AWS CDK Infrastructure Project

A comprehensive multi-environment AWS infrastructure project built with AWS CDK (Cloud Development Kit) using Python. This project demonstrates best practices for deploying AWS resources across multiple environments (dev, staging, production) with security and cost optimization in mind.

📋 Table of Contents

• Overview
• Architecture
• Prerequisites
• Getting Started
• Project Structure
• Deployment
• Stack Documentation
• Environment Configuration
• Security Best Practices
• Cost Optimization
• Troubleshooting

🎯 Overview

This project provisions the following AWS resources:

• VPC Stack: Virtual Private Cloud with public, private, and isolated subnets
• EC2 Stack: EC2 instances with security groups and IAM roles
• S3 Stack: S3 buckets with encryption, versioning, and lifecycle policies
• DynamoDB Stack: DynamoDB tables with auto-scaling and point-in-time recovery
• Lambda Stack: Lambda functions with CloudWatch monitoring
• EKS Stack: Elastic Kubernetes Service cluster (optional, commented out by default due to cost)

Key Features

✅ Multi-Environment Support: Dev, Staging, and Production environments
✅ Security First: Encryption at rest, VPC isolation, IAM least privilege
✅ Cost Optimized: Environment-specific configurations for resource sizing
✅ Infrastructure as Code: Full CDK implementation with Python
✅ Monitoring: CloudWatch logs, alarms, and X-Ray tracing
✅ Compliance: VPC Flow Logs, S3 access logging, DynamoDB PITR

🏗️ Architecture

┌─────────────────────────────────────────────────────────────┐
│                         AWS Account                          │
│  ┌──────────────────────────────────────────────────────┐   │
│  │                    VPC (10.x.0.0/16)                 │   │
│  │  ┌────────────────┐  ┌──────────────┐               │   │
│  │  │ Public Subnet  │  │ Private      │               │   │
│  │  │                │  │ Subnet       │               │   │
│  │  │  - EC2 (dev)   │  │ - EC2        │               │   │
│  │  │  - NAT Gateway │  │ - EKS Nodes  │               │   │
│  │  └────────────────┘  └──────────────┘               │   │
│  │                                                       │   │
│  │  ┌────────────────┐                                  │   │
│  │  │ Isolated       │                                  │   │
│  │  │ Subnet         │                                  │   │
│  │  │ - Databases    │                                  │   │
│  │  └────────────────┘                                  │   │
│  └──────────────────────────────────────────────────────┘   │
│                                                              │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐     │
│  │   S3 Bucket  │  │  DynamoDB    │  │   Lambda     │     │
│  │ (Encrypted)  │  │   Table      │  │  Functions   │     │
│  └──────────────┘  └──────────────┘  └──────────────┘     │
└─────────────────────────────────────────────────────────────┘

📦 Prerequisites

Before you begin, ensure you have the following installed:

• Python 3.8+: Download
• pip: Python package manager (usually included with Python)
• AWS CLI (v2): Installation Guide
• AWS CDK (v2): npm install -g aws-cdk or installed globally
• Git: For version control

AWS Account Setup

1. AWS Account: Active AWS account with appropriate permissions
2. AWS Credentials: Configure AWS credentials locally

   aws configure

3. CDK Bootstrap: Bootstrap your AWS account for CDK

   cdk bootstrap aws://ACCOUNT-NUMBER/REGION

🚀 Getting Started

1. Clone the Repository

git clone <repository-url>
cd cdk-infra

2. Set Up Python Virtual Environment

# Create virtual environment
python3 -m venv .venv

# Activate virtual environment
# On macOS/Linux:
source .venv/bin/activate

# On Windows:
.venv\Scripts\activate

3. Install Python Dependencies

# Upgrade pip
pip install --upgrade pip

# Install dependencies
pip install -r requirements.txt

4. Review the Configuration

Edit config/environment_config.py to customize settings for your environments.

