├── .npmignore ├── solution-overview.png ├── demos ├── rds-init-fn-code │ ├── script.sql │ ├── Dockerfile │ ├── package.json │ └── index.js └── rds-init-example.ts ├── jest.config.js ├── .gitignore ├── index.ts ├── CODE_OF_CONDUCT.md ├── bin └── rds-init-example.ts ├── cdk.json ├── tsconfig.json ├── LICENSE ├── package.json ├── CONTRIBUTING.md ├── lib └── resource-initializer.ts └── README.md /.npmignore: -------------------------------------------------------------------------------- 1 | *.ts 2 | !*.d.ts 3 | 4 | # CDK asset staging directory 5 | .cdk.staging 6 | cdk.out 7 | -------------------------------------------------------------------------------- /solution-overview.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/aws-samples/amazon-rds-init-cdk/HEAD/solution-overview.png -------------------------------------------------------------------------------- /demos/rds-init-fn-code/script.sql: -------------------------------------------------------------------------------- 1 | -- Your SQL scripts for initialization goes here... 2 | 3 | SELECT 'Hello World!' as message; -------------------------------------------------------------------------------- /jest.config.js: -------------------------------------------------------------------------------- 1 | module.exports = { 2 | roots: ['/test'], 3 | testMatch: ['**/*.test.ts'], 4 | transform: { 5 | '^.+\\.tsx?$': 'ts-jest' 6 | } 7 | } 8 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | *.js 2 | !jest.config.js 3 | *.d.ts 4 | node_modules 5 | 6 | !demos/*/*.js 7 | 8 | .cdk.staging 9 | cdk.out 10 | 11 | .npmrc 12 | 13 | package-lock.json -------------------------------------------------------------------------------- /index.ts: -------------------------------------------------------------------------------- 1 | // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. 2 | // SPDX-License-Identifier: MIT-0 3 | 4 | import { CdkResourceInitializer, CdkResourceInitializerProps } from './lib/resource-initializer' 5 | 6 | export { CdkResourceInitializer, CdkResourceInitializerProps } 7 | -------------------------------------------------------------------------------- /CODE_OF_CONDUCT.md: -------------------------------------------------------------------------------- 1 | ## Code of Conduct 2 | This project has adopted the [Amazon Open Source Code of Conduct](https://aws.github.io/code-of-conduct). 3 | For more information see the [Code of Conduct FAQ](https://aws.github.io/code-of-conduct-faq) or contact 4 | opensource-codeofconduct@amazon.com with any additional questions or comments. 5 | -------------------------------------------------------------------------------- /demos/rds-init-fn-code/Dockerfile: -------------------------------------------------------------------------------- 1 | # Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. 2 | # SPDX-License-Identifier: MIT-0 3 | 4 | FROM amazon/aws-lambda-nodejs:14 5 | WORKDIR ${LAMBDA_TASK_ROOT} 6 | 7 | COPY package.json ./ 8 | RUN npm install --only=production 9 | COPY index.js ./ 10 | COPY script.sql ./ 11 | 12 | CMD [ "index.handler" ] 13 | -------------------------------------------------------------------------------- /demos/rds-init-fn-code/package.json: -------------------------------------------------------------------------------- 1 | { 2 | "name": "rds-init-script", 3 | "version": "1.0.0", 4 | "description": "Source code for initializing RDS instance using Node.js", 5 | "main": "index.js", 6 | "scripts": { 7 | }, 8 | "keywords": [], 9 | "author": "", 10 | "license": "MIT", 11 | "dependencies": { 12 | "mysql": "^2.18.1" 13 | } 14 | } 15 | -------------------------------------------------------------------------------- /bin/rds-init-example.ts: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env node 2 | 3 | // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. 