実運用に耐えられるレベルまで CDK Pipelines を丁寧に作り込んでみる

import { Stack } from "aws-cdk-lib";
import {
  CodePipeline,
  CodePipelineSource,
  ShellStep,
} from "aws-cdk-lib/pipelines";
import { TargetStage } from "./target-stage";

import type { StackProps } from "aws-cdk-lib";
import type { Construct } from "constructs";

export class PipelineStack extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);

    const codepipeline = new CodePipeline(this, "Pipeline", {
      synth: new ShellStep("Synth", {
        input: CodePipelineSource.gitHub("<リポジトリ>", "<ブランチ>"),
        commands: [
          "npm ci",
          "npm run build",
          "npx cdk synth",
        ],
      }),
    });

    codepipeline.addStage(
      new TargetStage(this, "TargetStage", {
        env: props?.env,
      })
    );
  }
}

{
  "Version": "2012-10-17",
  "Statement": [
    //
    // Allow: まずはとりあえずフル権限を与える。
    //
    {
      "Sid": "ExplicitAllowAll",
      "Action": "*",
      "Effect": "Allow",
      "Resource": "*"
    },

    //
    // Deny: 指定の Permissions boundary がセットされていない IAMエンティティの作成を許可しない。
    //
    {
      "Sid": "DenyAccessIfRequiredPermBoundaryIsNotBeingApplied",
      "Action": [
        "iam:CreateUser",
        "iam:CreateRole",
        "iam:PutRolePermissionsBoundary",
        "iam:PutUserPermissionsBoundary"
      ],
      "Condition": {
        "StringNotEquals": {
          "iam:PermissionsBoundary": {
            "Fn::Sub": "arn:${ AWS::Partition }:iam::${ AWS::AccountId }:policy/pb-policy"
          }
        }
      },
      "Effect": "Deny",
      "Resource": "*"
    },

    //
    // Deny: Permissions boundary の変更/削除を許可しない。
    // 
    {
      "Sid": "DenyPermBoundaryIAMPolicyAlteration",
      "Action": [
        "iam:CreatePolicyVersion",
        "iam:DeletePolicy",
        "iam:DeletePolicyVersion",
        "iam:SetDefaultPolicyVersion"
      ],
      "Effect": "Deny",
      "Resource": {
        "Fn::Sub": "arn:${ AWS::Partition }:iam::${ AWS::AccountId }:policy/pb-policy"
      }
    },

    //
    // Deny: Permissions boundary の解除を許可しない。
    //
    {
      "Sid": "DenyRemovalOfPermBoundaryFromAnyUserOrRole",
      "Action": [
        "iam:DeleteUserPermissionsBoundary",
        "iam:DeleteRolePermissionsBoundary"
      ],
      "Effect": "Deny",
      "Resource": "*"
    },

    //
    // Deny: 他に許可しない操作を好きなだけ列挙する。
    //
    {
      "Sid": "DenyXXX",
      "Action": "xxx:*",
      "Effect": "Deny",
      "Resource": "*"
    }
  ]
}

{
  ...
  "context": {
    ...
    "@aws-cdk/core:permissionsBoundary": {
      "name": "pb-policy"
    }
  }
}

40/**
41 * CDK stores bootstrap version in parameter store. Example parameter name looks like /cdk-bootstrap/<qualifier>/version.
42 * The default value for qualifier is hnb659fds, i.e. default parameter path is /cdk-bootstrap/hnb659fds/version.
43 * The default qualifier is hardcoded value without any significance.
44 * Ability to provide custom qualifier is intended for name isolation between automated tests of the CDK itself.
45 * In order to use custom qualifier all stack synthesizers must be programmatically configured to use it.
46 * That makes bootstraps with custom qualifier incompatible with Amplify Backend and we treat that setup as
47 * not bootstrapped.
48 * See: https://docs.aws.amazon.com/cdk/v2/guide/bootstrapping.html
49 */
50export const CDK_DEFAULT_BOOTSTRAP_VERSION_PARAMETER_NAME =
51  // suppress spell checker, it is triggered by qualifier value.
52  // eslint-disable-next-line spellcheck/spell-checker
53  '/cdk-bootstrap/hnb659fds/version';

{
  ...
  "context": {
    ...
    "@aws-cdk/core:bootstrapQualifier": "nqtif7r0f"
  }
}

{
  ...
  "context": {
    ...
    "@aws-cdk/core:bootstrapQualifier": "hnb659fds"
  }
}

{
  ...
  "ssm:account=<AWSアカウントID>:parameterName=<パラメータのパス>:region=<リージョン>": "<値>"
}

#!/bin/bash

npx cdk context --json \
  | jq '. | keys_unsorted | .[] | select(startswith("ssm:"))' \
  | xargs -I @ npx cdk context --reset @

{
  ...
  "scripts": {
    ...
    "cdk:context:resetSsm": "./bin/context/reset-ssm.sh"
  }
}

