Get started with the AWS Cloud Development Kit (CDK) (2023)

How to Deploy a Simple Lambda and S3 Application Using the CDK

The more I use the AWS CDK, the more I like it. I've always found the raw CloudFormation to be tedious and long-winded, and the CDK seems like a faster and easier way to set up and manage your infrastructure.

In this story, I'll explain how to get started with the CDK and how to use it to deploy a small application to your AWS account.

AWS Cloud Development Kit (CDK)is a framework that allows engineers to define their infrastructure as code (IaC) in a familiar programming language, rather than having to manually manage their infrastructure or write raw CloudFormation.

While I generally prefer to write in Python, I've been writing my CDK in Typescript. I don't have very strong reasons for this; it was the language in which I was first introduced to the CDK. It's also the native language of the CDK, and between its strong typing and VSCode's autocompletion, it makes writing CDKs a breeze.

For this example, we'll create a simple application consisting of two S3 buckets (one source and one destination) and a Lambda that will read the source file, modify it, and write it to the destination bucket.

Obviously, this is a simple and contrived example, but we'll need to have the CDK written to:

• Set of S3 cubes
• Define our Lambda function
• Manage Permissions
• Give us an endpoint to invoke our Lambda

This guide assumes you have the AWS CLI and Node.js installed. If not, seeAWS official documentationto configure your environment.

Otherwise, we will create a new directory (this command must be executed in an empty directory, otherwise you will get an error)mkdir CDKDemo,cdthey are executed:

cdk init app --typescript

This will create a lot of files and also initialize a new git repository in your directory.

We have a few files to create that are unrelated to the CDK.

the text file

We're going to upload a file to S3, so let's define that file. It's just a simple txt file calledola.txt, and we will create a new directoryactive/to save it to:

Hello World!

the python function

This is the python file that will run in Lambda to move our file between repositories. In this example, we are going to create this file asola.pynolambda/directory:

import date and time
Careful
import boto3
FILE_NAME = "hola.txt"
s3 = boto3. recurso("s3")
def copy_file_to_destination():
new_file_name = f"{FILE_NAME.split('.')[0]}_updated.txt"
s3.Bucket(os.environ["DESTINATION_BUCKET"]).upload_file(
f"/tmp/{FILE_NAME}", new_file_name
)
def find_file_from_source():
s3.Bucket(os.environ["SOURCE_BUCKET"]).download_file(FILE_NAME, f"/tmp/{FILE_NAME}")
def update_file():
com open(f"/tmp/{FILE_NAME}", "a") como f:
my_str = f"\nI read this file on {datetime.datetime.now()}!"
f.write(my_string)
definition handler(event, context):
find_source_file()
Update file()
copy_file_to_destination()

Note that this function performs 3 simple tasks:

1. Using the boto3 library, get the file from ourSOURCE_BUCKETand store it in/tmpdirectory.
2. It then adds a newline to the file that announces when it reads the file.
3. Again using boto3, upload the updated file toDESTINATION_BUCKETwith "_updated" appended to the name.

After executing the above command, you should open thetfile insidereleaseaddress The name of this file will depend on what your working directory is called and there will be some boilerplate code in place. This is where we can start defining our stack!

S3

We need a source cube and a target cube for this demo. We don't need to have any public access to these buckets, so let's lock them down and let s3 handle the server-side encryption.

For this example, we also want to defineremoval policyaDESTROY, and having the items in our buckets automatically removed when we destroy the stack. keep in mind thatyou probably don't want this behavior in a real world application, but otherwise we'd be left with these orphaned buckets that we'd need to manually clean up when we're done.

import * as s3 from "aws-cdk-lib/aws-s3";
// S3 containers
const sourceBucket = new s3.Bucket(this, "sourceBucket", {
blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
cifrado: s3.BucketEncryption.S3_MANAGED,
removal policy: cdk.RemovalPolicy.DESTROY,
autoDeleteObjects: true,
});
const destinoCubo = new s3.Cubo(this, "destinoCubo", {
blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
cifrado: s3.BucketEncryption.S3_MANAGED,
removal policy: cdk.RemovalPolicy.DESTROY,
autoDeleteObjects: true,
});

