AWS — Deployed Infrastructure

Live verification of account 660537473428 (us-east-1), performed 2026-07-07 and re-verified 2026-07-17 with read-only AWS CLI calls (list/get/describe only; nothing modified) plus a read-only inspection of the production database (information_schema and routine definitions only). Fills the runtime gaps the source-only docs couldn’t answer. No secret values appear in these pages.

At a glance

• Source-of-truth drift: CloudFormation last ran May 2024; everything since was deployed outside SAM — the repo describes 2024, the console describes today
• Live auth status: Cognito authorizers are attached on prod and dev portal APIs (the template’s deploy-time gap is remediated in the account)
• Missing IaC, not missing source: 39 prod Lambdas run outside the template, and jbw-api/ has no IaC at all — but every deployed function now has source in the repo
• Git lags production: code reaches the console first and the repo second — the July 2026 release is committed but not deployed
• prodapi_jb360dealer runs a scaffold, not the vendor API — details
• Secrets policy: these pages reference secret locations only — no values are reproduced

AWS Section Map

Page	Covers
lambda-inventory.md	All deployed functions, the extraction Lambdas’ real config, template-vs-deployed drift
schedules-and-queues.md	Every EventBridge schedule (the sync heartbeat) and SQS queue/DLQ wiring
apis-auth-hosting.md	API Gateways, live authorizer state, Cognito pools, CloudFront/S3 hosting, RDS instances/proxies, VPC/network layout
s3-buckets.md	The 13 JB360 buckets (SPA hosting, deploy jars, sync CSVs, vendor-API file store) detailed; out-of-scope buckets listed by name
database.md	The jbwst schema: all tables with row counts, views, and every stored procedure’s logic (matching engine, agreement factory, claims detection)
deployment-history.md	Origin of the system (Jan 2024 Maktix handover) and the manual deploy procedure

Headline Findings

1. CloudFormation is 2 years stale. Stack jbw-prod-api last updated 2024-05-06, jbw-stage-api 2024-04-27 — yet many Lambdas show 2025–2026 modification dates. Everything since May 2024 was deployed outside SAM. The repo’s template.yaml describes May 2024, not today.
2. A full dev/stage environment exists (101 dev_* functions, own API Gateway, Cognito pool, queue, jbw360-stage.jbwarranties.com) even though samconfig.toml only defines prod.
3. Cognito auth IS currently attached to both portal APIs — the template’s “deploys with no authorizer” risk is real at deploy time but remediated in the live account. Verified on all methods (79/79 prod, 80/80 dev), not a sample.
4. 39 prod Lambdas are not in the template. As of the July 2026 release every one of them has source in the repo — the gap is IaC coverage, not lost code.
5. A second, newer API exists: JB360IntegrationAPI (created 2026-01-13) fronting the jb360dealer Java Lambdas. Its source is in this repo, at jbw-api/ — but it has no template, no samconfig, and no CI.
6. The prod vendor API may be dead. prodapi_jb360dealer is configured with the stock SAM Java scaffold handler (example.Hello::handleRequest), no env vars, and no VPC — yet the prod stage of JB360IntegrationAPI routes to it. Details.
7. Production leads git, not the other way round. The July 2026 release is committed but not deployed; several of its functions were console-pushed before being committed, and the features the commit is named for shipped 5+ weeks earlier. Evidence.

Follow-ups Worth Considering

Governance (decide before changing anything):

• Decide the source of truth: re-adopt SAM (import drift, fix the template’s indentation bug) or officially treat the console as truth. Every other follow-up depends on this call.

Source recovery — ✅ closed 2026-07-16

• The ~12 repo-less prod functions now have source: 11 were added to jbw-sam/src/ by commit 1ce5b3e, and the jb360dealer API’s source was found at jbw-api/ (in the repo since 2026-05-20). Every deployed function can now be rebuilt and reviewed. What replaced this concern is IaC coverage — see the governance item above.

Security (verify before anything else):

• prodapi_jb360dealer is running the SAM scaffold. Confirm with the team whether the prod vendor API is dead or serving scaffold responses — it is publicly routed at api-jb360.jbwarranties.com/prod.
• GET /api-docs on JB360IntegrationAPI is unauthenticated and invokes the dev Spring Lambda, which holds DB credentials and VPC reach into the stage RDS proxy.
• Cross-tenant authorization gap in jbw-api — most routes trust the {dealerid} path parameter without checking the authenticated vendor is entitled to it. Not exposed unauthenticated (the authorizer is attached), but a valid vendor token reaches other vendors’ data. Details.
• An RDS IAM auth token is logged at INFO in jbw-api/src/main/java/com/maktix/jb/api/config/JpaConfiguration.java:71 — a live 15-minute DB credential written to CloudWatch.

Reliability (cheap fixes, real failure modes):

• Dev and Workiz queues have no DLQ — failures are silently dropped after retries. Re-confirmed 2026-07-17: only prodtenantList has a redrive policy.
• Duplicate daily schedules on prod_getTenantInfo and prod_jbwequipmentsyncstoredpro. Re-confirmed 2026-07-17: both pairs still enabled and functionally identical.
• jb360-api-file-store accumulates vendor PII forever — encrypted and not public, but versioning is off, there is no lifecycle policy, and there is no access logging.