|
| 1 | +import * as cdk from '@aws-cdk/core'; |
| 2 | +import * as amplify from '@aws-cdk/aws-amplify'; |
| 3 | +import * as iam from '@aws-cdk/aws-iam'; |
| 4 | +import * as events from '@aws-cdk/aws-events'; |
| 5 | +import * as targets from '@aws-cdk/aws-events-targets'; |
| 6 | +import * as sns from '@aws-cdk/aws-sns'; |
| 7 | +import * as lambda from '@aws-cdk/aws-lambda'; |
| 8 | +import * as snsSubscription from '@aws-cdk/aws-sns-subscriptions'; |
| 9 | +import { BuildSpec } from 'aws-cdk-lib/aws-codebuild'; |
| 10 | +import { Branch } from '@aws-cdk/aws-amplify'; |
| 11 | +import { EventField } from '@aws-cdk/aws-events'; |
| 12 | +import * as fs from 'fs'; |
| 13 | +import { ServicePrincipal } from '@aws-cdk/aws-iam'; |
| 14 | + |
| 15 | +export class MainInfraStack extends cdk.Stack { |
| 16 | + constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { |
| 17 | + super(scope, id, props); |
| 18 | + |
| 19 | + // load env |
| 20 | + const appName = process.env.APP_NAME || ''; |
| 21 | + const owner = process.env.OWNER || ''; |
| 22 | + const repository = process.env.REPOSITORY || ''; |
| 23 | + const token = process.env.GITHUB_TOKEN || ''; |
| 24 | + const baseDomain = process.env.DOMAIN || ''; |
| 25 | + const projectName = process.env.PROJECT_NAME || ''; |
| 26 | + const slackWebhookURL = process.env.SLACK_WEBHOOK_URL || ''; |
| 27 | + |
| 28 | + const amplifyApp = this.createAmplifyApp(appName, owner, repository, token, baseDomain, projectName); |
| 29 | + this.addDeployNotificationStack(amplifyApp, appName, slackWebhookURL); |
| 30 | + } |
| 31 | + |
| 32 | + private createAmplifyApp( |
| 33 | + appName: string, |
| 34 | + owner: string, |
| 35 | + repository: string, |
| 36 | + token: string, |
| 37 | + baseDomain: string, |
| 38 | + projectName: string, |
| 39 | + ) { |
| 40 | + const amplifyApp = new amplify.App(this, appName, { |
| 41 | + sourceCodeProvider: new amplify.GitHubSourceCodeProvider({ |
| 42 | + owner: owner, |
| 43 | + repository: repository, |
| 44 | + oauthToken: cdk.SecretValue.plainText(token), |
| 45 | + }), |
| 46 | + autoBranchCreation: { |
| 47 | + patterns: ['develop', 'main', 'release*'], |
| 48 | + }, |
| 49 | + autoBranchDeletion: true, |
| 50 | + role: this.createRole(projectName), |
| 51 | + buildSpec: this.getBuildSpec(), |
| 52 | + }); |
| 53 | + |
| 54 | + const mainBranch = amplifyApp.addBranch('main'); |
| 55 | + const developBranch = amplifyApp.addBranch('develop'); |
| 56 | + |
| 57 | + amplifyApp.addCustomRule({ |
| 58 | + source: '/<*>', |
| 59 | + target: '/index.html', |
| 60 | + status: amplify.RedirectStatus.NOT_FOUND_REWRITE, |
| 61 | + }); |
| 62 | + |
| 63 | + const productionDomain = `${projectName}.${baseDomain}`; |
| 64 | + const stagingDomain = `staging-${productionDomain}`; |
| 65 | + this.createDomains(amplifyApp, mainBranch, productionDomain); |
| 66 | + this.createDomains(amplifyApp, developBranch, stagingDomain); |
| 67 | + |
| 68 | + return amplifyApp; |
| 69 | + } |
| 70 | + |
| 71 | + private createDomains(amplifyApp: amplify.App, branch: Branch, branchDomainName: string) { |
| 72 | + const domain = amplifyApp.addDomain(`${branchDomainName}`, { |
| 73 | + enableAutoSubdomain: false, |
| 74 | + }); |
| 75 | + domain.mapRoot(branch); // map master branch to domain root |
| 76 | + domain.mapSubDomain(branch, 'www'); |
| 77 | + } |
| 78 | + |
| 79 | + private createRole(projectName: string): iam.IRole { |
| 80 | + const role = new iam.Role(this, `cdk-amplify-role-${projectName}`, { |
| 81 | + assumedBy: new iam.ServicePrincipal('amplify.amazonaws.com'), |
| 82 | + description: `Custom role permitting resources creation from Amplify for ${projectName}`, |
| 83 | + }); |
| 84 | + |
| 85 | + const iManagedPolicy = iam.ManagedPolicy.fromAwsManagedPolicyName('AdministratorAccess-Amplify'); |
| 86 | + |
| 87 | + role.addManagedPolicy(iManagedPolicy); |
| 88 | + return role; |
| 89 | + } |
| 90 | + |
| 91 | + private getBuildSpec(): BuildSpec { |
| 92 | + return BuildSpec.fromObjectToYaml({ |
| 93 | + version: '1.0', |