4 | // SPDX-License-Identifier: MIT-0 5 | 6 | import * as cdk from '@aws-cdk/core' 7 | import { RdsInitStackExample } from '../demos/rds-init-example' 8 | 9 | const app = new cdk.App() 10 | 11 | /* eslint no-new: 0 */ 12 | new RdsInitStackExample(app, 'RdsInitExample') 13 | -------------------------------------------------------------------------------- /cdk.json: -------------------------------------------------------------------------------- 1 | { 2 | "app": "npx ts-node --prefer-ts-exts bin/rds-init-example.ts", 3 | "context": { 4 | "@aws-cdk/core:enableStackNameDuplicates": "true", 5 | "aws-cdk:enableDiffNoFail": "true", 6 | "@aws-cdk/core:stackRelativeExports": "true", 7 | "@aws-cdk/aws-ecr-assets:dockerIgnoreSupport": true, 8 | "@aws-cdk/aws-secretsmanager:parseOwnedSecretName": true, 9 | "@aws-cdk/aws-kms:defaultKeyPolicies": true, 10 | "@aws-cdk/aws-s3:grantWriteWithoutAcl": true, 11 | "@aws-cdk/aws-ecs-patterns:removeDefaultDesiredCount": true 12 | } 13 | } 14 | -------------------------------------------------------------------------------- /tsconfig.json: -------------------------------------------------------------------------------- 1 | { 2 | "compilerOptions": { 3 | "target":"ES2018", 4 | "module": "commonjs", 5 | "lib": ["es2018"], 6 | "declaration": true, 7 | "strict": true, 8 | "noImplicitAny": true, 9 | "strictNullChecks": true, 10 | "noImplicitThis": true, 11 | "alwaysStrict": true, 12 | "noUnusedLocals": false, 13 | "noUnusedParameters": false, 14 | "noImplicitReturns": true, 15 | "noFallthroughCasesInSwitch": false, 16 | "inlineSourceMap": true, 17 | "inlineSources": true, 18 | "experimentalDecorators": true, 19 | "strictPropertyInitialization":false, 20 | "typeRoots": ["./node_modules/@types"] 21 | }, 22 | "exclude": ["cdk.out"] 23 | } 24 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. 2 | 3 | Permission is hereby granted, free of charge, to any person obtaining a copy of 4 | this software and associated documentation files (the "Software"), to deal in 5 | the Software without restriction, including without limitation the rights to 6 | use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of 7 | the Software, and to permit persons to whom the Software is furnished to do so. 8 | 9 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 10 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS 11 | FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR 12 | COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER 13 | IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN 14 | CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. 15 | 16 | -------------------------------------------------------------------------------- /package.json: -------------------------------------------------------------------------------- 1 | { 2 | "name": "cdk-resource-initializer", 3 | "repository": "git@github.com:aws-samples/amazon-rds-init-cdk.git", 4 | "version": "1.0.0", 5 | "private": true, 6 | "main": "index.js", 7 | "license": "MIT-0", 8 | "scripts": { 9 | "build": "tsc", 10 | "watch": "tsc -w", 11 | "test": "jest", 12 | "cdk": "cdk" 13 | }, 14 | "devDependencies": { 15 | "@aws-cdk/assert": "^1.125.0", 16 | "@types/jest": "^27.0.2", 17 | "@types/node": "^14.17.20", 18 | "aws-cdk": "^1.125.0", 19 | "jest": "^27.2.4", 20 | "ts-jest": "^27.0.5", 21 | "ts-node": "^10.2.1", 22 | "typescript": "^4.4.3" 23 | }, 24 | "dependencies": { 25 | "@aws-cdk/aws-ec2": "^1.125.0", 26 | "@aws-cdk/aws-iam": "^1.125.0", 27 | "@aws-cdk/aws-lambda": "^1.125.0", 28 | "@aws-cdk/aws-logs": "^1.125.0", 29 | "@aws-cdk/aws-rds": "^1.125.0", 30 | "@aws-cdk/aws-s3": "^1.125.0", 31 | "@aws-cdk/aws-secretsmanager": "^1.125.0", 32 | "@aws-cdk/aws-ssm": "^1.125.0", 33 | "@aws-cdk/core": "^1.125.0", 34 | "@aws-cdk/custom-resources": "^1.125.0" 35 | } 36 | } 37 | -------------------------------------------------------------------------------- /demos/rds-init-fn-code/index.js: -------------------------------------------------------------------------------- 1 | // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. 