AWS¶

npm install -g aws-cdk

npm install -g aws-cdk

using Amazon.CDK;
using Amazon.CDK.AWS.APIGateway;
using Amazon.CDK.AWS.DynamoDB;
using Amazon.CDK.AWS.Lambda;
using Amazon.CDK.AWS.Logs;
using Constructs;
using AssetOptions = Amazon.CDK.AWS.S3.Assets.AssetOptions;

namespace CdkUrlShortener;

public class CdkUrlShortenerStack : Stack
{
    private new const string StackName = "cdk-url-shortener-stack";

    internal CdkUrlShortenerStack(Construct scope, string id, IStackProps props = null) : base(scope, id, props)
    {
        var buildOption = new BundlingOptions
        {
            Image = Runtime.DOTNET_6.BundlingImage,
            User = "root",
            OutputType = BundlingOutput.ARCHIVED,
            Command = new[]
            {
                "/bin/sh",
                "-c",
                " dotnet tool install -g Amazon.Lambda.Tools" +
                " && dotnet build" +
                " && dotnet lambda package --output-package /asset-output/function.zip"
            }
        };

        var lambdaFunction = new Function(this, $"{StackName}-lambda-function", new FunctionProps
        {
            Runtime = Runtime.DOTNET_6,
            MemorySize = 1024,
            LogRetention = RetentionDays.ONE_DAY,
            Handler = "Function",
            Code = Code.FromAsset("lambda/Function/", new AssetOptions
            {
                Bundling = buildOption
            })
        });

        // キーが短縮URL、バリューがもとのURL
        var table = new Table(this, $"{StackName}-mapping-table", new TableProps
        {
            PartitionKey = new Attribute
            {
                Name = "id",
                Type = AttributeType.STRING
            },
            RemovalPolicy = RemovalPolicy.DESTROY
        });

        table.GrantReadWriteData(lambdaFunction);
        lambdaFunction.AddEnvironment("TABLE_NAME", table.TableName);

        // Proxy all request from the root path "/" to Lambda Function One
        var restApi = new LambdaRestApi(this, $"{StackName}-url-shortener-api", new LambdaRestApiProps
        {
            Handler = lambdaFunction,
            Proxy = true
        });

        var unused = new CfnOutput(this, $"{StackName}-api-gw-arn",
            new CfnOutputProps {Value = restApi.ArnForExecuteApi()});
    }
}

cdk deploy --require-approval <LEVEL>

npm i -g npm-check-updates
ncu -g aws-cdk
npm -g install aws-cdk@<ver>

cdk init sample-app --language csharp

cdk diff

cdk synth

cdk deploy <stack-id>

        // 削除時にs3のバケットも削除する
        _ = new Bucket(this, "WorkshopBucket", new BucketProps
        {
            RemovalPolicy = RemovalPolicy.DESTROY
        });

aws ssm start-session --target i-0759d9149c57b9e13

aws ssm start-session \
  --target <ssm-managed-instance-id> \
  --document-name AWS-StartPortForwardingSessionToRemoteHost \
  --parameters '{"portNumber":["5432"],"localPortNumber":["1053"],"host":["<remote-database-host-name>"]}'


psql -h 127.0.0.1 -p 1053 -U pgadmin

aws ssm start-session \
  --target <ssm-managed-instance-id> \
  --document-name AWS-StartPortForwardingSessionToRemoteHost \
  --parameters '{"portNumber":["3306"],"localPortNumber":["1053"],"host":["<remote-database-host-name>"]}'


mysql -h 127.0.0.1 --port 1053 -u admin -p

aws s3api create-bucket \
--bucket <bucket-name> \
--region <region-name> \
--create-bucket-configuration LocationConstraint=<region-name>

aws configure

Default region name [None]: ap-northeast-1
Default output format [None]: json

[default]
region = ap-northeast-1
output = json

aws sts get-caller-identity
aws configure list

[toplevel]
whoami = sts get-caller-identity

aws configure list
export AWS_DEFAULT_PROFILE=<USER_NAME>

aws configure --profile <username>
cat ~/.aws/credentials

cd ~/.ssh
ssh-keygen
less ~/.ssh/id_rsa.pub

copilot job package -n dbmigrate -e staging --output-dir ./infrastructure

  healthcheck:
    path: "/health"
    healthy_threshold: 2
    unhealthy_threshold: 2
    interval: 10s
    timeout: 5s
    grace_period: 60s
  deregistration_delay: 60s

