GitLabを使ってAWS CDKのスタックをデプロイするCI/CDを構築してみた

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::{ AWS_ACCOUNT_ID }:oidc-provider/gitlab.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringLike": {
          "gitlab.com:sub": "project_path:{ GITLAB_PROJECT_PATH }:ref_type:branch:ref:*"
        }
      }
    }
  ]
}

AWS_DEFAULT_REGION: 対応するリージョン文字列 ex) ap-northeast-1
ROLE_ARN_DEV: dev環境のIAM Role arn
ROLE_ARN_STG: stg環境のIAM Role arn
ROLE_ARN_PROD: prod環境のIAM Role arn

stages:
  - deploy
  - deploy/manual

# AWS Assume role
.assume_role: &assume_role
  - STS=$(aws sts assume-role-with-web-identity --role-arn ${ROLE_ARN} --role-session-name "GitLabRunner-${CI_PROJECT_ID}-${CI_PIPELINE_ID}" --web-identity-token $CI_JOB_JWT_V2 --duration-seconds 3600)
  - export AWS_ACCESS_KEY_ID=$(echo "$STS" | jq -r ".Credentials.AccessKeyId")
  - export AWS_SECRET_ACCESS_KEY=$(echo "$STS" | jq -r ".Credentials.SecretAccessKey")
  - export AWS_SESSION_TOKEN=$(echo "$STS" | jq -r ".Credentials.SessionToken")
  - export AWS_DEFAULT_REGION=$AWS_DEFAULT_REGION
  - export AWS_ACCOUNT_ID=$(aws sts get-caller-identity | jq -r ".Account" )

# COMMON SCRIPT
.common_dev_environments: &common_dev_environments
  ENVIRONMENT: dev
  ROLE_ARN: $ROLE_ARN_DEV
  ENV_NAME: Dev

.common_stg_environments: &common_stg_environments
  ENVIRONMENT: stg
  ROLE_ARN: $ROLE_ARN_STG
  ENV_NAME: Stg

.common_prod_environments: &common_prod_environments
  ENVIRONMENT: prod
  ROLE_ARN: $ROLE_ARN_PROD
  ENV_NAME: Prod

# AWS CLI SCRIPT
.aws_cli_install_script: &aws_cli_install_script
  - apk add --no-cache binutils jq
  - curl -sL https://alpine-pkgs.sgerrand.com/sgerrand.rsa.pub -o /etc/apk/keys/sgerrand.rsa.pub
  - curl -sLO https://github.com/sgerrand/alpine-pkg-glibc/releases/download/${GLIBC_VER}/glibc-${GLIBC_VER}.apk
  - curl -sLO https://github.com/sgerrand/alpine-pkg-glibc/releases/download/${GLIBC_VER}/glibc-bin-${GLIBC_VER}.apk
  - curl -sLO https://github.com/sgerrand/alpine-pkg-glibc/releases/download/${GLIBC_VER}/glibc-i18n-${GLIBC_VER}.apk
  - apk add --no-cache glibc-${GLIBC_VER}.apk glibc-bin-${GLIBC_VER}.apk glibc-i18n-${GLIBC_VER}.apk
  - /usr/glibc-compat/bin/localedef -i en_US -f UTF-8 en_US.UTF-8
  - curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
  - unzip awscliv2.zip -d /opt-aws
  - /opt-aws/aws/install
  - aws --version

.aws_cli_environments: &aws_cli_environments
  GLIBC_VER: 2.31-r0

.common_install_script: &common_install_script
  - echo "http://dl-cdn.alpinelinux.org/alpine/v3.13/main/" >> /etc/apk/repositories
  - apk add --no-cache nodejs npm
  - npm i -g aws-cdk@latest
  - apk add --no-cache python3 gcc libc-dev python3-dev build-base libffi-dev musl-dev cargo libressl-dev curl zip
  - curl https://sh.rustup.rs -sSf | sh -s -- -y
  - source /root/.cargo/env
  - pip3 install -U pip==21.3.1
  - pip3 install -r cdk/requirements.txt
  - echo $DOCKER_PASSWORD | docker login -u $DOCKER_USER --password-stdin

.common_backend_deploy_script: &common_backend_deploy_script
  - cdk bootstrap aws://$AWS_ACCOUNT_ID/$AWS_DEFAULT_REGION
  - cdk -a "python3 app.py" deploy SnsStack$ENV_NAME --require-approval never

.cdk_synth_prod_script: &cdk_synth_prod_script
  - export ENV_NAME=$Prod
  - cdk -a "python3 app.py" synth -o cdk_prod.out -q

.cdk_deploy_prod_script: &cdk_deploy_prod_script
  - cdk bootstrap aws://$AWS_ACCOUNT_ID/$AWS_DEFAULT_REGION
  - cdk -a "cdk_prod.out" deploy SnsStack$ENV_NAME --require-approval never

default:
  image: docker:19.03.1
  services:
    - docker:19.03.5-dind
  before_script:
    - *common_install_script
    - *aws_cli_install_script
    - *assume_role

# job
cdk_dev_deploy_job:
  stage: deploy
  only:
    refs:
      - dev
    changes:
      - cdk/**/*
      - .gitlab-ci.yml
  variables:
    <<: [*aws_cli_environments, *common_dev_environments]
  script:
    - cd cdk
    - *common_backend_deploy_script

cdk_stg_deploy_job:
  stage: deploy
  only:
    refs:
      - main
    changes:
      - cdk/**/*
      - .gitlab-ci.yml
  variables:
    <<: [*aws_cli_environments, *common_stg_environments]
  script:
    - cd cdk
    - *common_backend_deploy_script
    - *cdk_synth_prod_script
  artifacts:
    paths:
      - 'cdk/cdk_prod.out'

cdk_prod_deploy_job:
  stage: deploy/manual
  when: manual
  only:
    refs:
      - main
    changes:
      - cdk/**/*
      - .gitlab-ci.yml
  variables:
    <<: [*aws_cli_environments, *common_prod_environments]
  script:
    - cd cdk
    - *cdk_deploy_prod_script

#!/usr/bin/env python3
import os
import aws_cdk as cdk
from stacks.sns_stack import SnsStack

env_name = os.getenv('ENV_NAME', 'Stg')

app = cdk.App()
SnsStack(app, "SnsStack" + env_name, stage=env_name)

app.synth()

from aws_cdk import (
    Stack,
    aws_sns as sns
)
from constructs import Construct


class SnsStack(Stack):

    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        stage: str = kwargs.pop('stage')
        super().__init__(scope, construct_id, **kwargs)
        stack_prefix = "spike-{}-{}"

        sns_name = stack_prefix.format("sns", stage)
        sns_topic = sns.Topic(self, sns_name,
                              topic_name=sns_name,
                              display_name=sns_name)

        self.sns_topic = sns_topic

stages:
  - deploy
  - deploy/manual

default:
  image: docker:19.03.1
  services:
    - docker:19.03.5-dind
  before_script:
    - *common_install_script
    - *aws_cli_install_script
    - *assume_role