2 | // SPDX-License-Identifier: MIT-0 3 | 4 | const mysql = require('mysql') 5 | const AWS = require('aws-sdk') 6 | const fs = require('fs') 7 | const path = require('path') 8 | 9 | const secrets = new AWS.SecretsManager({}) 10 | 11 | exports.handler = async (e) => { 12 | try { 13 | const { config } = e.params 14 | const { password, username, host } = await getSecretValue(config.credsSecretName) 15 | const connection = mysql.createConnection({ 16 | host, 17 | user: username, 18 | password, 19 | multipleStatements: true 20 | }) 21 | 22 | connection.connect() 23 | 24 | const sqlScript = fs.readFileSync(path.join(__dirname, 'script.sql')).toString() 25 | const res = await query(connection, sqlScript) 26 | 27 | return { 28 | status: 'OK', 29 | results: res 30 | } 31 | } catch (err) { 32 | return { 33 | status: 'ERROR', 34 | err, 35 | message: err.message 36 | } 37 | } 38 | } 39 | 40 | function query (connection, sql) { 41 | return new Promise((resolve, reject) => { 42 | connection.query(sql, (error, res) => { 43 | if (error) return reject(error) 44 | 45 | return resolve(res) 46 | }) 47 | }) 48 | } 49 | 50 | function getSecretValue (secretId) { 51 | return new Promise((resolve, reject) => { 52 | secrets.getSecretValue({ SecretId: secretId }, (err, data) => { 53 | if (err) return reject(err) 54 | 55 | return resolve(JSON.parse(data.SecretString)) 56 | }) 57 | }) 58 | } 59 | -------------------------------------------------------------------------------- /demos/rds-init-example.ts: -------------------------------------------------------------------------------- 1 | // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. 2 | // SPDX-License-Identifier: MIT-0 3 | 4 | import * as cdk from '@aws-cdk/core' 5 | import { CfnOutput, Duration, Stack, Token } from '@aws-cdk/core' 6 | import { CdkResourceInitializer } from '../lib/resource-initializer' 7 | import { DockerImageCode } from '@aws-cdk/aws-lambda' 8 | import { InstanceClass, InstanceSize, InstanceType, Port, SubnetType, Vpc } from '@aws-cdk/aws-ec2' 9 | import { RetentionDays } from '@aws-cdk/aws-logs' 10 | import { Credentials, DatabaseInstance, DatabaseInstanceEngine, DatabaseSecret, MysqlEngineVersion } from '@aws-cdk/aws-rds' 11 | 12 | export class RdsInitStackExample extends Stack { 13 | constructor (scope: cdk.App, id: string, props?: cdk.StackProps) { 14 | super(scope, id, props) 15 | 16 | const instanceIdentifier = 'mysql-01' 17 | const credsSecretName = `/${id}/rds/creds/${instanceIdentifier}`.toLowerCase() 18 | const creds = new DatabaseSecret(this, 'MysqlRdsCredentials', { 19 | secretName: credsSecretName, 20 | username: 'admin' 21 | }) 22 | 23 | const vpc = new Vpc(this, 'MyVPC', { 24 | subnetConfiguration: [{ 25 | cidrMask: 24, 26 | name: 'ingress', 27 | subnetType: SubnetType.PUBLIC, 28 | },{ 29 | cidrMask: 24, 30 | name: 'compute', 31 | subnetType: SubnetType.PRIVATE_WITH_NAT, 32 | },{ 33 | cidrMask: 28, 34 | name: 'rds', 35 | subnetType: SubnetType.PRIVATE_ISOLATED, 36 | }] 37 | }) 38 | 39 | const dbServer = new DatabaseInstance(this, 'MysqlRdsInstance', { 40 | vpcSubnets: { 41 | onePerAz: true, 42 | subnetType: SubnetType.PRIVATE_ISOLATED 43 | }, 44 | credentials: Credentials.fromSecret(creds), 45 | vpc: vpc, 46 | port: 3306, 47 | databaseName: 'main', 48 | allocatedStorage: 20, 49 | instanceIdentifier, 50 | engine: DatabaseInstanceEngine.mysql({ 51 | version: MysqlEngineVersion.VER_8_0 52 | }), 53 | instanceType: InstanceType.of(InstanceClass.T2, InstanceSize.LARGE) 54 | }) 55 | // potentially allow connections to the RDS instance... 56 | // dbServer.connections.allowFrom ... 