CD-02: Infrastructure as Code Pipeline

flowchart LR
    subgraph "Developer"
        A[CDK Code Change] --> B[PR Created]
    end

    subgraph "CI Phase"
        B --> C[CDK Synth]
        C --> D[CDK Unit Tests]
        D --> E[cdk diff — Post to PR]
        E --> F[Security Scan — cfn-nag]
        F --> G[Cost Estimate]
    end

    subgraph "Staging Deploy"
        G --> H[Deploy to Staging]
        H --> I[Integration Tests]
        I --> J{Tests Pass?}
    end

    subgraph "Production Deploy"
        J -->|Yes| K[Manual Approval Gate]
        K --> L[Deploy to Production]
        L --> M[Post-Deploy Validation]
        J -->|No| N[Fail + Notify]
    end

    style K fill:#ff9900,color:#000
    style L fill:#1B660F,color:#fff
    style N fill:#DD344C,color:#fff

infra/
├── bin/
│   └── app.ts                  # Stack instantiation + environment config
├── lib/
│   ├── stacks/
│   │   ├── networking-stack.ts     # VPC, subnets, security groups
│   │   ├── data-stack.ts           # DynamoDB, DAX, ElastiCache
│   │   ├── compute-stack.ts        # ECS, ALB, Lambda
│   │   ├── ai-ml-stack.ts          # SageMaker, Bedrock config
│   │   ├── search-stack.ts         # OpenSearch Serverless
│   │   ├── edge-stack.ts           # CloudFront, API Gateway, WAF
│   │   ├── observability-stack.ts  # CloudWatch, X-Ray
│   │   └── security-stack.ts       # IAM, Cognito, Secrets
│   ├── constructs/
│   │   ├── fargate-service.ts      # Reusable ECS Fargate pattern
│   │   ├── dynamodb-table.ts       # Table with standard config
│   │   └── alarm-factory.ts        # CloudWatch alarm patterns
│   └── config/
│       ├── staging.ts              # Staging environment config
│       └── production.ts           # Production environment config
├── test/
│   ├── stacks/
│   │   ├── networking-stack.test.ts
│   │   ├── compute-stack.test.ts
│   │   └── ...
│   └── constructs/
│       └── fargate-service.test.ts
├── cdk.json
├── tsconfig.json
└── package.json

graph TD
    NET["Networking Stack<br/>(VPC, Subnets, SGs)"]
    SEC["Security Stack<br/>(IAM, Cognito, Secrets)"]
    DATA["Data Stack<br/>(DynamoDB, Redis, DAX)"]
    SEARCH["Search Stack<br/>(OpenSearch Serverless)"]
    AIML["AI/ML Stack<br/>(SageMaker, Bedrock)"]
    COMP["Compute Stack<br/>(ECS, ALB, Lambda)"]
    EDGE["Edge Stack<br/>(CloudFront, API GW, WAF)"]
    OBS["Observability Stack<br/>(CloudWatch, X-Ray)"]

    NET --> DATA
    NET --> SEARCH
    NET --> AIML
    NET --> COMP
    SEC --> COMP
    SEC --> AIML
    SEC --> DATA
    DATA --> COMP
    SEARCH --> COMP
    AIML --> COMP
    COMP --> EDGE
    COMP --> OBS
    EDGE --> OBS

    style NET fill:#ff9900,color:#000
    style COMP fill:#146eb4,color:#fff
    style AIML fill:#8C4FFF,color:#fff

import * as cdk from 'aws-cdk-lib';
import * as ecs from 'aws-cdk-lib/aws-ecs';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as elbv2 from 'aws-cdk-lib/aws-elasticloadbalancingv2';
import { Construct } from 'constructs';

interface ComputeStackProps extends cdk.StackProps {
  vpc: ec2.IVpc;
  cluster?: ecs.ICluster;
  environment: 'staging' | 'production';
}

export class ComputeStack extends cdk.Stack {
  public readonly cluster: ecs.Cluster;
  public readonly service: ecs.FargateService;

  constructor(scope: Construct, id: string, props: ComputeStackProps) {
    super(scope, id, props);

