tWIL 2022.09 4주차

mkdir cdk-workshop && cd $_
cdk init sample-app --language=typescript

{
  "app": "npx ts-node --prefer-ts-exts cdk/index.ts",
  "watch": {
    "include": ["**"],
    "exclude": [
      "README.md",
      "cdk*.json",
      "**/*.d.ts",
      "**/*.js",
      "tsconfig.json",
      "package*.json",
      "yarn.lock",
      "node_modules",
      "test"
    ]
  }
}

#!/usr/bin/env node
import * as cdk from "aws-cdk-lib";
import { MyStacks } from "./libs";

const app = new cdk.App();

// https://docs.aws.amazon.com/cdk/v2/guide/stacks.html
const defaultProps: cdk.StackProps = {
  env: { account: process.env.CDK_DEFAULT_ACCOUNT, region: process.env.CDK_DEFAULT_REGION },
};
new MyStacks(app, "mystacks-dev", defaultProps);
new MyStacks(app, "mystacks-prod", defaultProps);

app.synth();

import * as cdk from "aws-cdk-lib";
import { MyStackECSCluster } from "./ecs";
import { MyStackRDSCluster } from "./rds";

export class MyStacks extends cdk.Stack {
  constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
    super(scope, id, props);
    new MyStackECSCluster(scope, `${id}-ecs`, props);
    new MyStackRDSCluster(scope, `${id}-rds`, props);
  }
}

import * as ec2 from "aws-cdk-lib/aws-ec2";
import * as cdk from "aws-cdk-lib";
import * as ssm from "aws-cdk-lib/aws-ssm";
import { MyStackApi } from "./api";
import { MyStackAuth } from "./auth";

export class MyStackECSCluster extends cdk.Stack {
  constructor(scope: cdk.App, name: string, props?: cdk.StackProps) {
    super(scope, name, props);
    const vpc = new ec2.Vpc(this, "myvpc", { maxAzs: 2 });
    new ssm.StringParameter(this, "VpcId", {
      parameterName: `/vpcProvider/myvpc`,
      stringValue: vpc.vpcId,
    });
    /**
     * Create a API Cluster
     */
    const apiFargateService = MyStackApi(this, vpc);
    /**
     * Create an Auth Cluster
     */
    const authFagateService = MyStackAuth(this, vpc);
    new cdk.CfnOutput(this, "ApiLoadBalancerDNS", {
      value: apiFargateService.loadBalancer.loadBalancerDnsName,
      description: "Network LoadBalancer URL",
    });
    new cdk.CfnOutput(this, "AuthLoadBalancerDNS", {
      value: authFagateService.loadBalancer.loadBalancerDnsName,
    });
  }
}

import * as ec2 from "aws-cdk-lib/aws-ec2";
import * as ecs from "aws-cdk-lib/aws-ecs";
import * as cdk from "aws-cdk-lib";
import * as ssm from "aws-cdk-lib/aws-ssm";
import { Platform } from "aws-cdk-lib/aws-ecr-assets";
import * as ecs_patterns from "aws-cdk-lib/aws-ecs-patterns";

export function MyStackApi(stack: cdk.Stack, vpc: ec2.Vpc) {
  const cluster = new ecs.Cluster(stack, "api", {
    vpc,
  });
  // CloudWatch Logs로 보내는 테스트 정의
  const logging = new ecs.AwsLogDriver({
    streamPrefix: "api",
  });
  const taskDefinition = new ecs.FargateTaskDefinition(stack, "api-task", {
    memoryLimitMiB: 512,
    cpu: 256,
  });
  taskDefinition.addContainer("api-container", {
    image: ecs.ContainerImage.fromAsset(".", {
      platform: Platform.LINUX_AMD64,
    }),
    logging,
    portMappings: [{ containerPort: 8000, hostPort: 8000 }],
    // secrets:
  });
  const fargateService = new ecs_patterns.ApplicationLoadBalancedFargateService(
    stack,
    "api-service",
    {
      cluster,
      taskDefinition,
    },
  );
  const scaling = fargateService.service.autoScaleTaskCount({
    maxCapacity: 2,
  });
  scaling.scaleOnCpuUtilization("CpuScaling", {
    targetUtilizationPercent: 50,
    scaleInCooldown: cdk.Duration.seconds(60),
    scaleOutCooldown: cdk.Duration.seconds(60),
  });
  return fargateService;
}

import * as ec2 from "aws-cdk-lib/aws-ec2";
import * as ecs from "aws-cdk-lib/aws-ecs";
import * as cdk from "aws-cdk-lib";
import * as ecs_patterns from "aws-cdk-lib/aws-ecs-patterns";

