feat(imagebuilder): add support for EC2 Image Builder L2 Constructs - Infrastructure Configuration #35882

tarunb12 · 2025-10-29T06:59:22Z

Issue # (aws/aws-cdk-rfcs#789)

Reason for this change

This change adds a new alpha module for EC2 Image Builder L2 Constructs (@aws-cdk/aws-imagebuilder-alpha), as outlined in aws/aws-cdk-rfcs#789. This PR specifically implements the InfrastructureConfiguration construct.

Description of changes

This change implements the InfrastructureConfiguration construct, which is a higher-level construct of CfnInfrastructureConfiguration.

Note - I have also added the YAML library as a dependency to the module. This will be used for the component/workflow resources, which need to pass JSON objects in a YAML string format when creating the resource.

Example

const infrastructureConfiguration = new imagebuilder.InfrastructureConfiguration(this, 'InfrastructureConfiguration', {
  infrastructureConfigurationName: 'test-infrastructure-configuration',
  description: 'An Infrastructure Configuration',
  // Optional - instance types to use for build/test
  instanceTypes: [
    ec2.InstanceType.of(ec2.InstanceClass.STANDARD7_INTEL, ec2.InstanceSize.LARGE),
    ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.LARGE)
  ],
  // Optional - create an instance profile with necessary permissions
  instanceProfile: new iam.InstanceProfile(this, 'InstanceProfile', {
    instanceProfileName: 'test-instance-profile',
    role: new iam.Role(this, 'InstanceProfileRole', {
      assumedBy: iam.ServicePrincipal.fromStaticServicePrincipleName('ec2.amazonaws.com'),
      managedPolicies: [
        iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonSSMManagedInstanceCore'),
        iam.ManagedPolicy.fromAwsManagedPolicyName('EC2InstanceProfileForImageBuilder')
      ]
    })
  }),
  // Use VPC network configuration
  vpc,
  subnetSelection: { subnetType: ec2.SubnetType.PUBLIC },
  securityGroups: [ec2.SecurityGroup.fromSecurityGroupId(this, 'SecurityGroup', vpc.vpcDefaultSecurityGroup)],
  keyPair: ec2.KeyPair.fromKeyPairName(this, 'KeyPair', 'imagebuilder-instance-key-pair'),
  terminateInstanceOnFailure: true,
  // Optional - IMDSv2 settings
  httpTokens: imagebuilder.HttpTokens.REQUIRED,
  httpPutResponseHopLimit: 1,
  // Optional - publish image completion messages to an SNS topic
  notificationTopic: sns.Topic.fromTopicArn(
    this,
    'Topic',
    this.formatArn({ service: 'sns', resource: 'image-builder-topic' })
  ),
  // Optional - log settings. Logging is enabled by default
  logging: {
    s3Bucket: s3.Bucket.fromBucketName(this, 'LogBucket', `imagebuilder-logging-${Aws.ACCOUNT_ID}`),
    s3KeyPrefix: 'imagebuilder-logs'
  },
  // Optional - host placement settings
  ec2InstanceAvailabilityZone: Stack.of(this).availabilityZones[0],
  ec2InstanceHostId: dedicatedHost.attrHostId,
  ec2InstanceTenancy: imagebuilder.Tenancy.HOST,
  resourceTags: {
    Environment: 'production'
  }
});

Describe any new or updated permissions being added

N/A - new L2 construct in alpha module

Description of how you validated changes

Validated with unit tests and integration tests. Manually verified generated CFN templates as well.

