クラウドネイティブ金融AP基盤（ECS Fargate / DevSecOps）

import * as cdk from "aws-cdk-lib";
import { Construct } from "constructs";
import * as ec2 from "aws-cdk-lib/aws-ec2";
import * as ecs from "aws-cdk-lib/aws-ecs";
import * as ecsPatterns from "aws-cdk-lib/aws-ecs-patterns";
import * as ecr from "aws-cdk-lib/aws-ecr";
import * as rds from "aws-cdk-lib/aws-rds";

export class CloudNativeEcsSecopsStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const vpc = new ec2.Vpc(this, "Vpc", { maxAzs: 2, natGateways: 2 });

    // Enhanced Scanning (Amazon Inspector) を有効化したリポジトリ
    const repo = new ecr.Repository(this, "AppRepo", {
      imageScanOnPush: true,
      encryption: ecr.RepositoryEncryption.KMS,
    });

    const cluster = new ecs.Cluster(this, "Cluster", {
      vpc,
      containerInsightsV2: ecs.ContainerInsights.ENHANCED,
    });

    const db = new rds.DatabaseCluster(this, "Aurora", {
      engine: rds.DatabaseClusterEngine.auroraPostgres({
        version: rds.AuroraPostgresEngineVersion.VER_16_1,
      }),
      writer: rds.ClusterInstance.provisioned("writer"),
      readers: [rds.ClusterInstance.provisioned("reader")],
      vpc,
      storageEncrypted: true,
      vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
      removalPolicy: cdk.RemovalPolicy.RETAIN,
    });

    const svc = new ecsPatterns.ApplicationLoadBalancedFargateService(this, "Svc", {
      cluster,
      cpu: 512,
      memoryLimitMiB: 1024,
      desiredCount: 2,
      publicLoadBalancer: true,
      taskImageOptions: {
        image: ecs.ContainerImage.fromEcrRepository(repo),
        containerPort: 8080,
      },
    });

    db.connections.allowDefaultPortFrom(svc.service);
    // WAF / VPC Lattice / Network Firewall は別スタックで関連付け
  }
}