5. Synthesize CloudFormation Templates

Generate CloudFormation templates without deploying:

# Development environment
cdk synth --context environment=dev

# Staging environment
cdk synth --context environment=staging

# Production environment
cdk synth --context environment=prod

6. Deploy to AWS

# Deploy to development (using helper script)
./scripts/deploy.sh dev deploy

# Deploy to staging
./scripts/deploy.sh staging deploy

# Deploy to production (requires manual approval)
./scripts/deploy.sh prod deploy

# Or use CDK directly
cdk deploy --all --context environment=dev --require-approval never

📁 Project Structure

cdk-infra/
├── app.py                        # CDK app entry point
├── config/
│   ├── __init__.py
│   └── environment_config.py     # Environment-specific configurations
├── stacks/
│   ├── __init__.py
│   ├── vpc_stack.py              # VPC and networking infrastructure
│   ├── ec2_stack.py              # EC2 instances and security groups
│   ├── s3_stack.py               # S3 buckets with security settings
│   ├── dynamodb_stack.py         # DynamoDB tables
│   ├── lambda_stack.py           # Lambda functions
│   └── eks_stack.py              # EKS cluster (optional)
├── lambda/
│   └── index.js                  # Lambda function code
├── docs/
│   ├── VPC.md                    # VPC stack documentation
│   ├── EC2.md                    # EC2 stack documentation
│   ├── S3.md                     # S3 stack documentation
│   ├── DYNAMODB.md               # DynamoDB stack documentation
│   ├── LAMBDA.md                 # Lambda stack documentation
│   └── EKS.md                    # EKS stack documentation
├── scripts/
│   ├── deploy.sh                 # Deployment helper script
│   └── clean.sh                  # Cleanup script
├── cdk.json                      # CDK configuration
├── requirements.txt              # Python dependencies
├── requirements-dev.txt          # Development dependencies
├── setup.py                      # Python package setup
└── .gitignore                    # Git ignore rules (includes security)

🚢 Deployment

Environment-Specific Deployments

The project supports three environments with different configurations:

Environment	VPC CIDR	NAT Gateways	EC2 Type	DynamoDB Mode
Development	10.0.0.0/16	1	t3.micro	PAY_PER_REQUEST
Staging	10.1.0.0/16	2	t3.small	PAY_PER_REQUEST
Production	10.2.0.0/16	3	t3.medium	PROVISIONED

CDK Commands

# List all stacks
cdk list --context environment=dev

# Show differences before deployment
cdk diff --all --context environment=dev

# Deploy all stacks
cdk deploy --all --context environment=dev --require-approval never

# Deploy specific stack
cdk deploy cdk-infra-dev-VPC --context environment=dev

# Destroy all stacks (BE CAREFUL!)
cdk destroy --all --context environment=dev --force

Using Helper Scripts

# Deploy to an environment
./scripts/deploy.sh dev deploy      # Deploy to dev
./scripts/deploy.sh staging diff    # Show staging changes
./scripts/deploy.sh prod synth      # Generate prod templates
./scripts/deploy.sh dev destroy     # Destroy dev environment

# Clean up build artifacts
./scripts/clean.sh

Deployment Order

Stacks are deployed in the following order due to dependencies:

1. VPC Stack (no dependencies)
2. S3 Stack (no dependencies)
3. DynamoDB Stack (no dependencies)
4. EC2 Stack (depends on VPC)
5. Lambda Stack (depends on VPC, S3, DynamoDB)
6. EKS Stack (depends on VPC) - Optional, commented out by default

📚 Stack Documentation

Detailed documentation for each stack:

• VPC Stack - Network infrastructure and VPC configuration
• EC2 Stack - EC2 instances, security groups, and IAM roles
• S3 Stack - S3 buckets, encryption, and lifecycle policies
• DynamoDB Stack - DynamoDB tables and indexes
• Lambda Stack - Lambda functions and monitoring
• EKS Stack - Kubernetes cluster setup and configuration

⚙️ Environment Configuration

Environment configurations are managed in config/environment_config.py. Each environment has specific settings for:

• VPC CIDR blocks
• Number of Availability Zones
• NAT Gateway count
• Instance types and sizes
• DynamoDB billing modes
• Lambda memory and timeout
• EKS cluster sizing

Modifying Configurations

1. Edit config/environment_config.py
2. Activate virtual environment: source .venv/bin/activate
3. Review changes: cdk diff --all --context environment=dev
4. Deploy: ./scripts/deploy.sh dev deploy

🔒 Security Best Practices

This project implements AWS security best practices:

🛡️ Network Security

• Private subnets for application workloads
• Isolated subnets for databases
• VPC Flow Logs enabled
• Security groups with least privilege

🔐 Data Encryption

• S3 bucket encryption at rest (S3-managed keys)
• DynamoDB encryption at rest (AWS-managed keys)
• SSL/TLS enforcement for S3

