aws-banking-system/template.yml at main · edinstance/aws-banking-system

890 lines (845 loc) · 28.7 KB
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: |
  SAM template for a banking transaction system with intuitive transaction types.
  Includes Cognito User Pool authentication for API Gateway and a custom login/refresh proxy.
Parameters:
  Environment:
    Type: String
    Description: The deployment environment (e.g. dev, test, prod).
    AllowedValues:
      - dev
      - test
      - prod
    Default: dev
  AwsRegion:
    Type: String
    Description: The region to deploy the infrastructure in.
    Default: eu-west-2
  SesEnabled:
    Type: String
    Description: Whether to enable SES email sending (true/false).
    AllowedValues:
      - true
      - false
    Default: true
  Function:
    Runtime: python3.12
    MemorySize: 128
    Timeout: 90
    Tracing: Active
    Environment:
      Variables:
        POWERTOOLS_LOG_LEVEL: INFO
        POWERTOOLS_SERVICE_NAME: !Sub ${AWS::StackName}
        ENVIRONMENT_NAME: !Ref Environment
        SES_ENABLED: !Ref SesEnabled
        SES_SENDER_EMAIL: !Sub '{{resolve:ssm:/banking-app/${Environment}/SesSenderEmail}}'
        SES_NO_REPLY_EMAIL: !Sub '{{resolve:ssm:/banking-app/${Environment}/SesNoReplyEmail}}'
        SES_REPLY_EMAIL: !Sub '{{resolve:ssm:/banking-app/${Environment}/SesReplyEmail}}'
        SES_BOUNCE_EMAIL: !Sub '{{resolve:ssm:/banking-app/${Environment}/SESBounceEmail}}'
  # --- Cognito User Pool ---
  BankingUserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      UserPoolName: !Sub ${AWS::StackName}-user-pool
      Policies:
        PasswordPolicy:
          MinimumLength: 8
          RequireLowercase: true
          RequireNumbers: true
          RequireSymbols: true
          RequireUppercase: true
      AutoVerifiedAttributes:
        - email
      UsernameAttributes:
        - email
      Schema:
        - Name: email
          AttributeDataType: String
          Mutable: true
          Required: true
      AccountRecoverySetting:
        RecoveryMechanisms:
          - Name: verified_email
            Priority: 1
      LambdaConfig:
        PostConfirmation: !GetAtt CognitoPostSignUpFunction.Arn
  BankingUserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      ClientName: !Sub ${AWS::StackName}-user-pool-client
      UserPoolId: !Ref BankingUserPool
      ExplicitAuthFlows:
        - ALLOW_ADMIN_USER_PASSWORD_AUTH
        - ALLOW_REFRESH_TOKEN_AUTH
      GenerateSecret: false
      AccessTokenValidity: 15
      IdTokenValidity: 15
      RefreshTokenValidity: 30
  # --- API Gateway ---
  BankingApiGateway:
    Type: AWS::Serverless::Api
    Properties:
      Name: !Sub ${AWS::StackName}-transaction-api
      StageName: !Ref Environment
      EndpointConfiguration: REGIONAL
      TracingEnabled: true
      Auth:
        DefaultAuthorizer: CognitoAuthorizer
        Authorizers:
          CognitoAuthorizer:
            UserPoolArn: !GetAtt BankingUserPool.Arn
      Domain:
        DomainName: !Sub '{{resolve:ssm:/banking-app/${Environment}/DomainName}}'
        CertificateArn: !Ref ApiCertificate
        EndpointConfiguration: REGIONAL
        Route53:
          HostedZoneId: !Sub '{{resolve:ssm:/banking-app/${Environment}/Route53HostedZoneId}}'
  # --- Lambda Functions ---
  RequestTransactionFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${AWS::StackName}-request-transaction
      Description: !Sub
        - Stack ${AWS::StackName} Function ${ResourceName} for Stage ${Environment}
        - ResourceName: RequestTransactionFunction
      CodeUri: functions/transactions/request_transaction/
      Handler: request_transaction.app.lambda_handler
      Environment:
        Variables:
          TRANSACTIONS_TABLE_NAME: !Ref TransactionsTable
          DYNAMODB_ENDPOINT: ''
          COGNITO_USER_POOL_ID: !Ref BankingUserPool
          COGNITO_CLIENT_ID: !Ref BankingUserPoolClient
      Layers:
        - !Ref PythonHelpersLambdaLayer
        - !Ref PythonAuthenticationLambdaLayer