57 | 58 | const initializer = new CdkResourceInitializer(this, 'MyRdsInit', { 59 | config: { 60 | credsSecretName 61 | }, 62 | fnLogRetention: RetentionDays.FIVE_MONTHS, 63 | fnCode: DockerImageCode.fromImageAsset(`${__dirname}/rds-init-fn-code`, {}), 64 | fnTimeout: Duration.minutes(2), 65 | fnSecurityGroups: [], 66 | vpc, 67 | subnetsSelection: vpc.selectSubnets({ 68 | subnetType: SubnetType.PRIVATE_WITH_NAT 69 | }) 70 | }) 71 | // manage resources dependency 72 | initializer.customResource.node.addDependency(dbServer) 73 | 74 | // allow the initializer function to connect to the RDS instance 75 | dbServer.connections.allowFrom(initializer.function, Port.tcp(3306)) 76 | 77 | // allow initializer function to read RDS instance creds secret 78 | creds.grantRead(initializer.function) 79 | 80 | /* eslint no-new: 0 */ 81 | new CfnOutput(this, 'RdsInitFnResponse', { 82 | value: Token.asString(initializer.response) 83 | }) 84 | } 85 | } 86 | -------------------------------------------------------------------------------- /CONTRIBUTING.md: -------------------------------------------------------------------------------- 1 | # Contributing Guidelines 2 | 3 | Thank you for your interest in contributing to our project. Whether it's a bug report, new feature, correction, or additional 4 | documentation, we greatly value feedback and contributions from our community. 5 | 6 | Please read through this document before submitting any issues or pull requests to ensure we have all the necessary 7 | information to effectively respond to your bug report or contribution. 8 | 9 | 10 | ## Reporting Bugs/Feature Requests 11 | 12 | We welcome you to use the GitHub issue tracker to report bugs or suggest features. 13 | 14 | When filing an issue, please check existing open, or recently closed, issues to make sure somebody else hasn't already 15 | reported the issue. Please try to include as much information as you can. Details like these are incredibly useful: 16 | 17 | * A reproducible test case or series of steps 18 | * The version of our code being used 19 | * Any modifications you've made relevant to the bug 20 | * Anything unusual about your environment or deployment 21 | 22 | 23 | ## Contributing via Pull Requests 24 | Contributions via pull requests are much appreciated. Before sending us a pull request, please ensure that: 25 | 26 | 1. You are working against the latest source on the *main* branch. 27 | 2. You check existing open, and recently merged, pull requests to make sure someone else hasn't addressed the problem already. 28 | 3. You open an issue to discuss any significant work - we would hate for your time to be wasted. 29 | 30 | To send us a pull request, please: 31 | 32 | 1. Fork the repository. 33 | 2. Modify the source; please focus on the specific change you are contributing. If you also reformat all the code, it will be hard for us to focus on your change. 34 | 3. Ensure local tests pass. 35 | 4. Commit to your fork using clear commit messages. 36 | 5. Send us a pull request, answering any default questions in the pull request interface. 37 | 6. Pay attention to any automated CI failures reported in the pull request, and stay involved in the conversation. 38 | 39 | GitHub provides additional document on [forking a repository](https://help.github.com/articles/fork-a-repo/) and 40 | [creating a pull request](https://help.github.com/articles/creating-a-pull-request/). 41 | 42 | 43 | ## Finding contributions to work on 44 | Looking at the existing issues is a great way to find something to contribute on. As our projects, by default, use the default GitHub issue labels (enhancement/bug/duplicate/help wanted/invalid/question/wontfix), looking at any 'help wanted' issues is a great place to start. 45 | 46 | 47 | ## Code of Conduct 48 | This project has adopted the [Amazon Open Source Code of Conduct](https://aws.github.io/code-of-conduct). 