mirror of
https://github.com/Sea-Haven-Industries/payments-dashboard.git
synced 2026-10-04 11:22:07 +00:00
7c2c806339
* refactor(iam): forget in-repo HCP exec roles Org-baseline owns the apply and plan roles, so this workspace can assume them without a bootstrap window. Prod state forgets the old addresses without destroying the live roles. * ci(terraform): pin the isolation check to v1.0.21 The pre-release pin cloned the private .github repo with the caller token and the Terraform job failed. v1.0.21 loads the checker from the workflow commit.
106 lines
5.5 KiB
HCL
106 lines
5.5 KiB
HCL
locals {
|
|
project = "payments-dashboard"
|
|
is_prod = var.environment == "prod"
|
|
account_id = local.is_prod ? "011934824531" : "710827005802"
|
|
environment = var.environment
|
|
|
|
hcp_project = "seahaven-${var.environment}"
|
|
hcp_workspace = "${local.project}-${var.environment}"
|
|
deploy_role = "githubdeploy-payments-dashboard"
|
|
# Owned by org-baseline stack seahaven-hcptf. This configuration only references it.
|
|
lambda_boundary_arn = "arn:aws:iam::${local.account_id}:policy/tf-managed/payments-dashboard-lambda-boundary"
|
|
|
|
artifacts_bucket_name = "payments-dashboard-artifacts-${local.account_id}"
|
|
csv_bucket_name = "seahaven-payments-csv-${local.account_id}"
|
|
boa_raw_bucket_name = "seahaven-payments-boa-raw-${local.account_id}"
|
|
ssm_prefix = "/payments-dashboard"
|
|
table_name = "PaymentsDashboard"
|
|
site_alerts_arn = "arn:aws:sns:${var.aws_region}:${local.account_id}:site-alerts"
|
|
dynamodb_cmk_ssm = "/seahaven/dynamodb/cmk-arn"
|
|
|
|
github_oidc_provider_arn = "arn:aws:iam::${local.account_id}:oidc-provider/token.actions.githubusercontent.com"
|
|
# Repo OIDC subject customization is the default (use_default=true), so tokens
|
|
# use the classic repo:owner/name:environment:<env> form. Each account's role
|
|
# trusts only its own Environment. The prod role must not trust dev.
|
|
github_oidc_subs_prod = [
|
|
"repo:${var.github_repo}:environment:prod",
|
|
]
|
|
github_oidc_subs_dev = [
|
|
"repo:${var.github_repo}:environment:dev",
|
|
]
|
|
github_oidc_subs = local.is_prod ? local.github_oidc_subs_prod : local.github_oidc_subs_dev
|
|
# Matches the SHA pin in .github/workflows/deploy.yaml. A reusable bump
|
|
# updates both together. StringEquals, not @*.
|
|
github_deploy_workflow_ref = "Sea-Haven-Industries/.github/.github/workflows/cd-hcp-lambda.yaml@ee5b843ca105422b679c3fdeb9eaa68c6e500a85"
|
|
|
|
dynamodb_cmk_arns = {
|
|
prod = "arn:aws:kms:us-east-1:011934824531:key/be5fa4cb-c546-40fe-a13d-c7bec79f5d12"
|
|
dev = "arn:aws:kms:us-east-1:710827005802:key/600997e6-418e-4b7f-9d63-cd42a7505a95"
|
|
}
|
|
dynamodb_cmk_arn = local.dynamodb_cmk_arns[var.environment]
|
|
|
|
# Exact ARNs (ticket rule). Dev values are shells created for this workspace.
|
|
# They are not prod secrets.
|
|
secret_arns_by_env = {
|
|
prod = {
|
|
"payments-dashboard/slack-bot-token" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/slack-bot-token-0pAM3S"
|
|
"payments-dashboard/slack-signing-secret" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/slack-signing-secret-u0T6h8"
|
|
"payments-dashboard/boa-check-mgmt" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/boa-check-mgmt-LEbC65"
|
|
"payments-dashboard/boa-reporting" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/boa-reporting-JoR9lq"
|
|
"payments-dashboard/expense-slack-token" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/expense-slack-token-SeMg3s"
|
|
"payments-dashboard/expense-slack-signing-secret" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/expense-slack-signing-secret-lbb78J"
|
|
}
|
|
dev = {
|
|
"payments-dashboard/slack-bot-token" = "arn:aws:secretsmanager:us-east-1:710827005802:secret:payments-dashboard/slack-bot-token-KhPaLp"
|
|
"payments-dashboard/slack-signing-secret" = "arn:aws:secretsmanager:us-east-1:710827005802:secret:payments-dashboard/slack-signing-secret-CDxsUK"
|
|
"payments-dashboard/boa-check-mgmt" = "arn:aws:secretsmanager:us-east-1:710827005802:secret:payments-dashboard/boa-check-mgmt-kkEnCw"
|
|
"payments-dashboard/boa-reporting" = "arn:aws:secretsmanager:us-east-1:710827005802:secret:payments-dashboard/boa-reporting-uMHHVo"
|
|
"payments-dashboard/expense-slack-token" = "arn:aws:secretsmanager:us-east-1:710827005802:secret:payments-dashboard/expense-slack-token-05OZg3"
|
|
"payments-dashboard/expense-slack-signing-secret" = "arn:aws:secretsmanager:us-east-1:710827005802:secret:payments-dashboard/expense-slack-signing-secret-DQAoXS"
|
|
}
|
|
}
|
|
secret_arns = local.secret_arns_by_env[var.environment]
|
|
|
|
functions = {
|
|
process_csv = {
|
|
function_name = "payments-processPaymentCsv"
|
|
role_name = "payments-dashboard-process-csv"
|
|
handler = "src/processPaymentCsv.handler"
|
|
timeout = 120
|
|
duration_ms = 96000
|
|
vpc = true
|
|
}
|
|
slack_app_home = {
|
|
function_name = "payments-slackAppHome"
|
|
role_name = "payments-dashboard-slack-app-home"
|
|
handler = "src/slackAppHome.handler"
|
|
timeout = 30
|
|
duration_ms = 24000
|
|
vpc = true
|
|
}
|
|
fetch_boa = {
|
|
function_name = "payments-fetchBoaTransactions"
|
|
role_name = "payments-dashboard-fetch-boa"
|
|
handler = "src/fetchBoaTransactions.handler"
|
|
timeout = 60
|
|
duration_ms = 48000
|
|
vpc = true
|
|
}
|
|
expense_receiver = {
|
|
function_name = "payments-expenseReceiver"
|
|
role_name = "payments-dashboard-expense-receiver"
|
|
handler = "src/expenseReceiver.handler"
|
|
timeout = 5
|
|
duration_ms = 4000
|
|
vpc = false
|
|
}
|
|
expense_processor = {
|
|
function_name = "payments-expenseProcessor"
|
|
role_name = "payments-dashboard-expense-processor"
|
|
handler = "src/expenseProcessor.handler"
|
|
timeout = 15
|
|
duration_ms = 12000
|
|
vpc = false
|
|
}
|
|
}
|
|
}
|