Security News
ESLint is Now Language-Agnostic: Linting JSON, Markdown, and Beyond
ESLint has added JSON and Markdown linting support with new officially-supported plugins, expanding its versatility beyond JavaScript.
@aws-cdk/cdk
Advanced tools
This is a developer preview (public beta) module. Releases might lack important features and might have future breaking changes.
This API is still under active development and subject to non-backward compatible changes or removal in any future version. Use of the API is not recommended in production environments. Experimental APIs are not subject to the Semantic Versioning model.
This library includes the basic building blocks of the AWS Cloud Development Kit (AWS CDK).
Aspects are a mechanism to extend the CDK without having to directly impact the class hierarchy. We have implemented aspects using the Visitor Pattern.
An aspect in the CDK is defined by this interface
Aspects can be applied to any construct. During the tree
"prepare" phase the aspect will visit each construct in the tree once.
Aspects are invoked in the order they were added to the construct. They
traverse the construct tree in a breadth first order starting at the App
ending at the leaf nodes (most commonly the CloudFormation Resource). Aspect
authors implement the visit(IConstruct)
function and can inspect the
Construct
for specific characteristics. Such as, is this construct a
CloudFormation Resource?
Tags are implemented using aspects.
Tags can be applied to any construct. Tags are inherited, based on the scope. If you tag construct A, and A contains construct B, construct B inherits the tag. The Tag API supports:
Tag
add (apply) a tag, either to specific resources or all but specific resourcesRemoveTag
remove a tag, again either from specific resources or all but specific resourcesA simple example, if you create a stack and want anything in the stack to receive a tag:
import cdk = require('@aws-cdk/cdk');
const app = new cdk.App();
const theBestStack = new cdk.Stack(app, 'MarketingSystem');
theBestStack.node.apply(new cdk.Tag('StackType', 'TheBest'));
// any resources added that support tags will get them
The goal was to enable the ability to define tags in one place and have them applied consistently for all resources that support tagging. In addition the developer should not have to know if the resource supports tags. The developer defines the tagging intents for all resources within a path. If the resources support tags they are added, else no action is taken.
We are going to use the ECS example as starting point.
For the purposes of example, this ECS cluster is for the Marketing Department. Marketing has two core groups Business to Business (B2B) and Business to Consumer (B2C). However, the Marketing team relies on the Platform team to help build the common components across businesses and separates costs to match. The goal here is tag the Platform team resources, the Marketing Department and then Marketing groups to enable proper cost allocations.
We have modified the example and the code is located: examples/cdk-examples-typescript/hello-cdk-ecs-tags
When the example is run the following tags are created:
We are omitting the default tags for VPC components.
Construct Path | Tag Key | Tag Value |
---|---|---|
MarketingSystem/MarketingVpc | CostCenter | Platform |
MarketingSystem/MarketingVpc/PublicSubnet1 | CostCenter | Platform |
MarketingSystem/MarketingVpc/PublicSubnet1/RouteTable | CostCenter | Platform |
MarketingSystem/MarketingVpc/PublicSubnet1/NATGateway | CostCenter | Platform |
MarketingSystem/MarketingVpc/PublicSubnet2 | CostCenter | Platform |
MarketingSystem/MarketingVpc/PublicSubnet2/RouteTable | CostCenter | Platform |
MarketingSystem/MarketingVpc/PublicSubnet2/NATGateway | CostCenter | Platform |
MarketingSystem/MarketingVpc/PublicSubnet3 | CostCenter | Platform |
MarketingSystem/MarketingVpc/PublicSubnet3/RouteTable | CostCenter | Platform |
MarketingSystem/MarketingVpc/PublicSubnet3/NATGateway | CostCenter | Platform |
MarketingSystem/MarketingVpc/PrivateSubnet1 | CostCenter | Platform |
MarketingSystem/MarketingVpc/PrivateSubnet1/RouteTable | CostCenter | Platform |
