Skip to content

Commit bed0a62

Browse files
rycerratBrian969
rycerrat
and
Brian969
authored
(fix): Lambda timeout in large customer environments (#1020)
* Rebased and merging in actual changes * Create force-github-actions.txt * Prettier Formatting * Fixing prettier issue with more files * Fixing typing issue for results --------- Co-authored-by: Brian969 <56414362+Brian969@users.noreply.github.com>
1 parent 2a5ed54 commit bed0a62

File tree

9 files changed

+469
-105
lines changed

9 files changed

+469
-105
lines changed

‎reference-artifacts/SAMPLE_CONFIGS/force-github-actions.txt‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
This file added solely to test forcing GitHub actions.
2+

‎src/core/cdk/src/initial-setup.ts‎

Lines changed: 65 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -11,32 +11,35 @@
1111
* and limitations under the License.
1212
*/
1313

14-
import * as path from 'path';
1514
import * as cdk from '@aws-cdk/core';
1615
import * as codebuild from '@aws-cdk/aws-codebuild';
16+
import * as dynamodb from '@aws-cdk/aws-dynamodb';
17+
import * as fs from 'fs';
1718
import * as iam from '@aws-cdk/aws-iam';
19+
import * as kms from '@aws-cdk/aws-kms';
1820
import * as lambda from '@aws-cdk/aws-lambda';
21+
import * as path from 'path';
22+
import * as s3 from '@aws-cdk/aws-s3';
1923
import * as s3assets from '@aws-cdk/aws-s3-assets';
2024
import * as secrets from '@aws-cdk/aws-secretsmanager';
21-
import * as dynamodb from '@aws-cdk/aws-dynamodb';
2225
import * as sfn from '@aws-cdk/aws-stepfunctions';
26+
import * as sns from '@aws-cdk/aws-sns';
2327
import * as tasks from '@aws-cdk/aws-stepfunctions-tasks';
24-
import * as s3 from '@aws-cdk/aws-s3';
25-
import { CdkDeployProject, PrebuiltCdkDeployProject } from '@aws-accelerator/cdk-accelerator/src/codebuild';
28+
2629
import { AcceleratorStack, AcceleratorStackProps } from '@aws-accelerator/cdk-accelerator/src/core/accelerator-stack';
27-
import { createRoleName, createName } from '@aws-accelerator/cdk-accelerator/src/core/accelerator-name-generator';
30+
import { CdkDeployProject, PrebuiltCdkDeployProject } from '@aws-accelerator/cdk-accelerator/src/codebuild';
31+
import { createName, createRoleName } from '@aws-accelerator/cdk-accelerator/src/core/accelerator-name-generator';
32+
33+
import { AddTagsToResourcesTask } from './tasks/add-tags-to-resources-task';
34+
import { CDKBootstrapTask } from './tasks/cdk-bootstrap';
2835
import { CodeTask } from '@aws-accelerator/cdk-accelerator/src/stepfunction-tasks';
36+
import { CreateAdConnectorTask } from './tasks/create-adconnector-task';
2937
import { CreateControlTowerAccountTask } from './tasks/create-control-tower-account-task';
3038
import { CreateOrganizationAccountTask } from './tasks/create-organization-account-task';
31-
import { CreateAdConnectorTask } from './tasks/create-adconnector-task';
3239
import { CreateStackTask } from './tasks/create-stack-task';
3340
import { RunAcrossAccountsTask } from './tasks/run-across-accounts-task';
34-
import * as fs from 'fs';
35-
import * as sns from '@aws-cdk/aws-sns';
3641
import { StoreOutputsTask } from './tasks/store-outputs-task';
3742
import { StoreOutputsToSSMTask } from './tasks/store-outputs-to-ssm-task';
38-
import { CDKBootstrapTask } from './tasks/cdk-bootstrap';
39-
import * as kms from '@aws-cdk/aws-kms';
4043

4144
const VPC_CIDR_POOL_TABLE = 'cidr-vpc-assign';
4245
const SUBNET_CIDR_POOL_TABLE = 'cidr-subnet-assign';
@@ -969,16 +972,61 @@ export namespace InitialSetup {
969972
resultPath: 'DISCARD',
970973
});
971974

