APIs, Auth, Hosting, Database & Network
Verified 2026-07-07 · account 660537473428, us-east-1
API Gateways (REST)
Section titled “API Gateways (REST)”| API name | ID | Base URL | Created | Authorizer (verified live) |
|---|---|---|---|---|
prod_JBWApiGateway | 18hyg9k8il | https://18hyg9k8il.execute-api.us-east-1.amazonaws.com/prod | 2024-05-06 | jb360-prod-authorizer (COGNITO_USER_POOLS, id 35bgmj) — confirmed attached on sampled methods |
dev_JBWApiGateway | hem88xn7p1 | https://hem88xn7p1.execute-api.us-east-1.amazonaws.com/dev | 2024-04-27 | jb360-stage-authorizer (COGNITO_USER_POOLS) |
JB360IntegrationAPI | cxjxljcmdb | https://cxjxljcmdb.execute-api.us-east-1.amazonaws.com/... | 2026-01-13 | jb360ApiAuthorizer (TOKEN → api_cognitoclienttokenauthorizer Lambda) |
The two portal gateway URLs match REACT_APP_AWS_GATEWAY_BASE_URL in jbwui’s prod.env / stage.env. JB360IntegrationAPI is the vendor/machine API fronting the jb360dealer Java Lambdas (source not in this repo).
Reminder from the source analysis: the SAM template creates the API without an authorizer; jbwapiauthorizerupdate must be invoked after any API redeploy to re-attach Cognito auth (currently attached).
Cognito User Pools
Section titled “Cognito User Pools”| Pool name | Pool ID | Role |
|---|---|---|
st-production-userpool | us-east-1_lhudmLLTj | JB360 portal login, prod (app client in jbwui/prod.env) |
st-sandbox-userpool | us-east-1_orCz2GNHt | JB360 portal login, stage (app client in jbwui/stage.env) |
jb360-api-production | us-east-1_wjhx9Cq8G | Vendor API tokens (validated by cognitoclienttokenauthorizer, scope https://jb360api.jbwarranties.com/apivendor) |
jb360-api-sandbox | us-east-1_L286Ab1Sh | Vendor API tokens, sandbox |
(Two CloudWatchDashboardSharing pools also exist — unrelated to this system.)
Frontend Hosting (S3 + CloudFront)
Section titled “Frontend Hosting (S3 + CloudFront)”| Env | CloudFront ID | CloudFront domain | Alias | Origin bucket |
|---|---|---|---|---|
| prod | E2KRETR1VH71KG | d2wq0tovu23xkl.cloudfront.net | jbw360.jbwarranties.com | jbw-prod-api-websitebucket-kngktu57hpif |
| stage | E28GJHAKWEKWHR | d3343daew4orp4.cloudfront.net | jbw360-stage.jbwarranties.com | jbw-stage-api-websitebucket-uqwzkpdkbfvb |
Deploying the UI = build jbwui with the matching env file and upload build/ to the bucket (then invalidate the distribution).
Database (MySQL / RDS) — verified
Section titled “Database (MySQL / RDS) — verified”| prod | stage | |
|---|---|---|
| Instance (⚠ naming) | jbw-st-integration (db.m6gd.xlarge, MySQL 8.0.44) | jbw-staging-st-integration (db.t4g.medium, MySQL 8.0.44) |
| RDS Proxy | jbw-prod-st-integration-proxy (resource id prx-0ad5bf52278468d5a) | jbw-st-integration-proxy (prx-0a2a653c0d593dfd7) |
| Proxy endpoint | jbw-prod-st-integration-proxy.proxy-czu4p9n2bibm.us-east-1.rds.amazonaws.com | jbw-st-integration-proxy.proxy-czu4p9n2bibm.us-east-1.rds.amazonaws.com |
| Proxy target (verified) | → jbw-st-integration (AVAILABLE) | → jbw-staging-st-integration (AVAILABLE) |
| Schema | jbwst | jbwst |
| Auth | IAM (rds-db:connect against the proxy; token via RDS Signer) | same |
| Credentials secret | rds!db-de12ec20-ee82-414a-a70a-1cb63b7e6728 (managed) | rds!db-18e624a3-84c7-4c31-979e-bfc7d471cbd1 |
The production instance has no “prod” in its name — jbw-st-integration is prod; only the proxy is prefixed prod. (A stale direct hostname with a different region-id string sits in extraction/src/main/resources/application.yml as a dev fallback.)
Schema, views, and stored-procedure logic are documented in database.md.
Network — verified
Section titled “Network — verified”Two VPCs are in play; prod and stage live in different VPCs:
| Resource | ID | Notes |
|---|---|---|
| JBW Network VPC (prod) | vpc-0541449e6318d65ff | 172.18.0.0/16, name “JBW Network” |
| Prod Lambda security group | sg-0b52dda01c1c42aff | default SG of the JBW Network VPC (in template.yaml Globals) |
| Prod Lambda subnets | subnet-08ca77c384ae0607c (“Private subnet”, us-east-1d, 172.18.1.0/24) · subnet-08e7d0a539b237f14 (“prod-private-subnet-2”, us-east-1a, 172.18.6.0/24) | in template.yaml Globals |
| NAT gateway (JBW Network) | nat-0733332cebdc114ed in subnet-014eb7cc35dc68f71, EIP 18.235.78.124 | prod Lambda egress |
| Default VPC (stage) | vpc-0d29d310746998b07 | 172.31.0.0/16 |
| Stage Lambda security group | sg-07057b1e842a6e0ba | default SG of the default VPC |
| Stage private subnets | subnet-0a80174ad9d0e144d (“stage-private-subnet-1”, us-east-1a) · subnet-0eefff7f21d82c4ea (“stage-private-subnet-2”, us-east-1b) | |
| NAT gateway (default VPC) | nat-04d8cd1ae3fd5c946 in subnet-090e108cd0ad09fb0 (“public-subnet-1”), EIP 34.195.93.175 | stage Lambda egress; matches the Jan-2024 setup notes |
Private subnets egress via their VPC’s NAT gateway (required for Lambdas in a VPC to reach ServiceTitan/JBW APIs).
SES is used by the notification/user-flow Lambdas (signup, password, pending agreements/claims emails) with sender/admin support@jbwarranties.com (prod parameter JBWADMINEMAIL).