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

packages/@aws-cdk/aws-imagebuilder-alpha/lib/infrastructure-configuration.ts

Pull request has been modified.

packages/@aws-cdk/aws-imagebuilder-alpha/lib/infrastructure-configuration.ts

kumsmrit · 2025-11-07T14:39:09Z

packages/@aws-cdk/aws-imagebuilder-alpha/lib/infrastructure-configuration.ts

+      securityGroupIds: props.securityGroups?.length
+        ? props.securityGroups?.map((securityGroup) => securityGroup.securityGroupId)
+        : undefined,
+      subnetId: props.vpc?.selectSubnets(props.subnetSelection).subnetIds[0],


If selectSubnets() returns 0 results, this becomes undefined and thus contradicts the user’s intent (where they provided vpc/subnetSelection). We should consider adding validation for this along with a default subnet selection type.

const selectedSubnets = props.vpc ? props.vpc.selectSubnets(props.subnetSelection ?? { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS }) : undefined; if (props.vpc && selectedSubnets && selectedSubnets.subnetIds.length === 0) { throw new cdk.ValidationError( 'No subnets matched the given subnetSelection for the provided VPC.', this, ); }

Or we should avoid accepting a VPC without a subnetSelection:

if (props.vpc && !props.subnetSelection) { throw new cdk.ValidationError( 'A subnetSelection is required when providing a VPC. ' this, ); } const selectedSubnets = props.vpc ? props.vpc.selectSubnets(props.subnetSelection!) : undefined; if (props.vpc && selectedSubnets && selectedSubnets.subnetIds.length === 0) { throw new cdk.ValidationError( 'No subnets matched the given subnetSelection for the provided VPC.', this, ); }

Added the first validation on checking length of selected subnets

Pull request has been modified.

… Infrastructure Configuration

kumsmrit · 2025-11-07T15:27:40Z

packages/@aws-cdk/aws-imagebuilder-alpha/lib/infrastructure-configuration.ts

+    }
+
+    const placement: CfnInfrastructureConfiguration.PlacementProperty = {
+      ...(props.ec2InstanceAvailabilityZone && { availabilityZone: props.ec2InstanceAvailabilityZone }),


Consider changing this to !==undefined to handle CDK tokens safely:

const placement = props.ec2InstanceAvailabilityZone !== undefined || props.ec2InstanceHostId !== undefined || props.ec2InstanceHostResourceGroupArn !== undefined || props.ec2InstanceTenancy !== undefined ? { ...(props.ec2InstanceAvailabilityZone !== undefined && { availabilityZone: props.ec2InstanceAvailabilityZone }), ...(props.ec2InstanceHostId !== undefined && { hostId: props.ec2InstanceHostId }), ...(props.ec2InstanceHostResourceGroupArn !== undefined && { hostResourceGroupArn: props.ec2InstanceHostResourceGroupArn }), ...(props.ec2InstanceTenancy !== undefined && { tenancy: props.ec2InstanceTenancy }), } : undefined;

kumsmrit · 2025-11-10T13:00:28Z

packages/@aws-cdk/aws-imagebuilder-alpha/lib/infrastructure-configuration.ts

+   *
+   * @default - 2
+   */
+  readonly httpPutResponseHopLimit?: number;


Don't we need validation on the max value for HttpPutResponseHopLimit ? CFN states max as 64.

kumsmrit · 2025-11-10T13:51:35Z

packages/@aws-cdk/aws-imagebuilder-alpha/lib/infrastructure-configuration.ts

+  public readonly instanceProfile: iam.IInstanceProfile;
+
+  /**
+   * The role associateded with the EC2 instance profile used for the build


Type: associateded → associated

kumsmrit · 2025-11-10T14:03:01Z

packages/@aws-cdk/aws-imagebuilder-alpha/lib/infrastructure-configuration.ts

+    this.logBucket = props.logging?.s3Bucket;
+
+    if (this.logBucket && this.role && props.logging?.s3KeyPrefix !== undefined) {
+      this.logBucket.grantPut(this.role, `${props.logging.s3KeyPrefix}/*`);


Since s3KeyPrefix is optional, if user sets logging.s3Bucket without s3KeyPrefix- Image Builder may then fail to upload logs due to msising write permissions; we can change this grant back to:

this.logBucket.grantPut( this.role, props.logging?.s3KeyPrefix ? `${props.logging.s3KeyPrefix}/*` : '*',`

kumsmrit · 2025-11-10T14:37:52Z

packages/@aws-cdk/aws-imagebuilder-alpha/test/infrastructure-configuration.test.ts