MarketingSystem/MarketingVpc/PrivateSubnet2 | CostCenter | Platform |
MarketingSystem/MarketingVpc/PrivateSubnet2/RouteTable | CostCenter | Platform |
MarketingSystem/MarketingVpc/PrivateSubnet3 | CostCenter | Platform |
MarketingSystem/MarketingVpc/PrivateSubnet3/RouteTable | CostCenter | Platform |
MarketingSystem/MarketingVpc/IGW | CostCenter | Platform |
MarketingSystem/B2BService/Service/SecurityGroup/Resource | CostCenter | Marketing |
MarketingSystem/B2BService/LB/Resource | CostCenter | Marketing |
MarketingSystem/B2BService/LB/SecurityGroup/Resource | CostCenter | Marketing |
MarketingSystem/B2BService/LB/PublicListener/ECSGroup/Resource | CostCenter | Marketing |
MarketingSystem/B2CService/Service/SecurityGroup/Resource | CostCenter | Marketing |
MarketingSystem/B2CService/LB/Resource | CostCenter | Marketing |
MarketingSystem/B2CService/LB/SecurityGroup/Resource | CostCenter | Marketing |
MarketingSystem/B2CService/LB/PublicListener/ECSGroup/Resource | CostCenter | Marketing |
As you can see many tags are generated with only a few intent based directives. The CDK does default some additional tags for suggested Name
keys. If you want to remove those tags you can do so by using the RemoveTag
aspect, see below:
// snip //
const vpc = new ec2.Vpc(marketingStack, 'MarketingVpc', {
maxAZs: 3 // Default is all AZs in region
});
// override the VPC tags with Platform
// this will tag the VPC, Subnets, Route Tables, IGW, and NatGWs
vpc.node.apply(new cdk.Tag(COST_CENTER_KEY, 'Platform'));
vpc.node.apply(new cdk.RemoveTag('Name'));
// snip //
This will remove the name tags from the VPC, subnets, route tables and NAT gateways. If you've been following closely, this may lead you to ask how does remove work when the tag is actually applied closer to the resource? The Tag API has a few features that are covered later to explain how this works.
In order to enable additional controls a Tag can specifically include or
exclude a CloudFormation Resource Type, propagate tags for an autoscaling group,
and use priority to override the default precedence. See the TagProps
interface for more details.
Tags can be configured by using the properties for the AWS CloudFormation layer resources or by using the tag aspects described here. The aspects will always take precedence over the AWS CloudFormation layer in the event of a name collision. The tags will be merged otherwise. For the aspect based tags, the tags applied closest to the resource will take precedence, given an equal priority. A higher priority tag will always take precedence over a lower priority tag.
This property is a boolean that defaults to true
. When true
and the aspect
visits an AutoScalingGroup resource the PropagateAtLaunch
property is set to
true. If false the property is set accordingly.
// ... snip
const vpc = new ec2.Vpc(this, 'MyVpc', { ... });
vpc.node.apply(new cdk.Tag('MyKey', 'MyValue', { applyToLaunchedInstances: false }));
// ... snip
Include is an array property that contains strings of CloudFormation Resource Types. As the aspect visits nodes it only takes action if node is one of the resource types in the array. By default the array is empty and an empty array is interpreted as apply to any resource type.
// ... snip
const vpc = new ec2.Vpc(this, 'MyVpc', { ... });
vpc.node.apply(new cdk.Tag('MyKey', 'MyValue', { includeResourceTypes: ['AWS::EC2::Subnet']}));
// ... snip
Exclude is the inverse of include. Exclude is also an array of CloudFormation Resource Types. As the aspect visit nodes it will not take action if the node is one of the resource types in the array. By default the array is empty and an empty array is interpreted to match no resource type. Exclude takes precedence over include in the event of a collision.
// ... snip
const vpc = new ec2.Vpc(this, 'MyVpc', { ... });
vpc.node.apply(new cdk.Tag('MyKey', 'MyValue', { exludeResourceTypes: ['AWS::EC2::Subnet']}));
// ... snip
Priority is used to control precedence when the default pattern does not work.
In general users should try to avoid using priority, but in some situations it
is required. In the example above, this is how RemoveTag
works. The default
setting for removing tags uses a higher priority than the standard tag.
