IaC with Programming Languages Using AWS CDK - Designing Constructs and Stacks
This article explains defining infrastructure in TypeScript/Python with CDK, choosing between L1/L2/L3 constructs, and testing techniques.
CDK Overview
CDK is an IaC framework for defining AWS infrastructure in TypeScript, JavaScript, Python, Java, C#/.Net, and Go. Instead of hand-writing CloudFormation YAML/JSON templates, you define resources with the classes and methods of a programming language. CDK automatically generates CloudFormation templates and runs the deployment.
Constructs and Testing
L1 constructs map one-to-one to CloudFormation resources, and you specify the resource properties directly. L2 constructs come with safe default values, so you can define resources with less code. L3 constructs (patterns) are high-level abstractions that combine multiple resources, and LambdaRestApi builds API Gateway and Lambda together in one step. You use hasResourceProperties in the Assertions module to test that the generated template contains the expected resources and properties.
Self-Mutation with CDK Pipelines
CDK Pipelines takes a "self-mutation" form, in which the pipeline itself is defined in CDK and changes to the pipeline's configuration are deployed through the pipeline. With CodePipeline as the backend, it automatically configures the stages of source retrieval → cdk synth → self-update → deployment. For multi-account / multi-region deployments, the Wave and Stage concepts let you declaratively describe parallel deployments and ordering control. For example, you can define in code a flow that deploys to the development environment first, inserts a manual approval, and then deploys to the production environment. If you build cdk diff into your pull request checks, you can confirm the scope of infrastructure changes at review time and notice unintended deletions or replacements of resources.
Governance with Aspects and Custom Rules
The CDK Aspects feature is a mechanism that traverses every construct in a stack to perform cross-cutting validation and enforce properties. For example, you can create an Aspect that enforces encryption on all S3 buckets or an Aspect that adds tags to all Lambda functions. The cdk-nag library provides AWS best practices and compliance rules such as NIST and HIPAA as Aspects, and detects violations at cdk synth time. You can also create your own Aspects to enforce organization-specific rules (naming conventions, prohibiting specific Regions, prohibiting public access, and so on). In addition to checks with CloudFormation Guard and Config rules, you can notice policy violations at the point of cdk synth.
CDK Pricing
CDK itself incurs no additional charges. CDK is a tool that generates CloudFormation templates, and the only cost is the usage fees for the AWS resources that are deployed. If you build CI/CD pipelines with CDK Pipelines, CodePipeline and CodeBuild charges apply. Storage charges apply for the S3 bucket (the CDK bootstrap bucket) that holds the templates generated by cdk synth. The charges when using CDK are for the resources you deploy and the bootstrap bucket.
Relationship with CloudFormation and How to Choose
CDK converts code written in a programming language into a CloudFormation template in the end, and deploys it. In other words, the actual deployment is done by CloudFormation, and CDK is positioned as a layer that makes it easier to write. For a simple, static configuration, writing CloudFormation templates directly is also an option. On the other hand, when there are many repetitions and conditional branches and you want to organize them as reusable components, CDK, which lets you use the expressiveness of a programming language, becomes a candidate. You choose according to your requirements, for example a dedicated framework for serverless-centered work and another tool for handling multiple clouds.
Abstraction That Uses the Power of the Language
With CDK, you can use the features of a familiar programming language to define infrastructure. You can generate repeated configurations with loops and express differences between environments with conditional branches. If you bundle a frequently used configuration as a component (a construct) that assembles the appropriate group of resources based on its inputs, you can reuse it. If you turn your organization's standard configuration into components and share them as packages, the team can use the same design. Abstracting as code lets you reduce duplication and consolidate changes in one place.
Deployment and Lifecycle
CDK has mechanisms that support everything from development to operations. Before you start using it, you perform an initial setup that prepares the resources needed for deployment. Before you deploy a change, you can check the differences from the current configuration and apply it after understanding what will change. You can separate settings by environment and deploy different configurations to development / production from the same code. If you check whether resources created by hand have drifted from the definitions in the code and make changes through the code, it becomes easier to prevent configuration drift. With these mechanisms, you can repeatedly deploy the same configuration from the same code.
Summary
CDK is an IaC framework that defines AWS infrastructure by using the expressiveness of programming languages. You can choose the level of abstraction with the L1 to L3 construct hierarchy, build self-mutating CI/CD with CDK Pipelines, and enforce governance rules at the code level with Aspects. Being able to write conditional branches and loops in a programming language is a characteristic of CDK.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- AWS CDK official page
- AWS CloudFormation official page
- AWS Lambda official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.