Skip to content

Commit 5e9169b

Browse files
ashphyashphy
committed
Deploy CDK
1 parent 95d450b commit 5e9169b

File tree

16 files changed

+5372
-490
lines changed

16 files changed

+5372
-490
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ jobs:
1313
uses: actions/setup-node@v4
1414
with:
1515
node-version: 20
16+
cache: "npm"
17+
1618
- run: npm ci
1719

1820
- name: Run ESLint

‎.github/workflows/deploy.yml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
name: Deploy Web App
2+
3+
# on:
4+
# push:
5+
# tags:
6+
# - "v*"
7+
8+
on: push
9+
10+
env:
11+
CDK_DEFAULT_ACCOUNT: ${{ vars.CDK_DEFAULT_ACCOUNT }}
12+
CDK_DEFAULT_REGION: ${{ vars.CDK_DEFAULT_REGION }}
13+
14+
jobs:
15+
deploy_infra:
16+
name: Deploy Infrastructure
17+
runs-on: ubuntu-latest
18+
permissions:
19+
id-token: write
20+
contents: read
21+
outputs:
22+
s3url: ${{ steps.extract_cdk_outputs.outputs.s3url }}
23+
steps:
24+
- uses: actions/checkout@v4
25+
- uses: actions/setup-node@v4
26+
with:
27+
node-version: 20
28+
cache: "npm"
29+
30+
- run: npm ci
31+
working-directory: infra
32+
- run: npm run build
33+
working-directory: infra
34+
- uses: aws-actions/configure-aws-credentials@v4
35+
with:
36+
role-to-assume: ${{ vars.CDK_DEPLOY_ROLE_ARN }}
37+
aws-region: ${{ vars.CDK_DEFAULT_REGION }}
38+
- run: npm run cdk -- deploy --all --require-approval never --outputs-file output.json
39+
working-directory: infra
40+
41+
- id: extract_cdk_outputs
42+
run: echo "s3url=$(jq -r '.JSONPathOnlineEvaluatorInfraStack.WebsiteBucketURI' output.json)" >> $GITHUB_OUTPUT
43+
working-directory: infra
44+
45+
deploy_app:
46+
name: Upload to Amazon S3
47+
needs: deploy_infra
48+
runs-on: ubuntu-latest
49+
permissions:
50+
id-token: write
51+
contents: read
52+
steps:
53+
- uses: actions/checkout@v4
54+
- uses: actions/setup-node@v4
55+
with:
56+
node-version: 20
57+
cache: "npm"
58+
59+
- run: npm ci
60+
- run: npm run build
61+
62+
- uses: aws-actions/configure-aws-credentials@v4
63+
with:
64+
role-to-assume: ${{ vars.CDK_DEPLOY_ROLE_ARN }}
65+
aws-region: ${{ vars.CDK_DEFAULT_REGION }}
66+
67+
- name: Copy files to the website with the AWS CLI
68+
run: |
69+
aws s3 sync dist ${{ needs.deploy_infra.outputs.s3url }} --delete

‎.github/workflows/release.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ jobs:
1717
uses: actions/setup-node@v4
1818
with:
1919
node-version: 20
20+
cache: "npm"
2021

2122
- run: npm ci
2223
- run: npm run build

‎infra/.gitignore‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
*.js
2+
!lib/cloudfront-functions/*.js
3+
!jest.config.js
4+
*.d.ts
5+
node_modules
6+
7+
# CDK asset staging directory
8+
.cdk.staging
9+
cdk.out
10+
output.json

‎infra/.npmignore‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
*.ts
2+
!*.d.ts
3+
4+
# CDK asset staging directory
5+
.cdk.staging
6+
cdk.out

‎infra/bin/infra.ts‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
#!/usr/bin/env node
2+
import * as cdk from "aws-cdk-lib";
3+
import { InfraStack } from "../lib/infra-stack";
4+
import { DomainStack } from "../lib/domain-stack";
5+
import { CertificateStack } from "../lib/certificate-stack";
6+
7+
const app = new cdk.App();
8+
cdk.Tags.of(app).add("project", "JSONPathOnlineEvaluator");
9+
10+
const zoneName = "jsonpath.com";
11+
const domainName = "jsonpath.com";
12+
13+
const domainStack = new DomainStack(app, "JSONPathOnlineEvaluatorDomainStack", {
14+
zoneName,
15+
env: { account: process.env.CDK_DEFAULT_ACCOUNT, region: "us-east-1" },
16+
crossRegionReferences: true,
17+
});
18+
19+
const certificateStack = new CertificateStack(
20+
app,
21+
"JSONPathOnlineEvaluatorCertificateStack",
22+
{
23+
hostedZone: domainStack.hostedZone,
24+
domainName,
25+
env: { account: process.env.CDK_DEFAULT_ACCOUNT, region: "us-east-1" },
26+
crossRegionReferences: true,
27+
}
28+
);
29+
30+
new InfraStack(app, "JSONPathOnlineEvaluatorInfraStack", {
31+
hostedZone: domainStack.hostedZone,
32+
domainName,
33+
certificate: certificateStack.certificate,
34+
env: {
35+
account: process.env.CDK_DEFAULT_ACCOUNT,
36+
region: process.env.CDK_DEFAULT_REGION,
37+
},
38+
crossRegionReferences: true,
39+
});

