026-04-09 14:59:39 -04:00
- Version: "2012-10-17"
Statement:
- Effect: Allow
Action:
- ec2:CreateNetworkInterface
- ec2:DescribeNetworkInterfaces
- ec2:DeleteNetworkInterface
Resource: "*"
Merge expense-approval-bot into payments-dashboard (#28) * Merge expense-approval-bot into payments-dashboard Port the Slack reaction-driven expense routing workflow (receiver + processor) from expense-approval-bot into this stack as JavaScript ESM. Secrets copied to payments-dashboard/ prefix in Secrets Manager. * Fix review findings from PR #28 - Add length check before timingSafeEqual to prevent RangeError on malformed signatures (returns 401 instead of 500) - Check event.type === reaction_added to prevent reaction_removed from advancing expenses - Move getPermalink call behind isOrigin check to skip unnecessary API call on non-origin stage transitions
2026-05-12 13:08:42 -04:00
ExpenseProcessorFunction:
Type: AWS::Serverless::Function
Properties:
FunctionName: payments-expenseProcessor
Handler: src/expenseProcessor.handler
Timeout: 15
Environment:
Variables:
EXPENSE_BOT_TOKEN_SECRET_NAME: payments-dashboard/expense-slack-token
Policies:
- Version: "2012-10-17"
Statement:
- Effect: Allow
Action: secretsmanager:GetSecretValue
Resource: !Sub arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:payments-dashboard/expense-slack-token-*
ExpenseReceiverFunction:
Type: AWS::Serverless::Function
Properties:
FunctionName: payments-expenseReceiver
Handler: src/expenseReceiver.handler
Timeout: 5
Environment:
Variables:
EXPENSE_PROCESSOR_FN: !Ref ExpenseProcessorFunction
EXPENSE_SIGNING_SECRET_NAME: payments-dashboard/expense-slack-signing-secret
Events:
ExpenseSlackEvent:
Type: HttpApi
Properties:
Path: /slack/expense-events
Method: POST
Policies:
- Version: "2012-10-17"
Statement:
- Effect: Allow
Action: lambda:InvokeFunction
Resource: !GetAtt ExpenseProcessorFunction.Arn
- Effect: Allow
Action: secretsmanager:GetSecretValue
Resource: !Sub arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:payments-dashboard/expense-slack-signing-secret-*
Initial SAM stack: payments CSV to Slack App Home Two Lambda functions: - processPaymentCsv: S3 trigger, parses CSV, stores dashboard in DynamoDB - slackAppHome: API Gateway endpoint for Slack events, publishes Home tab view
2026-04-09 13:29:28 -04:00
Outputs:
SlackEventUrl:
Description: URL to set as the Slack app Request URL
Value: !Sub https://${ServerlessHttpApi}.execute-api.${AWS::Region}.amazonaws.com/slack/events
CsvBucket:
Description: S3 bucket for CSV uploads
Value: !Ref PaymentsCsvBucket
Add VPC/NAT for static IP, dedup payments by check number, SSM token - VPC with NAT Gateway for static outbound IP (52.86.95.107) for BoA API - Payments stored as individual DynamoDB items keyed by check number - Slack bot token fetched from SSM at runtime instead of CF parameter - Slack Lambda scans payment items instead of reading single blob
2026-04-09 14:27:34 -04:00
StaticOutboundIp:
Description: Static IP for BoA API whitelist
Value: !Ref NatEip
Replace Dataddo/Aurora payroll pipeline with email-triggered notifications SES receives Gusto payroll emails at payroll@int.seahaven.com, stores to S3, Lambda parses and posts a combined Slack notification (employee payroll + contractor payments in one message) after a 10-minute SQS batching window. Removes Aurora Serverless, notifyPayroll Lambda, and @aws-sdk/client-rds-data. Adds mailparser, SQS delay queue, and processPayrollEmail Lambda.
2026-04-30 14:04:48 -04:00
PayrollEmailBucket:
Description: S3 bucket for inbound payroll emails from SES
Value: !Ref PayrollEmailBucket
Merge expense-approval-bot into payments-dashboard (#28) * Merge expense-approval-bot into payments-dashboard Port the Slack reaction-driven expense routing workflow (receiver + processor) from expense-approval-bot into this stack as JavaScript ESM. Secrets copied to payments-dashboard/ prefix in Secrets Manager. * Fix review findings from PR #28 - Add length check before timingSafeEqual to prevent RangeError on malformed signatures (returns 401 instead of 500) - Check event.type === reaction_added to prevent reaction_removed from advancing expenses - Move getPermalink call behind isOrigin check to skip unnecessary API call on non-origin stage transitions
2026-05-12 13:08:42 -04:00
ExpenseSlackEventsUrl:
Description: URL for Expense Approval Bot Slack Event Subscriptions
Value: !Sub https://${ServerlessHttpApi}.execute-api.${AWS::Region}.amazonaws.com/slack/expense-events
ExpenseProcessorFunctionArn:
Description: Expense Processor Lambda ARN
Value: !GetAtt ExpenseProcessorFunction.Arn
ExpenseReceiverFunctionArn:
Description: Expense Receiver Lambda ARN
Value: !GetAtt ExpenseReceiverFunction.Arn
Reference in a new issue Copy permalink