CDK Aspectsを利用してベストプラクティスに従ったインフラストラクチャを構築する

interface IAspect {
   visit(node: IConstruct): void ;
}

Aspects.of(myConstruct).add(new SomeAspect(...));

import * as cdk from 'aws-cdk-lib';
 import * as ec2 from 'aws-cdk-lib/aws-ec2';
 import * as rds from 'aws-cdk-lib/aws-rds';
 import * as s3 from 'aws-cdk-lib/aws-s3';
 import { Construct } from 'constructs';

 export class AwsCdkAspectsStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props ?: cdk.StackProps) {
    super(scope, id, props);

    //Create a VPC with 3 availability zones 
    const vpc = new ec2.Vpc(this, 'MyVpc', {
      maxAzs: 3,
    });

    //Create a security group 
    const sg = new ec2.SecurityGroup(this, 'mySG', {
      vpc: vpc,
      allowAllOutbound: true 
    })

    //Add ingress rule for SSH from the public internet 
    sg.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(22), 'SSH access from anywhere')

    //Launch an EC2 instance in private subnet 
    const instance = new ec2.Instance(this, 'MyInstance', {
      vpc: vpc,
      machineImage: ec2.MachineImage.latestAmazonLinux2(),
      instanceType: new ec2.InstanceType('t3.small'),
      vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
      securityGroup: sg 
    })

    //Launch MySQL rds database instance in private subnet 
    const database = new rds.DatabaseInstance(this, 'MyDatabase', {
      engine: rds.DatabaseInstanceEngine.mysql({
        version: rds.MysqlEngineVersion.VER_8_0 
      }),
      vpc: vpc,
      vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
      deletionProtection: false 
    })

    //Create an s3 bucket 
    const bucket = new s3.Bucket(this, 'MyBucket')
  }
}

import * as cdk from 'aws-cdk-lib';
 import * as ec2 from 'aws-cdk-lib/aws-ec2';
 import * as rds from 'aws-cdk-lib/aws-rds';
 import * as s3 from 'aws-cdk-lib/aws-s3';
 import { Stack, IAspect, Annotations, Tokenization } from 'aws-cdk-lib';
 import { IConstruct } from 'constructs';

//Verify VPC CIDR range 
 export class VPCCIDRAspect implements IAspect {
    public visit(node: IConstruct) {
        if (node instanceof ec2.CfnVPC && node.cidrBlock) {
            if (! node.cidrBlock.startsWith('192.168.')) {
                Annotations.of(node).addError('VPC does not use standard CIDR range starting with "192.168."');
            }
        }
    }
}

//Verify public ingress rule of security group 
 export class SecurityGroupNoPublicIngressAspect implements IAspect {
    public visit(node: IConstruct) {
        if (node instanceof ec2.CfnSecurityGroup) {
            checkRules(Stack.of(node).resolve(node.securityGroupIngress));
        }

        function checkRules (rules : Array<ec2.CfnSecurityGroup.IngressProperty>) {
            if(rules) {
                for (const rule of rules.values()) {
                    if (! Tokenization.isResolvable(rule) && (rule.cidrIp == '0.0.0.0/0' || rule.cidrIp == '::/0')) {
                        Annotations.of(node).addError('Security Group allows ingress from public internet.');
                    }
                }
            }
        }
    }
}

//Verify instance type of EC2 instance 
 export class EC2ApprovedITAspect implements IAspect {
    public visit(node: IConstruct) {
        const its = ['x', 'z', 'p', 'g', 'i', 't'] 
        if (node instanceof ec2.CfnInstance && node.instanceType) {
            const instanceType = node.instanceType ;
            if (its.some(its => instanceType.startsWith(its))) {
                Annotations.of(node).addError('EC2 Instance is not using approved instance type.');
            }
        }
    }
}

//Verify that bucket versioning is enabled 
 export class BucketVersioningAspect implements IAspect {
    public visit(node: IConstruct): void {
        if (node instanceof s3.CfnBucket) {
            if (! node.versioningConfiguration 
                || (! Tokenization.isResolvable(node.versioningConfiguration)
                    && node.versioningConfiguration.status !== 'Enabled')) {
                Annotations.of(node).addError('S3 bucket versioning is not enabled.');
            }
        }
    }
}

//Verify that bucket has server-side encryption enabled 
 export class BucketEncryptionAspect implements IAspect {
    public visit(node: IConstruct): void {
        if (node instanceof s3.CfnBucket) {
            if (! node.bucketEncryption) {
                Annotations.of(node).addError('S3 bucket encryption is not enabled.');
            }
        }
    }
}

//Verify that DB instance deletion protection is enabled 
 export class RDSDeletionProtectionAspect implements IAspect {
    public visit(node: IConstruct) {
        if (node instanceof rds.CfnDBInstance) {
            if (! node.deletionProtection) {
                Annotations.of(node).addError('RDS DB instance deletion protection is not enabled.');
            }
        }
    }
}

import * as cdk from 'aws-cdk-lib';
 import { Aspects } from 'aws-cdk-lib';
 import { AwsCdkAspectsStack } from '../lib/cdk-aspect-stack';
 import { BucketEncryptionAspect, BucketVersioningAspect,
    EC2ApprovedITAspect, RDSDeletionProtectionAspect, 
    SecurityGroupNoPublicIngressAspect, VPCCIDRAspect } from '../lib/cdk-aspect-rules';

 const app = new cdk.App();

 const stack = new AwsCdkAspectsStack(app, 'MyApplicationStack');

 Aspects.of(stack).add(new VPCCIDRAspect());
 Aspects.of(stack).add(new SecurityGroupNoPublicIngressAspect());
 Aspects.of(stack).add(new EC2ApprovedITAspect());
 Aspects.of(stack).add(new RDSDeletionProtectionAspect());
 Aspects.of(stack).add(new BucketEncryptionAspect());
 Aspects.of(stack).add(new BucketVersioningAspect());

 app.synth();

Tags.of(myConstruct).add('key', 'value');
 Tags.of(myConstruct).remove('key');

Tags.of(stack).add('Department', 'Finance');