‎infra/cdk.json‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
{
2+
"app": "npx ts-node --prefer-ts-exts bin/infra.ts",
3+
"watch": {
4+
"include": [
5+
"**"
6+
],
7+
"exclude": [
8+
"README.md",
9+
"cdk*.json",
10+
"**/*.d.ts",
11+
"**/*.js",
12+
"tsconfig.json",
13+
"package*.json",
14+
"yarn.lock",
15+
"node_modules",
16+
"test"
17+
]
18+
},
19+
"context": {
20+
"@aws-cdk/aws-lambda:recognizeLayerVersion": true,
21+
"@aws-cdk/core:checkSecretUsage": true,
22+
"@aws-cdk/core:target-partitions": [
23+
"aws",
24+
"aws-cn"
25+
],
26+
"@aws-cdk-containers/ecs-service-extensions:enableDefaultLogDriver": true,
27+
"@aws-cdk/aws-ec2:uniqueImdsv2TemplateName": true,
28+
"@aws-cdk/aws-ecs:arnFormatIncludesClusterName": true,
29+
"@aws-cdk/aws-iam:minimizePolicies": true,
30+
"@aws-cdk/core:validateSnapshotRemovalPolicy": true,
31+
"@aws-cdk/aws-codepipeline:crossAccountKeyAliasStackSafeResourceName": true,
32+
"@aws-cdk/aws-s3:createDefaultLoggingPolicy": true,
33+
"@aws-cdk/aws-sns-subscriptions:restrictSqsDescryption": true,
34+
"@aws-cdk/aws-apigateway:disableCloudWatchRole": true,
35+
"@aws-cdk/core:enablePartitionLiterals": true,
36+
"@aws-cdk/aws-events:eventsTargetQueueSameAccount": true,
37+
"@aws-cdk/aws-ecs:disableExplicitDeploymentControllerForCircuitBreaker": true,
38+
"@aws-cdk/aws-iam:importedRoleStackSafeDefaultPolicyName": true,
39+
"@aws-cdk/aws-s3:serverAccessLogsUseBucketPolicy": true,
40+
"@aws-cdk/aws-route53-patters:useCertificate": true,
41+
"@aws-cdk/customresources:installLatestAwsSdkDefault": false,
42+
"@aws-cdk/aws-rds:databaseProxyUniqueResourceName": true,
43+
"@aws-cdk/aws-codedeploy:removeAlarmsFromDeploymentGroup": true,
44+
"@aws-cdk/aws-apigateway:authorizerChangeDeploymentLogicalId": true,
45+
"@aws-cdk/aws-ec2:launchTemplateDefaultUserData": true,
46+
"@aws-cdk/aws-secretsmanager:useAttachedSecretResourcePolicyForSecretTargetAttachments": true,
47+
"@aws-cdk/aws-redshift:columnId": true,
48+
"@aws-cdk/aws-stepfunctions-tasks:enableEmrServicePolicyV2": true,
49+
"@aws-cdk/aws-ec2:restrictDefaultSecurityGroup": true,
50+
"@aws-cdk/aws-apigateway:requestValidatorUniqueId": true,
51+
"@aws-cdk/aws-kms:aliasNameRef": true,
52+
"@aws-cdk/aws-autoscaling:generateLaunchTemplateInsteadOfLaunchConfig": true,
53+
"@aws-cdk/core:includePrefixInUniqueNameGeneration": true,
54+
"@aws-cdk/aws-efs:denyAnonymousAccess": true,
55+
"@aws-cdk/aws-opensearchservice:enableOpensearchMultiAzWithStandby": true,
56+
"@aws-cdk/aws-lambda-nodejs:useLatestRuntimeVersion": true,
57+
"@aws-cdk/aws-efs:mountTargetOrderInsensitiveLogicalId": true,
58+
"@aws-cdk/aws-rds:auroraClusterChangeScopeOfInstanceParameterGroupWithEachParameters": true,
59+
"@aws-cdk/aws-appsync:useArnForSourceApiAssociationIdentifier": true,
60+
"@aws-cdk/aws-rds:preventRenderingDeprecatedCredentials": true,
61+
"@aws-cdk/aws-codepipeline-actions:useNewDefaultBranchForCodeCommitSource": true,
62+
"@aws-cdk/aws-cloudwatch-actions:changeLambdaPermissionLogicalIdForLambdaAction": true,
63+
"@aws-cdk/aws-codepipeline:crossAccountKeysDefaultValueToFalse": true,
64+
"@aws-cdk/aws-codepipeline:defaultPipelineTypeToV2": true,
65+
"@aws-cdk/aws-kms:reduceCrossAccountRegionPolicyScope": true,
66+
"@aws-cdk/aws-eks:nodegroupNameAttribute": true,
67+
"@aws-cdk/aws-ec2:ebsDefaultGp3Volume": true,
68+
"@aws-cdk/aws-ecs:removeDefaultDeploymentAlarm": true,
69+
"@aws-cdk/custom-resources:logApiResponseDataPropertyTrueDefault": false,
70+
"@aws-cdk/aws-s3:keepNotificationInImportedBucket": false,
71+
"@aws-cdk/aws-ecs:enableImdsBlockingDeprecatedFeature": false,
72+
"@aws-cdk/aws-ecs:disableEcsImdsBlocking": true,
73+
"@aws-cdk/aws-ecs:reduceEc2FargateCloudWatchPermissions": true,
74+
"@aws-cdk/aws-dynamodb:resourcePolicyPerReplica": true,
75+
"@aws-cdk/aws-ec2:ec2SumTImeoutEnabled": true,
76+
"@aws-cdk/aws-appsync:appSyncGraphQLAPIScopeLambdaPermission": true,
77+
"@aws-cdk/aws-rds:setCorrectValueForDatabaseInstanceReadReplicaInstanceResourceId": true,
78+
"@aws-cdk/core:cfnIncludeRejectComplexResourceUpdateCreatePolicyIntrinsics": true,
79+
"@aws-cdk/aws-lambda-nodejs:sdkV3ExcludeSmithyPackages": true,
80+
"@aws-cdk/aws-stepfunctions-tasks:fixRunEcsTaskPolicy": true,
81+
"@aws-cdk/aws-ec2:bastionHostUseAmazonLinux2023ByDefault": true,
82+
"@aws-cdk/aws-route53-targets:userPoolDomainNameMethodWithoutCustomResource": true,
83+
"@aws-cdk/aws-elasticloadbalancingV2:albDualstackWithoutPublicIpv4SecurityGroupRulesDefault": true,
84+
"@aws-cdk/aws-iam:oidcRejectUnauthorizedConnections": true
85+
}
86+
}