secrets:
  CLUSTER_SECRET:
    secretsmanager: 'mydjangodbAuroraSecret-ObSZ2fGHWHTm'

export AWS_DEFAULT_PROFILE=<aws-account-name>
copilot app init pt-domain
copilot env init --name test \
  --profile <aws-account-name> \
  --app pt-domain \
  --default-config \
  --import-cert-arns <ACMの値を設定>
copilot svc init --name pt-domain \
  --svc-type "Load Balanced Web Service" \
  --dockerfile ./Dockerfile \
  --port 80
copilot env deploy --name test
copilot svc deploy --env test
copilot svc show

export AWS_DEFAULT_PROFILE=<aws-account-name>
copilot env init --name stg \
  --profile <aws-account-name> \
  --app pt-domain \
  --default-config \
  --import-cert-arns <ACMの値を設定>

copilot env deploy --name stg
copilot svc deploy --env stg

http:
  alias: "www.academic-event.com"

environments:
  stg:
    http:
      alias: "stg.academic-event.com"
  test:
    http:
      alias: "www.academic-event.com"

http:
  public:
    # 適切なACMの値
    certificates: [<ACMの適切な値>]
  alias: "www.academic-event.com"


http:
  public:
    # 適切なACMの値
    certificates: [<ACMの適切な値>]
  alias: "stg.academic-event.com"

export AWS_DEFAULT_PROFILE=<aws-account-name>

nslookup -type=NS academic-event.com # お名前.comのDNSが表示されるか確認

export AWS_DEFAULT_PROFILE=<aws-account-name>
copilot app init pt-domain
copilot env init --name test \
  --profile <aws-account-name> \
  --app pt-domain \
  --default-config \
  --import-cert-arns <ACMの値を設定>
copilot svc init --name pt-domain \
  --svc-type "Load Balanced Web Service" \
  --dockerfile ./Dockerfile \
  --port 80
copilot env deploy --name test
copilot svc deploy --env test
copilot svc show

export AWS_DEFAULT_PROFILE=<aws-account-name>
copilot env init --name stg \
  --profile <aws-account-name> \
  --app pt-domain \
  --default-config \
  --import-cert-arns <ACMの値を設定>


copilot env deploy --name stg
copilot svc deploy --env stg

secrets:
  # 変数名と値は`copilot svc show`の値を指定する
  WEBCLUSTER_SECRET_ARN: "arn:aws:secretsmanager:us-west-2:573143736992:secret:webclusterAuroraSecret-5ggcmKflNSGA-UR8O44"

dotnet add package AWSSDK.SecretsManager.Caching

using System.Text.Json;
using Amazon.SecretsManager.Extensions.Caching;
using CopilotRequestDriven.Models;

namespace CopilotRequestDriven.Services;

public class DbConnectionStringService
{
    public async Task<string> GetConnectionString(string secretArn)
    {
        var cache = new SecretsManagerCache();
        string secretString;
        try
        {
            secretString = await cache.GetSecretString(secretArn);
            if (secretString == null)
            {
                Console.WriteLine("secretString is null");
                return "Cannot get a secret string";
            }
        }
        catch (Exception e)
        {
            // ジョブの場合は直接JSONの値が入るようでHTTPアクセスでエラーが出るため`secretArn`で置き換える
            secretString = secretArn;
        }
        Console.WriteLine($"secretString: {secretString}");
        var secret = JsonSerializer.Deserialize<AwsAuroraSecret>(secretString);
        return
            $"User ID={secret!.username};Password={secret.password};Host={secret.host};Port={secret.port};Database={secret.dbname};";
    }
}

using HogeApp.Services;

var secretArn = Environment.GetEnvironmentVariable("WEBCLUSTER_SECRET_ARN");
var dbConnection = new DbConnectionStringService();
Console.WriteLine($"secretArn: {secretArn}");
var defaultConnection = builder.Configuration.GetConnectionString("DefaultConnection");
var connectionString = secretArn is null
    ? defaultConnection ?? "should not empty"
    : await dbConnection.GetConnectionString(secretArn);
Console.WriteLine($"Connection String: {connectionString}");
builder.Services.AddDbContext<ApplicationDbContext>(options =>
    options.UseNpgsql(connectionString));