972-
const addTagsToSharedResourcesTask = new CodeTask(this, 'Add Tags to Shared Resources', {
973-
functionProps: {
974-
code: lambdaCode,
975-
handler: 'index.addTagsToSharedResourcesStep',
975+
// S3 bucket for Add Tags to Shared Resources Lambda fns
976+
const addTagsToSharedResourcesBucket = new s3.Bucket(this, 'AddTagsToSharedResourcesBucket', {
977+
blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
978+
encryption: s3.BucketEncryption.S3_MANAGED,
979+
removalPolicy: cdk.RemovalPolicy.RETAIN,
980+
lifecycleRules: [
981+
{
982+
id: '1DayDelete',
983+
enabled: true,
984+
expiration: cdk.Duration.days(1),
985+
},
986+
],
987+
});
988+
addTagsToSharedResourcesBucket.addToResourcePolicy(
989+
new iam.PolicyStatement({
990+
actions: ['s3:GetObject*', 's3:PutObject*', 's3:DeleteObject*', 's3:GetBucket*', 's3:List*'],
991+
resources: [addTagsToSharedResourcesBucket.arnForObjects('*'), addTagsToSharedResourcesBucket.bucketArn],
992+
principals: [pipelineRole],
993+
}),
994+
);
995+
// Allow only https requests
996+
addTagsToSharedResourcesBucket.addToResourcePolicy(
997+
new iam.PolicyStatement({
998+
actions: ['s3:*'],
999+
resources: [addTagsToSharedResourcesBucket.bucketArn, addTagsToSharedResourcesBucket.arnForObjects('*')],
1000+
principals: [new iam.AnyPrincipal()],
1001+
conditions: {
1002+
Bool: {
1003+
'aws:SecureTransport': 'false',
1004+
},
1005+
},
1006+
effect: iam.Effect.DENY,
1007+
}),
1008+
);
1009+
1010+
//State Machine and associated resources for Adding Tags to Shared Resources
1011+
const addTagsToSharedResourcesStateMachine = new sfn.StateMachine(this, 'Add Tags To Resources Sfn', {
1012+
stateMachineName: `${props.acceleratorPrefix}AddTagsToSharedResources_sfn`,
1013+
definition: new AddTagsToResourcesTask(this, 'AddTagsToSharedResources', {
1014+
lambdaCode,
9761015
role: pipelineRole,
977-
},
978-
functionPayload: {
1016+
name: 'Add Tags To Shared Resources',
1017+
}),
1018+
});
1019+
1020+
const addTagsToSharedResourcesTask = new tasks.StepFunctionsStartExecution(this, 'Add Tags To Resources', {
1021+
stateMachine: addTagsToSharedResourcesStateMachine,
1022+
integrationPattern: sfn.IntegrationPattern.RUN_JOB,
1023+
input: sfn.TaskInput.fromObject({
1024+
'accounts.$': '$.accounts',
1025+
acceleratorPrefix: props.acceleratorPrefix,
9791026
assumeRoleName: props.stateMachineExecutionRole,
9801027
outputTableName: outputsTable.tableName,
981-
},
1028+
s3Bucket: addTagsToSharedResourcesBucket.bucketName,
1029+
}),
9821030
resultPath: 'DISCARD',
9831031
});
9841032

