Initial Cdk Setup
Installing CDK
Installing CDK is pretty simple:
$ sudo npm install -g aws-cdk
[sudo] password for iwidlinski:
added 1 package in 2s
It worked:
$ cdk --version
2.174.0 (build 9604329)
Bootstrap CDK
We can now bootstrap the account:
$ cdk bootstrap aws://047719662517/us-west-2 --cloudformation-execution-policies arn:aws:iam::aws:policy/AdministratorAccess
⏳ Bootstrapping environment aws://047719662517/us-west-2...
Trusted accounts for deployment: (none)
Trusted accounts for lookup: (none)
Execution policies: arn:aws:iam::aws:policy/AdministratorAccess
CDKToolkit: creating CloudFormation changeset...
CDKToolkit | 0/12 | 12:35:13 PM | REVIEW_IN_PROGRESS | AWS::CloudFormation::Stack | CDKToolkit User Initiated
CDKToolkit | 0/12 | 12:35:19 PM | CREATE_IN_PROGRESS | AWS::CloudFormation::Stack | CDKToolkit User Initiated
CDKToolkit | 0/12 | 12:35:21 PM | CREATE_IN_PROGRESS | AWS::IAM::Role | LookupRole
CDKToolkit | 0/12 | 12:35:21 PM | CREATE_IN_PROGRESS | AWS::IAM::Role | CloudFormationExecutionRole
CDKToolkit | 0/12 | 12:35:21 PM | CREATE_IN_PROGRESS | AWS::ECR::Repository | ContainerAssetsRepository
CDKToolkit | 0/12 | 12:35:21 PM | CREATE_IN_PROGRESS | AWS::SSM::Parameter | CdkBootstrapVersion
CDKToolkit | 0/12 | 12:35:21 PM | CREATE_IN_PROGRESS | AWS::IAM::Role | FilePublishingRole
CDKToolkit | 0/12 | 12:35:21 PM | CREATE_IN_PROGRESS | AWS::IAM::Role | ImagePublishingRole
CDKToolkit | 0/12 | 12:35:21 PM | CREATE_IN_PROGRESS | AWS::S3::Bucket | StagingBucket
CDKToolkit | 0/12 | 12:35:22 PM | CREATE_IN_PROGRESS | AWS::IAM::Role | ImagePublishingRole Resource creation Initiated
CDKToolkit | 0/12 | 12:35:22 PM | CREATE_IN_PROGRESS | AWS::IAM::Role | LookupRole Resource creation Initiated
CDKToolkit | 0/12 | 12:35:22 PM | CREATE_IN_PROGRESS | AWS::IAM::Role | CloudFormationExecutionRole Resource creation Initiated
CDKToolkit | 0/12 | 12:35:22 PM | CREATE_IN_PROGRESS | AWS::IAM::Role | FilePublishingRole Resource creation Initiated
CDKToolkit | 0/12 | 12:35:22 PM | CREATE_IN_PROGRESS | AWS::ECR::Repository | ContainerAssetsRepository Resource creation Initiated
CDKToolkit | 0/12 | 12:35:22 PM | CREATE_IN_PROGRESS | AWS::SSM::Parameter | CdkBootstrapVersion Resource creation Initiated
CDKToolkit | 0/12 | 12:35:23 PM | CREATE_IN_PROGRESS | AWS::S3::Bucket | StagingBucket Resource creation Initiated
CDKToolkit | 1/12 | 12:35:23 PM | CREATE_COMPLETE | AWS::SSM::Parameter | CdkBootstrapVersion
CDKToolkit | 2/12 | 12:35:23 PM | CREATE_COMPLETE | AWS::ECR::Repository | ContainerAssetsRepository
CDKToolkit | 3/12 | 12:35:36 PM | CREATE_COMPLETE | AWS::S3::Bucket | StagingBucket
CDKToolkit | 3/12 | 12:35:37 PM | CREATE_IN_PROGRESS | AWS::S3::BucketPolicy | StagingBucketPolicy
CDKToolkit | 3/12 | 12:35:38 PM | CREATE_IN_PROGRESS | AWS::S3::BucketPolicy | StagingBucketPolicy Resource creation Initiated
