mirror of
https://github.com/Sea-Haven-Industries/payments-dashboard.git
synced 2026-10-07 12:49:02 +00:00
15ddb7dc74
* ci: pin ci-terraform to v1.0.26 That release classifies a pull request against the merge parent, so a re-run after main moves is not treated as a mixed app and Terraform change. * fix(iam): trust the Lambda reusable at any pin A digest in the deploy role meant every reusable bump had to edit Terraform before dev and prod could assume the role.
106 lines
5.5 KiB
HCL
106 lines
5.5 KiB
HCL
locals {
|
|
project = "payments-dashboard"
|
|
is_prod = var.environment == "prod"
|
|
account_id = local.is_prod ? "011934824531" : "710827005802"
|
|
environment = var.environment
|
|
|
|
hcp_project = "seahaven-${var.environment}"
|
|
hcp_workspace = "${local.project}-${var.environment}"
|
|
deploy_role = "githubdeploy-payments-dashboard"
|
|
# Owned by org-baseline stack seahaven-hcptf. This configuration only references it.
|
|
lambda_boundary_arn = "arn:aws:iam::${local.account_id}:policy/tf-managed/payments-dashboard-lambda-boundary"
|
|
|
|
artifacts_bucket_name = "payments-dashboard-artifacts-${local.account_id}"
|
|
csv_bucket_name = "seahaven-payments-csv-${local.account_id}"
|
|
boa_raw_bucket_name = "seahaven-payments-boa-raw-${local.account_id}"
|
|
ssm_prefix = "/payments-dashboard"
|
|
table_name = "PaymentsDashboard"
|
|
site_alerts_arn = "arn:aws:sns:${var.aws_region}:${local.account_id}:site-alerts"
|
|
dynamodb_cmk_ssm = "/seahaven/dynamodb/cmk-arn"
|
|
|
|
github_oidc_provider_arn = "arn:aws:iam::${local.account_id}:oidc-provider/token.actions.githubusercontent.com"
|
|
# Repo OIDC subject customization is the default (use_default=true), so tokens
|
|
# use the classic repo:owner/name:environment:<env> form. Each account's role
|
|
# trusts only its own Environment. The prod role must not trust dev.
|
|
github_oidc_subs_prod = [
|
|
"repo:${var.github_repo}:environment:prod",
|
|
]
|
|
github_oidc_subs_dev = [
|
|
"repo:${var.github_repo}:environment:dev",
|
|
]
|
|
github_oidc_subs = local.is_prod ? local.github_oidc_subs_prod : local.github_oidc_subs_dev
|
|
# The caller workflow stays SHA-pinned. @* keeps a pin bump from
|
|
# invalidating this role. sub still names this repo and environment.
|
|
github_deploy_workflow_ref = "Sea-Haven-Industries/.github/.github/workflows/cd-hcp-lambda.yaml@*"
|
|
|
|
dynamodb_cmk_arns = {
|
|
prod = "arn:aws:kms:us-east-1:011934824531:key/be5fa4cb-c546-40fe-a13d-c7bec79f5d12"
|
|
dev = "arn:aws:kms:us-east-1:710827005802:key/600997e6-418e-4b7f-9d63-cd42a7505a95"
|
|
}
|
|
dynamodb_cmk_arn = local.dynamodb_cmk_arns[var.environment]
|
|
|
|
# Exact ARNs (ticket rule). Dev values are shells created for this workspace.
|
|
# They are not prod secrets.
|
|
secret_arns_by_env = {
|
|
prod = {
|
|
"payments-dashboard/slack-bot-token" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/slack-bot-token-0pAM3S"
|
|
"payments-dashboard/slack-signing-secret" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/slack-signing-secret-u0T6h8"
|
|
"payments-dashboard/boa-check-mgmt" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/boa-check-mgmt-LEbC65"
|
|
"payments-dashboard/boa-reporting" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/boa-reporting-JoR9lq"
|
|
"payments-dashboard/expense-slack-token" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/expense-slack-token-SeMg3s"
|
|
"payments-dashboard/expense-slack-signing-secret" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/expense-slack-signing-secret-lbb78J"
|
|
}
|
|
dev = {
|
|
"payments-dashboard/slack-bot-token" = "arn:aws:secretsmanager:us-east-1:710827005802:secret:payments-dashboard/slack-bot-token-KhPaLp"
|
|
"payments-dashboard/slack-signing-secret" = "arn:aws:secretsmanager:us-east-1:710827005802:secret:payments-dashboard/slack-signing-secret-CDxsUK"
|
|
"payments-dashboard/boa-check-mgmt" = "arn:aws:secretsmanager:us-east-1:710827005802:secret:payments-dashboard/boa-check-mgmt-kkEnCw"
|
|
"payments-dashboard/boa-reporting" = "arn:aws:secretsmanager:us-east-1:710827005802:secret:payments-dashboard/boa-reporting-uMHHVo"
|
|
"payments-dashboard/expense-slack-token" = "arn:aws:secretsmanager:us-east-1:710827005802:secret:payments-dashboard/expense-slack-token-05OZg3"
|
|
"payments-dashboard/expense-slack-signing-secret" = "arn:aws:secretsmanager:us-east-1:710827005802:secret:payments-dashboard/expense-slack-signing-secret-DQAoXS"
|
|
}
|
|
}
|
|
secret_arns = local.secret_arns_by_env[var.environment]
|
|
|
|
functions = {
|
|
process_csv = {
|
|
function_name = "payments-processPaymentCsv"
|
|
role_name = "payments-dashboard-process-csv"
|
|
handler = "src/processPaymentCsv.handler"
|
|
timeout = 120
|
|
duration_ms = 96000
|
|
vpc = true
|
|
}
|
|
slack_app_home = {
|
|
function_name = "payments-slackAppHome"
|
|
role_name = "payments-dashboard-slack-app-home"
|
|
handler = "src/slackAppHome.handler"
|
|
timeout = 30
|
|
duration_ms = 24000
|
|
vpc = true
|
|
}
|
|
fetch_boa = {
|
|
function_name = "payments-fetchBoaTransactions"
|
|
role_name = "payments-dashboard-fetch-boa"
|
|
handler = "src/fetchBoaTransactions.handler"
|
|
timeout = 60
|
|
duration_ms = 48000
|
|
vpc = true
|
|
}
|
|
expense_receiver = {
|
|
function_name = "payments-expenseReceiver"
|
|
role_name = "payments-dashboard-expense-receiver"
|
|
handler = "src/expenseReceiver.handler"
|
|
timeout = 5
|
|
duration_ms = 4000
|
|
vpc = false
|
|
}
|
|
expense_processor = {
|
|
function_name = "payments-expenseProcessor"
|
|
role_name = "payments-dashboard-expense-processor"
|
|
handler = "src/expenseProcessor.handler"
|
|
timeout = 15
|
|
duration_ms = 12000
|
|
vpc = false
|
|
}
|
|
}
|
|
}
|