export function MyStackAuth(stack: cdk.Stack, vpc: ec2.Vpc) {
  const cluster = new ecs.Cluster(stack, "auth-cluster", {
    vpc,
  });
  // create a task definition with CloudWatch Logs
  const logging = new ecs.AwsLogDriver({
    streamPrefix: "auth",
  });
  const taskDefinition = new ecs.FargateTaskDefinition(stack, "TaskDef", {
    memoryLimitMiB: 512,
    cpu: 256,
  });
  taskDefinition.addContainer("auth-container", {
    image: ecs.ContainerImage.fromRegistry(
      "registry.supertokens.io/supertokens/supertokens-postgresql",
    ),
    logging,
    portMappings: [{ containerPort: 3567, hostPort: 3567 }],
  });
  const fargateService = new ecs_patterns.ApplicationLoadBalancedFargateService(
    stack,
    "auth-service",
    {
      cluster,
      taskDefinition,
    },
  );
  const scaling = fargateService.service.autoScaleTaskCount({
    maxCapacity: 2,
  });
  scaling.scaleOnCpuUtilization("CpuScaling", {
    targetUtilizationPercent: 50,
    scaleInCooldown: cdk.Duration.seconds(60),
    scaleOutCooldown: cdk.Duration.seconds(60),
  });
  return fargateService;
}

import { Tags, Fn, Duration, RemovalPolicy } from "aws-cdk-lib";
import * as cdk from "aws-cdk-lib";
import * as ec2 from "aws-cdk-lib/aws-ec2";
import * as kms from "aws-cdk-lib/aws-kms";
import * as rds from "aws-cdk-lib/aws-rds";
import * as ssm from "aws-cdk-lib/aws-ssm";
import { isUndefined } from "lodash";

export function MyStackRDS(stack: cdk.Stack, name: string) {
  const id = name;
  const dbName = "authdb";
  const auroraClusterUsername = "postgres";
  const vpcId = ssm.StringParameter.valueFromLookup(
    stack,
    "/vpcProvider/myVpc",
  );
  const backupRetentionDays = 14;

  const ingressSources: any[] = [];

  // vpc
  const vpc = ec2.Vpc.fromLookup(stack, "ExistingVPC", {
    vpcId,
  });
  // Subnets
  const subnets = vpc.privateSubnets.map(({ subnetId }) => {
    return ec2.Subnet.fromSubnetAttributes(stack, subnetId, {
      subnetId,
    });
  });

  // interface
  const vpcSubnets: ec2.SubnetSelection = {
    subnets: subnets,
  };

  // all the ports
  const allAll = ec2.Port.allTraffic();
  const tcp5432 = ec2.Port.tcpRange(5432, 5432);
  const tcp1433 = ec2.Port.tcpRange(1433, 1433);

  // Database Security Group
  const dbsg = new ec2.SecurityGroup(stack, "DatabaseSecurityGroup", {
    vpc: vpc,
    allowAllOutbound: true,
    description: id + "Database",
    securityGroupName: id + "Database",
  });
  dbsg.addIngressRule(dbsg, allAll, "all from self");
  dbsg.addEgressRule(ec2.Peer.ipv4("0.0.0.0/0"), allAll, "all out");

  const connectionPort = tcp5432;
  const connectionName = "tcp5432 PostgresSQL";

  for (const ingress_source of ingressSources!) {
    if (!isUndefined(ingress_source)) {
      dbsg.addIngressRule(ingress_source, connectionPort, connectionName);
      dbsg.addIngressRule(ingress_source, tcp1433, "tcp1433");
    }
  }

  // Declaring postgres engine
  const auroraEngine = rds.DatabaseClusterEngine.auroraPostgres({
    /**
     * 서울 리전 버전 체크
     * aws rds describe-db-engine-versions | jq '.DBEngineVersions[] | select(.SupportedEngineModes != null and .SupportedEngineModes[] == "serverless" and .Engine == "aurora-postgresql")'
     * */
    version: rds.AuroraPostgresEngineVersion.VER_11_13,
  });

  const auroraParameters: any = {};
  // aurora params
  const auroraParameterGroup = new rds.ParameterGroup(
    stack,
    "AuroraParameterGroup",
    {
      engine: auroraEngine,
      description: id + " Parameter Group",
      parameters: auroraParameters,
    },
  );

  // aurora credentials
  const auroraClusterCrendentials = rds.Credentials.fromGeneratedSecret(
    auroraClusterUsername,
  );