CDKToolkit | 4/12 | 12:35:38 PM | CREATE_COMPLETE | AWS::S3::BucketPolicy | StagingBucketPolicy
CDKToolkit | 5/12 | 12:35:39 PM | CREATE_COMPLETE | AWS::IAM::Role | ImagePublishingRole
CDKToolkit | 6/12 | 12:35:40 PM | CREATE_COMPLETE | AWS::IAM::Role | FilePublishingRole
CDKToolkit | 7/12 | 12:35:40 PM | CREATE_COMPLETE | AWS::IAM::Role | CloudFormationExecutionRole
CDKToolkit | 8/12 | 12:35:40 PM | CREATE_COMPLETE | AWS::IAM::Role | LookupRole
CDKToolkit | 8/12 | 12:35:40 PM | CREATE_IN_PROGRESS | AWS::IAM::Policy | FilePublishingRoleDefaultPolicy
CDKToolkit | 8/12 | 12:35:40 PM | CREATE_IN_PROGRESS | AWS::IAM::Policy | ImagePublishingRoleDefaultPolicy
CDKToolkit | 8/12 | 12:35:41 PM | CREATE_IN_PROGRESS | AWS::IAM::Role | DeploymentActionRole
CDKToolkit | 8/12 | 12:35:41 PM | CREATE_IN_PROGRESS | AWS::IAM::Policy | FilePublishingRoleDefaultPolicy Resource creation Initiated
CDKToolkit | 8/12 | 12:35:41 PM | CREATE_IN_PROGRESS | AWS::IAM::Policy | ImagePublishingRoleDefaultPolicy Resource creation Initiated
CDKToolkit | 8/12 | 12:35:42 PM | CREATE_IN_PROGRESS | AWS::IAM::Role | DeploymentActionRole Resource creation Initiated
CDKToolkit | 9/12 | 12:35:56 PM | CREATE_COMPLETE | AWS::IAM::Policy | FilePublishingRoleDefaultPolicy
CDKToolkit | 10/12 | 12:35:57 PM | CREATE_COMPLETE | AWS::IAM::Policy | ImagePublishingRoleDefaultPolicy
CDKToolkit | 11/12 | 12:35:59 PM | CREATE_COMPLETE | AWS::IAM::Role | DeploymentActionRole
CDKToolkit | 12/12 | 12:36:01 PM | CREATE_COMPLETE | AWS::CloudFormation::Stack | CDKToolkit
✅ Environment aws://047719662517/us-west-2 bootstrapped.
This should create s3 bucket, which it did:
$ aws s3 ls
2025-01-05 12:35:39 cdk-hnb659fds-assets-047719662517-us-west-2
But also we can see CDKToolkit cloudformation template was deployed:
$ aws cloudformation list-stacks
{
"StackSummaries": [
{
"StackId": "arn:aws:cloudformation:us-west-2:047719662517:stack/CDKToolkit/908f24f0-cba4-11ef-a2ae-063840ba6313",
"StackName": "CDKToolkit",
"TemplateDescription": "This stack includes resources needed to deploy AWS CDK apps into this environment",
"CreationTime": "2025-01-05T20:35:13.375000+00:00",
"LastUpdatedTime": "2025-01-05T20:35:19.222000+00:00",
"StackStatus": "CREATE_COMPLETE",
"DriftInformation": {
"StackDriftStatus": "NOT_CHECKED"
}
}
]
}
Creating first CDK App
We are still using root
aws account to perform work on our AWS accounts. So our first CDK app will be to create new user accounts. The CDK app will be called users
( yes very imaginative.. thank you).
For this I created new git repo cdk-playground which will contain this and other CDK apps.
$ cdk init app --language python
Applying project template app for python
# Welcome to your CDK Python project!
This is a blank project for CDK development with Python.
The `cdk.json` file tells the CDK Toolkit how to execute your app.
