template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: 'AWS::Serverless-2016-10-31'
Description: >
  openbanking-expenses-ingest

  Exports expenses to google sheets using OpenBanking via the GoCardless Bank Account Data API

Parameters:
  BankName:
    Type: String
    Description: The name of the bank institution to use to authenticate with
    Default: Starling Bank
  BankCountry:
    Type: String
    Description: The country of the bank instutution to use
    Default: GB
  RequisitionNotificationAddress:
    Type: String
    Description: The email address to notify when user action is needed to generate a requisition
  TransactionListRecipient:
    Type: String
    Description: An email addresses to receive the final list of transactions
  TransactionListSender:
    Type: String
    Description: The email address to send the final list of transactions from
  TransactionCurrency:
    Type: String
    Description: The currencty to validate all transaction amounts against. Transactions not in this currency will be flagged
    Default: GBP
  AccountUsersObjectKey:
    Type: String
    Description: "The object key in the transactions bucket to find the list of account users. The required format is a JSON file containting an array of { DebtorName: string, Reference: string, ExportName: string }. For more detail see type AccountUser in get-transactions"

Resources:
  UpdateApiCredentialsFunction:
    Type: AWS::Serverless::Function
    Properties:
      Description: Renews or refreshes the access token for the GoCardless Bank Account Data API where necessary
      CodeUri: functions/update-api-credentials/
      Runtime: nodejs18.x
      Architectures:
        - x86_64
      Handler: index.handler
      Timeout: 30
      Policies:
        - SSMParameterReadPolicy:
            ParameterName: 'GoCardless/*'
    Metadata:
      BuildMethod: esbuild
      BuildProperties:
        Minify: true
        Target: 'es2020'
        EntryPoints:
          - index.ts
  
  UpdateRequisitionFunction:
    Type: AWS::Serverless::Function
    Properties:
      Description: Renews or refreshes the requisition for the GoCardless Bank Account Data API where necessary
      CodeUri: functions/update-requisition/
      Runtime: nodejs18.x
      Architectures:
        - x86_64
      Handler: index.handler
      Timeout: 30
      Policies:
        - DynamoDBReadPolicy:
            TableName: !Ref RequisitionTable
        - DynamoDBWritePolicy:
            TableName: !Ref RequisitionTable
        - SNSPublishMessagePolicy:
            TopicName: !GetAtt RequisitionSnsTopic.TopicName
        - Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - states:SendTaskSuccess
              Resource: !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:stateMachine:*
    Metadata:
      BuildMethod: esbuild
      BuildProperties:
        Minify: true
        Target: 'es2020'
        EntryPoints:
          - index.ts

  HandleRequisitionResponseFunction:
    Type: AWS::Serverless::Function
    Properties:
      Description: Handles the requisition complete response
      CodeUri: functions/handle-requisition-response/
      Environment:
        Variables:
          REQUISITIONS_TABLE_NAME: !Ref RequisitionTable
      Runtime: nodejs18.x
      Architectures:
        - x86_64
      Handler: index.handler
      Timeout: 30
      Events:
        RequisitionComplete:
          Type: Api
          Properties:
            Path: /requisition-complete
            Method: GET
            RestApiId: !Ref RequisitionApi
      Policies:
        - DynamoDBReadPolicy:
            TableName: !Ref RequisitionTable
        - DynamoDBWritePolicy:
            TableName: !Ref RequisitionTable
        - Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - states:SendTaskSuccess
              Resource: !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:stateMachine:*
    Metadata:
      BuildMethod: esbuild
      BuildProperties:
        Minify: true
        Target: 'es2020'
        EntryPoints:
          - index.ts
    
  GetTransactionsFunction:
    Type: AWS::Serverless::Function
    Properties:
      Description: Retreives transactions from the GoCardless Bank Account Data API, formats them, and saves to S3
      CodeUri: functions/get-transactions/
      Environment:
        Variables:
          TRANSACTIONS_BUCKET: !Ref TransactionsBucket
          REQUISITIONS_TABLE_NAME: !Ref RequisitionTable
          TRANSACTION_COUNTRY: !Ref BankCountry
          TRANSACTION_CURRENCY: !Ref TransactionCurrency
      Runtime: nodejs18.x
      Architectures:
        - x86_64
      Handler: index.handler
      Timeout: 30
      Policies:
        - DynamoDBReadPolicy:
            TableName: !Ref RequisitionTable
        - S3WritePolicy:
            BucketName: !Ref TransactionsBucket
        - S3ReadPolicy:
            BucketName: !Ref TransactionsBucket
    Metadata:
      BuildMethod: esbuild
      BuildProperties:
        Minify: true
        Target: 'es2020'
        EntryPoints:
          - index.ts
  
  SendTransactionsFunction:
    Type: AWS::Serverless::Function
    Properties:
      Description: Sends the transactions formatted as CSVs to the recipient
      CodeUri: functions/send-transactions/
      Environment:
        Variables:
          TRANSACTIONS_BUCKET: !Ref TransactionsBucket
          TRANSACTIONS_CONFIG_SET: !Ref SenderConfigSet
      Runtime: nodejs18.x
      Architectures:
        - x86_64
      Handler: index.handler
      Timeout: 30
      Policies:
        - Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - ses:SendRawEmail
              Resource:
                - !Sub arn:aws:ses:${AWS::Region}:${AWS::AccountId}:configuration-set/*
                - !Sub
                  - arn:aws:ses:${AWS::Region}:${AWS::AccountId}:identity/${Identity}
                  - Identity: !Ref TransactionListSender
        - S3ReadPolicy:
            BucketName: !Ref TransactionsBucket
    Metadata:
      BuildMethod: esbuild
      BuildProperties:
        Minify: true
        Target: 'es2020'
        EntryPoints:
          - index.ts

