mirror of
https://github.com/Sea-Haven-Industries/payments-dashboard.git
synced 2026-09-30 03:03:13 +00:00
30a1737345
* feat(ci): deploy Lambda zips through the org reusable (PLAT-79) * fix(iam): trust only this account's deploy environment (PLAT-79)
109 lines
5.6 KiB
HCL
109 lines
5.6 KiB
HCL
locals {
|
|
project = "payments-dashboard"
|
|
is_prod = var.environment == "prod"
|
|
account_id = local.is_prod ? "011934824531" : "710827005802"
|
|
environment = var.environment
|
|
|
|
hcp_project = "seahaven-${var.environment}"
|
|
hcp_workspace = "${local.project}-${var.environment}"
|
|
apply_role = "hcptf-payments-dashboard"
|
|
plan_role = "hcptf-payments-dashboard-plan"
|
|
deploy_role = "githubdeploy-payments-dashboard"
|
|
stack_name = local.project
|
|
stack_prefix = "payments-dashboard-"
|
|
|
|
artifacts_bucket_name = "payments-dashboard-artifacts-${local.account_id}"
|
|
csv_bucket_name = "seahaven-payments-csv-${local.account_id}"
|
|
boa_raw_bucket_name = "seahaven-payments-boa-raw-${local.account_id}"
|
|
ssm_prefix = "/payments-dashboard"
|
|
table_name = "PaymentsDashboard"
|
|
site_alerts_arn = "arn:aws:sns:${var.aws_region}:${local.account_id}:site-alerts"
|
|
dynamodb_cmk_ssm = "/seahaven/dynamodb/cmk-arn"
|
|
|
|
github_oidc_provider_arn = "arn:aws:iam::${local.account_id}:oidc-provider/token.actions.githubusercontent.com"
|
|
# Repo OIDC subject customization is the default (use_default=true), so tokens
|
|
# use the classic repo:owner/name:environment:<env> form. Each account's role
|
|
# trusts only its own Environment. The prod role must not trust dev.
|
|
github_oidc_subs_prod = [
|
|
"repo:${var.github_repo}:environment:prod",
|
|
]
|
|
github_oidc_subs_dev = [
|
|
"repo:${var.github_repo}:environment:dev",
|
|
]
|
|
github_oidc_subs = local.is_prod ? local.github_oidc_subs_prod : local.github_oidc_subs_dev
|
|
# Matches the SHA pin in .github/workflows/deploy.yaml. A reusable bump
|
|
# updates both together. StringEquals, not @*.
|
|
github_deploy_workflow_ref = "Sea-Haven-Industries/.github/.github/workflows/cd-hcp-lambda.yaml@ee5b843ca105422b679c3fdeb9eaa68c6e500a85"
|
|
|
|
dynamodb_cmk_arns = {
|
|
prod = "arn:aws:kms:us-east-1:011934824531:key/be5fa4cb-c546-40fe-a13d-c7bec79f5d12"
|
|
dev = "arn:aws:kms:us-east-1:710827005802:key/600997e6-418e-4b7f-9d63-cd42a7505a95"
|
|
}
|
|
dynamodb_cmk_arn = local.dynamodb_cmk_arns[var.environment]
|
|
|
|
# Exact ARNs (ticket rule). Hardcoded so the first plan can run as
|
|
# hcptf-bootstrap-plan, which cannot ssm:GetParameter / DescribeSecret.
|
|
# Dev values are shells created for this workspace. They are not prod secrets.
|
|
secret_arns_by_env = {
|
|
prod = {
|
|
"payments-dashboard/slack-bot-token" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/slack-bot-token-0pAM3S"
|
|
"payments-dashboard/slack-signing-secret" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/slack-signing-secret-u0T6h8"
|
|
"payments-dashboard/boa-check-mgmt" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/boa-check-mgmt-LEbC65"
|
|
"payments-dashboard/boa-reporting" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/boa-reporting-JoR9lq"
|
|
"payments-dashboard/expense-slack-token" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/expense-slack-token-SeMg3s"
|
|
"payments-dashboard/expense-slack-signing-secret" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/expense-slack-signing-secret-lbb78J"
|
|
}
|
|
dev = {
|
|
"payments-dashboard/slack-bot-token" = "arn:aws:secretsmanager:us-east-1:710827005802:secret:payments-dashboard/slack-bot-token-KhPaLp"
|
|
"payments-dashboard/slack-signing-secret" = "arn:aws:secretsmanager:us-east-1:710827005802:secret:payments-dashboard/slack-signing-secret-CDxsUK"
|
|
"payments-dashboard/boa-check-mgmt" = "arn:aws:secretsmanager:us-east-1:710827005802:secret:payments-dashboard/boa-check-mgmt-kkEnCw"
|
|
"payments-dashboard/boa-reporting" = "arn:aws:secretsmanager:us-east-1:710827005802:secret:payments-dashboard/boa-reporting-uMHHVo"
|
|
"payments-dashboard/expense-slack-token" = "arn:aws:secretsmanager:us-east-1:710827005802:secret:payments-dashboard/expense-slack-token-05OZg3"
|
|
"payments-dashboard/expense-slack-signing-secret" = "arn:aws:secretsmanager:us-east-1:710827005802:secret:payments-dashboard/expense-slack-signing-secret-DQAoXS"
|
|
}
|
|
}
|
|
secret_arns = local.secret_arns_by_env[var.environment]
|
|
|
|
functions = {
|
|
process_csv = {
|
|
function_name = "payments-processPaymentCsv"
|
|
role_name = "payments-dashboard-process-csv"
|
|
handler = "src/processPaymentCsv.handler"
|
|
timeout = 120
|
|
duration_ms = 96000
|
|
vpc = true
|
|
}
|
|
slack_app_home = {
|
|
function_name = "payments-slackAppHome"
|
|
role_name = "payments-dashboard-slack-app-home"
|
|
handler = "src/slackAppHome.handler"
|
|
timeout = 30
|
|
duration_ms = 24000
|
|
vpc = true
|
|
}
|
|
fetch_boa = {
|
|
function_name = "payments-fetchBoaTransactions"
|
|
role_name = "payments-dashboard-fetch-boa"
|
|
handler = "src/fetchBoaTransactions.handler"
|
|
timeout = 60
|
|
duration_ms = 48000
|
|
vpc = true
|
|
}
|
|
expense_receiver = {
|
|
function_name = "payments-expenseReceiver"
|
|
role_name = "payments-dashboard-expense-receiver"
|
|
handler = "src/expenseReceiver.handler"
|
|
timeout = 5
|
|
duration_ms = 4000
|
|
vpc = false
|
|
}
|
|
expense_processor = {
|
|
function_name = "payments-expenseProcessor"
|
|
role_name = "payments-dashboard-expense-processor"
|
|
handler = "src/expenseProcessor.handler"
|
|
timeout = 15
|
|
duration_ms = 12000
|
|
vpc = false
|
|
}
|
|
}
|
|
}
|