This project is set up like a standard Python project. The initialization
process also creates a virtualenv within this project, stored under the `.venv`
directory. To create the virtualenv it assumes that there is a `python3`
(or `python` for Windows) executable in your path with access to the `venv`
package. If for any reason the automatic creation of the virtualenv fails,
you can create the virtualenv manually.
To manually create a virtualenv on MacOS and Linux:
```
$ python3 -m venv .venv
```
After the init process completes and the virtualenv is created, you can use the following
step to activate your virtualenv.
```
$ source .venv/bin/activate
```
If you are a Windows platform, you would activate the virtualenv like this:
```
% .venv\Scripts\activate.bat
```
Once the virtualenv is activated, you can install the required dependencies.
```
$ pip install -r requirements.txt
```
At this point you can now synthesize the CloudFormation template for this code.
```
$ cdk synth
```
To add additional dependencies, for example other CDK libraries, just add
them to your `setup.py` file and rerun the `pip install -r requirements.txt`
command.
## Useful commands
* `cdk ls` list all stacks in the app
* `cdk synth` emits the synthesized CloudFormation template
* `cdk deploy` deploy this stack to your default AWS account/region
* `cdk diff` compare deployed stack with current state
* `cdk docs` open CDK documentation
Enjoy!
Please run 'python3 -m venv .venv'!
Executing Creating virtualenv...
✅ All done!
Once that is complete, we need to create virtual env and activate it
$ python3 -m venv .venv
# activate
$ source .venv/bin/activate
(.venv) $
Then install pip requirements
(.venv) $ pip install -r requirements.txt
Collecting aws-cdk-lib==2.174.0 (from -r requirements.txt (line 1))
Downloading aws_cdk_lib-2.174.0-py3-none-any.whl.metadata (60 kB)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 60.0/60.0 kB 2.1 MB/s eta 0:00:00
Collecting constructs<11.0.0,>=10.0.0 (from -r requirements.txt (line 2))
Downloading constructs-10.4.2-py3-none-any.whl.metadata (2.9 kB)
Collecting aws-cdk.asset-awscli-v1<3.0.0,>=2.2.208 (from aws-cdk-lib==2.174.0->-r requirements.txt (line 1))
Downloading aws_cdk.asset_awscli_v1-2.2.218-py3-none-any.whl.metadata (1.1 kB)
Collecting aws-cdk.asset-kubectl-v20<3.0.0,>=2.1.3 (from aws-cdk-lib==2.174.0->-r requirements.txt (line 1))
Downloading aws_cdk.asset_kubectl_v20-2.1.3-py3-none-any.whl.metadata (1.1 kB)
Collecting aws-cdk.asset-node-proxy-agent-v6<3.0.0,>=2.1.0 (from aws-cdk-lib==2.174.0->-r requirements.txt (line 1))
Downloading aws_cdk.asset_node_proxy_agent_v6-2.1.0-py3-none-any.whl.metadata (1.1 kB)
Collecting aws-cdk.cloud-assembly-schema<40.0.0,>=39.0.1 (from aws-cdk-lib==2.174.0->-r requirements.txt (line 1))
Downloading aws_cdk.cloud_assembly_schema-39.1.42-py3-none-any.whl.metadata (3.9 kB)
Collecting jsii<2.0.0,>=1.104.0 (from aws-cdk-lib==2.174.0->-r requirements.txt (line 1))
Downloading jsii-1.106.0-py3-none-any.whl.metadata (79 kB)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 79.5/79.5 kB 5.8 MB/s eta 0:00:00
Collecting publication>=0.0.3 (from aws-cdk-lib==2.174.0->-r requirements.txt (line 1))
Downloading publication-0.0.3-py2.py3-none-any.whl.metadata (8.7 kB)
Collecting typeguard<4.3.0,>=2.13.3 (from aws-cdk-lib==2.174.0->-r requirements.txt (line 1))
Downloading typeguard-4.2.1-py3-none-any.whl.metadata (3.7 kB)
Downloading typeguard-2.13.3-py3-none-any.whl.metadata (3.6 kB)
Collecting attrs<25.0,>=21.2 (from jsii<2.0.0,>=1.104.0->aws-cdk-lib==2.174.0->-r requirements.txt (line 1))
