Skip to content

Commit 5e07960

Browse files
author
Yuriy Bezsonov
committed
first policy run
1 parent 540cdf0 commit 5e07960

5 files changed

Lines changed: 101 additions & 89 deletions

File tree

‎infra/cdk/src/main/java/sample/com/constructs/ThreadAnalysis.java‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -174,10 +174,14 @@ public ThreadAnalysis(final Construct scope, final String id, final ThreadAnalys
174174
.build();
175175

176176
// Add permission for Lambda to invoke itself (async pattern)
177-
threadDumpLambda.addToRolePolicy(PolicyStatement.Builder.create()
177+
// Use constructed ARN to avoid circular dependency (Lambda -> Role Policy -> Lambda)
178+
String lambdaArn = "arn:aws:lambda:" + software.amazon.awscdk.Stack.of(this).getRegion()
179+
+ ":" + software.amazon.awscdk.Stack.of(this).getAccount()
180+
+ ":function:" + prefix + "-thread-dump-lambda";
181+
lambdaRole.addToPolicy(PolicyStatement.Builder.create()
178182
.effect(Effect.ALLOW)
179183
.actions(List.of("lambda:InvokeFunction"))
180-
.resources(List.of(threadDumpLambda.getFunctionArn()))
184+
.resources(List.of(lambdaArn))
181185
.build());
182186

183187
// Create Function URL (replaces API Gateway + VPC Endpoint)

‎infra/cfn/base-stack.yaml‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -686,8 +686,19 @@ Resources:
686686
- Fn::GetAtt:
687687
- IdeInternalSecurityGroupB0A5D76B
688688
- GroupId
689-
ImageId:
690-
Ref: SsmParameterValueawsserviceamiamazonlinuxlatestal2023amikernel61x8664C96584B6F00A464EAD1953AFF4B05118Parameter
689+
SubnetIds:
690+
Fn::Join:
691+
- ""
692+
- - Ref: VpcPublicSubnet1Subnet8E8DEDC0
693+
- ","
694+
- Ref: VpcPublicSubnet2SubnetA811849C
695+
VolumeSize: "50"
696+
IamInstanceProfileArn:
697+
Fn::GetAtt:
698+
- IdeInstanceProfile61B92038
699+
- Arn
700+
InstanceName: ide
701+
InstanceTypes: m6a.xlarge,m7a.xlarge
691702
UserData:
692703
Fn::Base64:
693704
Fn::Join:
@@ -824,19 +835,8 @@ Resources:
824835
"
825836
exit 1
826837
fi
827-
InstanceTypes: m6a.xlarge,m7a.xlarge
828-
InstanceName: ide
829-
IamInstanceProfileArn:
830-
Fn::GetAtt:
831-
- IdeInstanceProfile61B92038
832-
- Arn
833-
VolumeSize: "50"
834-
SubnetIds:
835-
Fn::Join:
836-
- ""
837-
- - Ref: VpcPublicSubnet1Subnet8E8DEDC0
838-
- ","
839-
- Ref: VpcPublicSubnet2SubnetA811849C
838+
ImageId:
839+
Ref: SsmParameterValueawsserviceamiamazonlinuxlatestal2023amikernel61x8664C96584B6F00A464EAD1953AFF4B05118Parameter
840840
UpdateReplacePolicy: Delete
841841
DeletionPolicy: Delete
842842
IdeEipAssociationDFF81215:

‎infra/cfn/java-ai-agents-stack.yaml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -761,13 +761,6 @@ Resources:
761761
Fn::GetAtt:
762762
- IdeInstanceLauncherFunction803C5A2A
763763
- Arn
764-
VolumeSize: "50"
765-
SubnetIds:
766-
Fn::Join:
767-
- ""
768-
- - Ref: VpcPublicSubnet1Subnet8E8DEDC0
769-
- ","
770-
- Ref: VpcPublicSubnet2SubnetA811849C
771764
SecurityGroupIds:
772765
Fn::Join:
773766
- ""
@@ -922,6 +915,13 @@ Resources:
922915
Fn::GetAtt:
923916
- IdeInstanceProfile61B92038
924917
- Arn
918+
VolumeSize: "50"
919+
SubnetIds:
920+
Fn::Join:
921+
- ""
922+
- - Ref: VpcPublicSubnet1Subnet8E8DEDC0
923+
- ","
924+
- Ref: VpcPublicSubnet2SubnetA811849C
925925
UpdateReplacePolicy: Delete
926926
DeletionPolicy: Delete
927927
IdeEipAssociationDFF81215:

