インターネット / モバイルバンキング（チャネル系）

import * as cdk from "aws-cdk-lib";
import { Construct } from "constructs";
import * as ec2 from "aws-cdk-lib/aws-ec2";
import * as ecs from "aws-cdk-lib/aws-ecs";
import * as ecsPatterns from "aws-cdk-lib/aws-ecs-patterns";
import * as rds from "aws-cdk-lib/aws-rds";
import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
import * as cognito from "aws-cdk-lib/aws-cognito";
import * as cloudfront from "aws-cdk-lib/aws-cloudfront";
import * as origins from "aws-cdk-lib/aws-cloudfront-origins";
import * as wafv2 from "aws-cdk-lib/aws-wafv2";

// 顧客チャネル：CloudFront + WAF を前段に、ECS Fargate(内部ALB) + Aurora + DynamoDB(セッション)。
export class ChannelBankingStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const vpc = new ec2.Vpc(this, "Vpc", { maxAzs: 2, natGateways: 1 });
    const cluster = new ecs.Cluster(this, "Cluster", { vpc });

    const userPool = new cognito.UserPool(this, "Customers", { selfSignUpEnabled: false });

    const service = new ecsPatterns.ApplicationLoadBalancedFargateService(this, "Channel", {
      cluster,
      cpu: 512,
      memoryLimitMiB: 1024,
      desiredCount: 2,
      publicLoadBalancer: false, // 内部 ALB（前段は CloudFront/WAF）
      taskImageOptions: { image: ecs.ContainerImage.fromRegistry("public.ecr.aws/nginx/nginx:stable"), containerPort: 80 },
    });

    const sessions = new dynamodb.Table(this, "Sessions", {
      partitionKey: { name: "sessionId", type: dynamodb.AttributeType.STRING },
      billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
      timeToLiveAttribute: "ttl",
    });
    sessions.grantReadWriteData(service.taskDefinition.taskRole);

    new rds.DatabaseCluster(this, "Aurora", {
      engine: rds.DatabaseClusterEngine.auroraPostgres({ version: rds.AuroraPostgresEngineVersion.VER_16_1 }),
      writer: rds.ClusterInstance.provisioned("writer"),
      readers: [rds.ClusterInstance.provisioned("reader")],
      vpc,
      storageEncrypted: true,
    });

    const waf = new wafv2.CfnWebACL(this, "Waf", {
      scope: "CLOUDFRONT",
      defaultAction: { allow: {} },
      visibilityConfig: { cloudWatchMetricsEnabled: true, metricName: "channelWaf", sampledRequestsEnabled: true },
      rules: [],
    });

    new cloudfront.Distribution(this, "Cdn", {
      defaultBehavior: { origin: new origins.LoadBalancerV2Origin(service.loadBalancer) },
      webAclId: waf.attrArn,
    });
    void userPool;
  }
}