Downloading attrs-24.3.0-py3-none-any.whl.metadata (11 kB)
Collecting cattrs<24.2,>=1.8 (from jsii<2.0.0,>=1.104.0->aws-cdk-lib==2.174.0->-r requirements.txt (line 1))
Downloading cattrs-24.1.2-py3-none-any.whl.metadata (8.4 kB)
Collecting importlib-resources>=5.2.0 (from jsii<2.0.0,>=1.104.0->aws-cdk-lib==2.174.0->-r requirements.txt (line 1))
Downloading importlib_resources-6.5.2-py3-none-any.whl.metadata (3.9 kB)
Collecting python-dateutil (from jsii<2.0.0,>=1.104.0->aws-cdk-lib==2.174.0->-r requirements.txt (line 1))
Downloading python_dateutil-2.9.0.post0-py2.py3-none-any.whl.metadata (8.4 kB)
Collecting typing-extensions<5.0,>=3.8 (from jsii<2.0.0,>=1.104.0->aws-cdk-lib==2.174.0->-r requirements.txt (line 1))
Downloading typing_extensions-4.12.2-py3-none-any.whl.metadata (3.0 kB)
Collecting six>=1.5 (from python-dateutil->jsii<2.0.0,>=1.104.0->aws-cdk-lib==2.174.0->-r requirements.txt (line 1))
Downloading six-1.17.0-py2.py3-none-any.whl.metadata (1.7 kB)
Downloading aws_cdk_lib-2.174.0-py3-none-any.whl (38.8 MB)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 38.8/38.8 MB 4.5 MB/s eta 0:00:00
Downloading constructs-10.4.2-py3-none-any.whl (63 kB)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 63.5/63.5 kB 6.2 MB/s eta 0:00:00
Downloading aws_cdk.asset_awscli_v1-2.2.218-py3-none-any.whl (17.8 MB)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 17.8/17.8 MB 19.2 MB/s eta 0:00:00
Downloading aws_cdk.asset_kubectl_v20-2.1.3-py3-none-any.whl (25.5 MB)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 25.5/25.5 MB 37.6 MB/s eta 0:00:00
Downloading aws_cdk.asset_node_proxy_agent_v6-2.1.0-py3-none-any.whl (1.5 MB)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 1.5/1.5 MB 30.1 MB/s eta 0:00:00
Downloading aws_cdk.cloud_assembly_schema-39.1.42-py3-none-any.whl (184 kB)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 184.5/184.5 kB 13.1 MB/s eta 0:00:00
Downloading jsii-1.106.0-py3-none-any.whl (554 kB)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 554.8/554.8 kB 22.9 MB/s eta 0:00:00
Downloading publication-0.0.3-py2.py3-none-any.whl (7.7 kB)
Downloading typeguard-2.13.3-py3-none-any.whl (17 kB)
Downloading attrs-24.3.0-py3-none-any.whl (63 kB)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 63.4/63.4 kB 5.5 MB/s eta 0:00:00
Downloading cattrs-24.1.2-py3-none-any.whl (66 kB)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 66.4/66.4 kB 5.4 MB/s eta 0:00:00
Downloading importlib_resources-6.5.2-py3-none-any.whl (37 kB)
Downloading typing_extensions-4.12.2-py3-none-any.whl (37 kB)
Downloading python_dateutil-2.9.0.post0-py2.py3-none-any.whl (229 kB)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 229.9/229.9 kB 18.9 MB/s eta 0:00:00
Downloading six-1.17.0-py2.py3-none-any.whl (11 kB)
Installing collected packages: publication, typing-extensions, typeguard, six, importlib-resources, attrs, python-dateutil, cattrs, jsii, constructs, aws-cdk.cloud-assembly-schema, aws-cdk.asset-node-proxy-agent-v6, aws-cdk.asset-kubectl-v20, aws-cdk.asset-awscli-v1, aws-cdk-lib
Successfully installed attrs-24.3.0 aws-cdk-lib-2.174.0 aws-cdk.asset-awscli-v1-2.2.218 aws-cdk.asset-kubectl-v20-2.1.3 aws-cdk.asset-node-proxy-agent-v6-2.1.0 aws-cdk.cloud-assembly-schema-39.1.42 cattrs-24.1.2 constructs-10.4.2 importlib-resources-6.5.2 jsii-1.106.0 publication-0.0.3 python-dateutil-2.9.0.post0 six-1.17.0 typeguard-2.13.3 typing-extensions-4.12.2
(.venv) $
CDK Synth shows that our app can generate cloudformation just fine:
(.venv) $ cdk synth
Resources:
CDKMetadata:
Type: AWS::CDK::Metadata
### output cut
Then we can deploy this app that doesn’t do anything yet.