‎infra/cfn/java-on-amazon-eks-stack.yaml‎

Lines changed: 36 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -781,28 +781,6 @@ Resources:
781781
Fn::GetAtt:
782782
- IdeInstanceLauncherFunction803C5A2A
783783
- Arn
784-
SecurityGroupIds:
785-
Fn::Join:
786-
- ""
787-
- - Fn::GetAtt:
788-
- IdeSecurityGroup73B02454
789-
- GroupId
790-
- ","
791-
- Fn::GetAtt:
792-
- IdeInternalSecurityGroupB0A5D76B
793-
- GroupId
794-
SubnetIds:
795-
Fn::Join:
796-
- ""
797-
- - Ref: VpcPublicSubnet1Subnet8E8DEDC0
798-
- ","
799-
- Ref: VpcPublicSubnet2SubnetA811849C
800-
VolumeSize: "50"
801-
IamInstanceProfileArn:
802-
Fn::GetAtt:
803-
- IdeInstanceProfile61B92038
804-
- Arn
805-
InstanceName: ide
806784
InstanceTypes: m6a.xlarge,m7a.xlarge
807785
UserData:
808786
Fn::Base64:
@@ -942,6 +920,28 @@ Resources:
942920
fi
943921
ImageId:
944922
Ref: SsmParameterValueawsserviceamiamazonlinuxlatestal2023amikernel61x8664C96584B6F00A464EAD1953AFF4B05118Parameter
923+
SecurityGroupIds:
924+
Fn::Join:
925+
- ""
926+
- - Fn::GetAtt:
927+
- IdeSecurityGroup73B02454
928+
- GroupId
929+
- ","
930+
- Fn::GetAtt:
931+
- IdeInternalSecurityGroupB0A5D76B
932+
- GroupId
933+
SubnetIds:
934+
Fn::Join:
935+
- ""
936+
- - Ref: VpcPublicSubnet1Subnet8E8DEDC0
937+
- ","
938+
- Ref: VpcPublicSubnet2SubnetA811849C
939+
VolumeSize: "50"
940+
IamInstanceProfileArn:
941+
Fn::GetAtt:
942+
- IdeInstanceProfile61B92038
943+
- Arn
944+
InstanceName: ide
945945
UpdateReplacePolicy: Delete
946946
DeletionPolicy: Delete
947947
IdeEipAssociationDFF81215:
@@ -1530,12 +1530,12 @@ Resources:
15301530
Description: workshop-setup build complete
15311531
EventPattern:
15321532
detail:
1533-
project-name:
1534-
- Ref: CodeBuildProjectA0FF5539
15351533
build-status:
15361534
- SUCCEEDED
15371535
- FAILED
15381536
- STOPPED
1537+
project-name:
1538+
- Ref: CodeBuildProjectA0FF5539
15391539
detail-type:
15401540
- CodeBuild Build State Change
15411541
source:
@@ -1573,7 +1573,7 @@ Resources:
15731573
- Arn
15741574
ProjectName:
15751575
Ref: CodeBuildProjectA0FF5539
1576-
ContentHash: "1767018258469"
1576+
ContentHash: "1767020408395"
15771577
DependsOn:
15781578
- CodeBuildCompleteRuleAllowEventRuleWorkshopStackCodeBuildReportLambdaFunctionD77C60919E0B0C89
15791579
- CodeBuildCompleteRuleEE9277E8
@@ -1910,7 +1910,7 @@ Resources:
19101910
- Ref: AWS::AccountId
19111911
- "-"
19121912
- Ref: AWS::Region
1913-
- "-20251229152418"
1913+
- "-20251229160008"
19141914
PublicAccessBlockConfiguration:
19151915
BlockPublicAcls: true
19161916
BlockPublicPolicy: true
@@ -2101,9 +2101,13 @@ Resources:
21012101
- Action: lambda:InvokeFunction
21022102
Effect: Allow
21032103
Resource:
2104-
Fn::GetAtt:
2105-
- ThreadAnalysisLambda3EE9B29D
2106-
- Arn
2104+
Fn::Join:
2105+
- ""
2106+
- - "arn:aws:lambda:"
2107+
- Ref: AWS::Region
2108+
- ":"
2109+
- Ref: AWS::AccountId
2110+
- :function:workshop-thread-dump-lambda
21072111
Version: "2012-10-17"
21082112
PolicyName: ThreadAnalysisLambdaRoleDefaultPolicyC7AD40BA
21092113
Roles:
@@ -2173,12 +2177,12 @@ Resources:
21732177
}
21742178
Environment:
21752179
Variables:
2176-
S3_THREAD_DUMPS_PREFIX: thread-dumps/
2177-
S3_BUCKET_NAME:
2178-
Ref: WorkshopBucketFD5BC43F
21792180
EKS_CLUSTER_NAME:
21802181
Ref: EksClusterB2BDED5B
21812182
SECRET_NAME: workshop-ide-password
2183+
S3_THREAD_DUMPS_PREFIX: thread-dumps/
2184+
S3_BUCKET_NAME:
2185+
Ref: WorkshopBucketFD5BC43F
21822186
FunctionName: workshop-thread-dump-lambda
21832187
Handler: index.lambda_handler
21842188
MemorySize: 512

