AWS CDK for Infrastructure as Code

AWS Cloud Development Kit (CDK) is an open-source software development framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. Unlike writing raw YAML or JSON templates, CDK lets you use TypeScript, JavaScript, Python, Java, C#, or Go to define resources. The primary benefit is that you can use object-oriented programming, loops, conditions, and variables to create reusable infrastructure components called constructs. CDK synthesizes your code into CloudFormation templates, which are then deployed by CloudFormation. This abstraction reduces manual errors and accelerates development.

CDK operates in three main phases: Construct, Synthesize, and Deploy.

1. Construct Phase: You write code using CDK constructs. Constructs are the basic building blocks of CDK apps. They represent AWS resources or groups of resources. There are three levels of constructs: - L1 (Low-Level): These are direct representations of CloudFormation resources, prefixed with Cfn. For example, CfnBucket maps directly to AWS::S3::Bucket. They require you to specify every property manually. - L2 (Curated/High-Level): These are AWS-constructed resources that provide sensible defaults and convenience methods. For example, Bucket from aws-s3 automatically configures encryption, versioning, and lifecycle rules based on best practices. They also expose methods like addLifecycleRule(). - L3 (Patterns): These represent complete architectural patterns, like LoadBalancedFargateService from aws-ecs-patterns, which creates an ECS service behind an Application Load Balancer with auto-scaling.

CDK is tightly integrated with CloudFormation. When you deploy, CDK calls CloudFormation APIs. The generated templates are standard CloudFormation templates, so you can even deploy them manually via the console. CDK also integrates with: - AWS Identity and Access Management (IAM): CDK automatically creates IAM roles and policies based on resource interactions. - AWS Lambda: CDK can bundle Lambda code from local directories or inline code. It handles uploading the code to S3. - Amazon S3: CDK uses S3 for storing assets and templates. The bootstrap bucket stores all deployment artifacts. - AWS CodePipeline: CDK can generate pipeline resources to implement CI/CD for the infrastructure itself. - AWS CloudFormation StackSets: CDK can deploy to multiple accounts and regions using stack sets.

CDK also supports aspects, which are like middleware that can modify constructs. For example, you can apply an aspect that tags all resources with a specific tag.

from aws_cdk import (
    aws_s3 as s3,
    core as cdk
)

class MyStack(cdk.Stack):
    def __init__(self, scope: cdk.Construct, id: str, **kwargs) -> None:
        super().__init__(scope, id, **kwargs)
        
        # L2 bucket with default encryption
        bucket = s3.Bucket(
            self, "MyBucket",
            versioned=True,
            encryption=s3.BucketEncryption.S3_MANAGED,
            removal_policy=cdk.RemovalPolicy.DESTROY,
            auto_delete_objects=True
        )
        
        # Output the bucket name
        cdk.CfnOutput(self, "BucketName", value=bucket.bucket_name)

app = cdk.App()
MyStack(app, "MyStack")
app.synth()

When you run cdk synth, this generates a CloudFormation template with an AWS::S3::Bucket resource, including properties for VersioningConfiguration, BucketEncryption, and a deletion policy. The auto_delete_objects adds a custom resource Lambda that empties the bucket before deletion.

A financial services company manages over 50 microservices across three AWS accounts (dev, staging, prod). Each microservice requires an ALB, ECS Fargate cluster, RDS database, and IAM roles. Using raw CloudFormation templates, the team struggled with duplication and drift. They adopted CDK with TypeScript, creating L3 constructs like MicroserviceStack that encapsulate the entire pattern. The construct accepts parameters like serviceName, cpu, memory, and dbInstanceClass. It automatically creates a VPC with public and private subnets, security groups, and a load balancer. The team uses CDK Pipelines to deploy changes. The pipeline itself is defined in CDK and self-mutates. Each account has its own bootstrap stack. One common issue was that the autoDeleteObjects property on S3 buckets was not set initially, causing stack deletion to fail when buckets contained logs. They fixed this by adding autoDeleteObjects: true and removalPolicy: RemovalPolicy.DESTROY. Performance considerations: CDK synthesis time increased with many resources, but they mitigated by using nested stacks for independent components.

A healthcare startup must enforce encryption at rest and in transit for all services to meet HIPAA. They use CDK with Python and apply a custom Aspect that checks every resource for required encryption properties. The Aspect walks the construct tree and adds tags or modifies properties. For example, it ensures every S3 bucket has encryption: BucketEncryption.KMS and every RDS instance has storageEncrypted: true. They also use CDK Nag to run rules before deployment. One challenge was that some L2 constructs, like Bucket, default to BucketEncryption.S3_MANAGED, which is acceptable, but the Aspect flagged it because they required KMS. They overrode the default by passing encryption: BucketEncryption.KMS. They also used PermissionsBoundary to restrict IAM roles. The cdk diff command is used in CI/CD to prevent unauthorized changes.

An e-commerce company processes clickstream data using Lambda, Kinesis Firehose, and S3. They use CDK to define the pipeline. Each stage is a construct: ClickstreamSource, StreamProcessor, and DataLake. The StreamProcessor construct creates a Lambda function with the code stored as an asset. CDK automatically uploads the code to S3 and sets the Lambda's code property. They use cdk watch during development to automatically redeploy on code changes. A common misconfiguration was forgetting to set reservedConcurrentExecutions on the Lambda, causing throttling under load. They added reserved_concurrent_executions: 100. Also, they used CfnOutput to export the Firehose delivery stream name for other teams. The pipeline processes over 10 TB of data daily with no issues.