🚫 Public Access Prevention

• Block all public S3 access
• EC2 in private subnets (production)
• EKS private endpoints (production)

📊 Monitoring & Compliance

• CloudWatch Logs for all resources
• Lambda X-Ray tracing
• DynamoDB Point-in-Time Recovery (production)
• S3 access logging (production)

🔑 IAM Best Practices

• Least privilege IAM policies
• SSM Session Manager instead of SSH keys
• Managed policies where appropriate

⚠️ Important Security Notes

WARNING: This is a public repository. The .gitignore file is configured to prevent sensitive data from being committed:

• Never commit AWS credentials
• Never commit private keys or certificates
• Never commit environment-specific secrets
• Review .gitignore before making commits

💰 Cost Optimization

Cost Management Tips

1. Use Development Environment for Testing: Dev environment uses smaller, cheaper resources
2. EKS is Expensive: EKS stack is commented out by default. Uncomment only when needed.
3. NAT Gateway Costs: Dev uses 1 NAT gateway, Staging uses 2, Prod uses 3
4. DynamoDB Billing: Dev/Staging use on-demand, Prod uses provisioned with auto-scaling
5. Clean Up Unused Resources: Use ./scripts/deploy.sh dev destroy to remove dev resources when not in use

Estimated Monthly Costs (us-east-1)

Environment	Estimated Cost*
Development	$50-100/month
Staging	$100-200/month
Production	$200-500/month

*Costs vary based on usage, data transfer, and optional EKS deployment ($70+/month for control plane alone)

Cost Monitoring

# Use AWS Cost Explorer
aws ce get-cost-and-usage \
  --time-period Start=2025-10-01,End=2025-10-31 \
  --granularity MONTHLY \
  --metrics "BlendedCost" "UnblendedCost"

🔧 Troubleshooting

Common Issues

1. CDK Bootstrap Error

Error: This stack uses assets, so the toolkit stack must be deployed to the environment

Solution: Bootstrap your account

cdk bootstrap aws://ACCOUNT-NUMBER/REGION

2. Insufficient Permissions

Error: User is not authorized to perform: iam:CreateRole

Solution: Ensure your IAM user/role has administrator access or specific CDK permissions

3. Resource Already Exists

Error: Bucket already exists

Solution: S3 bucket names must be globally unique. CDK generates unique names automatically, but check for conflicts.

4. Python Module Not Found

ModuleNotFoundError: No module named 'aws_cdk'

Solution: Activate virtual environment and install dependencies

source .venv/bin/activate
pip install -r requirements.txt

5. EKS Deployment Timeout

Error: Stack creation timed out

Solution: EKS can take 15-20 minutes to create. Increase timeout or wait for completion.

6. Virtual Environment Issues

Error: python3: command not found

Solution: Ensure Python 3.8+ is installed

python3 --version
# If not installed, download from python.org

2. Insufficient Permissions

Error: User is not authorized to perform: iam:CreateRole

Solution: Ensure your IAM user/role has administrator access or specific CDK permissions

3. Resource Already Exists

Error: Bucket already exists

Solution: S3 bucket names must be globally unique. CDK generates unique names automatically, but check for conflicts.

4. Python Module Errors

ModuleNotFoundError: No module named 'aws_cdk'

Solution: Activate virtual environment and install dependencies

source .venv/bin/activate
pip install -r requirements.txt

5. EKS Deployment Timeout

Error: Stack creation timed out

Solution: EKS can take 15-20 minutes to create. Increase timeout or wait for completion.

Getting Help

• AWS CDK Documentation: https://docs.aws.amazon.com/cdk/
• AWS CDK API Reference: https://docs.aws.amazon.com/cdk/api/v2/
• CDK Workshop: https://cdkworkshop.com/
• AWS Support: https://aws.amazon.com/support/

📝 License

This project is open source and available under the MIT License.

🤝 Contributing

Contributions are welcome! Please ensure:

1. No sensitive data in commits
2. Follow Python best practices (PEP 8)
3. Update documentation for changes
4. Test in dev environment first
5. Use type hints where appropriate

📞 Support

For issues and questions:

• Open a GitHub issue
• Check the troubleshooting section
• Review stack-specific documentation in /docs

---

Note: Always review generated CloudFormation templates before deploying to production. Use cdk synth --context environment=prod to generate and review templates.