...
import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
import {
  CodeBuildStep,
  CodePipeline,
  CodePipelineSource,
} from "aws-cdk-lib/pipelines";

export class PipelineStack extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);

    const codepipeline = new CodePipeline(this, "Pipeline", {
      synth: new CodeBuildStep("Synth", { // `ShellStep` ではなく `CodeBuildStep` を使う
        input: ...
        commands: [
          "npm ci",
          "npm run build",
          "npm run cdk:context:resetSsm", // synth を実行する前に Parameter Store のキャッシュを消去する
          "npx cdk synth",
        ],
        rolePolicyStatements: [
          new PolicyStatement({
            actions: ["sts:AssumeRole"],
            resources: ["*"],
            effect: Effect.ALLOW,
            conditions: {
              StringEquals: {
                "iam:ResourceTag/aws-cdk:bootstrap-role": ["lookup"], // Parameter Store のルックアップ権限を与える
              },
            },
          }),
        ],
      }),
    });

    ...
  }
}

...
import { StringParameter } from "aws-cdk-lib/aws-ssm";

export class PipelineStack extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);

    const codepipeline = new CodePipeline(this, "Pipeline", {
      synth: new CodeBuildStep("Synth", {
        input: CodePipelineSource.gitHub(
          "<リポジトリ>",
          StringParameter.valueFromLookup(this, "<ParameterStoreキー>") // Parameter Store から環境ごとのブランチ名を取得する
        ),
        commands: [
          ...
        ],
        rolePolicyStatements: [
          ...
        ],
      }),
    });

    ...
  }
}

...
import {
  CodeBuildStep,
  CodePipeline,
  CodePipelineSource,
  ManualApprovalStep,
} from "aws-cdk-lib/pipelines";

export class PipelineStack extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);

    const codepipeline = new CodePipeline(this, "Pipeline", {
      ...
    });

    codepipeline.addStage(
      new TargetStage(this, "TargetStage", {
        env: props?.env,
      }),
      {
        pre: [new ManualApprovalStep("Approve")], // デプロイ前に手動承認ステップを配置する
      }
    );
  }
}

...

export class PipelineStack extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);

    const codepipeline = new CodePipeline(this, "Pipeline", {
      synth: new CodeBuildStep("Synth", {
        input: ...
        commands: [
          "npm ci",
          "npm run build",
          "npm run cdk:context:resetSsm",
          "npx cdk synth",
          "npx cdk diff --app ./cdk.out/assembly-PipelineStack-TargetStage/", // ターゲットStack の差分を表示する
        ],
        rolePolicyStatements: [
          new PolicyStatement({
            ...
            conditions: {
              StringEquals: {
                "iam:ResourceTag/aws-cdk:bootstrap-role": ["deploy", "lookup"], // Change set を作成する権限を与える
              },
            },
          }),
        ],
      }),
    });

    ...
  }
}

...
import { SlackChannelConfiguration } from "aws-cdk-lib/aws-chatbot";
import { PipelineNotificationEvents } from "aws-cdk-lib/aws-codepipeline";
import { RetentionDays } from "aws-cdk-lib/aws-logs";
import { Topic } from "aws-cdk-lib/aws-sns";

export class PipelineStack extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);

    const codepipeline = new CodePipeline(this, "Pipeline", {
      ...
    });

    codepipeline.addStage(
      ...
    );

    // いったんパイプラインを生成する
    codepipeline.buildPipeline();

    // SNS Topic
    const topic = new Topic(this, "SNS-Topic");

    // Chatbot
    const chatbot = new SlackChannelConfiguration(this, "Chatbot", {
      slackChannelConfigurationName: "Pipeline-Notification",
      slackWorkspaceId: "<SlackワークスペースID>",
      slackChannelId: "<SlackチャネルID>",
      logRetention: RetentionDays.THIRTEEN_MONTHS, // CloudWatch Logs の保持期間をお好みで
      userRoleRequired: true,
    });

    // Chatbot と SNS Topic を紐付ける
    chatbot.addNotificationTopic(topic);

    // 通知設定
    codepipeline.pipeline.notifyOn("Pipeline-Notification", topic, {
      events: [
        PipelineNotificationEvents.PIPELINE_EXECUTION_CANCELED,
        PipelineNotificationEvents.PIPELINE_EXECUTION_FAILED,
        PipelineNotificationEvents.PIPELINE_EXECUTION_RESUMED,
        PipelineNotificationEvents.PIPELINE_EXECUTION_STARTED,
        PipelineNotificationEvents.PIPELINE_EXECUTION_SUCCEEDED,
        PipelineNotificationEvents.PIPELINE_EXECUTION_SUPERSEDED,
        PipelineNotificationEvents.MANUAL_APPROVAL_FAILED,
        PipelineNotificationEvents.MANUAL_APPROVAL_NEEDED,
        PipelineNotificationEvents.MANUAL_APPROVAL_SUCCEEDED,
      ],
    });
  }
}