      Events:
        ApiSaveTransactionEvent:
          Type: Api
          Properties:
            Path: /transactions
            Method: POST
            RestApiId: !Ref BankingApiGateway
            Auth:
              Authorizer: CognitoAuthorizer
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref TransactionsTable
  GetTransactionsFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${AWS::StackName}-get-transactions
      Description: !Sub
        - Stack ${AWS::StackName} Function ${ResourceName} for Stage ${Environment}
        - ResourceName: GetTransactionsFunction
      CodeUri: functions/transactions/get_transactions/
      Handler: get_transactions.app.lambda_handler
      Environment:
        Variables:
          TRANSACTIONS_TABLE_NAME: !Ref TransactionsTable
          DYNAMODB_ENDPOINT: ''
          COGNITO_USER_POOL_ID: !Ref BankingUserPool
          COGNITO_CLIENT_ID: !Ref BankingUserPoolClient
      Layers:
        - !Ref PythonHelpersLambdaLayer
        - !Ref PythonAuthenticationLambdaLayer
      Events:
        ApiGetAllTransactionsEvent:
          Type: Api
          Properties:
            Path: /transactions
            Method: GET
            RestApiId: !Ref BankingApiGateway
            Auth:
              Authorizer: CognitoAuthorizer
        ApiGetTransactionByIdEvent:
          Type: Api
          Properties:
            Path: /transactions/{id}
            Method: GET
            RestApiId: !Ref BankingApiGateway
            Auth:
              Authorizer: CognitoAuthorizer
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref TransactionsTable
  ProcessTransactionsFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${AWS::StackName}-process-transactions
      Description: !Sub
        - Stack ${AWS::StackName} Function ${ResourceName} for Stage ${Environment}
        - ResourceName: ProcessTransactionsFunction
      CodeUri: functions/transactions/process_transactions/
      Handler: process_transactions.app.lambda_handler
      Environment:
        Variables:
          ACCOUNTS_TABLE_NAME: !Ref AccountsTable
          TRANSACTIONS_TABLE_NAME: !Ref TransactionsTable
          TRANSACTION_PROCESSING_DLQ_URL: !Ref TransactionProcessingDLQ
          DYNAMODB_ENDPOINT: ''
          SQS_ENDPOINT: ''
          COGNITO_USER_POOL_ID: !Ref BankingUserPool
      Layers:
        - !Ref PythonHelpersLambdaLayer
        - !Ref PythonAccountsLambdaLayer
      Events:
        DynamoDBStream:
          Type: DynamoDB
          Properties:
            Stream: !GetAtt TransactionsTable.StreamArn
            StartingPosition: TRIM_HORIZON
            BatchSize: 10
            MaximumRetryAttempts: 1
            DestinationConfig:
              OnFailure:
                Type: SQS
                Destination: !GetAtt TransactionProcessingDLQ.Arn
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref TransactionsTable
        - DynamoDBCrudPolicy:
            TableName: !Ref AccountsTable
        - DynamoDBStreamReadPolicy:
            TableName: !Ref TransactionsTable
            StreamName: !Select
              - !Split
                - !GetAtt TransactionsTable.StreamArn
        - Statement:
            Effect: Allow
            Action:
              - cognito-idp:AdminGetUser
            Resource: !GetAtt BankingUserPool.Arn
        - Statement:
            Effect: Allow
            Action:
              - sqs:SendMessage
              - sqs:GetQueueAttributes
              - sqs:GetQueueUrl
            Resource: !GetAtt TransactionProcessingDLQ.Arn
  GetAccountsFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${AWS::StackName}-get-accounts
      Description: !Sub
        - Stack ${AWS::StackName} Function ${ResourceName} for Stage ${Environment}
        - ResourceName: GetAccountsFunction
      CodeUri: functions/accounts/get_accounts/
      Handler: get_accounts.app.lambda_handler
      Environment:
        Variables:
          ACCOUNTS_TABLE_NAME: !Ref AccountsTable
          DYNAMODB_ENDPOINT: ''