49 | For more information see the [Code of Conduct FAQ](https://aws.github.io/code-of-conduct-faq) or contact 50 | opensource-codeofconduct@amazon.com with any additional questions or comments. 51 | 52 | 53 | ## Security issue notifications 54 | If you discover a potential security issue in this project we ask that you notify AWS/Amazon Security via our [vulnerability reporting page](http://aws.amazon.com/security/vulnerability-reporting/). Please do **not** create a public github issue. 55 | 56 | 57 | ## Licensing 58 | 59 | See the [LICENSE](LICENSE) file for our project's licensing. We will ask you to confirm the licensing of your contribution. 60 | -------------------------------------------------------------------------------- /lib/resource-initializer.ts: -------------------------------------------------------------------------------- 1 | // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. 2 | // SPDX-License-Identifier: MIT-0 3 | 4 | import * as ec2 from '@aws-cdk/aws-ec2' 5 | import * as lambda from '@aws-cdk/aws-lambda' 6 | import { Construct, Duration, Stack } from '@aws-cdk/core' 7 | import { AwsCustomResource, AwsCustomResourcePolicy, AwsSdkCall, PhysicalResourceId } from '@aws-cdk/custom-resources' 8 | import { RetentionDays } from '@aws-cdk/aws-logs' 9 | import { PolicyStatement, Role, ServicePrincipal } from '@aws-cdk/aws-iam' 10 | import { createHash } from 'crypto' 11 | 12 | export interface CdkResourceInitializerProps { 13 | vpc: ec2.IVpc 14 | subnetsSelection: ec2.SubnetSelection 15 | fnSecurityGroups: ec2.ISecurityGroup[] 16 | fnTimeout: Duration 17 | fnCode: lambda.DockerImageCode 18 | fnLogRetention: RetentionDays 19 | fnMemorySize?: number 20 | config: any 21 | } 22 | 23 | export class CdkResourceInitializer extends Construct { 24 | public readonly response: string 25 | public readonly customResource: AwsCustomResource 26 | public readonly function: lambda.Function 27 | 28 | constructor (scope: Construct, id: string, props: CdkResourceInitializerProps) { 29 | super(scope, id) 30 | 31 | const stack = Stack.of(this) 32 | 33 | const fnSg = new ec2.SecurityGroup(this, 'ResourceInitializerFnSg', { 34 | securityGroupName: `${id}ResourceInitializerFnSg`, 35 | vpc: props.vpc, 36 | allowAllOutbound: true 37 | }) 38 | 39 | const fn = new lambda.DockerImageFunction(this, 'ResourceInitializerFn', { 40 | memorySize: props.fnMemorySize || 128, 41 | functionName: `${id}-ResInit${stack.stackName}`, 42 | code: props.fnCode, 43 | vpcSubnets: props.vpc.selectSubnets(props.subnetsSelection), 44 | vpc: props.vpc, 45 | securityGroups: [fnSg, ...props.fnSecurityGroups], 46 | timeout: props.fnTimeout, 47 | logRetention: props.fnLogRetention, 48 | allowAllOutbound: true 49 | }) 50 | 51 | const payload: string = JSON.stringify({ 52 | params: { 53 | config: props.config 54 | } 55 | }) 56 | 57 | const payloadHashPrefix = createHash('md5').update(payload).digest('hex').substring(0, 6) 58 | 59 | const sdkCall: AwsSdkCall = { 60 | service: 'Lambda', 61 | action: 'invoke', 62 | parameters: { 63 | FunctionName: fn.functionName, 64 | Payload: payload 65 | }, 66 | physicalResourceId: PhysicalResourceId.of(`${id}-AwsSdkCall-${fn.currentVersion.version + payloadHashPrefix}`) 67 | } 68 | 69 | // IMPORTANT: the AwsCustomResource construct deploys a singleton AWS Lambda function that is re-used across the same CDK Stack, 70 | // because it is intended to be re-used, make sure it has permissions to invoke multiple "resource initializer functions" within the same stack and it's timeout is sufficient. 