Upload our text file

Since our example is using a predefined patternola.txtLet's go ahead and upload it to the source repository as part of our deployment. Remember that our text file is located at./active:

import * as s3deploy from "aws-cdk-lib/aws-s3-deployment";
// Subir hello.txt a sourceBucket
const deployment = new s3deploy.BucketDeployment(this, "DeployHello", {
fontes: [s3deploy.Source.asset("./assets")],
target repository: source repository,
});

lambda

The Lambda definition is probably the most complicated. Note that since I'm creating a lambda that uses python, I'm going to import and install theaws-lambda-python-alfapackage too. While not strictly necessary in this example, it makes packaging dependencies easier, so I got used to using it.
As this is not included inaws-cdk-lib, you will probably need to install it separately, using the command:

npm instala "@aws-cdk/aws-lambda-python-alpha"

We also need to tell this lambda to use Python 3.9, where to find ourola.pyfile and how to run it:manipulative. If you look back at the python file above, you'll also notice that we need to set two environment variables: the names of our buckets. We can access the name using thefontCubeytarget cubevariables that we assign to our S3 buckets.

Finally, we add an unauthenticated function URL that will allow us to invoke our lambda.

import * as lambda from "aws-cdk-lib/aws-lambda";
importar * como pyLambda de "@aws-cdk/aws-lambda-python-alpha";
//Lambda
const fileTransferLambda = new pyLambda.PythonFunction(
That's it,
"transferirarquivoLambda",
{
runtime: lambda.Runtime.PYTHON_3_9,
input: "./lambda",
index: "hello.py",
negotiations: "exchanges",
environment: {
SOURCE_BUCKET: sourceBucket.bucketName,
DESTINATION_BUCKET: destinoBucket.bucketName,
},
}
);
// URL lambda
const fileTransferLambdaUrl = fileTransferLambda.addFunctionUrl({
authentication type: lambda.FunctionUrlAuthType.NONE,
});

Police I.A.M.

Although we have defined our lambda and our buckets, they are currently not allowed to interact with each other. For that, we need to define some IAM policies.

we just needGETof the original warehouse andTO PLACEto the destination bucket, so we add only the minimum necessary permissions.

After defining these policies, we need to attach them to our lambda's security role.

import * as iam from "aws-cdk-lib/aws-iam";
//MILITARY
const getFromSourcePolicy = new iam.Policy(this, "getFromSourcePolicy", {
document: new now.PolicyDocument({
statements: [
nueva iam.PolicyStatement({
actions: ["s3:Get*"],
recursos: [sourceBucket.arnForObjects("*")],
}),
],
}),
});
const putInDestinationPolicy = new iam.Policy(
That's it,
"put in target policy",
{
document: new now.PolicyDocument({
statements: [
nueva iam.PolicyStatement({
actions: ["s3:Put*"],
recursos: [destinationBucket.arnForObjects("*")],
}),
],
}),
}
);
// Attach IAM policies to Lambda
const fileTransferLambdaRole = fileTransferLambda.role;
fileTransferLambdaRole?.attachInlinePolicy(getFromSourcePolicy);
fileTransferLambdaRole?.attachInlinePolicy(putInDestinationPolicy);

Note that setting policies this way is really overkill for this simple application! We could have just usedgrantReadygrant writein S3 cubes,but this gives an example of what a custom IAM policy might look like.

Production

Finally, we want the CDK to tell us the URL value of our lambda for ease of use, so we set it to aOutput Cfnfinal:

// Production
novo cdk.CfnOutput(this, "fileTransferLambdaUrl", {
valor: fileTransferLambdaUrl.url,
});

the whole file

That is all!
For easy reference, the full file is below. Note that we were able to define our entire infrastructure in less than 90 lines of code.

