Skip to content

Commit 12f7b6d

Browse files
author
Yuriy Bezsonov
committed
Refactor infra
1 parent 731cb61 commit 12f7b6d

10 files changed

Lines changed: 174 additions & 226 deletions

File tree

‎infra/cdk/src/main/java/sample/com/WorkshopStack.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -111,9 +111,9 @@ public WorkshopStack(final Construct scope, final String id, final StackProps pr
111111
.workshopBucket(workshopBucket.getBucket())
112112
.build());
113113

114-
// JVM Analysis (Pod Identity role for jvm-analysis-service)
115-
JvmAnalysis jvmAnalysis = new JvmAnalysis(this, "JvmAnalysis",
116-
JvmAnalysis.JvmAnalysisProps.builder()
114+
// JVM AI Analyzer (Pod Identity role for jvm-ai-analyzer)
115+
JvmAiAnalyzer jvmAiAnalyzer = new JvmAiAnalyzer(this, "JvmAiAnalyzer",
116+
JvmAiAnalyzer.JvmAiAnalyzerProps.builder()
117117
.workshopBucket(workshopBucket.getBucket())
118118
.build());
119119

infra/cdk/src/main/java/sample/com/constructs/JvmAnalysis.java renamed to infra/cdk/src/main/java/sample/com/constructs/JvmAiAnalyzer.java

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -7,59 +7,59 @@
77
import java.util.List;
88

99
/**
10-
* JvmAnalysis construct for JVM profiling analysis.
11-
* Creates Pod Identity role for jvm-analysis-service.
10+
* JvmAiAnalyzer construct for JVM profiling analysis.
11+
* Creates Pod Identity role for jvm-ai-analyzer.
1212
* Uses app-specific naming (no prefix) for workshop content compatibility.
1313
*
14-
* Note: ECR repository (jvm-analysis-service) is now created automatically via
14+
* Note: ECR repository (jvm-ai-analyzer) is now created automatically via
1515
* ECR Repository Creation Template (create-on-push) instead of explicit definition.
1616
*/
17-
public class JvmAnalysis extends Construct {
17+
public class JvmAiAnalyzer extends Construct {
1818

19-
private final Role jvmAnalysisServiceRole;
19+
private final Role jvmAiAnalyzerRole;
2020

21-
public static class JvmAnalysisProps {
21+
public static class JvmAiAnalyzerProps {
2222
private Bucket workshopBucket;
2323

24-
public static JvmAnalysisProps.Builder builder() { return new Builder(); }
24+
public static JvmAiAnalyzerProps.Builder builder() { return new Builder(); }
2525

2626
public static class Builder {
27-
private JvmAnalysisProps props = new JvmAnalysisProps();
27+
private JvmAiAnalyzerProps props = new JvmAiAnalyzerProps();
2828

2929
public Builder workshopBucket(Bucket workshopBucket) { props.workshopBucket = workshopBucket; return this; }
30-
public JvmAnalysisProps build() { return props; }
30+
public JvmAiAnalyzerProps build() { return props; }
3131
}
3232

3333
public Bucket getWorkshopBucket() { return workshopBucket; }
3434
}
3535

36-
public JvmAnalysis(final Construct scope, final String id) {
37-
this(scope, id, JvmAnalysisProps.builder().build());
36+
public JvmAiAnalyzer(final Construct scope, final String id) {
37+
this(scope, id, JvmAiAnalyzerProps.builder().build());
3838
}
3939

40-
public JvmAnalysis(final Construct scope, final String id, final JvmAnalysisProps props) {
40+
public JvmAiAnalyzer(final Construct scope, final String id, final JvmAiAnalyzerProps props) {
4141
super(scope, id);
4242

43-
// Note: ECR repository (jvm-analysis-service) is created automatically via
43+
// Note: ECR repository (jvm-ai-analyzer) is created automatically via
4444
// ECR Repository Creation Template when images are pushed
4545

46-
// Create Pod Identity role for jvm-analysis-service (app-specific naming, no prefix)
46+
// Create Pod Identity role for jvm-ai-analyzer (app-specific naming, no prefix)
4747
// Pod Identity requires both sts:AssumeRole and sts:TagSession
4848
CompositePrincipal podIdentityPrincipal = new CompositePrincipal(
4949
ServicePrincipal.Builder.create("pods.eks.amazonaws.com").build()
5050
);
5151