// ... snip
const vpc = new ec2.Vpc(this, 'MyVpc', { ... });
vpc.node.apply(new cdk.Tag('MyKey', 'MyValue', { priority: 2 }));
// ... snip
To help avoid accidental storage of secrets as plain text we use the SecretValue
type to
represent secrets.
The best practice is to store secrets in AWS Secrets Manager and reference them using SecretValue.secretsManager
:
const secret = SecretValue.secretsManager('secretId', {
jsonField: 'password' // optional: key of a JSON field to retrieve (defaults to all content),
versionId: 'id' // optional: id of the version (default AWSCURRENT)
versionStage: 'stage' // optional: version stage name (default AWSCURRENT)
});
Using AWS Secrets Manager is the recommended way to reference secrets in a CDK app.
However, SecretValue
supports the following additional options:
SecretValue.plainText(secret)
: stores the secret as plain text in your app and the resulting template (not recommended).SecretValue.ssmSecure(param, version)
: refers to a secret stored as a SecureString in the SSM Parameter Store.SecretValue.cfnParameter(param)
: refers to a secret passed through a CloudFormation parameter (must have NoEcho: true
).SecretValue.cfnDynamicReference(dynref)
: refers to a secret described by a CloudFormation dynamic reference (used by ssmSecure
and secretsManager
).0.35.0 (2019-06-19)
cdk context
(#2870) (b8a1c8e), closes #2854name
in StageProps
to stageName
. (#2882) (be574a1)hwType
to hardwareType
(#2916) (1aa0589), closes #2896aws-sns-subscribers
(#2804) (9ef899c)AssetProps.packaging
has been removed and is now automatically discovered based on the file type.ZipDirectoryAsset
has been removed, use aws-s3-assets.Asset
.FileAsset
has been removed, use aws-s3-assets.Asset
.Code.directory
and Code.file
have been removed. Use Code.asset
.hardwareType
from hwType
.TableOptions.pitrEnabled
renamed to pointInTimeRecovery
.TableOptions.sseEnabled
renamed to serverSideEncryption
.TableOptions.ttlAttributeName
renamed to timeToLiveAttribute
.TableOptions.streamSpecification
renamed stream
.ContainerImage.fromAsset()
now takes only build directory
directly (no need to pass scope
or id
anymore).ISecret.secretJsonValue
renamed to secretValueFromJson
.ParameterStoreString
has been removed. Use StringParameter.fromStringParameterAttributes
.ParameterStoreSecureString
has been removed. Use StringParameter.fromSecureStringParameterAttributes
.ParameterOptions.name
was renamed to parameterName
.newStream
renamed to addStream
and doesn't need a scopenewSubscriptionFilter
renamed to addSubscriptionFilter
and doesn't need a scopenewMetricFilter
renamed to addMetricFilter
and doesn't need a scopeNewSubscriptionFilterProps
renamed to SubscriptionProps
NewLogStreamProps
renamed to LogStreamOptions
NewMetricFilterProps
renamed to MetricFilterOptions
JSONPattern
renamed to JsonPattern
MethodOptions.authorizerId
is now called authorizer
and accepts an IAuthorizer
which is a placeholder interface for the authorizer resource.restapi.executeApiArn
renamed to arnForExecuteApi
.restapi.latestDeployment
and deploymentStage
are now read-only.EventPattern.detail
is now a map.scheduleExpression: string
is now schedule: Schedule
.cdk.RemovalPolicy
to configure the resource's removal policy.applyRemovalPolicy
is now CfnResource.applyRemovalPolicy
.RemovalPolicy.Orphan
has been renamed to Retain
.RemovalPolicy.Forbid
has been removed, use Retain
.RepositoryProps.retain
is now removalPolicy
, and defaults to Retain
instead of remove since ECR is a stateful resourceKeyProps.retain
is now removalPolicy
LogGroupProps.retainLogGroup
is now removalPolicy
LogStreamProps.retainLogStream
is now removalPolicy
DatabaseClusterProps.deleteReplacePolicy
is now removalPolicy
DatabaseInstanceNewProps.deleteReplacePolicy
is now removalPolicy
attr
instead of the resource type. For example, in S3 bucket.bucketArn
is now bucket.attrArn