    const config = {
      staging: { desiredCount: 2, cpu: 512, memory: 1024 },
      production: { desiredCount: 4, cpu: 1024, memory: 2048 },
    }[props.environment];

    this.cluster = new ecs.Cluster(this, 'ChatbotCluster', {
      vpc: props.vpc,
      containerInsights: true,
    });

    const taskDef = new ecs.FargateTaskDefinition(this, 'ChatbotTask', {
      cpu: config.cpu,
      memoryLimitMiB: config.memory,
    });

    taskDef.addContainer('chatbot', {
      image: ecs.ContainerImage.fromEcrRepository(/* ECR repo reference */),
      portMappings: [{ containerPort: 8080 }],
      logging: ecs.LogDrivers.awsLogs({ streamPrefix: 'chatbot' }),
      healthCheck: {
        command: ['CMD-SHELL', 'curl -f http://localhost:8080/health || exit 1'],
        interval: cdk.Duration.seconds(15),
        timeout: cdk.Duration.seconds(5),
        retries: 3,
      },
    });

    this.service = new ecs.FargateService(this, 'ChatbotService', {
      cluster: this.cluster,
      taskDefinition: taskDef,
      desiredCount: config.desiredCount,
      deploymentController: { type: ecs.DeploymentControllerType.CODE_DEPLOY },
      circuitBreaker: { rollback: true },
    });
  }
}

import { Template, Match } from 'aws-cdk-lib/assertions';
import * as cdk from 'aws-cdk-lib';
import { ComputeStack } from '../lib/stacks/compute-stack';
import { NetworkingStack } from '../lib/stacks/networking-stack';

describe('ComputeStack', () => {
  let template: Template;

  beforeAll(() => {
    const app = new cdk.App();
    const networkStack = new NetworkingStack(app, 'TestNetwork', {
      env: { account: '123456789', region: 'us-east-1' },
    });
    const stack = new ComputeStack(app, 'TestCompute', {
      vpc: networkStack.vpc,
      environment: 'production',
      env: { account: '123456789', region: 'us-east-1' },
    });
    template = Template.fromStack(stack);
  });

  test('ECS service uses CodeDeploy deployment controller', () => {
    template.hasResourceProperties('AWS::ECS::Service', {
      DeploymentController: { Type: 'CODE_DEPLOY' },
    });
  });

  test('Production has 4 desired tasks', () => {
    template.hasResourceProperties('AWS::ECS::Service', {
      DesiredCount: 4,
    });
  });

  test('Task definition uses 1024 CPU for production', () => {
    template.hasResourceProperties('AWS::ECS::TaskDefinition', {
      Cpu: '1024',
    });
  });

  test('Container has health check configured', () => {
    template.hasResourceProperties('AWS::ECS::TaskDefinition', {
      ContainerDefinitions: Match.arrayWith([
        Match.objectLike({
          HealthCheck: Match.objectLike({
            Command: Match.arrayWith(['CMD-SHELL']),
          }),
        }),
      ]),
    });
  });

  test('No public subnets for ECS tasks', () => {
    template.hasResourceProperties('AWS::ECS::Service', {
      NetworkConfiguration: Match.objectLike({
        AwsvpcConfiguration: Match.objectLike({
          AssignPublicIp: 'DISABLED',
        }),
      }),
    });
  });
});

name: infra-validate
on:
  pull_request:
    paths: ['infra/**']

permissions:
  id-token: write  # OIDC for AWS auth
  contents: read
  pull-requests: write

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::role/github-actions-infra
          aws-region: us-east-1

      - name: Install dependencies
        run: cd infra && npm ci

      - name: CDK Synth
        run: cd infra && npx cdk synth --all

      - name: CDK Unit Tests
        run: cd infra && npm test

      - name: Security Scan (cfn-nag)
        run: |
          gem install cfn-nag
          cfn_nag_scan --input-path infra/cdk.out/*.template.json