import * as cdk from "aws-cdk-lib";
import * as s3 from "aws-cdk-lib/aws-s3";
import * as s3deploy from "aws-cdk-lib/aws-s3-deployment";
import * as iam from "aws-cdk-lib/aws-iam";
import * as lambda from "aws-cdk-lib/aws-lambda";
importar * como pyLambda de "@aws-cdk/aws-lambda-python-alpha";
import {Building} from "buildings";
export class CdkDemoStack extends cdk.Stack {
constructor(scope: Build, id: string, props?: cdk.StackProps) {
super(range, id, props);
// S3 containers
const sourceBucket = new s3.Bucket(this, "sourceBucket", {
blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
cifrado: s3.BucketEncryption.S3_MANAGED,
});
const destinoCubo = new s3.Cubo(this, "destinoCubo", {
blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
cifrado: s3.BucketEncryption.S3_MANAGED,
});
// Subir hello.txt a sourceBucket
const deployment = new s3deploy.BucketDeployment(this, "DeployHello", {
fontes: [s3deploy.Source.asset("./assets")],
target repository: source repository,
});
//Lambda
const fileTransferLambda = new pyLambda.PythonFunction(
That's it,
"transferirarquivoLambda",
{
runtime: lambda.Runtime.PYTHON_3_9,
input: "./lambda",
index: "hello.py",
negotiations: "exchanges",
environment: {
SOURCE_BUCKET: sourceBucket.bucketName,
DESTINATION_BUCKET: destinoBucket.bucketName,
},
}
);
// URL lambda
const fileTransferLambdaUrl = fileTransferLambda.addFunctionUrl({
authentication type: lambda.FunctionUrlAuthType.NONE,
});
//MILITARY
const getFromSourcePolicy = new iam.Policy(this, "getFromSourcePolicy", {
document: new now.PolicyDocument({
statements: [
nueva iam.PolicyStatement({
actions: ["s3:Get*"],
recursos: [sourceBucket.arnForObjects("*")],
}),
],
}),
});
const putInDestinationPolicy = new iam.Policy(
That's it,
"put in target policy",
{
document: new now.PolicyDocument({
statements: [
nueva iam.PolicyStatement({
actions: ["s3:Put*"],
recursos: [destinationBucket.arnForObjects("*")],
}),
],
}),
}
);
// Attach IAM policies to Lambda
const fileTransferLambdaRole = fileTransferLambda.role;
fileTransferLambdaRole?.attachInlinePolicy(getFromSourcePolicy);
fileTransferLambdaRole?.attachInlinePolicy(putInDestinationPolicy);
// Production
novo cdk.CfnOutput(this, "fileTransferLambdaUrl", {
valor: fileTransferLambdaUrl.url,
});
}
}

Now that we have our files in order, it's time to test our app!

synthesizer

The first thing I tend to do when I create a new CDK stack (or make big changes) is runcdk synthesizer. This command generates the CloudFormation template that will run in the background and is a good way to ensure you don't have a bug in your CDK that prevents it from being synthesized.

Implantation

Finally, it's time to deploy our code to AWS! This is as simple ascdk deployment, although depending on your AWS configuration you may also need to specify which profile to use (e.g.--personal profile).

Since everything on the stack is new to start with, it will take a few minutes to run the first time, but it will usually take less (< 1 min) for future updates. However, do not exit after pressing Enter; You may need to approve some of the changes being implemented, especially changes related to security and permissions.

After accepting these changes, the rest of the stack will be deployed. If everything is implemented correctly, you will get the requested result in the end:

Evidence

Now, before you click that link and run your lambda, you can go ahead and log into the AWS console to investigate how everything looks now that it's deployed.

If you navigate to CloudFormation, you'll see its stack and its status:

You can also check the buckets that were created in S3:

And make sure ourola.txtis in the source bucket as it should be:

Finally, let's visit thefileTransferLambdaUrl- when clicked it will open a page that saysnull, since we didn't tell Lambda to generate anything, but now we can check our destination bucket. We should have a new updated text file!

if you open the newhello_updated.txt, you'll see that it's been updated with the line we added in our lambda function:

difference

Note that if you ever need to make changes to your stack and redeploy your application, thecdk differencecommand is also worth a quick call here. It will show the changes that the implementation will introduce.

To clean

Now that we have successfully tested our application,Don't forget to tip your stack!

Taking it all down is as easy as runningcdk destroy.

As I mentioned above, this is obviously a contrived example (and not a fully relevant use case likeS3 Embraced by Lambdaexists), but I hope it gives you an idea of ​​how quick and easy it is to get started writing IaC on the AWS CDK.

other resources

Here are some other resources that you might find useful when working with the AWS CDK:

• The official AWS referencecontains documentation on all builds
• construction centercontains other open source builds
• Also, check out another article I wrote on CDK:Managing Secrets with the AWS Cloud Development Kit (CDK)

Thank you for being part of our community! Before you go:

• 👏 Applaud the story and follow the author 👉
• 📰 See more content onTop Level Encoding Post
• 🔔 Follow us:Gore|LinkedIn|Informative report

🚀👉Join the Level Up Talent Collective and find amazing work