payments-dashboard/SETUP.md

Payments Dashboard — Setup Guide

Two workspaces, one configuration, selected by HCP variable environment:

Workspace	Project	Account	environment	boa_base_url
payments-dashboard-prod	seahaven-prod	011934824531	prod	https://api.bofa.com
payments-dashboard-dev	seahaven-dev	710827005802	dev	https://api-sb.bofa.com

Both carry tag app:payments-dashboard. schedules_enabled stays false until cutover.

1. Secrets

Six Secrets Manager names exist in each account. Terraform pins the exact ARNs in terraform/locals.tf. Values stay out of state. Dev shells are not copies of the prod secrets.

Name	Used by
payments-dashboard/slack-bot-token	slackAppHome
payments-dashboard/slack-signing-secret	slackAppHome
payments-dashboard/boa-check-mgmt	processPaymentCsv
payments-dashboard/boa-reporting	fetchBoaTransactions
payments-dashboard/expense-slack-token	expenseProcessor
payments-dashboard/expense-slack-signing-secret	expenseReceiver

2. HCP Terraform and GitHub Environments

Prod already applied. A new workspace (dev) uses one bootstrap window:

1. Tag the workspace app:payments-dashboard. Working directory terraform. VCS on main. Trigger prefix terraform/**. Speculative plans on. Set environment, schedules_enabled=false, and boa_base_url. No project-level variable set.
2. From seahaven-org-baseline: scripts/create-hcptf-bootstrap-roles.sh --account <dev|prod> --allow-workspace payments-dashboard-<env>
3. Point that workspace's TFC_AWS_APPLY_ROLE_ARN / TFC_AWS_PLAN_ROLE_ARN at hcptf-bootstrap / hcptf-bootstrap-plan. Set TFC_AWS_PROVIDER_AUTH=true.
4. One manual apply. This creates the scoped hcptf-* roles, the Lambda boundary, VPC/NAT, and the rest of the stack.
5. Retarget TFC_AWS_* to hcptf-payments-dashboard / hcptf-payments-dashboard-plan. Re-run the create script with no --allow-workspace.

GitHub Environment dev: no reviewers. DEPLOY_ROLE_ARN is the dev github_deploy_role_arn. Environment prod: reviewers, branch policy main and v*, prod github_deploy_role_arn.

Function zips: push to main deploys dev. A human gh release create vX.Y.Z --target main deploys prod (ship-gate on). workflow_dispatch takes environment and ref. The caller is .github/workflows/deploy.yaml. It calls org reusable cd-hcp-lambda.yaml. Keep schedules_enabled=false until Slack Request URLs and the Stampli uploader point at the prod stack.

HCP outputs to copy: slack_request_url, expense_slack_events_url, csv_bucket_name, static_outbound_ip, github_deploy_role_arn.

3. Bank of America IP whitelist

Submit static_outbound_ip to CashPro before any real Check Management or Reporting call. The NAT EIP is new in seahaven-prod; mgmt 52.86.95.107 stays until cutover.

4. Prod cutover (PLAT-79)

Avoid weekday 9am ET and the 16:00/19:00/22:00 UTC intraday slots.

1. Merge this repo's PR (SAM CD is gone). First HCP apply is the bootstrap window above with schedules_enabled=false.
2. Copy DynamoDB PaymentsDashboard mgmt → prod. Verify item counts for payment#, boa_recon#, and boa_balance#. Do not copy seahaven-payments-boa-raw-*.
3. Prod zip update is a human release, or workflow_dispatch with environment=prod, after the HCP apply. Re-run if the job raced apply.
4. Instant cut: Slack App Home and Expense bot Request URLs → prod; Stampli uploader bucket → seahaven-payments-csv-011934824531; schedules_enabled=true via a terraform-only merge; disable mgmt EventBridge.
5. After soak, delete mgmt stack payments-dashboard. Expect VPC ENI drain. Leave mgmt raw bucket as Retain cold archive. Sweep mgmt secrets last. Leave orphan githubdeploy-payments-dashboard.