✘ Proposing infrastructure changes for stack my-app-test-my-svc
✘ deploy service my-svc to environment test: deploy service: check if changeset is empty: create change set copilot-ceee385b-d1d7-4248-b4f9-a9a725daab12 for stack my-app-test-my-svc: ValidationError: Template format error: Unrecognized resource types: [AWS::AppRunner::Service]

copilot svc package

copilot pipeline init
copilot pipeline update

Mappings:
  PublicAccessibilityMap:
    test:
      "publiclyAccessible": true
    prod:
      "publiclyAccessible": false
[name]DBCluster:
  Metadata:
    'aws:copilot:description': 'The testing Aurora Serverless v2 database cluster'
  Type: 'AWS::RDS::DBCluster'
  Properties:
    PubliclyAccessible: !FindInMap [PublicAccessibilityMap, !Ref Env, publiclyAccessible]

environments:
  staging:
    image:
      build: Dockerfile.staging
    secrets:
      PostgreSQLConfig__Host:
        secretsmanager: 'AuroraSecret-ABC3G7c8bvFyP-C5JIGE:host::'

copilot svc exec

copilot svc pause -n maitred

copilot svc resume -n maitred

copilot job run
copilot job run --name db-migrate --env staging

network:
  vpc:
    placement: private

Parameters:
  App:
    Type: String
    Description: Your application's name.
  Env:
    Type: String
    Description: The environment name your service, job, or workflow is being deployed to.
  Name:
    Type: String
    Description: The name of the service, job, or workflow being deployed.

Resources:
  IamSecretsManagerPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
        - Sid: ListBucketActions
          Effect: Allow
          Action:
            - secretsmanager:GetResourcePolicy
            - secretsmanager:GetSecretValue
            - secretsmanager:DescribeSecret
            - secretsmanager:ListSecretVersionIds
          Resource: "!!!取得した値で更新!!!"

Outputs:
  ListBucketPolicyArn:
    Description: "The ARN of the ManagedPolicy to attatch to the task role."
    Value: !Ref IamSecretsManagerPolicy

    const AWS = require('aws-sdk');
    const client = new AWS.SecretsManager({
        region: process.env.AWS_DEFAULT_REGION,
    });
    const dbSecret = await client.getSecretValue({SecretId: process.env.APRDJANGOWEBCLUSTER_SECRET_ARN}).promise();
    const {username, host, dbname, password, port} = JSON.parse(dbSecret.SecretString);

import os
import json

secret_arn = os.getenv("APRDJANGOWEBCLUSTER_SECRET_ARN")
if secret_arn is None:
    print("Since `secret_arn` is None, we use sqlite!")
    DATABASES = {
        'default': {
            'ENGINE': 'django.db.backends.sqlite3',
            'NAME': BASE_DIR / 'db.sqlite3',
        }
    }
else:
    print("secret_arn is not None!")
    print(f"secret_arn: {secret_arn}")
    DBINFO = json.loads(secret_arn)
    print(f"DBINFO: {DBINFO}")

    DATABASES = {
        'default': {
            'ENGINE': 'django.db.backends.postgresql',
            'HOST': DBINFO['host'],
            'PORT': DBINFO['port'],
            'NAME': DBINFO['dbname'],
            'USER': DBINFO['username'],
            'PASSWORD': DBINFO['password'],
        }
    }

public class DbConnectionStringService
{
    public async Task<string> GetConnectionString(string secretArn)
    {
        var cache = new SecretsManagerCache();
        var secretString = await cache.GetSecretString(secretArn);
        if (secretString == null)
        {
            Console.WriteLine("secretString is null");
            return "Cannot get a secret string";
        }
        Console.WriteLine($"secretString: {secretString}");
        var secret = JsonSerializer.Deserialize<AwsAuroraSecret>(secretString);
        return
            $"User ID={secret!.username};Password={secret.password};Host={secret.host};Port={secret.port};Database={secret.dbname};";
    }
}