‎infra/jest.config.js‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
module.exports = {
2+
testEnvironment: 'node',
3+
roots: ['<rootDir>/test'],
4+
testMatch: ['**/*.test.ts'],
5+
transform: {
6+
'^.+\\.tsx?$': 'ts-jest'
7+
}
8+
};

‎infra/lib/certificate-stack.ts‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
import * as cdk from "aws-cdk-lib";
2+
import type { Construct } from "constructs";
3+
4+
import type * as route53 from "aws-cdk-lib/aws-route53";
5+
import * as acm from "aws-cdk-lib/aws-certificatemanager";
6+
7+
interface CertificateStackProps extends cdk.StackProps {
8+
hostedZone: route53.IHostedZone;
9+
domainName: string;
10+
}
11+
12+
export class CertificateStack extends cdk.Stack {
13+
readonly certificate: acm.Certificate;
14+
15+
constructor(scope: Construct, id: string, props: CertificateStackProps) {
16+
super(scope, id, props);
17+
18+
this.certificate = new acm.Certificate(this, "Certificate", {
19+
domainName: props.domainName,
20+
validation: acm.CertificateValidation.fromDns(props.hostedZone),
21+
});
22+
}
23+
}

‎infra/lib/cloudfront-functions/add-cache-control-header.js‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
async function handler(event) {
2+
const request = event.request;
3+
const uri = request.uri;
4+
5+
const response = event.response;
6+
const headers = response.headers;
7+
8+
if (response.statusCode >= 200 && response.statusCode < 400) {
9+
if (uri.startsWith("/assets/")) {
10+
headers["cache-control"] = { value: "public,max-age=31536000" };
11+
} else {
12+
headers["cache-control"] = { value: "public,max-age=0,must-revalidate" };
13+
}
14+
}
15+
16+
return response;
17+
}

0 commit comments

Comments
 (0)