{
  "name": "log-retention",
  "version": "1.0.0",
  "devDependencies": {
    "@types/aws-lambda": "^8.10.145"
  },
  "dependencies": {
    "@aws-sdk/client-cloudwatch-logs": "^3.649.0",
    "@aws-sdk/client-codepipeline": "^3.649.0"
  }
}

import {
  CloudWatchLogsClient,
  DescribeLogGroupsCommand,
  PutRetentionPolicyCommand,
} from "@aws-sdk/client-cloudwatch-logs";
import {
  CodePipelineClient,
  PutJobFailureResultCommand,
  PutJobSuccessResultCommand,
} from "@aws-sdk/client-codepipeline";

import type { LogGroup } from "@aws-sdk/client-cloudwatch-logs";
import type { CodePipelineEvent, Handler } from "aws-lambda";

// 対象とする LogGroup のプレフィックス
const prefix = "/aws/codebuild/Pipelines";

// 保持日数
const retentionDays = 400;

const cloudWatchLogs = new CloudWatchLogsClient();
const codePipeline = new CodePipelineClient();

//
// Handler
//
export const handler: Handler = async (event: CodePipelineEvent) => {
  console.log("LOG_GROUP_PREFIX: ", prefix);

  console.log("RETENTION_DAYS: ", retentionDays);

  const jobId = event["CodePipeline.job"].id;

  try {
    await run();

    await putJobSuccess(jobId);

    console.log("Success");
  } catch (e) {
    await putJobFailure(jobId, e);
  }
};

//
// 対象の LogGroup すべてに保持期間を設定して回る。
//
const run = async (token?: string) => {
  const logGroups = await getLogGroups(token);

  if (logGroups.logGroups == null) {
    return;
  }

  for (const x of logGroups.logGroups) {
    await putRetentionPolicy(x);
  }

  if (logGroups.nextToken) {
    await run(logGroups.nextToken);
  }
};

//
// 条件に合致する LogGroup のリストを取得する。
//
const getLogGroups = async (token?: string) => {
  return await cloudWatchLogs.send(
    new DescribeLogGroupsCommand({
      logGroupNamePrefix: prefix,
      nextToken: token,
    })
  );
};

//
// 保持期間を設定する。
//
const putRetentionPolicy = async (logGroup: LogGroup) => {
  console.log(
    `${logGroup.logGroupName}: ${logGroup.retentionInDays} => ${retentionDays}`
  );

  await cloudWatchLogs.send(
    new PutRetentionPolicyCommand({
      logGroupName: logGroup.logGroupName,
      retentionInDays: retentionDays,
    })
  );
};

//
// 実行に成功した旨を CodePipeline に通知する。
//
const putJobSuccess = async (jobId: string) => {
  await codePipeline.send(
    new PutJobSuccessResultCommand({
      jobId: jobId,
    })
  );
};

//
// 実行に失敗した旨を CodePipeline に通知する。
//
const putJobFailure = async (jobId: string, message: any) => {
  await codePipeline.send(
    new PutJobFailureResultCommand({
      jobId: jobId,
      failureDetails: {
        message: JSON.stringify(message),
        type: "JobFailed",
      },
    })
  );
};

...
import { Duration } from "aws-cdk-lib";
import { LambdaInvokeAction } from "aws-cdk-lib/aws-codepipeline-actions";
import { Architecture, Runtime } from "aws-cdk-lib/aws-lambda";
import { NodejsFunction } from "aws-cdk-lib/aws-lambda-nodejs";

export class PipelineStack extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);

    const codepipeline = new CodePipeline(this, "Pipeline", {
      ...
    };

    ...

    // Lambda関数を CodePipeline Action としてラップする
    const action = new LambdaInvokeAction({
      actionName: "LogRetention",
      lambda: new NodejsFunction(this, "LogRetention", { // TypeScript を Transpiling & Bundling する
        entry: __dirname + "/../asset/lambda/log-retention/index.ts",
        runtime: Runtime.NODEJS_20_X,
        architecture: Architecture.ARM_64,
        bundling: {
          minify: true,
        },
        logRetention: RetentionDays.ONE_DAY, // この Lambda関数自体のログ保持期間をお好みで
        timeout: Duration.minutes(3),
        initialPolicy: [
          new PolicyStatement({ // ログ保持期間の変更権限を与える
            actions: [
              "logs:DescribeLogGroups",
              "logs:PutRetentionPolicy",
              "logs:DeleteRetentionPolicy",
            ],
            resources: ["*"],
            effect: Effect.ALLOW,
          }),
        ],
      }),
    });

    // パイプラインのステージとして追加する
    codepipeline.pipeline.addStage({
      stageName: "PostDeploy",
      actions: [action],
    });
  }
}

...

export class PipelineStack extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {
    ...

    const topic = new Topic(this, "SNS-Topic");

    this.exportValue(topic.topicArn, {
      name: "Infra-PipelineStack-SnsTopicArn",
      description: "The ARN of the SNS topic for notifications.",
    });

    ...
  }
}