AWS¶

npm install -g aws-cdk

npm i -g npm-check-updates
ncu -g aws-cdk
npm -g install aws-cdk@<ver>

cdk init sample-app --language csharp

cdk diff

cdk synth

        // 削除時にs3のバケットも削除する
        _ = new Bucket(this, "WorkshopBucket", new BucketProps
        {
            RemovalPolicy = RemovalPolicy.DESTROY
        });

aws s3api create-bucket \
--bucket <bucket-name> \
--region <region-name> \
--create-bucket-configuration LocationConstraint=<region-name>

aws configure

Default region name [None]: ap-northeast-1
Default output format [None]: json

[default]
region = ap-northeast-1
output = json

aws sts get-caller-identity
aws configure list

[toplevel]
whoami = sts get-caller-identity

aws configure list
export AWS_DEFAULT_PROFILE=<USER_NAME>

aws configure --profile <username>
cat ~/.aws/credentials

cd ~/.ssh
ssh-keygen
less ~/.ssh/id_rsa.pub

  healthcheck:
    path: "/health"
    healthy_threshold: 2
    unhealthy_threshold: 2
    interval: 10s
    timeout: 5s
    grace_period: 60s
  deregistration_delay: 60s

secrets:
  CLUSTER_SECRET:
    secretsmanager: 'mydjangodbAuroraSecret-ObSZ2fGHWHTm'

secrets:
  # 変数名と値は`copilot svc show`の値を指定する
  WEBCLUSTER_SECRET_ARN: "arn:aws:secretsmanager:us-west-2:573143736992:secret:webclusterAuroraSecret-5ggcmKflNSGA-UR8O44"

dotnet add package AWSSDK.SecretsManager.Caching

using System.Text.Json;
using Amazon.SecretsManager.Extensions.Caching;
using CopilotRequestDriven.Models;

namespace CopilotRequestDriven.Services;

public class DbConnectionStringService
{
    public async Task<string> GetConnectionString(string secretArn)
    {
        var cache = new SecretsManagerCache();
        string secretString;
        try
        {
            secretString = await cache.GetSecretString(secretArn);
            if (secretString == null)
            {
                Console.WriteLine("secretString is null");
                return "Cannot get a secret string";
            }
        }
        catch (Exception e)
        {
            // ジョブの場合は直接JSONの値が入るようでHTTPアクセスでエラーが出るため`secretArn`で置き換える
            secretString = secretArn;
        }
        Console.WriteLine($"secretString: {secretString}");
        var secret = JsonSerializer.Deserialize<AwsAuroraSecret>(secretString);
        return
            $"User ID={secret!.username};Password={secret.password};Host={secret.host};Port={secret.port};Database={secret.dbname};";
    }
}

using HogeApp.Services;

var secretArn = Environment.GetEnvironmentVariable("WEBCLUSTER_SECRET_ARN");
var dbConnection = new DbConnectionStringService();
Console.WriteLine($"secretArn: {secretArn}");
var defaultConnection = builder.Configuration.GetConnectionString("DefaultConnection");
var connectionString = secretArn is null
    ? defaultConnection ?? "should not empty"
    : await dbConnection.GetConnectionString(secretArn);
Console.WriteLine($"Connection String: {connectionString}");
builder.Services.AddDbContext<ApplicationDbContext>(options =>
    options.UseNpgsql(connectionString));

✘ Proposing infrastructure changes for stack my-app-test-my-svc
✘ deploy service my-svc to environment test: deploy service: check if changeset is empty: create change set copilot-ceee385b-d1d7-4248-b4f9-a9a725daab12 for stack my-app-test-my-svc: ValidationError: Template format error: Unrecognized resource types: [AWS::AppRunner::Service]

copilot svc package

copilot pipeline init
copilot pipeline update

Mappings:
  PublicAccessibilityMap:
    test:
      "publiclyAccessible": true
    prod:
      "publiclyAccessible": false
[name]DBCluster:
  Metadata:
    'aws:copilot:description': 'The testing Aurora Serverless v2 database cluster'
  Type: 'AWS::RDS::DBCluster'
  Properties:
    PubliclyAccessible: !FindInMap [PublicAccessibilityMap, !Ref Env, publiclyAccessible]

environments:
  staging:
    image:
      build: Dockerfile.staging
    secrets:
      PostgreSQLConfig__Host:
        secretsmanager: 'AuroraSecret-ABC3G7c8bvFyP-C5JIGE:host::'

copilot svc exec

copilot svc pause -n maitred

copilot svc resume -n maitred

copilot job run
copilot job run --name db-migrate --env staging

network:
  vpc:
    placement: private

Parameters:
  App:
    Type: String
    Description: Your application's name.
  Env:
    Type: String
    Description: The environment name your service, job, or workflow is being deployed to.
  Name:
    Type: String
    Description: The name of the service, job, or workflow being deployed.