71 | // @see: https://github.com/aws/aws-cdk/blob/cafe8257b777c2c6f6143553b147873d640c6745/packages/%40aws-cdk/custom-resources/lib/aws-custom-resource/aws-custom-resource.ts#L360 72 | const customResourceFnRole = new Role(this, 'AwsCustomResourceRole', { 73 | assumedBy: new ServicePrincipal('lambda.amazonaws.com') 74 | }) 75 | customResourceFnRole.addToPolicy( 76 | new PolicyStatement({ 77 | resources: [`arn:aws:lambda:${stack.region}:${stack.account}:function:*-ResInit${stack.stackName}`], 78 | actions: ['lambda:InvokeFunction'] 79 | }) 80 | ) 81 | this.customResource = new AwsCustomResource(this, 'AwsCustomResource', { 82 | policy: AwsCustomResourcePolicy.fromSdkCalls({ resources: AwsCustomResourcePolicy.ANY_RESOURCE }), 83 | onUpdate: sdkCall, 84 | timeout: Duration.minutes(10), 85 | role: customResourceFnRole 86 | }) 87 | 88 | this.response = this.customResource.getResponseField('Payload') 89 | 90 | this.function = fn 91 | } 92 | } 93 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Supporting Amazon RDS initialization using CDK 2 | 3 | ## Introduction 4 | The source code and documentation in this repository describe how to support Amazon RDS instances initialization using CDK and CloudFormation Custom Resources. For the compute layer, it uses a Lambda function implemented in Node.js which is able to run custom SQL scripts with the purpose of initializing the Amazon RDS instance, but also to execute custom commands supported by the [Node.js client for MySQL](https://www.npmjs.com/package/mysql). 5 | 6 | This approach is also described in more details in the following AWS blog post: https://aws.amazon.com/blogs/infrastructure-and-automation/use-aws-cdk-to-initialize-amazon-rds-instances/ 7 | 8 | > While we focus on Amazon RDS for MySQL instances initialization, the concept being described can be applied to any other supported RDS engine. 9 | 10 | ### Potential use cases 11 | - Initialize databases. 12 | - Initialize/maintain users and their permissions. 13 | - Initialize/maintain stored procedures, views or other database resources. 14 | - Execute other custom logic as part of a resource initialization process. 15 | - Improve segregation of duties/least privilege by providing a flexible hook in the IaC, in order to manage RDS instances initialization. 16 | - Initialize database tables. (see note below) 17 | - Seed database tables with initial datasets. (see note below) 18 | 19 | > NOTE: Please be aware that application specific initilization logic (for example: database tables structure and initial seeding of data) is a concern that is commonly managed on the application side. Overall, we advice to keep infrastructure initialization/management separated from application specific initialization. 20 | 21 | ### Pre-Requisites 22 | - Node.js v14+ installed on your local machine: https://nodejs.org/en/download/ 23 | - Docker installed on your local machine: https://docs.docker.com/get-docker/ 24 | - CDK v1.122+ installed and configured on your local machine: https://docs.aws.amazon.com/cdk/latest/guide/getting_started.html 25 | 26 | ### Installation and Deployment steps 27 | - Git clone or download the repository: 28 | https://github.com/aws-samples/amazon-rds-init-cdk.git 29 | - Install NPM dependencies on project directory: 30 | ``` 31 | npm install 32 | ``` 33 | - Deploy the solution on your configured AWS account: 34 | ``` 35 | cdk deploy 36 | ``` 37 | 38 | > NOTE: For demo purposes, the example CDK stack `demos/rds-init-example.ts` creates a new VPC/Subnets to provision the RDS instance and Lambda funtions. In case you would prefer to re-use existing VPC and Subnets, you can easily do so by importing an existing VPC resource: https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-ec2.Vpc.html#static-fromwbrlookupscope-id-options 39 | 40 | #### Cleanup 41 | To avoid incurring future charges, delete the provisioned CDK Stack and related resources. This can be done by executing the following command and subsequent steps: 42 | ``` 43 | cdk destroy 44 | ``` 45 | 46 | ## Technical implementation 47 | In order to achieve custom logic execution during the deployment flow of a CDK stack, we make use of CloudFormation Custom Resources. In the context of CDK, we use the `AwsCustomResource` construct to invoke a deployed lambda containing the RDS initialization logic (execute SQL scripts). 