|
1 | | -import * as core from "@aws-cdk/core" |
2 | | -import * as iam from "@aws-cdk/aws-iam" |
3 | | -import {Effect} from "@aws-cdk/aws-iam" |
4 | | -import * as lambda from "@aws-cdk/aws-lambda" |
5 | | -import * as apiGWv1 from "@aws-cdk/aws-apigateway" |
6 | | -import {AuthorizationType} from "@aws-cdk/aws-apigateway" |
7 | | -import * as apiGWv2 from "@aws-cdk/aws-apigatewayv2" |
8 | | -import {GoFunction} from "@aws-cdk/aws-lambda-go" |
9 | | -import {LambdaProxyIntegration, LambdaWebSocketIntegration} from "@aws-cdk/aws-apigatewayv2-integrations" |
10 | | -import {RetentionDays} from "@aws-cdk/aws-logs"; |
11 | | -import * as path from "path"; |
12 | | - |
13 | | -(() => { |
14 | | - const app = new core.App() |
15 | | - |
16 | | - const env = { |
17 | | - region: app.node.tryGetContext('region') || process.env['CDK_DEFAULT_REGION'] || process.env['AWS_DEFAULT_REGION'], |
18 | | - account: app.node.tryGetContext('account') || process.env['CDK_DEFAULT_ACCOUNT'] || process.env['AWS_ACCOUNT'], |
19 | | - } |
20 | | - |
21 | | - const prefix = "SampleApp" |
22 | | - |
23 | | - const stack = new core.Stack(app, "SampleLambdaApp", {env}) |
24 | | - |
25 | | - const role = new iam.Role(stack, `${prefix}Role`, { |
26 | | - roleName: "sample-app", |
27 | | - assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"), |
28 | | - managedPolicies: [ |
29 | | - iam.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole") |
30 | | - ], |
31 | | - inlinePolicies: { |
32 | | - Websocket: new iam.PolicyDocument({ |
33 | | - statements: [ |
34 | | - new iam.PolicyStatement({ |
35 | | - effect: Effect.ALLOW, |
36 | | - actions: [ |
37 | | - "execute-api:ManageConnections", |
38 | | - ], |
39 | | - resources: [ |
40 | | - `arn:${core.Aws.PARTITION}:execute-api:*:${core.Aws.ACCOUNT_ID}:*/*/*/*` |
| 1 | +import * as core from "aws-cdk-lib/core" |
| 2 | +import {Size} from "aws-cdk-lib/core" |
| 3 | +import * as iam from "aws-cdk-lib/aws-iam" |
| 4 | +import {Effect} from "aws-cdk-lib/aws-iam" |
| 5 | +import * as lambda from "aws-cdk-lib/aws-lambda" |
| 6 | +import * as apiGWv1 from "aws-cdk-lib/aws-apigateway" |
| 7 | +import {AuthorizationType} from "aws-cdk-lib/aws-apigateway" |
| 8 | +import * as apiGWv2 from "aws-cdk-lib/aws-apigatewayv2" |
| 9 | +import {HttpLambdaIntegration, WebSocketLambdaIntegration} from "aws-cdk-lib/aws-apigatewayv2-integrations" |
| 10 | +import {LogGroup, RetentionDays} from "aws-cdk-lib/aws-logs" |
| 11 | + |
| 12 | +const app = new core.App() |
| 13 | + |
| 14 | +const env = { |
| 15 | + region: app.node.tryGetContext('region') || process.env['CDK_DEFAULT_REGION'] || process.env['AWS_DEFAULT_REGION'], |
| 16 | + account: app.node.tryGetContext('account') || process.env['CDK_DEFAULT_ACCOUNT'] || process.env['AWS_ACCOUNT'], |
| 17 | +} |
| 18 | + |
| 19 | +const prefix = "SampleApp" |
| 20 | + |
| 21 | +const stack = new core.Stack(app, "SampleLambdaApp", {env}) |
| 22 | + |
| 23 | +const handler = new lambda.DockerImageFunction(stack, `${prefix}Container`, { |
| 24 | + code: lambda.DockerImageCode.fromImageAsset("src"), |
| 25 | + memorySize: 128, |
| 26 | + timeout: core.Duration.minutes(1), |
| 27 | + architecture: lambda.Architecture.X86_64, |
| 28 | + logGroup: new LogGroup(stack, `${prefix}LogGroup`, { |
