aws-samples / aws-plaid-demo-app Goto Github PK

View Code? Open in Web Editor NEW

54.0 6.0 112.0 3.37 MB

Build a fintech app on AWS to link bank accounts using Plaid API

Home Page: https://aws.amazon.com/blogs/apn/how-to-build-a-fintech-app-on-aws-using-the-plaid-api/

License: MIT No Attribution

JavaScript 25.63% HTML 1.47% CSS 0.50% Makefile 0.32% Python 72.07%

plaid plaid-link aws aws-lambda dynamodb lambda serverless

aws-plaid-demo-app's Introduction

AWS Plaid Demo

Introduction
Architecture
Prerequisites
Tools and services
Usage
Clean up
Reference
Contributing
License

Introduction

This repo demonstrates how to build a Fintech app on AWS that uses Plaid Link to connect a user to their bank account. The app allows users to sign up using Amazon Cognito, select their bank from a list, log in to the bank, and display the accounts. The app is built using AWS Amplify, Amazon API Gateway, Amazon Cognito, AWS Secrets Manager, Amazon Simple Queue Service and Amazon DynamoDB.

Architecture

The architecture consists of a React application hosted on Amplify Hosting. The API is an AWS Lambda function behind an Amazon API Gateway. The API stores and retrieves data from DynamoDB. When webhooks are received from Plaid, those are stored in a FIFO SQS queue for processing.

Prerequisites

Python 3, installed
AWS Command Line Interface (AWS CLI) version 2, installed. Please follow these instructions with how to setup your AWS credentials.
AWS Serverless Application Model (SAM), installed
Docker Desktop, installed
GitHub account
Plaid account

Tools and services

AWS Lambda - AWS Lambda is a serverless compute service that lets you run code without provisioning or managing servers, creating workload-aware cluster scaling logic, maintaining event integrations, or managing runtimes.
Amazon Cognito - Amazon Cognito lets you add user sign-up, sign-in, and access control to your web and mobile apps quickly and easily. Amazon Cognito scales to millions of users and supports sign-in with social identity providers, such as Apple, Facebook, Google, and Amazon, and enterprise identity providers via SAML 2.0 and OpenID Connect.
Amazon API Gateway - Amazon API Gateway is a fully managed service that makes it easy for developers to create, publish, maintain, monitor, and secure APIs at any scale.
AWS Amplify - AWS Amplify is a complete solution that lets frontend web and mobile developers easily build, ship, and host full-stack applications on AWS, with the flexibility to leverage the breadth of AWS services as use cases evolve.
Amazon Simple Queue Service - Amazon Simple Queue Service (SQS) is a fully managed message queuing service that enables you to decouple and scale microservices, distributed systems, and serverless applications.
Amazon DynamoDB - Amazon DynamoDB is a fully managed, serverless, key-value NoSQL database designed to run high-performance applications at any scale.
AWS Secrets Manager - AWS Secrets Manager helps you manage, retrieve, and rotate database credentials, API keys, and other secrets throughout their lifecycles.
AWS CloudFormation - AWS CloudFormation lets you model, provision, and manage AWS and third-party resources by treating infrastructure as code.

Usage

Parameters

Parameter	Type	Default	Description
Environment	String	dev	Environment tag
GitHubOrg	String	aws-samples	Source code GitHub organization
GitHubRepo	String	aws-plaid-demo-app	Source code GitHub repository
PlaidClientId	String		Plaid Client ID
PlaidSecretKey	String		Plaid Secret Key
PlaidEnvironment	String	sandbox	Plaid Environment
GitHubAccessToken	String		GitHub Personal Access Token (PAT)

Installation

GitHub: Create a personal access token with the repo scope selected. The access token will be used by AWS Amplify to securely connect to your GitHub account to access the source code. Amplify will then build, deploy and host the application using Amplify Hosting.
GitHub: Fork the repository to your personal account. This is required so Amplify can access the repository and download the source code.
Plaid: Ensure you have both a client_id and Sandbox Secret available on the Keys page

git clone https://github.com/<GitHubUserName>/aws-plaid-demo-app
cd aws-plaid-demo-app
sam build --use-container --parallel --cached
sam deploy \
  --guided \
  --tags "GITHUB_ORG=<GitHubUserName> GITHUB_REPO=aws-plaid-demo-app"

