CloudFormation vs CDK

AWSTemplateFormatVersion: '2010-09-09'
Description: Serverless API with Lambda, API Gateway, and DynamoDB

Parameters:
  Environment:
    Type: String
    AllowedValues: [dev, staging, prod]
    Default: dev
  LogRetentionDays:
    Type: Number
    Default: 30
    AllowedValues: [7, 14, 30, 60, 90, 365]

Conditions:
  IsProd: !Equals [!Ref Environment, prod]

Resources:
  ApiFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub "${Environment}-api-handler"
      Runtime: python3.12
      Handler: index.handler
      MemorySize: !If [IsProd, 512, 256]
      Timeout: 30
      Code:
        S3Bucket: !Ref DeploymentBucket
        S3Key: !Ref CodePackageKey
      Environment:
        Variables:
          TABLE_NAME: !Ref DataTable
          ENVIRONMENT: !Ref Environment
      Tracing:
        Mode: Active
      Tags:
        - Key: Environment
          Value: !Ref Environment

  DataTable:
    Type: AWS::DynamoDB::Table
    DeletionPolicy: !If [IsProd, Retain, Delete]
    Properties:
      TableName: !Sub "${Environment}-data"
      BillingMode: PAY_PER_REQUEST
      PointInTimeRecoverySpecification:
        PointInTimeRecoveryEnabled: !If [IsProd, true, false]
      AttributeDefinitions:
        - AttributeName: pk
          AttributeType: S
        - AttributeName: sk
          AttributeType: S
      KeySchema:
        - AttributeName: pk
          KeyType: HASH
        - AttributeName: sk
          KeyType: RANGE
      SSESpecification:
        SSEEnabled: true

  FunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${Environment}-api-handler"
      RetentionInDays: !Ref LogRetentionDays

Outputs:
  FunctionArn:
    Value: !GetAtt ApiFunction.Arn
    Export:
      Name: !Sub "${Environment}-api-function-arn"
  TableName:
    Value: !Ref DataTable

import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import * as dynamodb from 'aws-cdk-lib/aws-dynamodb';
import * as apigateway from 'aws-cdk-lib/aws-apigateway';
import * as logs from 'aws-cdk-lib/aws-logs';

interface ApiStackProps extends cdk.StackProps {
  environment: 'dev' | 'staging' | 'prod';
}

export class ApiStack extends cdk.Stack {
  public readonly apiUrl: string;

  constructor(scope: Construct, id: string, props: ApiStackProps) {
    super(scope, id, props);

    const isProd = props.environment === 'prod';

    // DynamoDB table with environment-specific settings
    const table = new dynamodb.Table(this, 'DataTable', {
      partitionKey: { name: 'pk', type: dynamodb.AttributeType.STRING },
      sortKey: { name: 'sk', type: dynamodb.AttributeType.STRING },
      billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
      pointInTimeRecovery: isProd,
      encryption: dynamodb.TableEncryption.AWS_MANAGED,
      removalPolicy: isProd
        ? cdk.RemovalPolicy.RETAIN
        : cdk.RemovalPolicy.DESTROY,
    });

    // Lambda function with best practices baked in
    const fn = new lambda.Function(this, 'ApiHandler', {
      runtime: lambda.Runtime.PYTHON_3_12,
      handler: 'index.handler',
      code: lambda.Code.fromAsset('lambda/'),
      memorySize: isProd ? 512 : 256,
      timeout: cdk.Duration.seconds(30),
      tracing: lambda.Tracing.ACTIVE,
      environment: {
        TABLE_NAME: table.tableName,
        ENVIRONMENT: props.environment,
        POWERTOOLS_SERVICE_NAME: 'api',
      },
      logRetention: isProd
        ? logs.RetentionDays.ONE_YEAR
        : logs.RetentionDays.ONE_WEEK,
    });

    // One line grants least-privilege read/write access
    // CDK automatically generates the precise IAM policy
    table.grantReadWriteData(fn);

