Infrastructure

Service-owned infrastructure is AWS, defined in Terraform under deploy/ and applied per environment by .github/workflows/deploy.yaml; the JPM webhook gateway and every DynamoDB table are owned elsewhere (API Gateways, DynamoDB Tables). The application identifier is payments; resource names carry the site-payments- prefix (test, staging, or prod). Staging is a separate AWS account configured like test. Two regions are in play:

Region Holds test staging prod

Primary (AWS_DEFAULT_REGION)

Lambdas, API gateways, queues, the site-payments single table, the KMS key

us-west-2

us-east-2

us-east-2

Legacy (dynamo_legacy_region)

The payments table and its stream, kinesis-feeder (its package in floatme-site-media-legacy where this region differs from the primary), the other un-prefixed tables

us-west-2

us-east-1

us-east-1

Lambda Functions

Timeouts marked * derive from the consumed queue’s visibility timeout (90%; 50% for prenoter and debit-card-fixer). Memory is the fmtf-module-lambda default unless shown.

Function Trigger Timeout Memory Concurrency Key IAM Permissions

site-payments-api

API Gateway site-payments + site-payments-rest

300s

256 MB in prod (512 elsewhere)

—

DynamoDB R/W on payments, pinless-default-card, pinless-changes, site-float-service-log, usio-debit-refunds, Usio staging tables, site-payments; KMS encrypt/decrypt; invoke LOC, Users, Underwriting, Floats, Admin API, Txn; all Usio, JPM, salt, segment, growthbook, appsflyer, iterable secrets

site-payments-prenoter

SQS site-payments-prenotes (batch 10)

30s*

default

5

Invoke the site-payments API

site-payments-check-ach-scheduler

EventBridge check-ach

900s

2048 MB

—

DynamoDB Query payments + indexes; SQS SendMessage check-ach

site-payments-check-ach-worker

SQS site-payments-check-ach (batch 10)

54s*

default

5

DynamoDB PutItem payments; invoke Txn, Floats; JPM transport/public certs, growthbook secrets

site-payments-usio-scheduler

EventBridge (three Usio rules)

30s

default

—

SQS SendMessage usio-sync

site-payments-usio-syncer

SQS site-payments-usio-sync (batch 1)

810s*

1024 MB

1

DynamoDB BatchWrite/Get on Usio staging tables; Query/Get/Put on payments, site-payments, usio-debit-refunds; read pinless-default-card; invoke the API; all Usio + segment secrets

site-payments-blocklist-remover

SQS site-payments-blocklist-remove (batch 10)

540s*

default

5

DynamoDB PutItem site-payments

site-payments-kinesis-feeder

DynamoDB Stream on payments (LATEST); deployed in dynamo_legacy_region

840s

default

—

Kinesis PutRecord(s) on site-payments; stream read

site-payments-jpm-webhook-handler

API Gateway jpm.webhooks.floatme.io

300s

default

—

SQS SendMessage jpm-webhooks

site-payments-jpm-webhook-processor

SQS site-payments-jpm-webhooks (batch 10)

540s*

default

5

DynamoDB Get/Put payments

site-payments-blocklist-handler

Kinesis site-payments (see Kinesis)

840s

default

—

DynamoDB Put/Delete site-payments; invoke Txn, Users; growthbook, iterable secrets

site-payments-balance-reporter

EventBridge balance-reporter, balance-reporter-hourly

60s

default

—

Usio float_credit, loan_credit, slack secrets

site-payments-jpm-syncer

EventBridge jpm-syncer

600s

default

—

DynamoDB PutItem jpm-transaction-details; JPM transport/public certs

site-payments-usio-refresh-scheduler

EventBridge site-usio-token-refresh-event

600s

default

1

DynamoDB Query pinless-default-card, site-payments + indexes; SQS SendMessage usio-refresh

site-payments-usio-refresh-worker

SQS site-payments-usio-refresh (batch 10)

54s*

default

5

DynamoDB Put/Delete pinless-default-card; Put/Query/Delete site-payments; Usio main secret

site-payments-debit-card-fixer

SQS site-payments-debit-fixer (batch 10)

30s*

default

5

DynamoDB R/W pinless-default-card, pinless-changes, site-payments

SQS consumers other than prenoter, usio-syncer, and debit-card-fixer report partial batch failures (ReportBatchItemFailures).

API Gateways

Gateway Type Auth Integration

site-payments

HTTP API

AWS IAM

ANY /{proxy+} → site-payments-api, payload format 1.0, 30s timeout

site-payments-rest

REST API (regional)

AWS IAM

ANY /{proxy+} → site-payments-api (AWS_PROXY), 120s timeout, stage site, execution logs with 7-day retention

jpm.webhooks.floatme.io

HTTP API in the infrastructure repo (aws/webhooks)

AWS IAM

Routes to site-payments-jpm-webhook-handler

site-payments is also reachable as payments.site.svc.floatme.io and site-payments-rest as payments-rest.site.svc.floatme.io (deploy/domain.tf): alias records in the infrastructure repo’s per-environment site.svc.floatme.io zone, using its wildcard certificate. The execute-api endpoints stay enabled for existing callers.

The API Lambda’s fmsdk/authorizer middleware admits a request whose IAM identity matches the service’s AWS account ID; any other request must carry authorizer claims whose subject equals the user_id in the route, which is how mobile requests arriving through the shared mobile API host are authorized. POST /qa/payments acts only when ENVIRONMENT is test or staging.

