|
1 |
| -import * as core from "@aws-cdk/core" |
2 |
| -import * as iam from "@aws-cdk/aws-iam" |
3 |
| -import {Effect} from "@aws-cdk/aws-iam" |
4 |
| -import * as lambda from "@aws-cdk/aws-lambda" |
5 |
| -import * as apiGWv1 from "@aws-cdk/aws-apigateway" |
6 |
| -import {AuthorizationType} from "@aws-cdk/aws-apigateway" |
7 |
| -import * as apiGWv2 from "@aws-cdk/aws-apigatewayv2" |
8 |
| -import {GoFunction} from "@aws-cdk/aws-lambda-go" |
9 |
| -import {LambdaProxyIntegration, LambdaWebSocketIntegration} from "@aws-cdk/aws-apigatewayv2-integrations" |
10 |
| -import {RetentionDays} from "@aws-cdk/aws-logs"; |
11 |
| -import * as path from "path"; |
12 |
| - |
13 |
| -(() => { |
14 |
| - const app = new core.App() |
15 |
| - |
16 |
| - const env = { |
17 |
| - region: app.node.tryGetContext('region') || process.env['CDK_DEFAULT_REGION'] || process.env['AWS_DEFAULT_REGION'], |
18 |
| - account: app.node.tryGetContext('account') || process.env['CDK_DEFAULT_ACCOUNT'] || process.env['AWS_ACCOUNT'], |
19 |
| - } |
20 |
| - |
21 |
| - const prefix = "SampleApp" |
22 |
| - |
23 |
| - const stack = new core.Stack(app, "SampleLambdaApp", {env}) |
24 |
| - |
25 |
| - const role = new iam.Role(stack, `${prefix}Role`, { |
26 |
| - roleName: "sample-app", |
27 |
| - assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"), |
28 |
| - managedPolicies: [ |
29 |
| - iam.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole") |
30 |
| - ], |
31 |
| - inlinePolicies: { |
32 |
| - Websocket: new iam.PolicyDocument({ |
33 |
| - statements: [ |
34 |
| - new iam.PolicyStatement({ |
35 |
| - effect: Effect.ALLOW, |
36 |
| - actions: [ |
37 |
| - "execute-api:ManageConnections", |
38 |
| - ], |
39 |
| - resources: [ |
40 |
| - `arn:${core.Aws.PARTITION}:execute-api:*:${core.Aws.ACCOUNT_ID}:*/*/*/*` |
| 1 | +import * as core from "aws-cdk-lib/core" |
| 2 | +import {Size} from "aws-cdk-lib/core" |
| 3 | +import * as iam from "aws-cdk-lib/aws-iam" |
| 4 | +import {Effect} from "aws-cdk-lib/aws-iam" |
| 5 | +import * as lambda from "aws-cdk-lib/aws-lambda" |
| 6 | +import * as apiGWv1 from "aws-cdk-lib/aws-apigateway" |
| 7 | +import {AuthorizationType} from "aws-cdk-lib/aws-apigateway" |
| 8 | +import * as apiGWv2 from "aws-cdk-lib/aws-apigatewayv2" |
| 9 | +import {HttpLambdaIntegration, WebSocketLambdaIntegration} from "aws-cdk-lib/aws-apigatewayv2-integrations" |
| 10 | +import {LogGroup, RetentionDays} from "aws-cdk-lib/aws-logs" |
| 11 | + |
| 12 | +const app = new core.App() |
| 13 | + |
| 14 | +const env = { |
| 15 | + region: app.node.tryGetContext('region') || process.env['CDK_DEFAULT_REGION'] || process.env['AWS_DEFAULT_REGION'], |
| 16 | + account: app.node.tryGetContext('account') || process.env['CDK_DEFAULT_ACCOUNT'] || process.env['AWS_ACCOUNT'], |
| 17 | +} |
| 18 | + |
| 19 | +const prefix = "SampleApp" |
| 20 | + |
| 21 | +const stack = new core.Stack(app, "SampleLambdaApp", {env}) |
| 22 | + |
| 23 | +const handler = new lambda.DockerImageFunction(stack, `${prefix}Container`, { |
| 24 | + code: lambda.DockerImageCode.fromImageAsset("src"), |
| 25 | + memorySize: 128, |
| 26 | + timeout: core.Duration.minutes(1), |
| 27 | + architecture: lambda.Architecture.X86_64, |
| 28 | + logGroup: new LogGroup(stack, `${prefix}LogGroup`, { |