Resources:
  IamSecretsManagerPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
        - Sid: ListBucketActions
          Effect: Allow
          Action:
            - secretsmanager:GetResourcePolicy
            - secretsmanager:GetSecretValue
            - secretsmanager:DescribeSecret
            - secretsmanager:ListSecretVersionIds
          Resource: "!!!取得した値で更新!!!"

Outputs:
  ListBucketPolicyArn:
    Description: "The ARN of the ManagedPolicy to attatch to the task role."
    Value: !Ref IamSecretsManagerPolicy

    const AWS = require('aws-sdk');
    const client = new AWS.SecretsManager({
        region: process.env.AWS_DEFAULT_REGION,
    });
    const dbSecret = await client.getSecretValue({SecretId: process.env.APRDJANGOWEBCLUSTER_SECRET_ARN}).promise();
    const {username, host, dbname, password, port} = JSON.parse(dbSecret.SecretString);

import os
import json

secret_arn = os.getenv("APRDJANGOWEBCLUSTER_SECRET_ARN")
if secret_arn is None:
    print("Since `secret_arn` is None, we use sqlite!")
    DATABASES = {
        'default': {
            'ENGINE': 'django.db.backends.sqlite3',
            'NAME': BASE_DIR / 'db.sqlite3',
        }
    }
else:
    print("secret_arn is not None!")
    print(f"secret_arn: {secret_arn}")
    DBINFO = json.loads(secret_arn)
    print(f"DBINFO: {DBINFO}")

    DATABASES = {
        'default': {
            'ENGINE': 'django.db.backends.postgresql',
            'HOST': DBINFO['host'],
            'PORT': DBINFO['port'],
            'NAME': DBINFO['dbname'],
            'USER': DBINFO['username'],
            'PASSWORD': DBINFO['password'],
        }
    }

public class DbConnectionStringService
{
    public async Task<string> GetConnectionString(string secretArn)
    {
        var cache = new SecretsManagerCache();
        var secretString = await cache.GetSecretString(secretArn);
        if (secretString == null)
        {
            Console.WriteLine("secretString is null");
            return "Cannot get a secret string";
        }
        Console.WriteLine($"secretString: {secretString}");
        var secret = JsonSerializer.Deserialize<AwsAuroraSecret>(secretString);
        return
            $"User ID={secret!.username};Password={secret.password};Host={secret.host};Port={secret.port};Database={secret.dbname};";
    }
}

// Program.cs
var secretArn = Environment.GetEnvironmentVariable("WEBCLUSTER_SECRET_ARN");
var dbConnection = new DbConnectionStringService();
Console.WriteLine($"secretArn: {secretArn}");
var defaultConnection = builder.Configuration.GetConnectionString("DefaultConnection");
var connectionString = secretArn is null
    ? defaultConnection ?? "should not empty"
    : await dbConnection.GetConnectionString(secretArn);
Console.WriteLine($"Connection String: {connectionString}");

import os
import json

dbsecret = os.environ.get('MYDJANGODB_SECRET')
if dbsecret is None:
    print("Since `dbsecret` is None, we use sqlite!")
    DATABASES = {
        'default': {
            'ENGINE': 'django.db.backends.sqlite3',
            'NAME': BASE_DIR / 'db.sqlite3',
        }
    }
else:
    print("dbsecret is not None!")
    print(dbsecret)
    DBINFO = json.loads(dbsecret)
    print(DBINFO)
    DATABASES = {
        'default': {
            'ENGINE': 'django.db.backends.postgresql',
            'HOST': DBINFO['host'],
            'PORT': DBINFO['port'],
            'NAME': DBINFO['dbname'],
            'USER': DBINFO['username'],
            'PASSWORD': DBINFO['password'],
        }
    }

  mydjangodbDBClusterSecurityGroup: # 適切な項目を選ぶ
    Metadata:
      'aws:copilot:description': 'A security group for your Aurora Serverless v2 cluster mydjangodb'
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: The Security Group for the Aurora Serverless v2 cluster.
      SecurityGroupIngress:
        - ToPort: 5432
          FromPort: 5432
          IpProtocol: tcp
          Description: !Sub 'From the Aurora Security Group of the workload ${Name}.'
          SourceSecurityGroupId: !Ref mydjangodbSecurityGroup
        - ToPort: 5432                                                                                 # ADD
          FromPort: 5432                                                                               # ADD
          IpProtocol: tcp                                                                              # ADD
          Description: 'Access to environment security group'                                          # ADD
          SourceSecurityGroupId: { 'Fn::ImportValue': !Sub '${App}-${Env}-EnvironmentSecurityGroup' }  # ADD

aws iam list-roles

sam local start-api

sam pipeline init --bootstrap

sam init --runtime nodejs

sam build --use-container