.propertyOverrides
has been removed from all "Cfn" resources, instead
users can now read/write resource properties directly on the resource class. For example, instead of lambda.propertyOverrides.runtime
just use lambda.runtime
.stageName
instead of name
Function.addLayer
to addLayers
and made it variadicIFunction.handler
propertyIVersion.versionArn
property (the value is at functionArn
)SingletonLayerVersion
LogRetention
PolicyStatement
no longer has a fluid API, and accepts a
props object to be able to set the important fields.ImportedResourcePrincipal
to UnknownPrincipal
.managedPolicyArns
renamed to managedPolicies
, takes
return value from ManagedPolicy.fromAwsManagedPolicyName()
.PolicyDocument.postProcess()
is now removed.PolicyDocument.addStatement()
renamed to addStatements
.PolicyStatement
is no longer IResolvable
, call .toStatementJson()
to retrieve the IAM policy statement JSON.AwsPrincipal
has been removed, use ArnPrincipal
instead.s3.StorageClass
is now an enum-like class instead of a regular
enum. This means that you need to call .value
in order to obtain it's value.s3.Coordinates
renamed to s3.Location
Artifact.s3Coordinates
renamed to Artifact.s3Location
.BuildSpec
object.lambda.Runtime.NodeJS*
are now lambda.Runtime.Nodejs*
Stack
APIstack.name
renamed to stack.stackName
stack.stackName
will return the concrete stack name. Use Aws.stackName
to indicate { Ref: "AWS::StackName" }.stack.account
and stack.region
will return the concrete account/region only if they are explicitly specified when the stack is defined (under the env
prop). Otherwise, they will return a token that resolves to the AWS::AccountId and AWS::Region intrinsic references. Use Context.getDefaultAccount()
and Context.getDefaultRegion()
to obtain the defaults passed through the toolkit in case those are needed. Use Token.isUnresolved(v)
to check if you have a concrete or intrinsic.stack.logicalId
has been removed. Use stack.getLogicalId()
stack.env
has been removed, use stack.account
, stack.region
and stack.environment
insteadstack.accountId
renamed to stack.account
(to allow treating account more abstractly)AvailabilityZoneProvider
can now be accessed through Context.getAvailabilityZones()
SSMParameterProvider
can now be accessed through Context.getSsmParameter()
parseArn
is now Arn.parse
arnFromComponents
is now arn.format
node.lock
and node.unlock
are now privatestack.requireRegion
and requireAccountId
have been removed. Use Token.unresolved(stack.region)
insteadstack.parentApp
have been removed. Use App.isApp(stack.node.root)
instead.stack.missingContext
is now privatestack.renameLogical
have been renamed to stack.renameLogicalId
IAddressingScheme
, HashedAddressingScheme
and LogicalIDs
are now internal. Override Stack.allocateLogicalId
to customize how logical IDs are allocated to resources.--rename
, and the stack
names are now immutable on the stack artifact.@aws-cdk/aws-sns-subscribers
package.roleName
in RoleProps
is now of type PhysicalName
bucketName
in BucketProps
is now of type PhysicalName
roleName
in RoleProps
is now of type PhysicalName
FAQs
Deprecated: this module ha been renamed to @aws-cdk/core
The npm package @aws-cdk/cdk receives a total of 116 weekly downloads. As such, @aws-cdk/cdk popularity was classified as not popular.
We found that @aws-cdk/cdk demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
ESLint has added JSON and Markdown linting support with new officially-supported plugins, expanding its versatility beyond JavaScript.
Security News
Members Hub is conducting large-scale campaigns to artificially boost Discord server metrics, undermining community trust and platform integrity.
Security News
NIST has failed to meet its self-imposed deadline of clearing the NVD's backlog by the end of the fiscal year. Meanwhile, CVE's awaiting analysis have increased by 33% since June.