| 29 | + logGroupName: `/aws/lambda/${prefix}Container`, |
| 30 | + retention: RetentionDays.THREE_MONTHS, |
| 31 | + removalPolicy: core.RemovalPolicy.DESTROY, |
| 32 | + }) |
| 33 | +}) |
| 34 | + |
| 35 | +handler.addToRolePolicy(new iam.PolicyStatement({ |
| 36 | + effect: Effect.ALLOW, |
| 37 | + actions: [ |
| 38 | + "execute-api:ManageConnections", |
| 39 | + ], |
| 40 | + resources: [ |
| 41 | + `arn:${core.Aws.PARTITION}:execute-api:*:${core.Aws.ACCOUNT_ID}:*/*/*/*` |
| 42 | + ], |
| 43 | +})) |
| 44 | + |
| 45 | +const integrationV1 = new apiGWv1.LambdaIntegration(handler) |
| 46 | + |
| 47 | +const integrationV2 = new HttpLambdaIntegration("HTTPAPI", handler) |
| 48 | + |
| 49 | +const restAPI = new apiGWv1.RestApi(stack, `${prefix}API-REST`, { |
| 50 | + restApiName: "sample-app-rest", |
| 51 | + cloudWatchRole: false, |
| 52 | + endpointTypes: [apiGWv1.EndpointType.REGIONAL], |
| 53 | + minCompressionSize: Size.kibibytes(100), |
| 54 | + policy: new iam.PolicyDocument({ |
| 55 | + statements: [ |
| 56 | + new iam.PolicyStatement({ |
| 57 | + effect: Effect.ALLOW, |
| 58 | + principals: [ |
| 59 | + new iam.AnyPrincipal() |
| 60 | + ], |
| 61 | + actions: [ |
| 62 | + "execute-api:Invoke" |
| 63 | + ], |
| 64 | + resources: [ |
| 65 | + "execute-api:/*" |
| 66 | + ], |
| 67 | + conditions: { |
| 68 | + StringEquals: { |
| 69 | + "aws:PrincipalOrgID": [ |
| 70 | + "o-aq4agy4d07" // dmgw |
41 | 71 | ],
|
42 |
| - }) |
43 |
| - ] |
| 72 | + } |
| 73 | + }, |
44 | 74 | })
|
45 |
| - } |
46 |
| - }) |
47 |
| - |
48 |
| - const appDir = path.join(__dirname, "app") |
49 |
| - |
50 |
| - const handler = new GoFunction(stack, `${prefix}Func`, { |
51 |
| - functionName: "sample-app", |
52 |
| - role, |
53 |
| - logRetention: RetentionDays.THREE_MONTHS, |
54 |
| - runtime: lambda.Runtime.GO_1_X, |
55 |
| - entry: path.join(appDir, "main.go"), |
56 |
| - bundling: { |
57 |
| - goBuildFlags: [`-ldflags='-s -w'`], |
58 |
| - cgoEnabled: false, |
59 |
| - }, |
60 |
| - memorySize: 128, |
61 |
| - timeout: core.Duration.minutes(1), |
62 |
| - }) |
63 |
| - |
64 |
| - const integrationV1 = new apiGWv1.LambdaIntegration(handler) |
65 |
| - |
66 |
| - const integrationV2 = new LambdaProxyIntegration({ |
67 |
| - handler, |
68 |
| - }) |
69 |
| - |
70 |
| - const restAPI = new apiGWv1.RestApi(stack, `${prefix}API-REST`, { |
71 |
| - restApiName: "sample-app-rest", |
72 |
| - cloudWatchRole: false, |
73 |
| - endpointTypes: [apiGWv1.EndpointType.REGIONAL], |
| 75 | + ] |
74 | 76 | })
|
| 77 | +}) |
75 | 78 |
|
76 |
| - restAPI.root.addProxy({ |
77 |
| - anyMethod: true, |
78 |
| - defaultIntegration: integrationV1, |
79 |
| - defaultMethodOptions: { |
80 |
| - authorizationType: AuthorizationType.IAM, |
81 |
| - } |
82 |
| - }) |
83 |
| - |
84 |
| - const httpAPI = new apiGWv2.HttpApi(stack, `${prefix}API-HTTP`, { |
85 |
| - apiName: "sample-app-http", |
86 |
| - createDefaultStage: true, |
87 |
| - }) |
88 |
| - |
89 |
| - httpAPI.addRoutes({ |
90 |
| - path: "/{proxy+}", |
91 |
| - methods: [ |
92 |
| - apiGWv2.HttpMethod.ANY, |
93 |
| - ], |
94 |
| - integration: integrationV2, |
95 |
| - }) |
| 79 | +restAPI.root.addProxy({ |
| 80 | + anyMethod: true, |
| 81 | + defaultIntegration: integrationV1, |
| 82 | + defaultMethodOptions: { |
| 83 | + authorizationType: AuthorizationType.IAM, |
