AWS CDK

name: production deploy

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ap-northeast-1
      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2
      - name: Build, tag, and push image to Amazon ECR
        env:
          REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          REPOSITORY: clockwork
          IMAGE_TAG: ${{ github.sha }}
        run: |
          docker build -t $REGISTRY/$REPOSITORY:$IMAGE_TAG .
          docker push $REGISTRY/$REPOSITORY:$IMAGE_TAG

[-] AWS::ECS::Cluster ClockworkCluster ClockworkClusterB221FF6F destroy
[-] AWS::IAM::Role ClockworkTaskDefinition/TaskRole ClockworkTaskDefinitionTaskRoleA304BF0D destroy
[-] AWS::ECS::TaskDefinition ClockworkTaskDefinition ClockworkTaskDefinition1ED8F4FF destroy
[-] AWS::IAM::Role ClockworkTaskDefinition/ExecutionRole ClockworkTaskDefinitionExecutionRole73E56845 destroy
[-] AWS::IAM::Policy ClockworkTaskDefinition/ExecutionRole/DefaultPolicy ClockworkTaskDefinitionExecutionRoleDefaultPolicyCDADD057 destroy
[-] AWS::ECS::Service ClockworkService/Service ClockworkServiceDC6EF4CD destroy
[-] AWS::EC2::SecurityGroup ClockworkService/SecurityGroup ClockworkServiceSecurityGroupE70405BF destroy

    ///////////////
    // ECS
    ///////////////
    const cluster = new ecs.Cluster(this, "ClockworkCluster", {
      clusterName: `ClockworkCluster`,
      vpc: vpc,
    });

    const taskDefinition = new ecs.FargateTaskDefinition(
      this,
      "ClockworkTaskDefinition",
      {
        cpu: 1024,
        memoryLimitMiB: 2048,
      }
    );

    const container = taskDefinition.addContainer("ClockworkContainer", {
      image: ecs.ContainerImage.fromEcrRepository(
        ecrRepository,
        "0c272af55c7700fae62b3d9cfdc8e7efeca14980"
      ),
      //TODO タグをパラメータストアから取得する
    });
    container.addPortMappings({
      containerPort: 3000,
      protocol: ecs.Protocol.TCP,
    });
    const ecsSericeSecurityGroup = new ec2.SecurityGroup(
      this,
      "EcsServiceSecurityGroup",
      {
        vpc: vpc,
        description: "Security Group for ECS Service",
        allowAllOutbound: true,
      }
    );
    ecsSericeSecurityGroup.addIngressRule(
      ec2.Peer.anyIpv4(),
      ec2.Port.tcp(3000)
    );
    const service = new ecs.FargateService(this, "ClockworkService", {
      cluster: cluster,
      taskDefinition: taskDefinition,
      securityGroups: [ecsSericeSecurityGroup],
      capacityProviderStrategies: [
        {
          capacityProvider: "FARGATE_SPOT",
          base: 1,
          weight: 1,
        },
      ],
      assignPublicIp: true,
    });

    ///////////////
    // ALB
    ///////////////
    const albSecurityGroup = new ec2.SecurityGroup(this, "AlbSecurityGroup", {
      vpc: vpc,
      description: "Security Group for ALB",
    });
    albSecurityGroup.addIngressRule(
      ec2.Peer.anyIpv4(),
      ec2.Port.tcp(80),
      "Allow HTTP traffic"
    );
    albSecurityGroup.addEgressRule(
      ecsSericeSecurityGroup,
      ec2.Port.tcp(3000),
      "Allow HTTP traffic"
    );
    ecsSericeSecurityGroup.addIngressRule(
      albSecurityGroup,
      ec2.Port.tcp(3000),
      "Allow HTTP traffic"
    );
    const alb = new ApplicationLoadBalancer(this, "ClorkworkLoadBalancer", {
      vpc,
      internetFacing: true,
      securityGroup: albSecurityGroup,
    });
    const listener = alb.addListener("Listener", {
      port: 80,
      open: true,
    });
    listener.addTargets("EcsService", {
      port: 80,
      targets: [service],
    });

    // ecsSericeSecurityGroup.addIngressRule(
    //   ec2.Peer.anyIpv4(),
    //   ec2.Port.tcp(3000)
    // );

    const service = new ecs.FargateService(this, "ClockworkService", {
      cluster: cluster,
      taskDefinition: taskDefinition,
      securityGroups: [ecsSericeSecurityGroup],
      capacityProviderStrategies: [
        {
          capacityProvider: "FARGATE_SPOT",
          base: 1,
          weight: 1,
        },
      ],
      // assignPublicIp: true,
    });

import { 
  aws_route53_targets as targets,
} from 'aws-cdk-lib';