(.venv) $ cdk deploy
✨ Synthesis time: 5.3s
current credentials could not be used to assume 'arn:aws:iam::047719662517:role/cdk-hnb659fds-deploy-role-047719662517-us-west-2', but are for the right account. Proceeding anyway.
UsersStack: start: Building f69126b922d56178d8112ba4e2d879fc39c05dc44a46776d54bd32132bc700ac:current_account-current_region
UsersStack: success: Built f69126b922d56178d8112ba4e2d879fc39c05dc44a46776d54bd32132bc700ac:current_account-current_region
UsersStack: start: Publishing f69126b922d56178d8112ba4e2d879fc39c05dc44a46776d54bd32132bc700ac:current_account-current_region
current credentials could not be used to assume 'arn:aws:iam::047719662517:role/cdk-hnb659fds-file-publishing-role-047719662517-us-west-2', but are for the right account. Proceeding anyway.
UsersStack: success: Published f69126b922d56178d8112ba4e2d879fc39c05dc44a46776d54bd32132bc700ac:current_account-current_region
current credentials could not be used to assume 'arn:aws:iam::047719662517:role/cdk-hnb659fds-lookup-role-047719662517-us-west-2', but are for the right account. Proceeding anyway.
Lookup role arn:aws:iam::047719662517:role/cdk-hnb659fds-lookup-role-047719662517-us-west-2 was not assumed. Proceeding with default credentials.
UsersStack: deploying... [1/1]
current credentials could not be used to assume 'arn:aws:iam::047719662517:role/cdk-hnb659fds-deploy-role-047719662517-us-west-2', but are for the right account. Proceeding anyway.
UsersStack: creating CloudFormation changeset...
UsersStack | 0/2 | 8:08:55 PM | REVIEW_IN_PROGRESS | AWS::CloudFormation::Stack | UsersStack User Initiated
UsersStack | 0/2 | 8:09:01 PM | CREATE_IN_PROGRESS | AWS::CloudFormation::Stack | UsersStack User Initiated
UsersStack | 0/2 | 8:09:03 PM | CREATE_IN_PROGRESS | AWS::CDK::Metadata | CDKMetadata/Default (CDKMetadata)
UsersStack | 0/2 | 8:09:04 PM | CREATE_IN_PROGRESS | AWS::CDK::Metadata | CDKMetadata/Default (CDKMetadata) Resource creation Initiated
UsersStack | 1/2 | 8:09:04 PM | CREATE_COMPLETE | AWS::CDK::Metadata | CDKMetadata/Default (CDKMetadata)
UsersStack | 2/2 | 8:09:05 PM | CREATE_COMPLETE | AWS::CloudFormation::Stack | UsersStack
✅ UsersStack
✨ Deployment time: 11.9s
Stack ARN:
arn:aws:cloudformation:us-west-2:047719662517:stack/UsersStack/717047a0-ce3f-11ef-b888-0a2aa41805d9
✨ Total time: 17.19s
The UsersStack
stack is deployed along the CDKToolKit
stack.
(.venv) $ aws cloudformation list-stacks --query 'StackSummaries[*].[StackName,StackStatus]'
[
[
"UsersStack",
"CREATE_COMPLETE"
],
[
"CDKToolkit",
"CREATE_COMPLETE"
]
]
Now we need to make the app to do something useful