| 29 | + logGroupName: `/aws/lambda/${prefix}Container`, |
| 30 | + retention: RetentionDays.THREE_MONTHS, |
| 31 | + removalPolicy: core.RemovalPolicy.DESTROY, |
| 32 | + }) |
| 33 | +}) |
| 34 | + |
| 35 | +handler.addToRolePolicy(new iam.PolicyStatement({ |
| 36 | + effect: Effect.ALLOW, |
| 37 | + actions: [ |
| 38 | + "execute-api:ManageConnections", |
| 39 | + ], |
| 40 | + resources: [ |
| 41 | + `arn:${core.Aws.PARTITION}:execute-api:*:${core.Aws.ACCOUNT_ID}:*/*/*/*` |
| 42 | + ], |
| 43 | +})) |
| 44 | + |
| 45 | +const integrationV1 = new apiGWv1.LambdaIntegration(handler) |
| 46 | + |
| 47 | +const integrationV2 = new HttpLambdaIntegration("HTTPAPI", handler) |
| 48 | + |
| 49 | +const restAPI = new apiGWv1.RestApi(stack, `${prefix}API-REST`, { |
| 50 | + restApiName: "sample-app-rest", |
| 51 | + cloudWatchRole: false, |
| 52 | + endpointTypes: [apiGWv1.EndpointType.REGIONAL], |
| 53 | + minCompressionSize: Size.kibibytes(100), |
| 54 | + policy: new iam.PolicyDocument({ |
| 55 | + statements: [ |
| 56 | + new iam.PolicyStatement({ |
| 57 | + effect: Effect.ALLOW, |
| 58 | + principals: [ |
| 59 | + new iam.AnyPrincipal() |
| 60 | + ], |
| 61 | + actions: [ |
| 62 | + "execute-api:Invoke" |
| 63 | + ], |
| 64 | + resources: [ |
| 65 | + "execute-api:/*" |
| 66 | + ], |
| 67 | + conditions: { |
| 68 | + StringEquals: { |
| 69 | + "aws:PrincipalOrgID": [ |
| 70 | + "o-aq4agy4d07" // dmgw |
41 | 71 | ], |
42 | | - }) |
43 | | - ] |
| 72 | + } |
| 73 | + }, |
44 | 74 | }) |
45 | | - } |
46 | | - }) |
47 | | - |
48 | | - const appDir = path.join(__dirname, "app") |
49 | | - |
50 | | - const handler = new GoFunction(stack, `${prefix}Func`, { |
51 | | - functionName: "sample-app", |
52 | | - role, |
53 | | - logRetention: RetentionDays.THREE_MONTHS, |
54 | | - runtime: lambda.Runtime.GO_1_X, |
55 | | - entry: path.join(appDir, "main.go"), |
56 | | - bundling: { |
57 | | - goBuildFlags: [`-ldflags='-s -w'`], |
58 | | - cgoEnabled: false, |
59 | | - }, |
60 | | - memorySize: 128, |
61 | | - timeout: core.Duration.minutes(1), |
62 | | - }) |
63 | | - |
64 | | - const integrationV1 = new apiGWv1.LambdaIntegration(handler) |
65 | | - |
66 | | - const integrationV2 = new LambdaProxyIntegration({ |
67 | | - handler, |
68 | | - }) |
69 | | - |
70 | | - const restAPI = new apiGWv1.RestApi(stack, `${prefix}API-REST`, { |
71 | | - restApiName: "sample-app-rest", |
72 | | - cloudWatchRole: false, |
73 | | - endpointTypes: [apiGWv1.EndpointType.REGIONAL], |
| 75 | + ] |
74 | 76 | }) |
| 77 | +}) |
75 | 78 |
|
76 | | - restAPI.root.addProxy({ |
77 | | - anyMethod: true, |
78 | | - defaultIntegration: integrationV1, |
79 | | - defaultMethodOptions: { |
80 | | - authorizationType: AuthorizationType.IAM, |
81 | | - } |
82 | | - }) |
83 | | - |
84 | | - const httpAPI = new apiGWv2.HttpApi(stack, `${prefix}API-HTTP`, { |
85 | | - apiName: "sample-app-http", |
86 | | - createDefaultStage: true, |
87 | | - }) |
88 | | - |
89 | | - httpAPI.addRoutes({ |
90 | | - path: "/{proxy+}", |
91 | | - methods: [ |
92 | | - apiGWv2.HttpMethod.ANY, |
93 | | - ], |
94 | | - integration: integrationV2, |
95 | | - }) |
| 79 | +restAPI.root.addProxy({ |
| 80 | + anyMethod: true, |
| 81 | + defaultIntegration: integrationV1, |
| 82 | + defaultMethodOptions: { |
| 83 | + authorizationType: AuthorizationType.IAM, |
