mirror of
https://github.com/Sea-Haven-Industries/payments-dashboard.git
synced 2026-10-02 16:43:21 +00:00
0e3e95c240
Some checks are pending
Deploy / Deploy to prod (push) Waiting to run
* feat(infra): migrate payments-dashboard to HCP Terraform (PLAT-79) Replace the mgmt SAM stack with a prod-only HCP workspace using the afterhours stub-plus-zip-CD seam so GitHub Actions owns function code and Terraform owns infrastructure. * fix(infra): pin secret and CMK ARNs for bootstrap-plan hcptf-bootstrap-plan cannot ssm:GetParameter or DescribeSecret, so the first plan must not data-source those values. * fix(infra): add EIP describe and DynamoDB CMK grants for first apply Scoped apply missed ec2:DescribeAddressesAttribute and kms Encrypt/Decrypt/GenerateDataKey on the table CMK.
81 lines
3.6 KiB
HCL
81 lines
3.6 KiB
HCL
locals {
|
|
project = "payments-dashboard"
|
|
account_id = "011934824531"
|
|
environment = "prod"
|
|
|
|
hcp_project = "seahaven-prod"
|
|
hcp_workspace = "payments-dashboard-prod"
|
|
apply_role = "hcptf-payments-dashboard"
|
|
plan_role = "hcptf-payments-dashboard-plan"
|
|
deploy_role = "githubdeploy-payments-dashboard"
|
|
stack_name = local.project
|
|
stack_prefix = "payments-dashboard-"
|
|
|
|
artifacts_bucket_name = "payments-dashboard-artifacts-${local.account_id}"
|
|
csv_bucket_name = "seahaven-payments-csv-${local.account_id}"
|
|
boa_raw_bucket_name = "seahaven-payments-boa-raw-${local.account_id}"
|
|
ssm_prefix = "/payments-dashboard"
|
|
table_name = "PaymentsDashboard"
|
|
site_alerts_arn = "arn:aws:sns:${var.aws_region}:${local.account_id}:site-alerts"
|
|
dynamodb_cmk_ssm = "/seahaven/dynamodb/cmk-arn"
|
|
|
|
github_oidc_provider_arn = "arn:aws:iam::${local.account_id}:oidc-provider/token.actions.githubusercontent.com"
|
|
# Org has Actions OIDC use_immutable_subject=true.
|
|
github_oidc_sub = "repo:Sea-Haven-Industries@183236204/payments-dashboard@1206210946:environment:prod"
|
|
|
|
dynamodb_cmk_arn = "arn:aws:kms:us-east-1:011934824531:key/be5fa4cb-c546-40fe-a13d-c7bec79f5d12"
|
|
|
|
# Exact ARNs (ticket rule). Hardcoded so the first plan can run as
|
|
# hcptf-bootstrap-plan, which cannot ssm:GetParameter / DescribeSecret.
|
|
secret_arns = {
|
|
"payments-dashboard/slack-bot-token" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/slack-bot-token-0pAM3S"
|
|
"payments-dashboard/slack-signing-secret" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/slack-signing-secret-u0T6h8"
|
|
"payments-dashboard/boa-check-mgmt" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/boa-check-mgmt-LEbC65"
|
|
"payments-dashboard/boa-reporting" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/boa-reporting-JoR9lq"
|
|
"payments-dashboard/expense-slack-token" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/expense-slack-token-SeMg3s"
|
|
"payments-dashboard/expense-slack-signing-secret" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/expense-slack-signing-secret-lbb78J"
|
|
}
|
|
|
|
functions = {
|
|
process_csv = {
|
|
function_name = "payments-processPaymentCsv"
|
|
role_name = "payments-dashboard-process-csv"
|
|
handler = "src/processPaymentCsv.handler"
|
|
timeout = 120
|
|
duration_ms = 96000
|
|
vpc = true
|
|
}
|
|
slack_app_home = {
|
|
function_name = "payments-slackAppHome"
|
|
role_name = "payments-dashboard-slack-app-home"
|
|
handler = "src/slackAppHome.handler"
|
|
timeout = 30
|
|
duration_ms = 24000
|
|
vpc = true
|
|
}
|
|
fetch_boa = {
|
|
function_name = "payments-fetchBoaTransactions"
|
|
role_name = "payments-dashboard-fetch-boa"
|
|
handler = "src/fetchBoaTransactions.handler"
|
|
timeout = 60
|
|
duration_ms = 48000
|
|
vpc = true
|
|
}
|
|
expense_receiver = {
|
|
function_name = "payments-expenseReceiver"
|
|
role_name = "payments-dashboard-expense-receiver"
|
|
handler = "src/expenseReceiver.handler"
|
|
timeout = 5
|
|
duration_ms = 4000
|
|
vpc = false
|
|
}
|
|
expense_processor = {
|
|
function_name = "payments-expenseProcessor"
|
|
role_name = "payments-dashboard-expense-processor"
|
|
handler = "src/expenseProcessor.handler"
|
|
timeout = 15
|
|
duration_ms = 12000
|
|
vpc = false
|
|
}
|
|
}
|
|
}
|