template.yaml

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: >
  This application syncs BUNQ transactions to YNAB. You need to add your BUNQ api_token 
  and YNAB accesstoken.

Metadata:
  AWS::ServerlessRepo::Application:
    Name: bunq-ynab-aws-lambda
    Description: >
      This application syncs BUNQ transactions to YNAB. You need to run the function 
      to list your accounts and budgets. Next add these to your SSM parameter json. 
      Finally set the LIST_MODE environment variable to 0. Full instructions in the
      README file.
    Author: Wessel Troost and Javy de Koning and Nick Strijbos
    ReadmeUrl: README.md
    SpdxLicenseId: GPL-2.0-only
    LicenseUrl: LICENSE
    Labels: ["Bunq", "Ynab"]
    HomePageUrl: https://github.com/wesselt/bunq2ynab
    SemanticVersion: 1.4.4
    SourceCodeUrl: https://github.com/wesselt/bunq2ynab

Parameters:
  BunqApiToken:
    Type: String
    Description: Your BUNQ API Token
  YnabAccessToken:
    Type: String
    Description: Your YNAB access token
  YnabBudget:
    Type: String
    Description: Name of your YNAB budget (use * for all budgets)

Resources:
  Bunq2YnabLayer:
    Type: AWS::Serverless::LayerVersion
    Properties:
      ContentUri: aws-layer-content
      CompatibleRuntimes:
        - python3.12
    Metadata:
      BuildMethod: makefile

  Bunq2YnabFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Metadata:
      BuildMethod: makefile
    Properties:
      CodeUri: ./
      Handler: lambda_function.lambda_handler
      Runtime: python3.12
      Layers:
        - !Ref Bunq2YnabLayer
      MemorySize: 512
      Timeout: 180 # 3 minutes
      Environment:
        Variables:
          LOG_LEVEL: "INFO"
      Policies:
        - Statement:
            - Sid: SSMGetConfig
              Effect: Allow
              Action:
                - ssm:GetParameter
              Resource:
                [
                  !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/bunq2ynab-config",
                ]
            - Sid: SSMGetPutState
              Effect: Allow
              Action:
                - ssm:GetParameter
                - ssm:PutParameter
              Resource:
                [
                  !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/bunq2ynab-state",
                ]
      Events:
        CloudWatchCronEvent:
          Type: Schedule
          Properties:
            Schedule: rate(8 hours)
        HttpApiEvent:
          Type: HttpApi
          Properties:
            ApiId: !Ref HttpApi
            Path: /bunq2ynab-lambda
            Method: POST

  HttpApi:
    Type: AWS::Serverless::HttpApi
    Properties:
      DefaultRouteSettings:
        ThrottlingBurstLimit: 1 # 1 request per second
        ThrottlingRateLimit: 0.1 # 1 request per 10 seconds

  ConfigJSON:
    Type: AWS::SSM::Parameter
    Properties:
      Name: bunq2ynab-config
      Type: String
      Value: !Sub >
        {
          "api_token": "${BunqApiToken}",
          "personal_access_token": "${YnabAccessToken}",
          "accounts": [
            {
              "ynab_budget_name": "${YnabBudget}"
            }
          ]
        }

  StateJSON:
    Type: AWS::SSM::Parameter
    Properties:
      Name: bunq2ynab-state
      Type: String
      Value: !Sub >
        {
          "private_key": "",
          "private_key_for_api_token": "",
          "installation_token": "",
          "device_registered": "",
          "session_token": "",
          "aws_callback": "https://${HttpApi}.execute-api.${AWS::Region}.amazonaws.com/bunq2ynab-lambda"
        }