"""CDK stack for the work order email ingestion pipeline.""" import aws_cdk as cdk from aws_cdk import ( Duration, RemovalPolicy, Stack, aws_cloudwatch as cloudwatch, aws_cloudwatch_actions as cw_actions, aws_dynamodb as dynamodb, aws_lambda as lambda_, aws_logs as logs, aws_s3 as s3, aws_s3_notifications as s3n, aws_ses as ses, aws_ses_actions as ses_actions, aws_secretsmanager as secretsmanager, aws_sns as sns, aws_sqs as sqs, aws_ssm as ssm, ) from constructs import Construct class WorkorderIngestStack(Stack): def __init__(self, scope: Construct, construct_id: str, **kwargs): super().__init__(scope, construct_id, **kwargs) # --- S3 bucket for raw emails --- email_bucket = s3.Bucket( self, "EmailBucket", bucket_name=f"workorder-ingest-emails-{self.account}", removal_policy=RemovalPolicy.RETAIN, lifecycle_rules=[ s3.LifecycleRule(expiration=Duration.days(90)), ], ) # --- DynamoDB tables --- work_orders_table = dynamodb.Table( self, "WorkOrdersTable", table_name="WorkOrders", partition_key=dynamodb.Attribute( name="work_order_id", type=dynamodb.AttributeType.STRING, ), billing_mode=dynamodb.BillingMode.PAY_PER_REQUEST, removal_policy=RemovalPolicy.RETAIN, ) # site-code-index and status-index GSIs removed 2026-06-03 (audit M-20): # 0 reads in 30d against ~50k WCU each of write amplification. Re-add if # a site-code or status query path ships. comments_table = dynamodb.Table( self, "CommentsTable", table_name="WorkOrderComments", partition_key=dynamodb.Attribute( name="work_order_id", type=dynamodb.AttributeType.STRING, ), sort_key=dynamodb.Attribute( name="comment_id", type=dynamodb.AttributeType.STRING, ), billing_mode=dynamodb.BillingMode.PAY_PER_REQUEST, removal_policy=RemovalPolicy.RETAIN, ) # --- Secrets Manager for Anthropic API key --- anthropic_secret = secretsmanager.Secret( self, "AnthropicApiKey", secret_name="workorder-ingest/anthropic-api-key", description="Anthropic API key for work order email parsing", removal_policy=RemovalPolicy.RETAIN, ) # --- DLQ for failed async invocations (INFRA-41 / audit H-8) --- # SES → S3 → Lambda is async; without an OnFailure destination a failed # parse (bad email, transient error) is silently dropped after Lambda's # retries. CDK generates the queue name to avoid colliding with the # interim CLI-created workorder-email-processor-dlq (removed post-deploy). email_processor_dlq = sqs.Queue( self, "EmailProcessorDlq", retention_period=Duration.days(14), enforce_ssl=True, ) # --- Lambda function --- email_processor = lambda_.Function( self, "EmailProcessor", function_name="workorder-email-processor", runtime=lambda_.Runtime.PYTHON_3_12, architecture=lambda_.Architecture.ARM_64, handler="handler.handler", code=lambda_.Code.from_asset( "../lambdas/wo/email_processor", bundling=cdk.BundlingOptions( image=lambda_.Runtime.PYTHON_3_12.bundling_image, command=[ "bash", "-c", "pip install --platform manylinux2014_aarch64 --only-binary=:all: " "-r requirements.txt -t /asset-output && " "cp -r . /asset-output/", ], ), ), timeout=Duration.seconds(60), memory_size=256, log_retention=logs.RetentionDays.TWO_MONTHS, dead_letter_queue=email_processor_dlq, environment={ "WORK_ORDERS_TABLE": work_orders_table.table_name, "COMMENTS_TABLE": comments_table.table_name, "ANTHROPIC_API_KEY_SECRET_ARN": anthropic_secret.secret_arn, }, ) # Grant permissions email_bucket.grant_read(email_processor) work_orders_table.grant_read_write_data(email_processor) comments_table.grant_read_write_data(email_processor) anthropic_secret.grant_read(email_processor) # NOTE: The pre-emptive grant_encrypt_decrypt on the shared DynamoDB CMK # (alias/seahaven-dynamodb) was removed (security sweep 2026-06-17). The # WorkOrders/WorkOrderComments tables are NOT SSE-KMS encrypted with that # CMK, so the grant was unused for these tables yet handed # wo-email-processor kms:Decrypt on the CMK that also protects the # purchase-orders table (cross-stack decrypt reach). Re-add this grant only # as part of the actual CMK migration of these tables (INFRA-6), at which # point grant_read_write_data on the (then encrypted) tables would propagate # the needed key permissions automatically. # --- Errors alarm (INFRA-41 / audit H-8) --- # ALARM-only (no OK action, per the CloudWatch-alarm preference) to the # shared site-alerts topic (CMK alias/seahaven-alarm-topics lives on the # topic). Any errored invocation in a 5-min window pages. alarm_topic = sns.Topic.from_topic_arn( self, "SiteAlertsTopic", f"arn:aws:sns:{self.region}:{self.account}:site-alerts", ) email_processor.metric_errors( period=Duration.minutes(5), statistic="Sum", ).create_alarm( self, "EmailProcessorErrorsAlarm", alarm_name="workorder-email-processor-errors", alarm_description="workorder-email-processor async invocation errors", threshold=0, evaluation_periods=1, comparison_operator=cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD, treat_missing_data=cloudwatch.TreatMissingData.NOT_BREACHING, ).add_alarm_action(cw_actions.SnsAction(alarm_topic)) # S3 event notification -> Lambda email_bucket.add_event_notification( s3.EventType.OBJECT_CREATED, s3n.LambdaDestination(email_processor), s3.NotificationKeyFilter(prefix="inbound/"), ) # --- SES Receipt Rule --- rule_set = ses.ReceiptRuleSet.from_receipt_rule_set_name( self, "ExistingRuleSet", "INBOUND_MAIL", ) rule_set.add_rule( "WorkorderEmailRule", recipients=["apm@int.seahaven.com"], actions=[ ses_actions.S3( bucket=email_bucket, object_key_prefix="inbound/", ), ], ) # --- Web UI Lambda --- web_ui = lambda_.Function( self, "WebUI", function_name="workorder-web-ui", runtime=lambda_.Runtime.PYTHON_3_12, architecture=lambda_.Architecture.ARM_64, handler="handler.handler", code=lambda_.Code.from_asset("../lambdas/wo/web_ui"), timeout=Duration.seconds(15), memory_size=128, log_retention=logs.RetentionDays.TWO_MONTHS, environment={ "WORK_ORDERS_TABLE": work_orders_table.table_name, "COMMENTS_TABLE": comments_table.table_name, # Defense-in-depth shared secret for the web UI handler. The # handler fails closed if this is unset, so any future invocation # path cannot re-expose the WO DB unauthenticated. Sourced from the # SSM String parameter /procurement-ingest/web-ui-auth-token; create # it before deploy. NOTE: a plaintext String (not SecureString) is # used deliberately — value_for_string_parameter resolves String # params into Lambda env vars at deploy via {{resolve:ssm:...}}; # SecureString dynamic references are NOT resolved in Lambda env # vars and would pass the token literally. This is a defense-in-depth # floor for a currently-detached URL (INFRA-74), not a primary auth. "WEB_UI_AUTH_TOKEN": ssm.StringParameter.value_for_string_parameter( self, "/procurement-ingest/web-ui-auth-token" ), }, ) work_orders_table.grant_read_data(web_ui) comments_table.grant_read_data(web_ui) # Public Function URL removed 2026-06-08 (INFRA-74 / audit C-5): the # unauthenticated FunctionUrlAuthType.NONE URL was deleted out-of-band # via CLI. Removing the construct (and its auto-generated Principal:* # invoke permission) reconciles IaC with the live state.