    ///////////////
    // Route53
    ///////////////
    const hostedZone = route53.HostedZone.fromLookup(this, "HostedZone", {
      domainName: "ayataka0nk.com",
    });
    const aRecord = new route53.ARecord(this, "ARecord", {
      zone: hostedZone,
      recordName: "clockwork",
      target: route53.RecordTarget.fromAlias(
        new cdk.aws_route53_targets.LoadBalancerTarget(alb)
      ),
    });

Error: Cannot retrieve value from context provider hosted-zone since account/region are not specified at the stack level. Configure "env" with an account and region when you define your stack.See https://docs.aws.amazon.com/cdk/latest/guide/environments.html for more details.

    ///////////////
    // Route53
    ///////////////
    const hostedZone = route53.HostedZone.fromLookup(this, "HostedZone", {
      domainName: "ayataka0nk.com",
    });
    const aRecord = new route53.ARecord(this, "ARecord", {
      zone: hostedZone,
      recordName: "clockwork",
      target: route53.RecordTarget.fromAlias(
        new cdk.aws_route53_targets.LoadBalancerTarget(alb)
      ),
      ttl: cdk.Duration.minutes(5),
    });

const acmForCloudfront = new AcmForCloudfrontStack(
  app,
  "AcmForCloudfrontStack",
  {
    env: envUS,
    crossRegionReferences: true,
    hostName: "clockwork",
    domainName: "ayataka0nk.com",
  }
);

Since this app includes more than a single stack, specify which stacks to use (wildcards are supported) or specify `--all`
Stacks: AcmForCloudfrontStack · AwsStack

cdk bootstrap aws://710587538762/us-east-1 --profile ayataka0nk

npx cdk deploy AcmForCloudfrontStack --profile ayataka0nk

    ///////////////
    // Cloudfront
    ///////////////
    const distribution = new cloudfront.CloudFrontWebDistribution(
      this,
      "WebsiteDistribution",
      {
        viewerCertificate: cloudfront.ViewerCertificate.fromAcmCertificate(
          props.certificate,
          {
            aliases: ["clockwork.ayataka0nk.com"],
          }
        ),
        priceClass: cloudfront.PriceClass.PRICE_CLASS_200,
        originConfigs: [
          {
            customOriginSource: {
              domainName: alb.loadBalancerDnsName,
              originProtocolPolicy: cloudfront.OriginProtocolPolicy.HTTP_ONLY,
            },
            behaviors: [
              {
                isDefaultBehavior: true,
              },
            ],
          },
        ],
      }
    );

npx cdk deploy AwsStack --profile ayataka0nk

    const aRecord = new route53.ARecord(this, "ARecord", {
      zone: hostedZone,
      recordName: "clockwork",
      target: route53.RecordTarget.fromAlias(
        new cdk.aws_route53_targets.CloudFrontTarget(distribution)
      ),
      ttl: cdk.Duration.minutes(5),
    });

albSecurityGroup.addIngressRule(
      ec2.Peer.prefixList("pl-58a04531"),
      ec2.Port.tcp(80),
      "Allow HTTP traffic"
    );

22:27:17 | DELETE_FAILED        | AWS::ECR::Repository                        | EcrRepository4D7B3EE1
Resource handler returned message: "The repository with name 'clockwork' in registry with id '710587538762' cannot be de
leted because it still contains images (Service: Ecr, Status Code: 400, Request ID: b7f2f683-7317-4e22-b109-345d75036284
)" (RequestToken: 2548260a-27c0-c0c2-e373-7d1894b93f81, HandlerErrorCode: GeneralServiceException)


 ❌  AwsStack: destroy failed Error: The stack named AwsStack is in a failed state. You may need to delete it from the AWS console : DELETE_FAILED (The following resource(s) failed to delete: [EcrRepository4D7B3EE1]. ): Resource handler returned message: "The repository with name 'clockwork' in registry with id '710587538762' cannot be deleted because it still contains images (Service: Ecr, Status Code: 400, Request ID: b7f2f683-7317-4e22-b109-345d75036284)" (RequestToken: 2548260a-27c0-c0c2-e373-7d1894b93f81, HandlerErrorCode: GeneralServiceException)
    at destroyStack (/home/ayataka/workspace/aws/node_modules/aws-cdk/lib/index.js:440:2157)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async CdkToolkit.destroy (/home/ayataka/workspace/aws/node_modules/aws-cdk/lib/index.js:443:207402)
    at async exec4 (/home/ayataka/workspace/aws/node_modules/aws-cdk/lib/index.js:498:54331)

 npx cdk destroy --profile ayataka0nk --all