| 84 | + } |
| 85 | +}) |
96 | 86 |
|
97 | | - new apiGWv2.HttpStage(stack, `${prefix}APIStage`, { |
98 | | - httpApi: httpAPI, |
99 | | - stageName: "test", |
100 | | - autoDeploy: true, |
101 | | - }) |
| 87 | +const deploy = new apiGWv1.Deployment(stack, `${prefix}-API-REST-Deploy`, { |
| 88 | + api: restAPI, |
| 89 | +}) |
102 | 90 |
|
103 | | - const integrationWS = new LambdaWebSocketIntegration({ |
104 | | - handler, |
| 91 | +const stages = ["dev"].map(stageName => { |
| 92 | + const stage = new apiGWv1.Stage(stack, `${prefix}-API-REST-Stage-${stageName}`, { |
| 93 | + stageName, |
| 94 | + deployment: deploy, |
105 | 95 | }) |
106 | | - |
107 | | - const webSocketApi = new apiGWv2.WebSocketApi(stack, `${prefix}API-WS`, { |
108 | | - apiName: "websocket-api", |
109 | | - routeSelectionExpression: "$request.body.action", |
110 | | - connectRouteOptions: { |
111 | | - integration: integrationWS, |
112 | | - }, |
113 | | - disconnectRouteOptions: { |
114 | | - integration: integrationWS, |
115 | | - }, |
116 | | - defaultRouteOptions: { |
117 | | - integration: integrationWS, |
118 | | - }, |
119 | | - }) |
120 | | - |
121 | | - new apiGWv2.WebSocketStage(stack, `${prefix}API-WS-Prod`, { |
122 | | - stageName: "prod", |
123 | | - webSocketApi, |
124 | | - autoDeploy: true, |
| 96 | + handler.addPermission(`${prefix}Func-Policy-API-REST-Stage-${stageName}`, { |
| 97 | + principal: new iam.ServicePrincipal("apigateway.amazonaws.com"), |
| 98 | + action: "lambda:InvokeFunction", |
| 99 | + sourceArn: restAPI.arnForExecuteApi("*", "/*", stageName) |
125 | 100 | }) |
126 | | -})() |
| 101 | + return stage |
| 102 | +}) |
| 103 | + |
| 104 | +handler.addPermission(`${prefix}Func-Policy-API-REST`, { |
| 105 | + principal: new iam.ServicePrincipal("apigateway.amazonaws.com"), |
| 106 | + action: "lambda:InvokeFunction", |
| 107 | + sourceArn: restAPI.arnForExecuteApi() |
| 108 | +}) |
| 109 | + |
| 110 | +const httpAPI = new apiGWv2.HttpApi(stack, `${prefix}API-HTTP`, { |
| 111 | + apiName: "sample-app-http", |
| 112 | + createDefaultStage: true, |
| 113 | +}) |
| 114 | + |
| 115 | +httpAPI.addRoutes({ |
| 116 | + path: "/{proxy+}", |
| 117 | + methods: [ |
| 118 | + apiGWv2.HttpMethod.ANY, |
| 119 | + ], |
| 120 | + integration: integrationV2, |
| 121 | +}) |
| 122 | + |
| 123 | +new apiGWv2.HttpStage(stack, `${prefix}APIStage`, { |
| 124 | + httpApi: httpAPI, |
| 125 | + stageName: "test", |
| 126 | + autoDeploy: true, |
| 127 | +}) |
| 128 | + |
| 129 | +const integrationWS = new WebSocketLambdaIntegration("WebsocketAPI", handler) |
| 130 | + |
| 131 | +const webSocketApi = new apiGWv2.WebSocketApi(stack, `${prefix}API-WS`, { |
| 132 | + apiName: "websocket-api", |
| 133 | + routeSelectionExpression: "$request.body.action", |
| 134 | + connectRouteOptions: { |
| 135 | + integration: integrationWS, |
| 136 | + }, |
| 137 | + disconnectRouteOptions: { |
| 138 | + integration: integrationWS, |
| 139 | + }, |
| 140 | + defaultRouteOptions: { |
| 141 | + integration: integrationWS, |
| 142 | + }, |
| 143 | +}) |
| 144 | + |
| 145 | +new apiGWv2.WebSocketStage(stack, `${prefix}API-WS-Prod`, { |
| 146 | + stageName: "prod", |
| 147 | + webSocketApi, |
| 148 | + autoDeploy: true, |
| 149 | +}) |
| 150 | + |
| 151 | +app.synth() |
0 commit comments