066ff59d22
Puts qbo-lookup and qbo-oauth Lambdas in seahaven-vpc private subnets so all outbound traffic routes through NAT Gateway (52.202.83.13). Required for Intuit app listing IP allowlist.
102 lines
4.6 KiB
TypeScript
102 lines
4.6 KiB
TypeScript
import * as cdk from 'aws-cdk-lib';
|
|
import * as ec2 from 'aws-cdk-lib/aws-ec2';
|
|
import { Construct } from 'constructs';
|
|
import { ConversationLogConstruct } from './constructs/conversation-log';
|
|
import { KnowledgeBaseConstruct } from './constructs/knowledge-base';
|
|
import { BedrockAgentConstruct } from './constructs/bedrock-agent';
|
|
import { SlackHandlerConstruct } from './constructs/slack-handler';
|
|
import { NotionSyncConstruct } from './constructs/notion-sync';
|
|
import { PoSyncConstruct } from './constructs/po-sync';
|
|
import { WorkorderSyncConstruct } from './constructs/workorder-sync';
|
|
|
|
export class SeahavenSlackBotStack extends cdk.Stack {
|
|
constructor(scope: Construct, id: string, props?: cdk.StackProps) {
|
|
super(scope, id, props);
|
|
|
|
// Wildcard cert ARN (*.seahaven.com) — set in cdk.json or via --context
|
|
const wildcardCertArn = this.node.tryGetContext('wildcardCertArn') as string | undefined;
|
|
if (!wildcardCertArn || wildcardCertArn.includes('CHANGE-ME')) {
|
|
throw new Error(
|
|
'Set wildcardCertArn in cdk.json or pass --context wildcardCertArn=arn:aws:acm:...\n' +
|
|
'Run: aws acm list-certificates --region us-east-1 to find your cert ARN.',
|
|
);
|
|
}
|
|
|
|
// ── VPC (existing) — QBO Lambdas run here for static outbound IP ──────────
|
|
const vpc = ec2.Vpc.fromLookup(this, 'SeahavenVpc', { vpcId: 'vpc-0d3d4b67bd0cf8a68' });
|
|
|
|
const lambdaSecurityGroup = new ec2.SecurityGroup(this, 'QBOLambdaSG', {
|
|
vpc,
|
|
securityGroupName: 'seahaven-qbo-lambda',
|
|
description: 'QBO Lambdas - outbound HTTPS only',
|
|
allowAllOutbound: true,
|
|
});
|
|
|
|
// ── Conversation history (DynamoDB) ───────────────────────────────────────
|
|
const conversationLog = new ConversationLogConstruct(this, 'ConversationLog');
|
|
|
|
// ── Bedrock Knowledge Base (OpenSearch Serverless + S3) ───────────────────
|
|
const knowledgeBase = new KnowledgeBaseConstruct(this, 'KnowledgeBase', {
|
|
accountId: this.account,
|
|
region: this.region,
|
|
});
|
|
|
|
// ── Bedrock Agent (Claude Sonnet + QBO + Google Maps action groups) ───────
|
|
const bedrockAgent = new BedrockAgentConstruct(this, 'BedrockAgent', {
|
|
accountId: this.account,
|
|
region: this.region,
|
|
knowledgeBaseId: knowledgeBase.knowledgeBase.knowledgeBaseId,
|
|
knowledgeBaseArn: knowledgeBase.knowledgeBase.knowledgeBaseArn,
|
|
vpc,
|
|
lambdaSecurityGroup,
|
|
});
|
|
|
|
// ── Notion → KB daily sync (EventBridge + Lambda) ────────────────────────
|
|
new NotionSyncConstruct(this, 'NotionSync', {
|
|
region: this.region,
|
|
kbDocsBucket: knowledgeBase.docsBucket,
|
|
knowledgeBaseId: knowledgeBase.knowledgeBase.knowledgeBaseId,
|
|
dataSourceId: knowledgeBase.dataSource.dataSourceId,
|
|
});
|
|
|
|
// ── Purchase Orders → KB daily sync (EventBridge + Lambda) ────────────────
|
|
new PoSyncConstruct(this, 'PoSync', {
|
|
region: this.region,
|
|
kbDocsBucket: knowledgeBase.docsBucket,
|
|
knowledgeBaseId: knowledgeBase.knowledgeBase.knowledgeBaseId,
|
|
dataSourceId: knowledgeBase.dataSource.dataSourceId,
|
|
});
|
|
|
|
// ── Work Orders → KB daily sync (EventBridge + Lambda) ────────────────────
|
|
new WorkorderSyncConstruct(this, 'WorkorderSync', {
|
|
region: this.region,
|
|
kbDocsBucket: knowledgeBase.docsBucket,
|
|
knowledgeBaseId: knowledgeBase.knowledgeBase.knowledgeBaseId,
|
|
dataSourceId: knowledgeBase.dataSource.dataSourceId,
|
|
});
|
|
|
|
// ── Slack webhook handler (API Gateway + Lambda) ───────────────────────────
|
|
new SlackHandlerConstruct(this, 'SlackHandler', {
|
|
accountId: this.account,
|
|
region: this.region,
|
|
agentId: bedrockAgent.agent.attrAgentId,
|
|
agentAliasId: bedrockAgent.agentAlias.attrAgentAliasId,
|
|
conversationTable: conversationLog.table,
|
|
wildcardCertArn,
|
|
vpc,
|
|
lambdaSecurityGroup,
|
|
});
|
|
|
|
// ── Stack outputs ─────────────────────────────────────────────────────────
|
|
new cdk.CfnOutput(this, 'KBDocsBucketName', {
|
|
value: knowledgeBase.docsBucket.bucketName,
|
|
description: 'Upload SA8000 docs, SOPs, and employee handbook here to populate the KB',
|
|
});
|
|
|
|
new cdk.CfnOutput(this, 'AgentId', {
|
|
value: bedrockAgent.agent.attrAgentId,
|
|
description: 'Bedrock Agent ID',
|
|
});
|
|
|
|
}
|
|
}
|