| 84 | + } |
| 85 | +}) |
96 | 86 |
|
97 |
| - new apiGWv2.HttpStage(stack, `${prefix}APIStage`, { |
98 |
| - httpApi: httpAPI, |
99 |
| - stageName: "test", |
100 |
| - autoDeploy: true, |
101 |
| - }) |
| 87 | +const deploy = new apiGWv1.Deployment(stack, `${prefix}-API-REST-Deploy`, { |
| 88 | + api: restAPI, |
| 89 | +}) |
102 | 90 |
|
103 |
| - const integrationWS = new LambdaWebSocketIntegration({ |
104 |
| - handler, |
| 91 | +const stages = ["dev"].map(stageName => { |
| 92 | + const stage = new apiGWv1.Stage(stack, `${prefix}-API-REST-Stage-${stageName}`, { |
| 93 | + stageName, |
| 94 | + deployment: deploy, |
105 | 95 | })
|
106 |
| - |
107 |
| - const webSocketApi = new apiGWv2.WebSocketApi(stack, `${prefix}API-WS`, { |
108 |
| - apiName: "websocket-api", |
109 |
| - routeSelectionExpression: "$request.body.action", |
110 |
| - connectRouteOptions: { |
111 |
| - integration: integrationWS, |
112 |
| - }, |
113 |
| - disconnectRouteOptions: { |
114 |
| - integration: integrationWS, |
115 |
| - }, |
116 |
| - defaultRouteOptions: { |
117 |
| - integration: integrationWS, |
118 |
| - }, |
119 |
| - }) |
120 |
| - |
121 |
| - new apiGWv2.WebSocketStage(stack, `${prefix}API-WS-Prod`, { |
122 |
| - stageName: "prod", |
123 |
| - webSocketApi, |
124 |
| - autoDeploy: true, |
| 96 | + handler.addPermission(`${prefix}Func-Policy-API-REST-Stage-${stageName}`, { |
| 97 | + principal: new iam.ServicePrincipal("apigateway.amazonaws.com"), |
| 98 | + action: "lambda:InvokeFunction", |
| 99 | + sourceArn: restAPI.arnForExecuteApi("*", "/*", stageName) |
125 | 100 | })
|
126 |
| -})() |
| 101 | + return stage |
| 102 | +}) |
| 103 | + |
| 104 | +handler.addPermission(`${prefix}Func-Policy-API-REST`, { |
| 105 | + principal: new iam.ServicePrincipal("apigateway.amazonaws.com"), |
| 106 | + action: "lambda:InvokeFunction", |
| 107 | + sourceArn: restAPI.arnForExecuteApi() |
| 108 | +}) |
| 109 | + |
| 110 | +const httpAPI = new apiGWv2.HttpApi(stack, `${prefix}API-HTTP`, { |
| 111 | + apiName: "sample-app-http", |
| 112 | + createDefaultStage: true, |
| 113 | +}) |
| 114 | + |
| 115 | +httpAPI.addRoutes({ |
| 116 | + path: "/{proxy+}", |
| 117 | + methods: [ |
| 118 | + apiGWv2.HttpMethod.ANY, |
| 119 | + ], |
| 120 | + integration: integrationV2, |
| 121 | +}) |
| 122 | + |
| 123 | +new apiGWv2.HttpStage(stack, `${prefix}APIStage`, { |
| 124 | + httpApi: httpAPI, |
| 125 | + stageName: "test", |
| 126 | + autoDeploy: true, |
| 127 | +}) |
| 128 | + |
| 129 | +const integrationWS = new WebSocketLambdaIntegration("WebsocketAPI", handler) |
| 130 | + |
| 131 | +const webSocketApi = new apiGWv2.WebSocketApi(stack, `${prefix}API-WS`, { |
| 132 | + apiName: "websocket-api", |
| 133 | + routeSelectionExpression: "$request.body.action", |
| 134 | + connectRouteOptions: { |
| 135 | + integration: integrationWS, |
| 136 | + }, |
| 137 | + disconnectRouteOptions: { |
| 138 | + integration: integrationWS, |
| 139 | + }, |
| 140 | + defaultRouteOptions: { |
| 141 | + integration: integrationWS, |
| 142 | + }, |
| 143 | +}) |
| 144 | + |
| 145 | +new apiGWv2.WebSocketStage(stack, `${prefix}API-WS-Prod`, { |
| 146 | + stageName: "prod", |
| 147 | + webSocketApi, |
| 148 | + autoDeploy: true, |
| 149 | +}) |
| 150 | + |
| 151 | +app.synth() |
0 commit comments