‎infra/cfn/java-on-aws-immersion-day-stack.yaml‎

Lines changed: 37 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -781,6 +781,28 @@ Resources:
781781
Fn::GetAtt:
782782
- IdeInstanceLauncherFunction803C5A2A
783783
- Arn
784+
InstanceName: ide
785+
IamInstanceProfileArn:
786+
Fn::GetAtt:
787+
- IdeInstanceProfile61B92038
788+
- Arn
789+
VolumeSize: "50"
790+
SubnetIds:
791+
Fn::Join:
792+
- ""
793+
- - Ref: VpcPublicSubnet1Subnet8E8DEDC0
794+
- ","
795+
- Ref: VpcPublicSubnet2SubnetA811849C
796+
SecurityGroupIds:
797+
Fn::Join:
798+
- ""
799+
- - Fn::GetAtt:
800+
- IdeSecurityGroup73B02454
801+
- GroupId
802+
- ","
803+
- Fn::GetAtt:
804+
- IdeInternalSecurityGroupB0A5D76B
805+
- GroupId
784806
ImageId:
785807
Ref: SsmParameterValueawsserviceamiamazonlinuxlatestal2023amikernel61x8664C96584B6F00A464EAD1953AFF4B05118Parameter
786808
UserData:
@@ -920,28 +942,6 @@ Resources:
920942
exit 1
921943
fi
922944
InstanceTypes: m6a.xlarge,m7a.xlarge
923-
InstanceName: ide
924-
IamInstanceProfileArn:
925-
Fn::GetAtt:
926-
- IdeInstanceProfile61B92038
927-
- Arn
928-
VolumeSize: "50"
929-
SubnetIds:
930-
Fn::Join:
931-
- ""
932-
- - Ref: VpcPublicSubnet1Subnet8E8DEDC0
933-
- ","
934-
- Ref: VpcPublicSubnet2SubnetA811849C
935-
SecurityGroupIds:
936-
Fn::Join:
937-
- ""
938-
- - Fn::GetAtt:
939-
- IdeSecurityGroup73B02454
940-
- GroupId
941-
- ","
942-
- Fn::GetAtt:
943-
- IdeInternalSecurityGroupB0A5D76B
944-
- GroupId
945945
UpdateReplacePolicy: Delete
946946
DeletionPolicy: Delete
947947
IdeEipAssociationDFF81215:
@@ -1320,12 +1320,12 @@ Resources:
13201320
Environment:
13211321
ComputeType: BUILD_GENERAL1_MEDIUM
13221322
EnvironmentVariables:
1323-
- Name: GIT_BRANCH
1324-
Type: PLAINTEXT
1325-
Value: new-ws-infra
13261323
- Name: TEMPLATE_TYPE
13271324
Type: PLAINTEXT
13281325
Value: java-on-aws-immersion-day
1326+
- Name: GIT_BRANCH
1327+
Type: PLAINTEXT
1328+
Value: new-ws-infra
13291329
Image: aws/codebuild/amazonlinux2-x86_64-standard:5.0
13301330
ImagePullCredentialsType: CODEBUILD
13311331
PrivilegedMode: false
@@ -1530,12 +1530,12 @@ Resources:
15301530
