new CodePipeline()` capabilities

[jacido]

Hi Team,

Is there a way to use new CodePipeline() to simplify having the artifact s3 bucket and key for use in the CfnFunction calls in TestStack?

So far I have this:

const myCodePipeline = new aws_codepipeline.Pipeline(this, .....)
// Getting the artifact bucket [3]
myCodePipeline.artifactBucket

// Getting the KMS key [4]
const cfnPipeline = myCodePipeline.defaultChild as CfnPipeline
const key = cfnPipeline.artifactStores[0].encryptionKey

new CodePipeline() is a construct and retrievable properties are these:
https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.pipelines.CodePipeline.html#properties

I have an issue where they building the whole pipeline piece by piece instead of using new CodePipeline()
The problem is that they have to create all the policies and resources individually to just have the s3 bucket and key for use in the CfnFunction calls in TestStack.

[jacido]

The current use case is for a migration from SAM to CDK. Is it possible to get the CDK artifact bucket/key for the lambda source code to input to a CfnFunction. After being imported, the CfnFunction constructs have hard-coded references to the currently deployed S3 object key.

import { CfnDeletionPolicy, Stack, StackProps } from "aws-cdk-lib";
import { CfnRole } from "aws-cdk-lib/aws-iam";
import { CfnAlias, CfnFunction, CfnVersion } from "aws-cdk-lib/aws-lambda";
import * as codedeploy from "aws-cdk-lib/aws-codedeploy";
import { Construct } from "constructs";

// interface TestStackProps extends StackProps {
//   artifactBucket: string;
//   artifactKey: string;
// }

export class TestStack extends Stack {
  constructor(scope: Construct, id: string, stackProps: StackProps) {
    super(scope, id, stackProps);
    // const { artifactBucket, artifactKey } = stackProps;

    const CBTestFunctionRole = new CfnRole(this, "CBTestFunctionRole", {
      assumeRolePolicyDocument: {
        Version: "2012-10-17",
        Statement: [
          {
            Action: ["sts:AssumeRole"],
            Effect: "Allow",
            Principal: {
              Service: ["lambda.amazonaws.com"],
            },
          },
        ],
      },
      managedPolicyArns: [
        "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
        "arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess",
      ],
      tags: [
        {
          key: "lambda:createdBy",
          value: "SAM",
        },
        {
          key: "CostCenter",
          value: "JOULE",
        },
      ],
    });

    const codeDeployServiceRole = new CfnRole(this, "CodeDeployServiceRole", {
      assumeRolePolicyDocument: {
        Version: "2012-10-17",
        Statement: [
          {
            Action: ["sts:AssumeRole"],
            Effect: "Allow",
            Principal: {
              Service: ["codedeploy.amazonaws.com"],
            },
          },
        ],
      },
      managedPolicyArns: ["arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambda"],
    });

    const serverlessDeploymentApplication = new codedeploy.CfnApplication(
      this,
      "ServerlessDeploymentApplication",
      {
        computePlatform: "Lambda",
      },
    );

    const cbTestFunctionDeploymentGroup = new codedeploy.CfnDeploymentGroup(
      this,
      "CBTestFunctionDeploymentGroup",
      {
        applicationName: serverlessDeploymentApplication.ref,
        autoRollbackConfiguration: {
          enabled: true,
          events: ["DEPLOYMENT_FAILURE", "DEPLOYMENT_STOP_ON_ALARM", "DEPLOYMENT_STOP_ON_REQUEST"],
        },
        deploymentConfigName: "CodeDeployDefault.LambdaAllAtOnce",
        deploymentStyle: {
          deploymentType: "BLUE_GREEN",
          deploymentOption: "WITH_TRAFFIC_CONTROL",
        },
        serviceRoleArn: codeDeployServiceRole.attrArn,
      },
    );

    const cbTestFunction = new CfnFunction(this, "CBTestFunction", {
      code: {
        s3Bucket: "artifactBucket", // TODO
        s3Key: "artifactKey", // TODO
      },
      functionName: "CBTestFunction",
      handler: "dist/lambdas/analytics/authentication.handler",
      memorySize: 256,
      role: CBTestFunctionRole.attrArn,
      runtime: "nodejs18.x",
      timeout: 15,
      tags: [
        {
          key: "lambda:createdBy",
          value: "SAM",
        },
        {
          key: "CostCenter",
          value: "JOULE",
        },
      ],
      tracingConfig: {
        mode: "Active",
      },
    });

    const cbTestFunctionV1 = new CfnVersion(this, "CBTestFunctionV1", {
      functionName: cbTestFunction.ref,
    });
    cbTestFunctionV1.cfnOptions.deletionPolicy = CfnDeletionPolicy.RETAIN;

    const cbTestFunctionAliaslive = new CfnAlias(this, "CBTestFunctionAliaslive", {
      name: "live",
      functionName: cbTestFunction.ref,
      functionVersion: cbTestFunctionV1.attrVersion,
    });
    cbTestFunctionAliaslive.cfnOptions.updatePolicy = {
      codeDeployLambdaAliasUpdate: {
        applicationName: serverlessDeploymentApplication.ref,
        deploymentGroupName: cbTestFunctionDeploymentGroup.ref,
      },
    };
  }
}

[pahud]

Yes it would be possible but you will need to bake the CfnFunction yourself and you lose all the benefits of lambda.Function L2. Do you have any errors?

[pahud]

You should try to use L2 whenever possible.

For example, you can create a lambda.Function with dummy inline assets.

    // create a dummy lambda func
    const lambda = new cdk.aws_lambda.Function(this, 'lambda', {
      runtime: cdk.aws_lambda.Runtime.NODEJS_20_X,
      code: cdk.aws_lambda.Code.fromInline('dummy'),
      handler: 'index.handler',
    });

    (lambda.node.defaultChild as lambda.CfnFunction).addPropertyOverride('Code', {
      'S3Bucket': 'your-bucket-name',
      'S3Key': 'your-s3-key',
    })

[jacido]

They aren't sure that converting to L2 Lambda constructs would help here. They still need the s3 bucket and key, which is the center of the problem. They are not able to retrieve the s3 bucket and key of the lambda code when using new CodePipeline(). They are using the CloudFormation template created when using new CodePipeline() and recreating all of the pipeline resources manually in CDK.

Unfortunately they can't use the Stage construct to insert the TestStack resulting in them being stuck on the prepare/deploy actions.

The goal of this initial push to CDK is to simply be able to deploy all of the resources generated by cdk migrate using a CDK pipeline. Next steps will be to break out nested stacks to overcome the resource limit of the existing stack, and convert to L2 constructs.