Fixes for Lambda/k8s-connection

Author: smoell

infrastructure/cdk/src/main/java/com/unicorn/UnicornStoreStack.java

@@ -34,10 +34,9 @@ public class UnicornStoreStack extends Stack {
         whoami
         echo '\n'
         echo '=== Checking directory ===\n'
-        sudo -H -i -u ec2-user bash -c "ls -la ~/java-on-aws/infrastructure/scripts/setup/"
         sudo -H -i -u ec2-user bash -c "~/java-on-aws/infrastructure/scripts/setup/app.sh"
         sudo -H -i -u ec2-user bash -c "~/java-on-aws/infrastructure/scripts/setup/eks.sh"
-        # sudo -H -i -u ec2-user bash -c "~/java-on-aws/infrastructure/scripts/setup/monitoring.sh"
+        sudo -H -i -u ec2-user bash -c "~/java-on-aws/infrastructure/scripts/setup/monitoring.sh"
         """;
 
     private final String buildspec = """
@@ -54,7 +53,6 @@ public class UnicornStoreStack extends Stack {
                     - |
                         # Resolution for when creating the first service in the account
                         aws organizations enable-all-features
-                        aws sso-admin create-instance --name "grafana-instance" --region eu-west-1
                         aws iam create-service-linked-role --aws-service-name ecs.amazonaws.com 2>/dev/null || true
                         aws iam create-service-linked-role --aws-service-name apprunner.amazonaws.com 2>/dev/null || true
                         aws iam create-service-linked-role --aws-service-name elasticloadbalancing.amazonaws.com 2>/dev/null || true

infrastructure/cdk/src/main/java/com/unicorn/constructs/EksCluster.java

@@ -1,6 +1,6 @@
 package com.unicorn.constructs;
 
-import software.amazon.awscdk.services.ec2.IVpc;
+import software.amazon.awscdk.services.ec2.*;
 import software.amazon.awscdk.services.eks.CfnCluster;
 import software.amazon.awscdk.services.eks.CfnCluster.LoggingProperty;
 import software.amazon.awscdk.services.eks.CfnCluster.ClusterLoggingProperty;
@@ -17,10 +17,6 @@
 import software.amazon.awscdk.services.eks.CfnAccessEntry.AccessScopeProperty;
 import software.amazon.awscdk.services.eks.CfnAccessEntry.AccessPolicyProperty;
 import software.amazon.awscdk.services.eks.CfnPodIdentityAssociation;
-import software.amazon.awscdk.services.ec2.SubnetType;
-import software.amazon.awscdk.services.ec2.SubnetSelection;
-import software.amazon.awscdk.services.ec2.ISubnet;
-import software.amazon.awscdk.services.ec2.ISecurityGroup;
 import software.amazon.awscdk.services.iam.ManagedPolicy;
 import software.amazon.awscdk.services.iam.Role;
 import software.amazon.awscdk.services.iam.ServicePrincipal;
@@ -188,4 +184,18 @@ public void createPodIdentity(final String principalArn, final String clusterNam
             .build();
         podIdentityAssociation.getNode().addDependency(cluster);
     }
+
+    // Get the default cluster security group
+    public String getClusterSecurityGroupId() {
+        return cluster.getAttrClusterSecurityGroupId();
+    }
+
+    // Get the default cluster security group as ISecurityGroup
+    public ISecurityGroup getClusterSecurityGroup() {
+        return SecurityGroup.fromSecurityGroupId(
+                this,
+                "ImportedClusterSecurityGroup",
+                cluster.getAttrClusterSecurityGroupId()
+        );
+    }
 }

infrastructure/cdk/src/main/java/com/unicorn/core/InfrastructureLambdaBedrock.java

@@ -2,10 +2,7 @@
 
 import com.unicorn.constructs.EksCluster;
 import software.amazon.awscdk.*;
-import software.amazon.awscdk.services.ec2.IVpc;
-import software.amazon.awscdk.services.ec2.SecurityGroup;
-import software.amazon.awscdk.services.ec2.SubnetSelection;
-import software.amazon.awscdk.services.ec2.SubnetType;
+import software.amazon.awscdk.services.ec2.*;
 import software.amazon.awscdk.services.iam.*;
 import software.amazon.awscdk.services.lambda.Code;
 import software.amazon.awscdk.services.lambda.Function;
@@ -31,10 +28,33 @@ public InfrastructureLambdaBedrock(Construct scope, String id, String region, Bu
         // Create a security group for the Lambda function
         SecurityGroup lambdaSg = SecurityGroup.Builder.create(this, "LambdaSecurityGroup")
                 .vpc(vpc)
+                .securityGroupName("unicornstore-thread-dump-lambda-sg")
                 .description("Security group for Thread Dump Lambda function")
                 .allowAllOutbound(true)
                 .build();
 
+        // Allow Lambda to communicate with EKS API server
+        // The Kubernetes API typically runs on port 443 (HTTPS)
+        eksCluster.getClusterSecurityGroup().addIngressRule(
+                Peer.securityGroupId(lambdaSg.getSecurityGroupId()),
+                Port.tcp(443),
+                "Allow Lambda access to Kubernetes API"
+        );
+
+        // Allow Lambda to reach EKS cluster
+        lambdaSg.addEgressRule(
+                Peer.securityGroupId(eksCluster.getClusterSecurityGroup().getSecurityGroupId()),
+                Port.tcp(443),
+                "Allow Lambda to reach Kubernetes API"
+        );
+
+        // Allow EKS cluster to respond back to Lambda
+        eksCluster.getClusterSecurityGroup().addIngressRule(
+                Peer.securityGroupId(lambdaSg.getSecurityGroupId()),
+                Port.tcp(443),
+                "Allow Lambda access to Kubernetes API"
+        );
+
         // IAM Role for Bedrock
         Role bedrockRole = Role.Builder.create(this, "BedrockAccessRole")
                 .assumedBy(new ServicePrincipal("bedrock.amazonaws.com"))