  // Aurora DB Key
  const kmsKey = new kms.Key(stack, "AuroraDatabaseKey", {
    enableKeyRotation: true,
    alias: dbName,
  });

  const cluster = new rds.ServerlessCluster(stack, name, {
    engine: auroraEngine,
    vpc,
    credentials: auroraClusterCrendentials,
    backupRetention: Duration.days(backupRetentionDays),
    parameterGroup: auroraParameterGroup,
    clusterIdentifier: name,
    defaultDatabaseName: "authdb",
    storageEncryptionKey: kmsKey,
    deletionProtection: true,
    removalPolicy: RemovalPolicy.SNAPSHOT,
    copyTagsToSnapshot: true,
    vpcSubnets,
    securityGroups: [dbsg],
  });
  cluster.applyRemovalPolicy(RemovalPolicy.RETAIN);

  Tags.of(cluster).add("Name", dbName!, {
    priority: 300,
  });
  return cluster;
}

aws rds describe-db-engine-versions | jq '.DBEngineVersions[] | select(.SupportedEngineModes != null and .SupportedEngineModes[] == "serverless" and .Engine == "aurora-postgresql")'

{
  "Engine": "aurora-postgresql",
  "EngineVersion": "10.18",
  "DBParameterGroupFamily": "aurora-postgresql10",
  "DBEngineDescription": "Aurora (PostgreSQL)",
  "DBEngineVersionDescription": "Aurora PostgreSQL (compatible with PostgreSQL 10.18)",
  "ValidUpgradeTarget": [
    {
      "Engine": "aurora-postgresql",
      "EngineVersion": "11.13",
      "Description": "Aurora PostgreSQL (compatible with PostgreSQL 11.13)",
      "AutoUpgrade": false,
      "IsMajorVersionUpgrade": true,
      "SupportedEngineModes": [
        "serverless"
      ],
      "SupportsParallelQuery": false,
      "SupportsGlobalDatabases": false,
      "SupportsBabelfish": false
    }
  ],
  "ExportableLogTypes": [
    "postgresql"
  ],
  "SupportsLogExportsToCloudwatchLogs": true,
  "SupportsReadReplica": false,
  "SupportedEngineModes": [
    "serverless"
  ],
  "SupportedFeatureNames": [
    "Comprehend",
    "s3Export",
    "s3Import",
    "SageMaker"
  ],
  "Status": "available",
  "SupportsParallelQuery": false,
  "SupportsGlobalDatabases": false,
  "MajorEngineVersion": "10",
  "SupportsBabelfish": false
}
{
  "Engine": "aurora-postgresql",
  "EngineVersion": "11.13",
  "DBParameterGroupFamily": "aurora-postgresql11",
  "DBEngineDescription": "Aurora (PostgreSQL)",
  "DBEngineVersionDescription": "Aurora PostgreSQL (compatible with PostgreSQL 11.13)",
  "ValidUpgradeTarget": [],
  "ExportableLogTypes": [
    "postgresql"
  ],
  "SupportsLogExportsToCloudwatchLogs": true,
  "SupportsReadReplica": false,
  "SupportedEngineModes": [
    "serverless"
  ],
  "SupportedFeatureNames": [
    "Comprehend",
    "Lambda",
    "s3Export",
    "s3Import",
    "SageMaker"
  ],
  "Status": "available",
  "SupportsParallelQuery": false,
  "SupportsGlobalDatabases": false,
  "MajorEngineVersion": "11",
  "SupportsBabelfish": false
}

import * as cdk from "aws-cdk-lib";
import { MyStackRDS } from "./postgres";

export class MyStackRDSCluster extends cdk.Stack {
  constructor(scope: cdk.App, name: string, props?: cdk.StackProps) {
    super(scope, name, props);

    const cluster = MyStackRDS(this, name);

    new cdk.CfnOutput(this, "OutputSecretName", {
      exportName: cluster.stack.stackName + ":SecretName",
      value: cluster.secret?.secretArn!,
    });

    new cdk.CfnOutput(this, "OutputSecretArn", {
      exportName: cluster.stack.stackName + ":SecretArn",
      value: cluster.secret?.secretArn!,
    });

    new cdk.CfnOutput(this, "OutputGetSecretValue", {
      exportName: cluster.stack.stackName + ":GetSecretValue",
      value:
        "aws secretsmanager get-secret-value --secret-id " +
        cluster.secret?.secretArn,
    });
  }
}

cdk synth mystacks-dev-ecs

cdk deploy mystacks-dev-ecs

cdk synth mystacks-dev-rds

cdk deploy mystacks-dev-rds