‎src/core/cdk/src/tasks/add-tags-to-resources-task.ts‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
/**
2+
* Copyright 2021 Amazon.com, Inc. or its affiliates. All Rights Reserved.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance
5+
* with the License. A copy of the License is located at
6+
*
7+
* http://www.apache.org/licenses/LICENSE-2.0
8+
*
9+
* or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES
10+
* OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions
11+
* and limitations under the License.
12+
*/
13+
14+
import * as cdk from '@aws-cdk/core';
15+
import * as iam from '@aws-cdk/aws-iam';
16+
import * as lambda from '@aws-cdk/aws-lambda';
17+
import * as sfn from '@aws-cdk/aws-stepfunctions';
18+
19+
import { CodeTask } from '@aws-accelerator/cdk-accelerator/src/stepfunction-tasks';
20+
21+
export namespace AddTagsToResourcesTask {
22+
export interface Props {
23+
role: iam.IRole;
24+
lambdaCode: lambda.Code;
25+
waitSeconds?: number;
26+
name: string;
27+
permissions?: string[];
28+
functionPayload?: { [key: string]: string };
29+
}
30+
}
31+
32+
export class AddTagsToResourcesTask extends sfn.StateMachineFragment {
33+
readonly startState: sfn.State;
34+
readonly endStates: sfn.INextable[];
35+
36+
constructor(scope: cdk.Construct, id: string, props: AddTagsToResourcesTask.Props) {
37+
super(scope, id);
38+
39+
const { role, lambdaCode, name, permissions, waitSeconds = 60 } = props;
40+
41+
role.addToPrincipalPolicy(
42+
new iam.PolicyStatement({
43+
effect: iam.Effect.ALLOW,
44+
resources: ['*'],
45+
actions: ['logs:CreateLogGroup', 'logs:CreateLogStream', 'logs:PutLogEvents'],
46+
}),
47+
);
48+
if (permissions && permissions.length > 0) {
49+
role.addToPrincipalPolicy(
50+
new iam.PolicyStatement({
51+
effect: iam.Effect.ALLOW,
52+
resources: ['*'],
53+
actions: permissions,
54+
}),
55+
);
56+
}
57+
58+
const ddbTask = new CodeTask(scope, `${name} DDB Task`, {
59+
resultPath: '$',
60+
functionProps: {
61+
role,
62+
code: lambdaCode,
63+
handler: 'index.addTagsToSharedResources.scan',
64+
},
65+
functionPayload: {
66+
'assumeRoleName.$': '$.assumeRoleName',
67+
'outputTableName.$': '$.outputTableName',
68+
's3Bucket.$': '$.s3Bucket',
69+
'accounts.$': '$.accounts',
70+
...props.functionPayload,
71+
},
72+
});
73+
74+
// Create Map task to iterate
75+
const mapTask = new sfn.Map(this, `${name} Map`, {
76+
itemsPath: '$.accounts',
77+
//resultPath: '$.errors',
78+
resultPath: '$.results',
79+
maxConcurrency: 10,
80+
parameters: {
81+
'accountId.$': '$$.Map.Item.Value',
82+
'assumeRoleName.$': '$.assumeRoleName',
83+
'outputTableName.$': '$.outputTableName',
84+
's3Bucket.$': '$.s3Bucket',
85+
's3Key.$': '$.s3Key',
86+
...props.functionPayload,
87+
},
88+
});
89+
90+
const addTagTask = new CodeTask(scope, `${name} Add Tag Task`, {
91+
resultPath: '$',
92+
functionProps: {
93+
role,
94+
code: lambdaCode,
95+
handler: 'index.addTagsToSharedResources.add',
96+
},
97+
functionPayload: {
98+
'accountId.$': '$.accountId',
99+
'assumeRoleName.$': '$.assumeRoleName',
100+
'outputTableName.$': '$.outputTableName',
101+
's3Bucket.$': '$.s3Bucket',
102+
's3Key.$': '$.s3Key',
103+
...props.functionPayload,
104+
},
105+
});
106+
107+
mapTask.iterator(addTagTask);
108+
109+
const verifyddbTask = new CodeTask(scope, `${name} Verify DDB Task`, {
110+
resultPath: '$',
111+
functionProps: {
112+
role,
113+
code: lambdaCode,
114+
handler: 'index.addTagsToSharedResources.verify',
115+
},
116+
inputPath: '$',
117+
});
118+
119+
const pass = new sfn.Pass(this, `${name} Verify DDB Success`, {
120+
resultPath: 'DISCARD',
121+
});
122+
123+
const fail = new sfn.Fail(this, `${name} Verify DDB Failed`);
124+
125+
const isDdbTaskSuccess = new sfn.Choice(scope, `${name} Verify DDB Success?`)
126+
.when(sfn.Condition.stringEquals('$.status', 'SUCCESS'), pass)
127+
.otherwise(fail);
128+
129+
let chain: sfn.Chain;
130+
chain = sfn.Chain.start(ddbTask).next(mapTask).next(verifyddbTask).next(isDdbTaskSuccess);
131+
this.startState = chain.startState;
132+
this.endStates = chain.endStates;
133+
}
134+
}

‎src/core/runtime/src/add-tags-to-shared-resources-step.ts‎

Lines changed: 0 additions & 84 deletions
This file was deleted.

0 commit comments

Comments
 (0)