52-
this.jvmAnalysisServiceRole = Role.Builder.create(this, "ServiceRole")
53-
.roleName("jvm-analysis-service-eks-pod-role")
52+
this.jvmAiAnalyzerRole = Role.Builder.create(this, "ServiceRole")
53+
.roleName("jvm-ai-analyzer-eks-pod-role")
5454
.assumedBy(podIdentityPrincipal)
55-
.description("Role for jvm-analysis-service EKS pod to access Bedrock and S3")
55+
.description("Role for jvm-ai-analyzer EKS pod to access Bedrock and S3")
5656
.managedPolicies(List.of(
5757
ManagedPolicy.fromAwsManagedPolicyName("AmazonBedrockLimitedAccess")
5858
))
5959
.build();
6060

6161
// Add sts:TagSession to the assume role policy for Pod Identity
62-
PolicyDocument assumeRolePolicy = jvmAnalysisServiceRole.getAssumeRolePolicy();
62+
PolicyDocument assumeRolePolicy = jvmAiAnalyzerRole.getAssumeRolePolicy();
6363
if (assumeRolePolicy != null) {
6464
assumeRolePolicy.addStatements(
6565
PolicyStatement.Builder.create()
@@ -72,7 +72,7 @@ public JvmAnalysis(final Construct scope, final String id, final JvmAnalysisProp
7272

7373
// Add S3 permissions for profiling data
7474
if (props.getWorkshopBucket() != null) {
75-
jvmAnalysisServiceRole.addToPolicy(PolicyStatement.Builder.create()
75+
jvmAiAnalyzerRole.addToPolicy(PolicyStatement.Builder.create()
7676
.effect(Effect.ALLOW)
7777
.actions(List.of(
7878
"s3:ListBucket",
@@ -88,7 +88,7 @@ public JvmAnalysis(final Construct scope, final String id, final JvmAnalysisProp
8888
}
8989

9090
// Getters
91-
public Role getJvmAnalysisServiceRole() {
92-
return jvmAnalysisServiceRole;
91+
public Role getJvmAiAnalyzerRole() {
92+
return jvmAiAnalyzerRole;
9393
}
9494
}

‎infra/cdk/src/main/java/sample/com/constructs/Unicorn.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -197,6 +197,7 @@ private void createEcsRoles(UnicornProps props) {
197197

198198
this.ecsInfrastructureRole = Role.Builder.create(this, "UnicornStoreEcsInfrastructureRole")
199199
.roleName("unicornstore-ecs-infrastructure-role")
200+
.path("/service-role/")
200201
.assumedBy(ecsService)
201202
.description("ECS infrastructure role for Express Mode services")
202203
.build();
@@ -209,6 +210,7 @@ private void createEcsRoles(UnicornProps props) {
209210

210211
this.ecsTaskExecutionRole = Role.Builder.create(this, "UnicornStoreEcsTaskExecutionRole")
211212
.roleName("unicornstore-ecs-task-execution-role")
213+
.path("/service-role/")
212214
.assumedBy(ecsTasks)
213215
.description("ECS task execution role for pulling images and injecting secrets")
214216
.build();
@@ -233,6 +235,7 @@ private void createEcsRoles(UnicornProps props) {
233235
// === ECS Task Role (app runtime permissions) ===
234236
this.ecsTaskRole = Role.Builder.create(this, "UnicornStoreEcsTaskRole")
235237
.roleName("unicornstore-ecs-task-role")
238+
.path("/service-role/")
236239
.assumedBy(ecsTasks)
237240
.description("ECS task role for application runtime permissions")
238241
.build();

‎infra/cdk/src/main/resources/iam-policy.json‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,11 @@
2727
"Action": [
2828
"aws-marketplace:Unsubscribe",
2929
"aws-marketplace:ViewSubscriptions",
30+
"acm:*",
3031
"bedrock:*",
3132
"bedrock-agentcore:*",
3233
"apigateway:*",
34+
"application-autoscaling:*",
3335
"application-signals:*",
3436
"cloudformation:*",
3537
"cloudwatch:*",
@@ -61,7 +63,8 @@
6163
],
6264
"Resource": [
6365
"arn:aws:iam::{{.AccountId}}:role/unicorn*",
64-
"arn:aws:iam::{{.AccountId}}:role/jvm-analysis-service*"
66+
"arn:aws:iam::{{.AccountId}}:role/service-role/unicorn*",
67+
"arn:aws:iam::{{.AccountId}}:role/jvm-ai-analyzer*"
6568
]
6669
},
6770
{