SQS Queues

Queue Visibility Max Receive Redrive DLQ Consumer

site-payments-prenotes

60s

10

site-payments-prenotes-dlq

prenoter

site-payments-usio-sync

900s

10

site-payments-usio-sync-dlq

usio-syncer

site-payments-check-ach

60s

1

site-payments-check-ach-dlq

check-ach-worker

site-payments-blocklist-remove

600s

10

site-payments-blocklist-remove-dlq

blocklist-remover

site-payments-jpm-webhooks

600s

10

site-payments-jpm-webhooks-dlq

jpm-webhook-processor

site-payments-usio-refresh

60s

1

site-payments-usio-refresh-dlq

usio-refresh-worker

site-payments-debit-fixer

60s

1

site-payments-usio-refresh-dlq

debit-card-fixer

All DLQs have a 900s visibility timeout. site-payments-debit-fixer-dlq is provisioned but no queue redrives to it. Producers are listed in Events.

Kinesis

site-payments is the outbound event stream (region kinesis_stream_region, defaulting to the primary region). kinesis-feeder writes it; blocklist-handler consumes it with filter data.type in SUBSCRIPTION_RETURNED, FLOAT_DEBIT_RETURNED, batch size 10, parallelization factor 2, starting position LATEST, BisectBatchOnFunctionError, and ReportBatchItemFailures. Other consumers are listed in Events.

DynamoDB Tables

Schemas and item types are in DynamoDB Tables. Terraform reads every table as a data source; none is created in this repo.

Table Region Role

payments

Legacy

Payment records; DynamoDB stream → kinesis-feeder

site-payments

Primary

Single table: debit cards, bank accounts, card attempts, blocklist, RTP cache, ACH risk reports, marketing locks

pinless-default-card

Legacy

One-card-per-user debit card mirror

pinless-changes

Legacy

Debit card change history

usio-debit-refunds

Legacy

Refund records

usio-debit-transactions, usio-credit-transactions

Legacy

Usio transaction staging

site-usio-tokenization-transactions

Primary

Usio tokenization-account staging

jpm-transaction-details

Legacy

JPM transaction detail staging

site-float-service-log

Primary

Fraud log

EventBridge

Rule Schedule Enabled Target Input

usio-transactions-syncer

cron(0/30 * ? * * *)

prod only

usio-scheduler

{"minutes":35,"job_type":"transactions"}

usio-ach-returns-syncer

cron(30 16 ? * * *)

prod only

usio-scheduler

{"today":true,"job_type":"ach_returns"}

usio-chargebacks-syncer

cron(30 20 ? * * *)

prod only

usio-scheduler

{"today":true,"job_type":"chargebacks"}

check-ach

cron(0 17 ? * * *)

always

check-ach-scheduler

—

site-usio-token-refresh-event

cron(0 15 ? * * *)

always

usio-refresh-scheduler

—

balance-reporter

cron(0 13 ? * * *)

prod only

balance-reporter

—

balance-reporter-hourly

rate(1 hour)

prod only

balance-reporter

{"hourly":true}

jpm-syncer

cron(0 13 ? * * *)

always

jpm-syncer

—

Secrets Manager

All secrets are namespaced site/…​.

Secret Contents Consumers

site/usio/main

Master (tokenization) merchant credentials

api, usio-syncer, usio-refresh-worker

site/usio/float_debit, site/usio/loan_debit, site/usio/subscription, site/usio/subscription_2

Debit merchant credentials

api, usio-syncer

site/usio/float_credit, site/usio/loan_credit

Credit merchant credentials

api, usio-syncer, balance-reporter

site/jpm/ach_info, site/jpm/signing_certs

JPM ACH account info; JWS signing cert

api

site/jpm/transport_certs, site/jpm/public_certs

mTLS client cert; JPM public certs

api, check-ach-worker, jpm-syncer

site/salt

Hash salt for account and card hashes

api

site/growthbook

GrowthBook SDK key

api, check-ach-worker, blocklist-handler

site/iterable

Iterable API key

api, blocklist-handler

site/segment

Segment write key

api, usio-syncer

site/appsflyer

AppsFlyer S2S key

api

site/slack

Slack bot token

balance-reporter

site/datadog/terraform

Datadog API and app keys

Terraform only

site/plaid

Plaid credentials

Data source only; no Lambda receives it

Provider endpoints: Usio https://payments.usiopay.com (prod) / https://devpayments.usiopay.com (elsewhere); JPM https://apigateway.jpmorgan.com (prod) / https://apigatewayqaf.jpmorgan.com (elsewhere).

KMS

alias/site-payments-bank-account (region kms_region, defaulting to the primary region) encrypts bank account and routing numbers — Bank Accounts. Only the API Lambda holds kms:Encrypt / kms:Decrypt.

Monitoring

Datadog monitors and SLOs exist in prod only (local.create_datadog_monitors in deploy/datadog.tf). Alerts outside prod go unread, and the old and new test accounts both deploy as test, so Datadog would reject the second account’s identical monitors as duplicates.

In prod, each SLO has a 99.9% target / 99.99% warning over 7-day and 30-day windows:

SLO Lambdas

Errors

prenoter, check-ach-scheduler, check-ach-worker, usio-scheduler, usio-syncer, blocklist-remover, api, kinesis-feeder, jpm-webhook-handler, jpm-webhook-processor, blocklist-handler, balance-reporter

Throughput

prenoter, check-ach-scheduler, usio-scheduler, usio-syncer, blocklist-remover, jpm-webhook-handler, jpm-webhook-processor, blocklist-handler, balance-reporter

Latency

prenoter, check-ach-scheduler, check-ach-worker, usio-scheduler, usio-syncer, blocklist-remover, api, kinesis-feeder, jpm-webhook-handler, jpm-webhook-processor, balance-reporter

The Datadog service definition registers payments as tier 1 (team devops) with links to the repo and https://docs.floatme.io/payments-service.