      - name: CDK Diff (Post to PR)
        run: |
          cd infra
          DIFF=$(npx cdk diff --all 2>&1) || true
          echo "## Infrastructure Changes" > diff.md
          echo '```' >> diff.md
          echo "$DIFF" >> diff.md
          echo '```' >> diff.md

      - name: Comment diff on PR
        uses: marocchino/sticky-pull-request-comment@v2
        with:
          path: infra/diff.md

sequenceDiagram
    participant Dev as Developer
    participant GH as GitHub
    participant CI as CI Pipeline
    participant STG as Staging Account
    participant PROD as Production Account
    participant CW as CloudWatch

    Dev->>GH: Merge PR to main
    GH->>CI: Trigger deploy pipeline
    CI->>CI: cdk synth + tests
    CI->>STG: cdk deploy --all
    STG-->>CI: Stack outputs
    CI->>STG: Run integration tests
    STG-->>CI: Tests pass

    CI->>GH: Request manual approval
    Dev->>GH: Approve deployment
    GH->>CI: Approval received

    CI->>PROD: cdk deploy --all (stack-by-stack)
    Note over CI,PROD: Deploy order: Networking → Security → Data → AI/ML → Compute → Edge → Observability
    PROD-->>CI: All stacks deployed
    CI->>CW: Verify alarms healthy
    CI->>GH: Post deployment summary

# Daily drift detection Lambda (triggered by EventBridge)
import boto3
import json

def lambda_handler(event, context):
    cfn = boto3.client('cloudformation')
    sns = boto3.client('sns')

    stacks = [
        'MangaAssist-Networking',
        'MangaAssist-Data',
        'MangaAssist-Compute',
        'MangaAssist-Edge',
        'MangaAssist-Observability',
    ]

    drifted_stacks = []
    for stack_name in stacks:
        cfn.detect_stack_drift(StackName=stack_name)
        waiter = cfn.get_waiter('stack_drift_detection_complete')
        # Note: In production, use Step Functions for async wait

        status = cfn.describe_stack_drift_detection_status(
            StackDriftDetectionId=detection_id
        )
        if status['StackDriftStatus'] == 'DRIFTED':
            drifted_stacks.append({
                'stack': stack_name,
                'drifted_resources': status['DriftedStackResourceCount'],
            })

    if drifted_stacks:
        sns.publish(
            TopicArn='arn:aws:sns:us-east-1:ACCOUNT:infra-drift-alerts',
            Subject=f'DRIFT DETECTED: {len(drifted_stacks)} stacks',
            Message=json.dumps(drifted_stacks, indent=2),
        )

    return {'drifted': len(drifted_stacks), 'details': drifted_stacks}

graph LR
    subgraph "AWS Organization"
        MGMT["Management Account<br/>(Billing, SSO)"]
        STG["Staging Account<br/>(MangaAssist-Staging)"]
        PROD["Production Account<br/>(MangaAssist-Production)"]
        SHARED["Shared Services<br/>(ECR, Artifacts)"]
    end

    MGMT --> STG
    MGMT --> PROD
    MGMT --> SHARED
    SHARED -->|"Cross-account ECR pull"| STG
    SHARED -->|"Cross-account ECR pull"| PROD

graph TD
    subgraph "Product Manager"
        PM1["Fast infrastructure changes"]
        PM2["New features need new AWS resources quickly"]
        PM3["Don't want infra to be the bottleneck"]
    end

    subgraph "Architect"
        AR1["Every infra change reviewed by human"]
        AR2["Staging must mirror production exactly"]
        AR3["Zero-tolerance for infra drift"]
    end

    subgraph "DevOps Engineer"
        DE1["I'm the only one who can approve"]
        DE2["Manual approval creates bottleneck"]
        DE3["Automate gates, not approvals"]
    end

    PM2 ---|"Tension"| AR1
    PM3 ---|"Tension"| DE1
    AR2 ---|"Cost tension"| PM1
    DE2 ---|"Agrees with"| PM3
    AR3 ---|"Enables trust in"| DE3

CDK Code:       ~200 lines TypeScript
Generated CFN:  ~2,000 lines YAML
Debug Surface:  10x larger than source code