金融決済プラットフォーム（ISO 20022 / マルチリージョン Active-Active）

import * as cdk from "aws-cdk-lib";
import { Construct } from "constructs";
import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
import * as lambda from "aws-cdk-lib/aws-lambda";
import * as apigw from "aws-cdk-lib/aws-apigateway";
import * as sqs from "aws-cdk-lib/aws-sqs";
import * as events from "aws-cdk-lib/aws-events";
import * as cognito from "aws-cdk-lib/aws-cognito";
import * as wafv2 from "aws-cdk-lib/aws-wafv2";

// 東京/大阪の Active-Active。DynamoDB Global Table で取引台帳を双方向複製します。
export class Iso20022PaymentsStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const ledger = new dynamodb.TableV2(this, "Ledger", {
      partitionKey: { name: "txnId", type: dynamodb.AttributeType.STRING },
      billing: dynamodb.Billing.onDemand(),
      replicas: [{ region: "ap-northeast-3" }], // 大阪レプリカ
    });

    const queue = new sqs.Queue(this, "PaymentEvents");
    new events.EventBus(this, "PaymentBus");

    const fn = new lambda.Function(this, "PaymentSvc", {
      runtime: lambda.Runtime.NODEJS_20_X,
      handler: "index.handler",
      code: lambda.Code.fromInline("exports.handler = async () => ({ statusCode: 200, body: 'ok' });"),
      environment: { LEDGER: ledger.tableName, QUEUE_URL: queue.queueUrl },
    });
    ledger.grantReadWriteData(fn);
    queue.grantSendMessages(fn);

    const userPool = new cognito.UserPool(this, "ApiUsers");
    const api = new apigw.RestApi(this, "PaymentApi");
    const auth = new apigw.CognitoUserPoolsAuthorizer(this, "Auth", { cognitoUserPools: [userPool] });
    api.root.addProxy({
      defaultIntegration: new apigw.LambdaIntegration(fn),
      defaultMethodOptions: { authorizer: auth, authorizationType: apigw.AuthorizationType.COGNITO },
    });

    new wafv2.CfnWebACL(this, "Waf", {
      scope: "REGIONAL",
      defaultAction: { allow: {} },
      visibilityConfig: { cloudWatchMetricsEnabled: true, metricName: "paymentWaf", sampledRequestsEnabled: true },
      rules: [{
        name: "AWSCommon", priority: 1, overrideAction: { none: {} },
        statement: { managedRuleGroupStatement: { vendorName: "AWS", name: "AWSManagedRulesCommonRuleSet" } },
        visibilityConfig: { cloudWatchMetricsEnabled: true, metricName: "common", sampledRequestsEnabled: true },
      }],
    });
  }
}