+    }).toThrow(cdk.ValidationError);
+  });
+
+  test('throws a validation error an a subnet selection is provided without a VPC', () => {


Typo: throws validation error when subnet selection is provided without a VPC

aws-cdk-automation requested a review from a team October 29, 2025 06:59

github-actions bot added p2 beginning-contributor [Pilot] contributed between 0-2 PRs to the CDK labels Oct 29, 2025

aws-cdk-automation added the pr/needs-further-review PR requires additional review from our team specialists due to the scope or complexity of changes. label Oct 29, 2025

tarunb12 force-pushed the imagebuilder branch from c34ddf8 to 9f0796e Compare October 29, 2025 07:32

tarunb12 marked this pull request as ready for review October 29, 2025 07:35

kumsmrit self-assigned this Oct 30, 2025

github-actions bot mentioned this pull request Nov 1, 2025

Monthly PR metrics report #35917

Open

tarunb12 force-pushed the imagebuilder branch 2 times, most recently from 4c463b8 to e6969a9 Compare November 4, 2025 06:10

Naton1 approved these changes Nov 4, 2025

View reviewed changes

kumsmrit previously requested changes Nov 6, 2025

View reviewed changes

tarunb12 force-pushed the imagebuilder branch 4 times, most recently from 007c467 to ab5b1f9 Compare November 7, 2025 09:15

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Nov 7, 2025

tarunb12 force-pushed the imagebuilder branch 2 times, most recently from da30685 to 5c5bf40 Compare November 7, 2025 10:05

kumsmrit previously requested changes Nov 7, 2025

View reviewed changes

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Nov 7, 2025

tarunb12 force-pushed the imagebuilder branch 2 times, most recently from e4d2666 to b523ba3 Compare November 7, 2025 15:42

tarunb12 force-pushed the imagebuilder branch from b523ba3 to 105746f Compare November 7, 2025 16:40

feat(imagebuilder): add support for EC2 Image Builder L2 Constructs -…

e8c029f

… Infrastructure Configuration

tarunb12 force-pushed the imagebuilder branch from 105746f to e8c029f Compare November 7, 2025 16:42

feat(imagebuilder): add support for EC2 Image Builder L2 Constructs -…

e433819

… Infrastructure Configuration

kumsmrit requested changes Nov 10, 2025

View reviewed changes

kumsmrit reviewed Nov 10, 2025

View reviewed changes

gasolima added the pr/requires-two-approvers This PR is critical (e.g., security, broadly-impacting) and requires 2 approvers to be merged. label Nov 10, 2025

gasolima approved these changes Nov 10, 2025

View reviewed changes

kumsmrit reviewed Nov 10, 2025

View reviewed changes

feat(imagebuilder): add support for EC2 Image Builder L2 Constructs - Infrastructure Configuration #35882

Are you sure you want to change the base?

feat(imagebuilder): add support for EC2 Image Builder L2 Constructs - Infrastructure Configuration #35882

Conversation

tarunb12 commented Oct 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue # (aws/aws-cdk-rfcs#789)

Reason for this change

Description of changes

Example

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kumsmrit Nov 7, 2025

Choose a reason for hiding this comment

Uh oh!

tarunb12 Nov 7, 2025

Choose a reason for hiding this comment

Uh oh!

kumsmrit Nov 7, 2025

Choose a reason for hiding this comment

Uh oh!

kumsmrit Nov 10, 2025

Choose a reason for hiding this comment

Uh oh!

kumsmrit Nov 10, 2025

Choose a reason for hiding this comment

Uh oh!

kumsmrit Nov 10, 2025

Choose a reason for hiding this comment

Uh oh!

kumsmrit Nov 10, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

tarunb12 commented Oct 29, 2025 •

edited

Loading