          COGNITO_USER_POOL_ID: !Ref BankingUserPool
          COGNITO_CLIENT_ID: !Ref BankingUserPoolClient
      Layers:
        - !Ref PythonHelpersLambdaLayer
        - !Ref PythonAuthenticationLambdaLayer
      Events:
        ApiGetAllAccountsEvent:
          Type: Api
          Properties:
            Path: /accounts
            Method: GET
            RestApiId: !Ref BankingApiGateway
            Auth:
              Authorizer: CognitoAuthorizer
        ApiGetAccountByIdEvent:
          Type: Api
          Properties:
            Path: /accounts/{account_id}
            Method: GET
            RestApiId: !Ref BankingApiGateway
            Auth:
              Authorizer: CognitoAuthorizer
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref AccountsTable
  GetAccountTransactionsFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${AWS::StackName}-get-account-transactions
      Description: !Sub
        - Stack ${AWS::StackName} Function ${ResourceName} for Stage ${Environment}
        - ResourceName: GetAccountTransactionsFunction
      CodeUri: functions/accounts/get_account_transactions
      Handler: get_account_transactions.app.lambda_handler
      Environment:
        Variables:
          TRANSACTIONS_TABLE_NAME: !Ref TransactionsTable
          DYNAMODB_ENDPOINT: ''
      Layers:
        - !Ref PythonHelpersLambdaLayer
      Events:
        ApiGetAccountTransactionsEvent:
          Type: Api
          Properties:
            Path: /accounts/{account_id}/transactions
            Method: GET
            RestApiId: !Ref BankingApiGateway
            Auth:
              Authorizer: CognitoAuthorizer
      Policies:
        - DynamoDBReadPolicy:
            TableName: !Ref TransactionsTable
  AuthFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${AWS::StackName}-auth
      Description: !Sub
        - Stack ${AWS::StackName} Function ${ResourceName} for Stage ${Environment}
        - ResourceName: AuthFunction
      CodeUri: functions/auth/
      Handler: auth.app.lambda_handler
      Environment:
        Variables:
          COGNITO_USER_POOL_ID: !Ref BankingUserPool
          COGNITO_CLIENT_ID: !Ref BankingUserPoolClient
      Layers:
        - !Ref PythonHelpersLambdaLayer
        - !Ref PythonAuthenticationLambdaLayer
      Events:
        ApiLoginEvent:
          Type: Api
          Properties:
            Path: /auth/login
            Method: POST
            RestApiId: !Ref BankingApiGateway
            Auth:
              Authorizer: NONE
        ApiTokenRefreshEvent:
          Type: Api
          Properties:
            Path: /auth/refresh
            Method: POST
            RestApiId: !Ref BankingApiGateway
            Auth:
              Authorizer: NONE
      Policies:
        - Statement:
            Effect: Allow
            Action:
              - cognito-idp:InitiateAuth
              - cognito-idp:RespondToAuthChallenge
              - cognito-idp:AdminInitiateAuth
              - cognito-idp:AdminRespondToAuthChallenge
            Resource: !GetAtt BankingUserPool.Arn
  CognitoPostSignUpFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${AWS::StackName}-cognito-post-sign-up-function
      Description: !Sub
        - Stack ${AWS::StackName} Function ${ResourceName} for Stage ${Environment}
        - ResourceName: CognitoPostSignUpFunction
      CodeUri: functions/cognito/post_sign_up/
      Handler: post_sign_up.app.lambda_handler
      Environment:
        Variables:
          ACCOUNTS_TABLE_NAME: !Ref AccountsTable
          DYNAMODB_ENDPOINT: ''
      Layers:
        - !Ref PythonHelpersLambdaLayer
        - !Ref PythonAccountsLambdaLayer
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref AccountsTable
        - Statement:
            - Effect: Allow
              Action:
                - ses:SendEmail
                - ses:SendRawEmail
              Resource: '*'
  MonthlyAccountReportsTriggerFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${AWS::StackName}-monthly-account-reports-trigger-function