| 94 | + frontend: { |
| 95 | + phases: { |
| 96 | + preBuild: { |
| 97 | + commands: ['yarn'], |
| 98 | + }, |
| 99 | + build: { |
| 100 | + commands: ['yarn run build'], |
| 101 | + }, |
| 102 | + }, |
| 103 | + artifacts: { |
| 104 | + baseDirectory: '.next', |
| 105 | + files: -'**/*', |
| 106 | + }, |
| 107 | + cache: { |
| 108 | + paths: ['node_modules/**/*'], |
| 109 | + }, |
| 110 | + }, |
| 111 | + }); |
| 112 | + } |
| 113 | + |
| 114 | + private addDeployNotificationStack(amplifyApp: amplify.App, appName: string, slackWebhookURL: string) { |
| 115 | + const rule = new events.Rule(this, 'rule', { |
| 116 | + eventPattern: { |
| 117 | + source: ['aws.amplify'], |
| 118 | + detail: { |
| 119 | + appId: [amplifyApp.appId], |
| 120 | + jobStatus: ['SUCCEED', 'FAILED', 'STARTED'], |
| 121 | + }, |
| 122 | + detailType: ['Amplify Deployment Status Change'], |
| 123 | + }, |
| 124 | + }); |
| 125 | + |
| 126 | + const snsTopic = new sns.Topic(this, `sns-${appName}-deploy-topic`, { |
| 127 | + displayName: `${appName}`, |
| 128 | + }); |
| 129 | + |
| 130 | + const lambdaFunction = this.createNotifyLambdaFunction(slackWebhookURL, appName, snsTopic); |
| 131 | + snsTopic.addSubscription(new snsSubscription.LambdaSubscription(lambdaFunction)); |
| 132 | + |
| 133 | + this.createDeployNotificationRole(appName, snsTopic); |
| 134 | + rule.addTarget( |
| 135 | + new targets.SnsTopic(snsTopic, { |
| 136 | + message: events.RuleTargetInput.fromText( |
| 137 | + `Hi, the build status for ${EventField.fromPath( |
| 138 | + '$.detail.branchName', |
| 139 | + )} branch with build ID ${EventField.fromPath( |
| 140 | + '$.detail.jobId', |
| 141 | + )} on ${appName} is ${EventField.fromPath('$.detail.jobStatus')}.`, |
| 142 | + ), |
| 143 | + }), |
| 144 | + ); |
| 145 | + } |
| 146 | + |
| 147 | + private createNotifyLambdaFunction(slackWebhookURL: string, appName: string, snsTopic: sns.Topic): lambda.Function { |
| 148 | + const lambdaCode = fs.readFileSync('static/lambda-notify.js'); |
| 149 | + |
| 150 | + const lambdaRole = new iam.Role(this, `iam-role-lambda-send-slack-notification-${appName}`, { |
| 151 | + roleName: `iam-role-lambda-send-slack-notification-${appName}`, |
| 152 | + assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'), |
| 153 | + }); |
| 154 | + |
| 155 | + // policy to allow assume role TenantUserRole |
| 156 | + lambdaRole.addToPolicy( |
| 157 | + new iam.PolicyStatement({ |
| 158 | + resources: ['*'], |
| 159 | + actions: ['sts:AssumeRole'], |
| 160 | + }), |
| 161 | + ); |
| 162 | + |
| 163 | + const fn = new lambda.Function(this, `sendSlackNotification${appName}`, { |
| 164 | + runtime: lambda.Runtime.NODEJS_12_X, |
| 165 | + handler: 'index.handler', |
| 166 | + code: lambda.Code.fromInline(`${lambdaCode.toString()}`), |
| 167 | + environment: { WEBHOOK_URL: slackWebhookURL }, |
| 168 | + role: lambdaRole, |
| 169 | + }); |
| 170 | + |
| 171 | + fn.addPermission(`sendSlack${appName}-execution-permission`, { |
| 172 | + action: 'lambda:InvokeFunction', |
| 173 | + principal: new ServicePrincipal('sns.amazonaws.com'), |
| 174 | + sourceArn: snsTopic.topicArn, |
| 175 | + }); |
| 176 | + |
| 177 | + return fn; |
| 178 | + } |
| 179 | + |
| 180 | + private createDeployNotificationRole(appName: string, snsTopic: sns.Topic): iam.IRole { |
| 181 | + const role = new iam.Role(this, `cdk-amplify-notification-role-${appName}`, { |
| 182 | + assumedBy: new iam.ServicePrincipal('events.amazonaws.com'), |
| 183 | + description: `Custom role permitting event publishing from Amplify for ${appName}`, |
| 184 | + }); |
| 185 | + |
| 186 | + const inlinePolicy = new iam.Policy(this, `cdk-amplify-deploy-notification-policy-${appName}`, { |
| 187 | + statements: [ |
| 188 | + new iam.PolicyStatement({ |
| 189 | + actions: ['SNS:Publish'], |
| 190 | + resources: [snsTopic.topicArn], |
| 191 | + }), |
| 192 | + ], |
| 193 | + }); |
| 194 | + |
| 195 | + role.attachInlinePolicy(inlinePolicy); |
| 196 | + return role; |
| 197 | + } |
| 198 | +} |
0 commit comments