// Program.cs
var secretArn = Environment.GetEnvironmentVariable("WEBCLUSTER_SECRET_ARN");
var dbConnection = new DbConnectionStringService();
Console.WriteLine($"secretArn: {secretArn}");
var defaultConnection = builder.Configuration.GetConnectionString("DefaultConnection");
var connectionString = secretArn is null
    ? defaultConnection ?? "should not empty"
    : await dbConnection.GetConnectionString(secretArn);
Console.WriteLine($"Connection String: {connectionString}");

import os
import json

dbsecret = os.environ.get('MYDJANGODB_SECRET')
if dbsecret is None:
    print("Since `dbsecret` is None, we use sqlite!")
    DATABASES = {
        'default': {
            'ENGINE': 'django.db.backends.sqlite3',
            'NAME': BASE_DIR / 'db.sqlite3',
        }
    }
else:
    print("dbsecret is not None!")
    print(dbsecret)
    DBINFO = json.loads(dbsecret)
    print(DBINFO)
    DATABASES = {
        'default': {
            'ENGINE': 'django.db.backends.postgresql',
            'HOST': DBINFO['host'],
            'PORT': DBINFO['port'],
            'NAME': DBINFO['dbname'],
            'USER': DBINFO['username'],
            'PASSWORD': DBINFO['password'],
        }
    }

  mydjangodbDBClusterSecurityGroup: # 適切な項目を選ぶ
    Metadata:
      'aws:copilot:description': 'A security group for your Aurora Serverless v2 cluster mydjangodb'
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: The Security Group for the Aurora Serverless v2 cluster.
      SecurityGroupIngress:
        - ToPort: 5432
          FromPort: 5432
          IpProtocol: tcp
          Description: !Sub 'From the Aurora Security Group of the workload ${Name}.'
          SourceSecurityGroupId: !Ref mydjangodbSecurityGroup
        - ToPort: 5432                                                                                 # ADD
          FromPort: 5432                                                                               # ADD
          IpProtocol: tcp                                                                              # ADD
          Description: 'Access to environment security group'                                          # ADD
          SourceSecurityGroupId: { 'Fn::ImportValue': !Sub '${App}-${Env}-EnvironmentSecurityGroup' }  # ADD

curl -sL https://amazon-dynamodb-labs.com/static/game-player-data/battle-royale.tar | tar -xv

using System.Text.Json.Serialization;
using Amazon.DynamoDBv2.DataModel;

namespace Function.Entity;

[DynamoDBTable("mapping-table")]
public class MappingTable
{
    [JsonPropertyName("id")]
    [DynamoDBHashKey]
    public string Id { get; set; } = default!;

    [JsonPropertyName("targetUrl")]
    [DynamoDBRangeKey]
    public string TargetUrl { get; set; } = default!;
}

aws iam list-roles

sam local start-api

sam pipeline init --bootstrap

sam init --runtime nodejs

sam build --use-container

// IAwsS3FileUpload
public interface IAwsS3FileUpload
{
    /// <summary>
    ///     `durationHours`で指定された時間の分だけ、
    ///     `objectKey`で指定されたファイルにアクセスする証明付きURLを生成する。
    /// </summary>
    /// <param name="objectKey">署名付きURLでアクセスさせるオブジェクトの名前</param>
    /// <param name="durationHours">時間(hour)指定でのURLの有効期間</param>
    /// <returns></returns>
    string GetPreSignedUrl(string objectKey, double durationHours);
}

// AwsS3FileUpload.cs
using Amazon.S3;
using Amazon.S3.Model;
using Models;
using Services.Interfaces;

public class AwsS3FileUpload : IAwsS3FileUpload
{
    private readonly IAmazonS3 _s3Client;
    private readonly IConfiguration _configuration;

    public AwsS3FileUpload(
        IAmazonS3 s3Client,
        IConfiguration configuration)
    {
        _s3Client = s3Client;
        _configuration = configuration;
    }

    public string GetPreSignedUrl(string objectKey, double durationHours)
    {
        var bucketName = _configuration.GetValue<string>(Constants.ApBucketName);
        var request = new GetPreSignedUrlRequest
        {
            BucketName = bucketName,
            Key = objectKey,
            Expires = DateTime.UtcNow.AddHours(durationHours),
        };
        return _s3Client.GetPreSignedURL(request);
    }
}