      Description: !Sub
        - Stack ${AWS::StackName} Function ${ResourceName} for Stage ${Environment}
        - ResourceName: MonthlyAccountReportsTriggerFunction
      CodeUri: functions/monthly_reports/accounts/trigger/
      Handler: trigger.app.lambda_handler
      Timeout: 300
      Environment:
        Variables:
          ACCOUNTS_TABLE_NAME: !Ref AccountsTable
          STATE_MACHINE_ARN: !Ref StateMachine
          CONTINUATION_QUEUE_URL: !Ref MonthlyAccountReportsContinuationQueue
          DLQ_URL: !Ref MonthlyAccountReportsContinuationDLQ
          DYNAMODB_ENDPOINT: ''
          SQS_ENDPOINT: ''
      Events:
        MonthlySchedule:
          Type: Schedule
          Properties:
            Name: !Sub ${AWS::StackName}-monthly-accounts-reports-trigger
            Schedule: cron(0 0 1 * ? *)
            Description: !Sub Monthly accounts reports trigger for ${Environment}
      Layers:
        - !Ref PythonHelpersLambdaLayer
        - !Ref PythonMonthlyReportsLambdaLayer
      ReservedConcurrentExecutions: 1
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref AccountsTable
        - StepFunctionsExecutionPolicy:
            StateMachineName: !GetAtt StateMachine.Name
        - Statement:
            Effect: Allow
            Action:
              - sqs:SendMessage
              - sqs:GetQueueAttributes
              - sqs:GetQueueUrl
            Resource: !GetAtt MonthlyAccountReportsContinuationQueue.Arn
        - Statement:
            Effect: Allow
            Action:
              - sqs:SendMessage
              - sqs:GetQueueAttributes
              - sqs:GetQueueUrl
            Resource: !GetAtt MonthlyAccountReportsContinuationDLQ.Arn
  MonthlyAccountReportsProcessPendingReportsFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${AWS::StackName}-monthly-accounts-reports-continuation
      Description: !Sub
        - Stack ${AWS::StackName} Function ${ResourceName} for Stage ${Environment}
        - ResourceName: MonthlyAccountReportsProcessPendingReportsFunction
      CodeUri: functions/monthly_reports/accounts/process_pending_reports/
      Handler: process_pending_reports.app.lambda_handler
      Timeout: 150
      Environment:
        Variables:
          ACCOUNTS_TABLE_NAME: !Ref AccountsTable
          STATE_MACHINE_ARN: !Ref StateMachine
          CONTINUATION_QUEUE_URL: !Ref MonthlyAccountReportsContinuationQueue
          DLQ_URL: !Ref MonthlyAccountReportsContinuationDLQ
          DYNAMODB_ENDPOINT: ''
          SQS_ENDPOINT: ''
      Events:
        SQSEvent:
          Type: SQS
          Properties:
            Queue: !GetAtt MonthlyAccountReportsContinuationQueue.Arn
            BatchSize: 1
            Enabled: true
      Layers:
        - !Ref PythonHelpersLambdaLayer
        - !Ref PythonMonthlyReportsLambdaLayer
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref AccountsTable
        - StepFunctionsExecutionPolicy:
            StateMachineName: !GetAtt StateMachine.Name
        - Statement:
            Effect: Allow
            Action:
              - sqs:ReceiveMessage
              - sqs:DeleteMessage
              - sqs:GetQueueAttributes
              - sqs:GetQueueUrl
            Resource: !GetAtt MonthlyAccountReportsContinuationQueue.Arn
        - Statement:
            Effect: Allow
            Action:
              - sqs:SendMessage
              - sqs:GetQueueAttributes
              - sqs:GetQueueUrl
            Resource: !GetAtt MonthlyAccountReportsContinuationDLQ.Arn
  CreateAccountsReportFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${AWS::StackName}-create-accounts-report
      Description: !Sub
        - Stack ${AWS::StackName} Function ${ResourceName} for Stage ${Environment}
        - ResourceName: CreateAccountsReportFunction
      CodeUri: functions/monthly_reports/accounts/create_report
      Handler: create_report.app.lambda_handler
      Environment:
        Variables:
          REPORTS_BUCKET: !Ref MonthlyReportsBucket
      Layers:
        - !Ref PythonHelpersLambdaLayer
      Policies:
        - S3WritePolicy:
            BucketName: !Ref MonthlyReportsBucket
        - Statement:
            Effect: Allow
            Action:
              - s3:GetObject
            Resource: !Sub ${MonthlyReportsBucket.Arn}/*
  AccountsReportsNotifyClientFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${AWS::StackName}-account-reports-notify-client
      Description: !Sub
        - Stack ${AWS::StackName} Function ${ResourceName} for Stage ${Environment}
        - ResourceName: AccountsReportsNotifyClientFunction
      CodeUri: functions/monthly_reports/accounts/notify_client
      Handler: notify_client.app.lambda_handler
      Environment:
        Variables:
          REPORTS_BUCKET: !Ref MonthlyReportsBucket
          COGNITO_USER_POOL_ID: !Ref BankingUserPool
          COGNITO_CLIENT_ID: !Ref BankingUserPoolClient
          ACCOUNTS_TABLE_NAME: !Ref AccountsTable
          DYNAMODB_ENDPOINT: ''
      Events:
        ApiRequestNewMonthlyAccountReportEvent:
          Type: Api
          Properties:
            Path: /accounts/{account_id}/reports/{statement_period}
            Method: GET
            RestApiId: !Ref BankingApiGateway
            Auth:
              Authorizer: CognitoAuthorizer
      Layers:
        - !Ref PythonHelpersLambdaLayer
        - !Ref PythonAuthenticationLambdaLayer
        - !Ref PythonAccountsLambdaLayer
      Policies:
        - Statement:
            Effect: Allow
            Action:
              - s3:GetObject
            Resource: !Sub ${MonthlyReportsBucket.Arn}/*
        - Statement:
            Effect: Allow
            Action:
              - cognito-idp:AdminGetUser
            Resource: !GetAtt BankingUserPool.Arn
        - DynamoDBReadPolicy:
            TableName: !Ref AccountsTable
        - Statement:
            - Effect: Allow
              Action:
                - ses:SendEmail
                - ses:SendRawEmail
              Resource: '*'
  # --- Lambda Layers ---
  PythonHelpersLambdaLayer:
    Type: AWS::Serverless::LayerVersion
    Properties:
      LayerName: !Sub ${AWS::StackName}-banking-python-helpers-layer
      ContentUri: layers/python/helpers
      CompatibleRuntimes:
        - python3.12
    Metadata:
      BuildMethod: python3.12
      BuildArchitecture: x86_64
  PythonAccountsLambdaLayer:
    Type: AWS::Serverless::LayerVersion
    Properties:
      LayerName: !Sub ${AWS::StackName}-banking-python-accounts-layer
      ContentUri: layers/python/accounts
      CompatibleRuntimes:
        - python3.12
    Metadata:
      BuildMethod: python3.12
      BuildArchitecture: x86_64
  PythonAuthenticationLambdaLayer:
    Type: AWS::Serverless::LayerVersion
    Properties:
      LayerName: !Sub ${AWS::StackName}-banking-python-authentication-layer
      ContentUri: layers/python/authentication
      CompatibleRuntimes:
        - python3.12
    Metadata:
      BuildMethod: python3.12
      BuildArchitecture: x86_64
  PythonMonthlyReportsLambdaLayer:
    Type: AWS::Serverless::LayerVersion
    Properties:
      LayerName: !Sub ${AWS::StackName}-banking-python-monthly-reports-layer
      ContentUri: layers/python/monthly_reports
      CompatibleRuntimes:
        - python3.12
    Metadata:
      BuildMethod: python3.12
      BuildArchitecture: x86_64
  # --- Log Groups ---
  RequestTransactionFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      LogGroupName: !Sub /aws/lambda/${RequestTransactionFunction}
      RetentionInDays: 7
  AuthFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      LogGroupName: !Sub /aws/lambda/${AuthFunction}
      RetentionInDays: 7
  ProcessTransactionsFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      LogGroupName: !Sub /aws/lambda/${ProcessTransactionsFunction}
      RetentionInDays: 7
  GetTransactionsFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      LogGroupName: !Sub /aws/lambda/${GetTransactionsFunction}
      RetentionInDays: 7
  CognitoPostSignUpFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      LogGroupName: !Sub /aws/lambda/${CognitoPostSignUpFunction}
      RetentionInDays: 7
  GetAccountsFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      LogGroupName: !Sub /aws/lambda/${GetAccountsFunction}
      RetentionInDays: 7
  MonthlyAccountReportsTriggerFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      LogGroupName: !Sub /aws/lambda/${MonthlyAccountReportsTriggerFunction}
      RetentionInDays: 7
  MonthlyAccountReportsProcessPendingReportsFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      LogGroupName: !Sub /aws/lambda/${MonthlyAccountReportsProcessPendingReportsFunction}
      RetentionInDays: 7
  GetAccountTransactionsFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      LogGroupName: !Sub /aws/lambda/${GetAccountTransactionsFunction}
      RetentionInDays: 7
  CreateAccountsReportFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      LogGroupName: !Sub /aws/lambda/${CreateAccountsReportFunction}
      RetentionInDays: 7
  AccountsReportsNotifyClientLogGroup:
    Type: AWS::Logs::LogGroup
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      LogGroupName: !Sub /aws/lambda/${AccountsReportsNotifyClientFunction}
      RetentionInDays: 7
  # --- DynamoDB Table for Transactions ---
  TransactionsTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: !Sub ${AWS::StackName}-transactions-table
      KeySchema:
        - AttributeName: idempotencyKey
          KeyType: HASH
      AttributeDefinitions:
        - AttributeName: idempotencyKey
          AttributeType: S
        - AttributeName: id
          AttributeType: S
        - AttributeName: userId
          AttributeType: S
        - AttributeName: accountId
          AttributeType: S
        - AttributeName: createdAt
          AttributeType: S
      BillingMode: PAY_PER_REQUEST
      PointInTimeRecoverySpecification:
        PointInTimeRecoveryEnabled: true
      SSESpecification:
        SSEEnabled: true
      GlobalSecondaryIndexes:
        - IndexName: TransactionIdIndex
          KeySchema:
            - AttributeName: id
              KeyType: HASH
          Projection:
            ProjectionType: ALL
        - IndexName: UserIdIndex
          KeySchema:
            - AttributeName: userId
              KeyType: HASH
          Projection:
            ProjectionType: ALL
        - IndexName: AccountDateIndex
          KeySchema:
            - AttributeName: accountId
              KeyType: HASH
            - AttributeName: createdAt
              KeyType: RANGE
          Projection:
            ProjectionType: ALL
      TimeToLiveSpecification:
        AttributeName: ttlTimestamp
        Enabled: true
      StreamSpecification:
        StreamViewType: NEW_IMAGE
  # --- DynamoDB Table for Accounts ---
  AccountsTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: !Sub ${AWS::StackName}-accounts-table
      KeySchema:
        - AttributeName: accountId
          KeyType: HASH
      AttributeDefinitions:
        - AttributeName: accountId
          AttributeType: S
        - AttributeName: userId
          AttributeType: S
      BillingMode: PAY_PER_REQUEST
      PointInTimeRecoverySpecification:
        PointInTimeRecoveryEnabled: true
      SSESpecification:
        SSEEnabled: true
      GlobalSecondaryIndexes:
        - IndexName: UserIdIndex
          KeySchema:
            - AttributeName: userId
              KeyType: HASH
          Projection:
            ProjectionType: ALL
      TimeToLiveSpecification:
        AttributeName: ttlTimestamp
        Enabled: true
  # --- SQS Queues ---
  MonthlyAccountReportsContinuationQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: !Sub ${AWS::StackName}-monthly-account-reports-continuation-queue
      VisibilityTimeout: 200
      MessageRetentionPeriod: 1209600 # 14 days
      ReceiveMessageWaitTimeSeconds: 20
      RedrivePolicy:
        deadLetterTargetArn: !GetAtt MonthlyAccountReportsContinuationDLQ.Arn
        maxReceiveCount: 3