    // API Gateway wired to Lambda
    const api = new apigateway.LambdaRestApi(this, 'Api', {
      handler: fn,
      proxy: true,
      deployOptions: {
        stageName: props.environment,
        tracingEnabled: true,
        metricsEnabled: true,
      },
    });

    this.apiUrl = api.url;
  }
}

import { Template, Match, Capture } from 'aws-cdk-lib/assertions';
import * as cdk from 'aws-cdk-lib';
import { ApiStack } from '../lib/api-stack';

describe('ApiStack', () => {
  let template: Template;

  beforeAll(() => {
    const app = new cdk.App();
    const stack = new ApiStack(app, 'TestStack', {
      environment: 'prod',
    });
    template = Template.fromStack(stack);
  });

  test('DynamoDB table has point-in-time recovery in prod', () => {
    template.hasResourceProperties('AWS::DynamoDB::Table', {
      PointInTimeRecoverySpecification: {
        PointInTimeRecoveryEnabled: true,
      },
    });
  });

  test('DynamoDB table uses PAY_PER_REQUEST billing', () => {
    template.hasResourceProperties('AWS::DynamoDB::Table', {
      BillingMode: 'PAY_PER_REQUEST',
    });
  });

  test('Lambda function has X-Ray tracing enabled', () => {
    template.hasResourceProperties('AWS::Lambda::Function', {
      TracingConfig: { Mode: 'Active' },
    });
  });

  test('Lambda has correct memory for prod', () => {
    template.hasResourceProperties('AWS::Lambda::Function', {
      MemorySize: 512,
    });
  });

  test('No S3 buckets are publicly accessible', () => {
    const buckets = template.findResources('AWS::S3::Bucket');
    for (const [id, bucket] of Object.entries(buckets)) {
      expect((bucket as any).Properties?.PublicAccessBlockConfiguration).toEqual(
        expect.objectContaining({
          BlockPublicAcls: true,
          BlockPublicPolicy: true,
        })
      );
    }
  });

  test('IAM roles have least-privilege policies', () => {
    const policyCapture = new Capture();
    template.hasResourceProperties('AWS::IAM::Policy', {
      PolicyDocument: policyCapture,
    });
    // Verify no wildcard actions
    const policy = policyCapture.asObject();
    for (const statement of policy.Statement) {
      expect(statement.Action).not.toContain('*');
    }
  });
});

import { App, Aspects } from 'aws-cdk-lib';
import { AwsSolutionsChecks, NagSuppressions } from 'cdk-nag';
import { ApiStack } from '../lib/api-stack';

const app = new App();
const stack = new ApiStack(app, 'ProdStack', {
  environment: 'prod',
});

// Apply AWS Solutions checks to all constructs
Aspects.of(app).add(new AwsSolutionsChecks({ verbose: true }));

// Suppress known-acceptable findings with justification
NagSuppressions.addStackSuppressions(stack, [
  {
    id: 'AwsSolutions-APIG1',
    reason: 'Access logging configured at the account level via centralized logging',
  },
]);

# CloudFormation Guard rules for security compliance
# Run: cfn-guard validate -d template.yaml -r rules.guard

# All S3 buckets must have encryption enabled
AWS::S3::Bucket {
  Properties.BucketEncryption.ServerSideEncryptionConfiguration[*] {
    ServerSideEncryptionByDefault.SSEAlgorithm in ["aws:kms", "AES256"]
  }
}