SAM will then prompt you to provide values for the missing parameters listed above:

Setting default arguments for 'sam deploy'
=========================================
Stack Name [sam-app]: aws-plaid-demo-app
AWS Region [us-east-1]:
Parameter Environment [dev]:
Parameter GitHubOrg: <GitHubUserName>
Parameter GitHubRepo [aws-plaid-demo-app]:
Parameter PlaidClientId: *************
Parameter PlaidSecretKey: *************
Parameter PlaidEnvironment [sandbox]:
Parameter GitHubAccessToken: *************
#Shows you resources changes to be deployed and require a 'Y' to initiate deploy
Confirm changes before deploy [y/N]:
#SAM needs permission to be able to create roles to connect to the resources in your template
Allow SAM CLI IAM role creation [Y/n]:
Capabilities [['CAPABILITY_IAM']]: CAPABILITY_IAM CAPABILITY_AUTO_EXPAND
#Preserves the state of previously provisioned resources when an operation fails
Disable rollback [y/N]:
Save arguments to configuration file [Y/n]:
SAM configuration file [samconfig.toml]:
SAM configuration environment [default]:

SAM will then monitor the CloudFormation stack as its being deployed. Once CloudFormation completes, you can access the application within the Amplify Console to monitor the deployment progress.

Testing the Application

Click the FrontendUrl listed CloudFormation Outputs (or the Domain URL from the Amplify Console) to access the application. You should see a screen like this:

Go through the process to create a new account providing your email address for the username. Cognito will send you a verification code to verify your email. Then click on the "Connect with Plaid" button to begin the linking process.

Select "Bank of America" and use these demo credentials:

Username: user_good
Password: pass_good
Code: 1111

Continue through the Plaid Link process to have "Bank of America" and its accounts linked to the application.

Clean up

Deleting the CloudFormation Stack will remove the Lambda functions, Amplify application, API Gateway and DynamoDB table.

sam delete

Reference

Contributing

See CONTRIBUTING for more information.

License

This library is licensed under the MIT-0 License. See the LICENSE file.

aws-plaid-demo-app's People

Contributors

Stargazers

Watchers

Forkers

aptix amar-m-cloud nanderoo plaid jwstanwick yourlyfefinancial xpress-pay 443781544 harpritsehra berniecpa carlos-alzate srss waterviewcap sukalidi apw-mat muneer0072000 awsriyadani hacchen jeffdlin1618 salmanburhan dizzsteele iriteshp aditya1 skywaresllcglobal iwillpicklethat brianseries ahilan-subbaian johnruffin nathannewyen venkyyy segunawe alaappandit johnleonard56 vanidevilekkala66 hemcharanpv godsboro1 andrewxlokw hareshmn01 skywares-llc-nm dgrabbe saayfi seven-plus07 go-settle-it ericdoppelt skywares-nm-llc koby823 stevenslack dafrimer pedler7 jamesma123 plantrackretire andrewj23 haleyspillars gbustamante24 rossmck80 blinkapp-group josh10237 dshl dwarakeswaran daltonsena roelmore jackbowendemoaccount pkgadw scribnerx ben-smith-ccbinfotech necco903 coleworsley sleiber cmdavies10 halla-cob mlihmohammed joeldg trade-platform ewave33 ace8199 pcleckler tom-huguenard sparshwadhwa arnabroy crowleysean motart sac-associates sac-associates njpalmin balindam webclinic017 jdizzle777 popipopop1 marcelstranak jacky-lam-cy chengfangho jerald nickbaumann98 marcinknara nexetion map112300 mthomas-github fjnunes kkrish39 deleomike

aws-plaid-demo-app's Issues

Handle Plaid Item updates

When item credentials need updating, Plaid sends webhooks that look like:

{
  "environment": "sandbox",
  "error": {
    "error_code": "ITEM_LOGIN_REQUIRED",
    "error_message": "the login details of this item have changed (credentials, MFA, or required user action) and a user login is required to update this information. use Link's update mode to restore the item to a good state",
    "error_type": "ITEM_ERROR",
    "status": 400
  },
  "item_id": "p3LELdGW4GFPEnwMR6N3IaorEJbDq9CLblzno",
  "webhook_code": "ERROR",
  "webhook_type": "ITEM"
}

which are currently not processed

Development Version

Hi, If i wanted to deploy a development version of this instead of sandbox, would i just need to change the following variables?

Parameter PlaidSecretKey: *************
Parameter PlaidEnvironment [sandbox]: [development]

template.yml does not work with localstack.

Can you please have a look into this? With a localstack Pro licence, I am able to run samlocal.py (provided by localstack) to run the sam deploy command to create all services locally. It fails though. I have modified it to try to get it to work, but I am not sure how to proceed.

I would appreciate any help you might offer.

Accounts and Transaction Page Flickers

flicker.mp4

Seems to be on rapid refresh

App URL leads to "Your app will appear here once you complete your first deployment."

Everything seems to build/deploy successfully but then I get a generic page "Your app will appear here once you complete your first deployment."

Balances sync, Transactions dont.

chase item refreshing the account balances but new transactions aren't added to db?

Frontend url not displaying the app

Greetings, I followed the directions to build and deploy the demo app. No errors in CloudFormation logs. I can see the frontend url in the console output, CloudFormation output, and in the Amplify Domain management tab. When clicking the frontend url link, I get:

Welcome
Your app will appear here once you complete your first deployment.
Deployment didn't work? Here are some options:

Check out [our docs](https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html)
Click the Feedback button in the bottom-left corner of the service page
Quick tips:

Have you checked your build settings? The baseDirectory parameter in the artifacts step of your YAML file should match your build output directory
Building your app should produce an index.html file. Try building your app locally and check a file with that name exists in the artifacts base directory.

Did I miss a step in the documentation here?

Cloud Formation Error on AWS Lambda

When Previewing CloudFormation change set before deployment, i get the error

CREATE_FAILED AWS::Lambda::LayerVersion DependencyLayerd10f9d4ecf null (Service: AWSLambdaInternal;
Status Code: 403; Error Code:
AccessDeniedException; Request ID:
431229b1-6269-40b9-ad7d-24e4391d693
f; Proxy: null)

instructions

It would be nice if there was more clear instructions on how to set this up cause I can't get it to work for the life of me.

Creating new account doesn't work out of the box

Trying to create a new account leads to the following error in the console:

[ERROR] 58:36.432 AuthError -
Error: Amplify has not been configured correctly.
The configuration object is missing required auth properties.
This error is typically caused by one of the following scenarios:

        1. Did you run `amplify push` after adding auth via `amplify add auth`?
            See https://aws-amplify.github.io/docs/js/authentication#amplify-project-setup for more information

        2. This could also be caused by multiple conflicting versions of amplify packages, see (https://docs.amplify.aws/lib/troubleshooting/upgrading/q/platform/js) for help upgrading Amplify packages.

I haven't been able to add the auth feature either on the Amplify CLI or console.

Amplify Creation Failing due to "Bad Credentials"

When I try to build i get [AWS Amplify Create Failed] and with a error message that says "message: "bad credentials","documentation_url": "https://docs.github.com/rest". I've logged in and out of my github desktop like it says in the forum but still no luck. What could be the issue?

Least Privilege

Since every demo eventually becomes production code, may I suggest/request that your demo demonstrate the practice of least privilege?

In particular, I would love for you to provide a "Least Privilege Stack" that creates the IAM permissions sufficient to building and deploying the sam-app stack.

It would be sufficient, I suppose, to provide a list of those least privilege access rights so the user can then create them.