  MonthlyAccountReportsContinuationDLQ:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: !Sub ${AWS::StackName}-monthly-account-reports-dlq
  MonthlyAccountReportsCreationDLQ:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: !Sub ${AWS::StackName}-monthly-account-reports-creation-dlq
  TransactionProcessingDLQ:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: !Sub ${AWS::StackName}-transaction-processing-dlq
  # --- Permissions ---
  CognitoPostSignUpFunctionPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref CognitoPostSignUpFunction
      Action: lambda:InvokeFunction
      Principal: cognito-idp.amazonaws.com
      SourceArn: !GetAtt BankingUserPool.Arn
  # S3 Buckets
  MonthlyReportsBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${AWS::StackName}-monthly-reports-bucket
      VersioningConfiguration:
        Status: Enabled
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      LifecycleConfiguration:
        Rules:
          - Id: TransitionToIA
            Status: Enabled
            Transitions:
              - TransitionInDays: 90
                StorageClass: STANDARD_IA
              - TransitionInDays: 365
                StorageClass: GLACIER
  # Domain Configuration
  ApiCertificate:
    Type: AWS::CertificateManager::Certificate
    Properties:
      DomainName: !Sub '{{resolve:ssm:/banking-app/${Environment}/DomainName}}'
      ValidationMethod: DNS
      DomainValidationOptions:
        - DomainName: !Sub '{{resolve:ssm:/banking-app/${Environment}/DomainName}}'
          HostedZoneId: !Sub '{{resolve:ssm:/banking-app/${Environment}/Route53HostedZoneId}}'
  # State machines
  StateMachine:
    Type: AWS::Serverless::StateMachine
    Properties:
      Name: !Sub ${AWS::StackName}-monthly-reports-creation-state-machine
      Type: STANDARD
      Definition:
        StartAt: GetAccountTransactions
        States:
          GetAccountTransactions:
            Type: Task
            Resource: !GetAtt GetAccountTransactionsFunction.Arn
            Next: CreateAccountsReport
            Retry:
              - ErrorEquals: [ "States.ALL" ]
                IntervalSeconds: 5
                MaxAttempts: 3
                BackoffRate: 2.0
            Catch:
              - ErrorEquals: [ "States.ALL" ]
                ResultPath: $.error
                Next: SendToDLQ
          CreateAccountsReport:
            Type: Task
            Resource: !GetAtt CreateAccountsReportFunction.Arn
            Next: NotifyClient
            Retry:
              - ErrorEquals: [ "States.ALL" ]
                IntervalSeconds: 5
                MaxAttempts: 3
                BackoffRate: 2.0
            Catch:
              - ErrorEquals: [ "States.ALL" ]
                ResultPath: $.error
                Next: SendToDLQ
          NotifyClient:
            Type: Task
            Resource: !GetAtt AccountsReportsNotifyClientFunction.Arn
            End: true
            Retry:
              - ErrorEquals: [ "States.ALL" ]
                IntervalSeconds: 10
                MaxAttempts: 2
                BackoffRate: 2.0
            Catch:
              - ErrorEquals: [ "States.ALL" ]
                ResultPath: $.error
                Next: SendToDLQ
          SendToDLQ:
            Type: Task
            Resource: arn:aws:states:::sqs:sendMessage
            Parameters:
              QueueUrl: !Ref MonthlyAccountReportsCreationDLQ
              MessageBody.$: $
            End: true
      Policies:
        - LambdaInvokePolicy:
            FunctionName: !Ref GetAccountTransactionsFunction
        - LambdaInvokePolicy:
            FunctionName: !Ref CreateAccountsReportFunction
        - LambdaInvokePolicy:
            FunctionName: !Ref AccountsReportsNotifyClientFunction
        - SQSSendMessagePolicy:
            QueueName: !GetAtt MonthlyAccountReportsCreationDLQ.QueueName
Provide feedback

Saved searches

Use saved searches to filter your results more quickly

FilesExpand file tree

template.yml

Latest commit

History

template.yml

File metadata and controls