48 | 49 | > Optionally you can read more about making custom AWS API calls using the AwsCustomResource construct: https://docs.aws.amazon.com/cdk/api/latest/docs/custom-resources-readme.html#custom-resources-for-aws-apis 50 | 51 | ### Client implementation based on Node.js 52 | To execute SQL scripts on the provisioned Amazon RDS instance we make use of the `mysql` NPM module, it allow us to easily execute custom SQL scripts or any other support client -> server command: 53 | ```js 54 | const mysql = require('mysql') 55 | const connection = mysql.createConnection({ 56 | host, 57 | user, 58 | password, 59 | multipleStatements: true 60 | }) 61 | connection.connect() 62 | 63 | connection.query("SELECT 'Hello World!';", (err, res) => { 64 | // ... 65 | }) 66 | ``` 67 | > Full Node.js implementation example for MySQL is available at `./demos/rds-init-fn-code/index.js` 68 | 69 | ### Docker container images for Lambda functions 70 | To avoid unnecessary overhead dealing with software dependencies, we promote the usage of Docker container images to package the RDS initialization Lambda function code. 71 | 72 | Docker container images are automatically managed by CDK and there is no need to interact with ECR repositories, simply use: 73 | ```js 74 | const fnCode = DockerImageCode.fromImageAsset(`${__dirname}/your-fn-code-directory`, {}) 75 | ``` 76 | > You can see a Lambda function code example inside the `./demos/rds-init-fn-code` directory. 77 | 78 | ### High level solution overview 79 | ![Solution Overview](solution-overview.png "Solution Overview") 80 | 81 | > NOTE: For simplicity, Amazon S3, Amazon ECR and Amazon CloudWatch configurations are ommitted from the diagram. 82 | 83 | ### The CdkResourceInitializer construct 84 | 85 | TThe `CDKResourceInitializer` CDK construct generalizes the proposed solution, it encapsulates the integration requirements behind `CloudFormation Custom Resources` and `CDK`, to support the execution of AWS Lambda functions with custom initialization logic. 86 | 87 | #### Usage (full example) 88 | ```ts 89 | import * as cdk from '@aws-cdk/core' 90 | import { CfnOutput, Duration, Stack, Token } from '@aws-cdk/core' 91 | import { CdkResourceInitializer } from '../lib/resource-initializer' 92 | import { DockerImageCode } from '@aws-cdk/aws-lambda' 93 | import { InstanceClass, InstanceSize, InstanceType, Port, SubnetType, Vpc } from '@aws-cdk/aws-ec2' 94 | import { RetentionDays } from '@aws-cdk/aws-logs' 95 | import { Credentials, DatabaseInstance, DatabaseInstanceEngine, DatabaseSecret, MysqlEngineVersion } from '@aws-cdk/aws-rds' 96 | 97 | export class RdsInitStackExample extends Stack { 98 | constructor (scope: cdk.App, id: string, props?: cdk.StackProps) { 99 | super(scope, id, props) 100 | 101 | const instanceIdentifier = 'mysql-01' 102 | const credsSecretName = `/${id}/rds/creds/${instanceIdentifier}`.toLowerCase() 103 | const creds = new DatabaseSecret(this, 'MysqlRdsCredentials', { 104 | secretName: credsSecretName, 105 | username: 'admin' 106 | }) 107 | 108 | const vpc = new Vpc(this, 'MyVPC', { 109 | subnetConfiguration: [{ 110 | cidrMask: 24, 111 | name: 'ingress', 112 | subnetType: SubnetType.PUBLIC, 113 | },{ 114 | cidrMask: 24, 115 | name: 'compute', 116 | subnetType: SubnetType.PRIVATE_WITH_NAT, 117 | },{ 118 | cidrMask: 28, 119 | name: 'rds', 120 | subnetType: SubnetType.PRIVATE_ISOLATED, 121 | }] 122 | }) 123 | 124 | const dbServer = new DatabaseInstance(this, 'MysqlRdsInstance', { 125 | vpcSubnets: { 126 | onePerAz: true, 127 | subnetType: SubnetType.PRIVATE_ISOLATED 128 | }, 129 | credentials: Credentials.fromSecret(creds), 130 | vpc: vpc, 131 | port: 3306, 132 | databaseName: 'main', 133 | allocatedStorage: 20, 134 | instanceIdentifier, 135 | engine: DatabaseInstanceEngine.mysql({ 136 | version: MysqlEngineVersion.VER_8_0 137 | }), 138 | instanceType: InstanceType.of(InstanceClass.T2, InstanceSize.LARGE) 139 | }) 140 | // potentially allow connections to the RDS instance... 