# All Lambda functions must have tracing enabled
AWS::Lambda::Function {
  Properties.TracingConfig.Mode == "Active"
}

# No security groups should allow SSH from 0.0.0.0/0
AWS::EC2::SecurityGroup {
  Properties.SecurityGroupIngress[*] {
    when IpProtocol == "tcp" and FromPort == 22 {
      CidrIp != "0.0.0.0/0"
    }
  }
}

import { Construct } from 'constructs';
import * as s3 from 'aws-cdk-lib/aws-s3';
import * as kms from 'aws-cdk-lib/aws-kms';
import * as cdk from 'aws-cdk-lib';

export interface SecureBucketProps {
  /** Bucket name (optional - CDK will generate if omitted) */
  bucketName?: string;
  /** Enable versioning (default: true) */
  versioned?: boolean;
  /** Days before transitioning to IA (default: 30) */
  iaTransitionDays?: number;
  /** Days before transitioning to Glacier (default: 90) */
  glacierTransitionDays?: number;
  /** Days before expiring objects (default: no expiration) */
  expirationDays?: number;
}

/**
 * A secure S3 bucket with encryption, access logging, lifecycle policies,
 * and public access blocking baked in.
 *
 * Usage:
 *   const bucket = new SecureBucket(this, 'DataBucket', {
 *     versioned: true,
 *     iaTransitionDays: 30,
 *   });
 */
export class SecureBucket extends Construct {
  public readonly bucket: s3.Bucket;
  public readonly key: kms.Key;

  constructor(scope: Construct, id: string, props: SecureBucketProps = {}) {
    super(scope, id);

    this.key = new kms.Key(this, 'Key', {
      enableKeyRotation: true,
      description: `Encryption key for ${id}`,
    });

    this.bucket = new s3.Bucket(this, 'Bucket', {
      bucketName: props.bucketName,
      encryption: s3.BucketEncryption.KMS,
      encryptionKey: this.key,
      bucketKeyEnabled: true,
      versioned: props.versioned ?? true,
      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
      enforceSSL: true,
      minimumTLSVersion: 1.2,
      objectOwnership: s3.ObjectOwnership.BUCKET_OWNER_ENFORCED,
      removalPolicy: cdk.RemovalPolicy.RETAIN,
      lifecycleRules: [
        {
          transitions: [
            {
              storageClass: s3.StorageClass.INFREQUENT_ACCESS,
              transitionAfter: cdk.Duration.days(props.iaTransitionDays ?? 30),
            },
            {
              storageClass: s3.StorageClass.GLACIER,
              transitionAfter: cdk.Duration.days(props.glacierTransitionDays ?? 90),
            },
          ],
          ...(props.expirationDays && {
            expiration: cdk.Duration.days(props.expirationDays),
          }),
          abortIncompleteMultipartUploadAfter: cdk.Duration.days(7),
        },
      ],
    });
  }
}

import * as cdk from 'aws-cdk-lib';
import { CodePipeline, CodePipelineSource, ShellStep } from 'aws-cdk-lib/pipelines';
import { ApiStage } from './api-stage';

export class PipelineStack extends cdk.Stack {
  constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const pipeline = new CodePipeline(this, 'Pipeline', {
      pipelineName: 'api-pipeline',
      synth: new ShellStep('Synth', {
        input: CodePipelineSource.gitHub('my-org/my-repo', 'main'),
        commands: [
          'npm ci',
          'npm run build',
          'npm run test',
          'npx cdk synth',
        ],
      }),
    });

    // Deploy to dev (no approval)
    pipeline.addStage(new ApiStage(this, 'Dev', {
      environment: 'dev',
      env: { account: '111111111111', region: 'us-east-1' },
    }));

    // Deploy to staging with integration tests
    const staging = pipeline.addStage(new ApiStage(this, 'Staging', {
      environment: 'staging',
      env: { account: '222222222222', region: 'us-east-1' },
    }));
    staging.addPost(new ShellStep('IntegrationTests', {
      commands: ['npm run test:integration'],
    }));

    // Deploy to prod with manual approval
    const prod = pipeline.addStage(new ApiStage(this, 'Prod', {
      environment: 'prod',
      env: { account: '333333333333', region: 'us-east-1' },
    }));
    prod.addPre(new cdk.pipelines.ManualApprovalStep('PromoteToProd'));
  }
}