payments-dashboard/terraform/locals.tf

locals {
  project     = "payments-dashboard"
  is_prod     = var.environment == "prod"
  account_id  = local.is_prod ? "011934824531" : "710827005802"
  environment = var.environment

  hcp_project   = "seahaven-${var.environment}"
  hcp_workspace = "${local.project}-${var.environment}"
  apply_role    = "hcptf-payments-dashboard"
  plan_role     = "hcptf-payments-dashboard-plan"
  deploy_role   = "githubdeploy-payments-dashboard"
  stack_name    = local.project
  stack_prefix  = "payments-dashboard-"

  artifacts_bucket_name = "payments-dashboard-artifacts-${local.account_id}"
  csv_bucket_name       = "seahaven-payments-csv-${local.account_id}"
  boa_raw_bucket_name   = "seahaven-payments-boa-raw-${local.account_id}"
  ssm_prefix            = "/payments-dashboard"
  table_name            = "PaymentsDashboard"
  site_alerts_arn       = "arn:aws:sns:${var.aws_region}:${local.account_id}:site-alerts"
  dynamodb_cmk_ssm      = "/seahaven/dynamodb/cmk-arn"

  github_oidc_provider_arn = "arn:aws:iam::${local.account_id}:oidc-provider/token.actions.githubusercontent.com"
  # Org has Actions OIDC use_immutable_subject=true. Both forms, both environments.
  github_oidc_subs = [
    "repo:${var.github_repo}:environment:dev",
    "repo:${var.github_repo}:environment:prod",
    "repo:Sea-Haven-Industries@183236204/payments-dashboard@1206210946:environment:dev",
    "repo:Sea-Haven-Industries@183236204/payments-dashboard@1206210946:environment:prod",
  ]

  dynamodb_cmk_arns = {
    prod = "arn:aws:kms:us-east-1:011934824531:key/be5fa4cb-c546-40fe-a13d-c7bec79f5d12"
    dev  = "arn:aws:kms:us-east-1:710827005802:key/600997e6-418e-4b7f-9d63-cd42a7505a95"
  }
  dynamodb_cmk_arn = local.dynamodb_cmk_arns[var.environment]

  # Exact ARNs (ticket rule). Hardcoded so the first plan can run as
  # hcptf-bootstrap-plan, which cannot ssm:GetParameter / DescribeSecret.
  # Dev values are shells created for this workspace. They are not prod secrets.
  secret_arns_by_env = {
    prod = {
      "payments-dashboard/slack-bot-token"              = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/slack-bot-token-0pAM3S"
      "payments-dashboard/slack-signing-secret"         = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/slack-signing-secret-u0T6h8"
      "payments-dashboard/boa-check-mgmt"               = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/boa-check-mgmt-LEbC65"
      "payments-dashboard/boa-reporting"                = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/boa-reporting-JoR9lq"
      "payments-dashboard/expense-slack-token"          = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/expense-slack-token-SeMg3s"
      "payments-dashboard/expense-slack-signing-secret" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/expense-slack-signing-secret-lbb78J"
    }
    dev = {
      "payments-dashboard/slack-bot-token"              = "arn:aws:secretsmanager:us-east-1:710827005802:secret:payments-dashboard/slack-bot-token-KhPaLp"
      "payments-dashboard/slack-signing-secret"         = "arn:aws:secretsmanager:us-east-1:710827005802:secret:payments-dashboard/slack-signing-secret-CDxsUK"
      "payments-dashboard/boa-check-mgmt"               = "arn:aws:secretsmanager:us-east-1:710827005802:secret:payments-dashboard/boa-check-mgmt-kkEnCw"
      "payments-dashboard/boa-reporting"                = "arn:aws:secretsmanager:us-east-1:710827005802:secret:payments-dashboard/boa-reporting-uMHHVo"
      "payments-dashboard/expense-slack-token"          = "arn:aws:secretsmanager:us-east-1:710827005802:secret:payments-dashboard/expense-slack-token-05OZg3"
      "payments-dashboard/expense-slack-signing-secret" = "arn:aws:secretsmanager:us-east-1:710827005802:secret:payments-dashboard/expense-slack-signing-secret-DQAoXS"
    }
  }
  secret_arns = local.secret_arns_by_env[var.environment]

  functions = {
    process_csv = {
      function_name = "payments-processPaymentCsv"
      role_name     = "payments-dashboard-process-csv"
      handler       = "src/processPaymentCsv.handler"
      timeout       = 120
      duration_ms   = 96000
      vpc           = true
    }
    slack_app_home = {
      function_name = "payments-slackAppHome"
      role_name     = "payments-dashboard-slack-app-home"
      handler       = "src/slackAppHome.handler"
      timeout       = 30
      duration_ms   = 24000
      vpc           = true
    }
    fetch_boa = {
      function_name = "payments-fetchBoaTransactions"
      role_name     = "payments-dashboard-fetch-boa"
      handler       = "src/fetchBoaTransactions.handler"
      timeout       = 60
      duration_ms   = 48000
      vpc           = true
    }
    expense_receiver = {
      function_name = "payments-expenseReceiver"
      role_name     = "payments-dashboard-expense-receiver"
      handler       = "src/expenseReceiver.handler"
      timeout       = 5
      duration_ms   = 4000
      vpc           = false
    }
    expense_processor = {
      function_name = "payments-expenseProcessor"
      role_name     = "payments-dashboard-expense-processor"
      handler       = "src/expenseProcessor.handler"
      timeout       = 15
      duration_ms   = 12000
      vpc           = false
    }
  }
}