141 | // dbServer.connections.allowFrom ... 142 | 143 | const initializer = new CdkResourceInitializer(this, 'MyRdsInit', { 144 | config: { 145 | credsSecretName 146 | }, 147 | fnLogRetention: RetentionDays.FIVE_MONTHS, 148 | fnCode: DockerImageCode.fromImageAsset(`${__dirname}/rds-init-fn-code`, {}), 149 | fnTimeout: Duration.minutes(2), 150 | fnSecurityGroups: [], 151 | vpc, 152 | subnetsSelection: vpc.selectSubnets({ 153 | subnetType: SubnetType.PRIVATE_WITH_NAT 154 | }) 155 | }) 156 | // manage resources dependency 157 | initializer.customResource.node.addDependency(dbServer) 158 | 159 | // allow the initializer function to connect to the RDS instance 160 | dbServer.connections.allowFrom(initializer.function, Port.tcp(3306)) 161 | 162 | // allow initializer function to read RDS instance creds secret 163 | creds.grantRead(initializer.function) 164 | 165 | new CfnOutput(this, 'RdsInitFnResponse', { 166 | value: Token.asString(initializer.response) 167 | }) 168 | } 169 | } 170 | ``` 171 | 172 | #### Configuration options 173 | ```ts 174 | export interface CdkResourceInitializerProps { 175 | vpc: ec2.IVpc 176 | subnetsSelection: ec2.SubnetSelection 177 | fnSecurityGroups: ec2.ISecurityGroup[] 178 | fnTimeout: Duration 179 | fnCode: lambda.DockerImageCode 180 | fnLogRetention: RetentionDays 181 | fnMemorySize?: number // defaults to 128 182 | config: any 183 | } 184 | ``` 185 | 186 | #### Instance properties 187 | The `CdkResourceInitializer` class exposes the following readonly properties: 188 | ```ts 189 | // response from initializer function once executed (JSON string) 190 | public readonly response: string 191 | // reference to the internal AwsCustomResource resource instance 192 | public readonly customResource: AwsCustomResource 193 | // reference to the internal Function resource instance 194 | public readonly function: lambda.Function 195 | ``` 196 | 197 | ### Networking configuration 198 | 199 | The `CdkResourceInitializer` construct interface requires networking parameters such as VPC and Subnets, the intention here is to allow the initializer function to communicate with RDS instances which are usually provisioned on Private or Isolated subnets within customer managed VPCs. 200 | 201 | **IMPORTANT**: Because the initializer function also requires to fetch AWS Secrets (RDS credentials), we require to provision it inside a Subnet with internet access or at least with an existing [VPC endpoint for AWS Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/vpc-endpoint-overview.html) attached. 202 | 203 | ### Initializer function execution lifecycle 204 | 205 | The initializer function will be executed under one the following circumstances: 206 | - The `CdkResourceInitializer` construct is provisioned the first time. 207 | - The function configuration (networking, code, etc...) changes. 208 | - The `config` parameter changes. 209 | 210 | ## Useful CDK commands for this repository 211 | 212 | - `cdk deploy` Deploy the CDK stack to your default AWS account/region 213 | - `cdk diff` Compare deployed stack with current local state 214 | - `cdk synth` Generates a synthesized CloudFormation template 215 | 216 | ## Security 217 | 218 | See [CONTRIBUTING](CONTRIBUTING.md#security-issue-notifications) for more information. 219 | 220 | ## License 221 | 222 | This library is licensed under the MIT-0 License. See the LICENSE file. 223 | 224 | --------------------------------------------------------------------------------