Description: workshop-setup build complete
15311531
EventPattern:
15321532
detail:
1533+
project-name:
1534+
- Ref: CodeBuildProjectA0FF5539
15331535
build-status:
15341536
- SUCCEEDED
15351537
- FAILED
15361538
- STOPPED
1537-
project-name:
1538-
- Ref: CodeBuildProjectA0FF5539
15391539
detail-type:
15401540
- CodeBuild Build State Change
15411541
source:
@@ -1567,13 +1567,13 @@ Resources:
15671567
Fn::GetAtt:
15681568
- CodeBuildStartLambdaFunction8349284F
15691569
- Arn
1570-
ContentHash: "1767018250950"
15711570
ProjectName:
15721571
Ref: CodeBuildProjectA0FF5539
15731572
CodeBuildIamRoleArn:
15741573
Fn::GetAtt:
15751574
- CodeBuildRoleE9A44575
15761575
- Arn
1576+
ContentHash: "1767020399733"
15771577
DependsOn:
15781578
- CodeBuildCompleteRuleAllowEventRuleWorkshopStackCodeBuildReportLambdaFunctionD77C60919E0B0C89
15791579
- CodeBuildCompleteRuleEE9277E8
@@ -1910,7 +1910,7 @@ Resources:
19101910
- Ref: AWS::AccountId
19111911
- "-"
19121912
- Ref: AWS::Region
1913-
- "-20251229152411"
1913+
- "-20251229160000"
19141914
PublicAccessBlockConfiguration:
19151915
BlockPublicAcls: true
19161916
BlockPublicPolicy: true
@@ -2101,9 +2101,13 @@ Resources:
21012101
- Action: lambda:InvokeFunction
21022102
Effect: Allow
21032103
Resource:
2104-
Fn::GetAtt:
2105-
- ThreadAnalysisLambda3EE9B29D
2106-
- Arn
2104+
Fn::Join:
2105+
- ""
2106+
- - "arn:aws:lambda:"
2107+
- Ref: AWS::Region
2108+
- ":"
2109+
- Ref: AWS::AccountId
2110+
- :function:workshop-thread-dump-lambda
21072111
Version: "2012-10-17"
21082112
PolicyName: ThreadAnalysisLambdaRoleDefaultPolicyC7AD40BA
21092113
Roles:
@@ -2173,12 +2177,12 @@ Resources:
21732177
}
21742178
Environment:
21752179
Variables:
2180+
S3_THREAD_DUMPS_PREFIX: thread-dumps/
21762181
SECRET_NAME: workshop-ide-password
21772182
EKS_CLUSTER_NAME:
21782183
Ref: EksClusterB2BDED5B
21792184
S3_BUCKET_NAME:
21802185
Ref: WorkshopBucketFD5BC43F
2181-
S3_THREAD_DUMPS_PREFIX: thread-dumps/
21822186
FunctionName: workshop-thread-dump-lambda
21832187
Handler: index.lambda_handler
21842188
MemorySize: 512

0 commit comments

Comments
 (0)