  CalculateDateRangeFunction:
    Type: AWS::Serverless::Function
    Properties:
      Description: Calculates the full date range for the previous month and invokes the state machine with appropriate input
      CodeUri: functions/calculate-date-range/
      Environment:
        Variables:
          STATE_MACHINE_ARN: !Ref IngestSharedExpensesStateMachine
      Policies:
        - StepFunctionsExecutionPolicy:
            StateMachineName: !GetAtt IngestSharedExpensesStateMachine.Name
      Events:
        StartOfMonth:
          Type: ScheduleV2
          Properties:
            Description: Invokes the OpenBanking Expenses Ingest state machine at the start of the month
            ScheduleExpression: cron(0 3 1 * ? *)
            FlexibleTimeWindow:
              MaximumWindowInMinutes: 180
              Mode: FLEXIBLE
      Runtime: nodejs18.x
      Architectures:
        - x86_64
      Handler: index.handler
      Timeout: 30
    Metadata:
      BuildMethod: esbuild
      BuildProperties:
        Minify: true
        Target: 'es2020'
        EntryPoints:
          - index.ts
  
  IngestSharedExpensesStateMachine:
    Type: AWS::Serverless::StateMachine
    Properties:
      DefinitionUri: statemachine/openbanking-expenses-ingest.json
      DefinitionSubstitutions:
        UpdateApiCredentialsFunctionARN: !Ref UpdateApiCredentialsFunction
        UpdateRequisitionFunctionARN: !Ref UpdateRequisitionFunction
        SecretIdParamName: /GoCardless/Secret-Id
        SecretKeyParamName: /GoCardless/Secret-Key
        AccessTokenParamName: /GoCardless/Access-Token
        AccessTokenExpiresParamName: /GoCardless/Access-Token-Expires
        RefreshTokenParamName: /GoCardless/Refresh-Token
        RefreshTokenExpiresParamName: /GoCardless/Refresh-Token-Expires
        RequisitionReferenceParamName: /GoCardless/Requisition-Reference
        BankName: !Ref BankName
        BankCountry: !Ref BankCountry
        RequisitionTableName: !Ref RequisitionTable
        RequisitionNotificationTopicARN: !Ref RequisitionSnsTopic
        RequisitionCompleteEndpointUrl: !Sub
          - "https://${ApiId}.execute-api.${AWS::Region}.amazonaws.com/v1/requisition-complete"
          - ApiId: !Ref RequisitionApi
        GetTransactionsFunctionARN: !Ref GetTransactionsFunction
        TransactionCurrency: !Ref TransactionCurrency
        AccountUsersKey: !Ref AccountUsersObjectKey
        AccountUsersBucket: !Ref TransactionsBucket
        SendTransactionsFunctionARN: !Ref SendTransactionsFunction
        TransactionListSender: !Ref TransactionListSender
        TransactionListRecipient: !Ref TransactionListRecipient
      Policies:
        - LambdaInvokePolicy:
            FunctionName: !Ref UpdateApiCredentialsFunction
        - LambdaInvokePolicy:
            FunctionName: !Ref UpdateRequisitionFunction
        - LambdaInvokePolicy:
            FunctionName: !Ref GetTransactionsFunction
        - LambdaInvokePolicy:
            FunctionName: !Ref SendTransactionsFunction
        - SSMParameterReadPolicy:
            ParameterName: 'GoCardless/*'
        - Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - ssm:PutParameter
              Resource: !Sub 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/GoCardless/*'
            - Effect: Allow
              Action:
                - states:SendTaskSuccess
              Resource: !Sub arn:aws:states:${AWS::Region}:${AWS::AccountId}:stateMachine:*

  RequisitionTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: GoCardless-Requisition
      AttributeDefinitions:
        - AttributeName: reference
          AttributeType: S
      KeySchema:
        - AttributeName: reference
          KeyType: HASH
      BillingMode: PAY_PER_REQUEST
      TimeToLiveSpecification:
        AttributeName: expires
        Enabled: true
  
  RequisitionApi:
    Type: AWS::Serverless::Api
    Properties:
      Name: GoCardless Requisition API
      Description: "API to update the status of requisitions when they have been authorized by the end user"
      StageName: v1
      MethodSettings:
        - ResourcePath: /requisition-complete
          HttpMethod: GET
  
  RequisitionSnsTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: GoCardless-Bank-Account-Data-Agreement
      DisplayName: GoCardless Bank Account API agreement notification
      Subscription:
        - Endpoint: !Ref RequisitionNotificationAddress
          Protocol: email

  TransactionsBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets : true
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      VersioningConfiguration:
        Status: Enabled
  
  SenderIdentity:
    Type: AWS::SES::EmailIdentity
    Properties:
      EmailIdentity: !Ref TransactionListSender
      DkimAttributes:
        SigningEnabled: true

  SenderConfigSet:
    Type: AWS::SES::ConfigurationSet