‎infra/cdk/src/test/java/sample/com/constructs/IdePropsTest.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -101,14 +101,14 @@ void x86_64ReturnsIntelAmdInstanceTypes() {
101101
}
102102

103103
/**
104-
* Unit test: Default architecture is ARM64
104+
* Unit test: Default architecture is X86_64
105105
*/
106106
@Test
107-
void defaultArchitectureIsArm64() {
107+
void defaultArchitectureIsX86_64() {
108108
IdeProps props = IdeProps.builder().build();
109109

110-
assertEquals(IdeArch.ARM64, props.getIdeArch());
111-
// Should return ARM64 instance types by default
112-
assertTrue(props.getInstanceTypes().contains("m7g.xlarge"));
110+
assertEquals(IdeArch.X86_64, props.getIdeArch());
111+
// Should return X86_64 instance types by default
112+
assertTrue(props.getInstanceTypes().contains("m7i-flex.xlarge"));
113113
}
114114
}

‎infra/cfn/base-stack.yaml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -676,6 +676,16 @@ Resources:
676676
Fn::GetAtt:
677677
- IdeInstanceLauncherFunction803C5A2A
678678
- Arn
679+
SecurityGroupIds:
680+
Fn::Join:
681+
- ""
682+
- - Fn::GetAtt:
683+
- IdeSecurityGroup73B02454
684+
- GroupId
685+
- ","
686+
- Fn::GetAtt:
687+
- IdeInternalSecurityGroupB0A5D76B
688+
- GroupId
679689
SubnetIds:
680690
Fn::Join:
681691
- ""
@@ -827,16 +837,6 @@ Resources:
827837
fi
828838
ImageId:
829839
Ref: SsmParameterValueawsserviceamiamazonlinuxlatestal2023amikernel61x8664C96584B6F00A464EAD1953AFF4B05118Parameter
830-
SecurityGroupIds:
831-
Fn::Join:
832-
- ""
833-
- - Fn::GetAtt:
834-
- IdeSecurityGroup73B02454
835-
- GroupId
836-
- ","
837-
- Fn::GetAtt:
838-
- IdeInternalSecurityGroupB0A5D76B
839-
- GroupId
840840
UpdateReplacePolicy: Delete
841841
DeletionPolicy: Delete
842842
IdeEipAssociationDFF81215:

‎infra/cfn/java-ai-agents-stack.yaml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -355,7 +355,9 @@ Resources:
355355
Resource: "*"
356356
Sid: MarketplaceSubscribeClaude45Opus45Sonnet4Sonnet
357357
- Action:
358+
- acm:*
358359
- apigateway:*
360+
- application-autoscaling:*
359361
- application-signals:*
360362
- aws-marketplace:Unsubscribe
361363
- aws-marketplace:ViewSubscriptions
@@ -386,7 +388,8 @@ Resources:
386388
- Action: iam:PassRole
387389
Effect: Allow
388390
Resource:
389-
- !Sub arn:aws:iam::${AWS::AccountId}:role/jvm-analysis-service*
391+
- !Sub arn:aws:iam::${AWS::AccountId}:role/jvm-ai-analyzer*
392+
- !Sub arn:aws:iam::${AWS::AccountId}:role/service-role/unicorn*
390393
- !Sub arn:aws:iam::${AWS::AccountId}:role/unicorn*
391394
Sid: PassRole
392395
- Action: ec2:RunInstances
@@ -757,8 +760,6 @@ Resources:
757760
Fn::GetAtt:
758761
- IdeInstanceLauncherFunction803C5A2A
759762
- Arn
760-
ImageId:
761-
Ref: SsmParameterValueawsserviceamiamazonlinuxlatestal2023amikernel61x8664C96584B6F00A464EAD1953AFF4B05118Parameter
762763
UserData:
763764
Fn::Base64:
764765
Fn::Join:
@@ -918,6 +919,8 @@ Resources:
918919
- Fn::GetAtt:
919920
- IdeInternalSecurityGroupB0A5D76B
920921
- GroupId
922+
ImageId:
923+
Ref: SsmParameterValueawsserviceamiamazonlinuxlatestal2023amikernel61x8664C96584B6F00A464EAD1953AFF4B05118Parameter
921924
UpdateReplacePolicy: Delete
922925
DeletionPolicy: Delete
923926
IdeEipAssociationDFF81215:

0 commit comments

Comments
 (0)