AWS CDK is th "Cloud Development Kit" which lets you programm CloudFormation Templates.

This is a collection of templates for the cdk

We use tasks for scripting.

For switching profiles awsume is used.

If you use awsume, then the env variable AWSUME_PROFILE is set. If you work with different accounts its better to call the cdk cli with profile parameter.

So with awsume:

task deploy

Or with cdk directly:

cdk deploy

Simple application load balancer with "hello world" webserver on instance. It spins up its own vpc for that.

Using the custom resource helper from the CDK "AwsCustomResource" to create resources not supported by CloudFormation with e few lines of code.

• Auto generate AMI for region and OS type
• Attach AWS managed policy to role
• EC2 Userdata in external file
• Attach Role for SSM Session Manager to instance in ASG

• cdk deploy
• Open LoadBalancer DNS in browser

Example to use CDK Pipeline Construct introduced in CDK 1.52

Deploy a static (hugo) website with CodePipeline and CodeCommit

• CodeCommit repository
• S3 Bucket with website, Bucket policy
• CodeBuild
• CodePipeline
• Output parameters

Deploys a Jenkins EC2 instance, which is automatically stopped at a certain time. See `stop-instance.ts``

• EC2 Userdata in a seperate single files
• Cloudwatch Event Rule
• extending the CDK by implementing an interface: `class EC2Stop implements events.IRuleTarget``

• EC2 instance with security group ssh incoming dynamic ip
• Tasks for enabling and disabling instance metadata service v2

• generate many users with for loop
• create and get initial password from SecretsManager

Lambda with an api Gateway

Lambda with go. Uses taskfile for compile depencies.

Simple lambda with CloudWatch event rule for daily triggering.

Simple Lambda which takes all files from local lambda directory. It create the lambda ressource and uploads the code.

• lambda with local code (asset)
• Programming resources and Lambda in the same programming language.

Role for AWS OpsCenter

• Create IAM Role with own policy statements

Creates a group with all rights for a user to change the own credentials and only them.

• creating a IAM group
• add policy statements to the group

Use role in any context.

Route 53 Zone with a A Record entry

Creates a Transitgateway with two connected VPCs

VPC with a bastion host, which is managed by SSM. So no security groups.

• Instance ProfileRole
• Searching EC2 image types

Connect to bastion host with Systems Manager session manager, or new mssh.