feat(imagebuilder): add support for EC2 Image Builder L2 Constructs - Infrastructure Configuration

[tarunb12]

Issue # (aws/aws-cdk-rfcs#789)

Reason for this change

This change adds a new alpha module for EC2 Image Builder L2 Constructs (@aws-cdk/aws-imagebuilder-alpha), as outlined in aws/aws-cdk-rfcs#789. This PR specifically implements the InfrastructureConfiguration construct.

Description of changes

This change implements the InfrastructureConfiguration construct, which is a higher-level construct of CfnInfrastructureConfiguration.

Note - I have also added the YAML library as a dependency to the module. This will be used for the component/workflow resources, which need to pass JSON objects in a YAML string format when creating the resource.

Example

const infrastructureConfiguration = new imagebuilder.InfrastructureConfiguration(this, 'InfrastructureConfiguration', {
  infrastructureConfigurationName: 'test-infrastructure-configuration',
  description: 'An Infrastructure Configuration',
  // Optional - instance types to use for build/test
  instanceTypes: [
    ec2.InstanceType.of(ec2.InstanceClass.STANDARD7_INTEL, ec2.InstanceSize.LARGE),
    ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.LARGE)
  ],
  // Optional - create an instance profile with necessary permissions
  instanceProfile: new iam.InstanceProfile(this, 'InstanceProfile', {
    instanceProfileName: 'test-instance-profile',
    role: new iam.Role(this, 'InstanceProfileRole', {
      assumedBy: iam.ServicePrincipal.fromStaticServicePrincipleName('ec2.amazonaws.com'),
      managedPolicies: [
        iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonSSMManagedInstanceCore'),
        iam.ManagedPolicy.fromAwsManagedPolicyName('EC2InstanceProfileForImageBuilder')
      ]
    })
  }),
  // Use VPC network configuration
  vpc,
  subnetSelection: { subnetType: ec2.SubnetType.PUBLIC },
  securityGroups: [ec2.SecurityGroup.fromSecurityGroupId(this, 'SecurityGroup', vpc.vpcDefaultSecurityGroup)],
  keyPair: ec2.KeyPair.fromKeyPairName(this, 'KeyPair', 'imagebuilder-instance-key-pair'),
  terminateInstanceOnFailure: true,
  // Optional - IMDSv2 settings
  httpTokens: imagebuilder.HttpTokens.REQUIRED,
  httpPutResponseHopLimit: 1,
  // Optional - publish image completion messages to an SNS topic
  notificationTopic: sns.Topic.fromTopicArn(
    this,
    'Topic',
    this.formatArn({ service: 'sns', resource: 'image-builder-topic' })
  ),
  // Optional - log settings. Logging is enabled by default
  logging: {
    s3Bucket: s3.Bucket.fromBucketName(this, 'LogBucket', `imagebuilder-logging-${Aws.ACCOUNT_ID}`),
    s3KeyPrefix: 'imagebuilder-logs'
  },
  // Optional - host placement settings
  ec2InstanceAvailabilityZone: Stack.of(this).availabilityZones[0],
  ec2InstanceHostId: dedicatedHost.attrHostId,
  ec2InstanceTenancy: imagebuilder.Tenancy.HOST,
  resourceTags: {
    Environment: 'production'
  }
});

Describe any new or updated permissions being added

N/A - new L2 construct in alpha module

Description of how you validated changes

Validated with unit tests and integration tests. Manually verified generated CFN templates as well.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

Pull request has been modified.

[kumsmrit]

If selectSubnets() returns 0 results, this becomes undefined and thus contradicts the user’s intent (where they provided vpc/subnetSelection). We should consider adding validation for this along with a default subnet selection type.

const selectedSubnets = props.vpc ? props.vpc.selectSubnets(props.subnetSelection ?? { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS }) : undefined;
if (props.vpc && selectedSubnets && selectedSubnets.subnetIds.length === 0) {
  throw new cdk.ValidationError(
    'No subnets matched the given subnetSelection for the provided VPC.', this,
  );
}

Or we should avoid accepting a VPC without a subnetSelection:

if (props.vpc && !props.subnetSelection) {
  throw new cdk.ValidationError(
    'A subnetSelection is required when providing a VPC. ' this,
  );
}

const selectedSubnets = props.vpc ? props.vpc.selectSubnets(props.subnetSelection!) : undefined;
if (props.vpc && selectedSubnets && selectedSubnets.subnetIds.length === 0) {
  throw new cdk.ValidationError(
    'No subnets matched the given subnetSelection for the provided VPC.', this,
  );
}

[tarunb12]

Added the first validation on checking length of selected subnets

Pull request has been modified.