ALBのルーティングを応用してレガシーWEBシステムにモダンなサブシステムを導入する 3. ALB/Kinesis編

  private readonly getListener = (): void => {
    this.listener = elbv2.ApplicationListener.fromApplicationListenerAttributes(
      this.scope,
      `${this.appId}-listener`,
      {
        listenerArn: `arn:aws:elasticloadbalancing:${this.region}:${this.account}:listener/app/${this.listenerId}`,
        securityGroup: this.securityGroup,
      }
    );
  };

  private readonly addTarget = (): void => {
    const targetGroupId = `${this.appId}-tg`;
    this.targetGroup = new elbv2.ApplicationTargetGroup(
      this.scope,
      targetGroupId,
      {
        healthCheck: {
          enabled: true,
          healthyHttpCodes: "200",
          path: this.healthcheckPath,
          port: "80",
          protocol: elbv2.Protocol.HTTP,
          timeout: cdk.Duration.seconds(this.healthCheckTimeout),
          interval: cdk.Duration.seconds(this.healthCheckInterval),
        },
        port: 80,
        protocol: elbv2.ApplicationProtocol.HTTP,
        protocolVersion: elbv2.ApplicationProtocolVersion.HTTP1,
        targets: [this.ecsWrapper.service],
        vpc: this.vpcWrapper.vpc,
        targetGroupName: targetGroupId,
      }
    );

    this.listener.addTargetGroups(`${this.appId}-listener-tg`, {
      targetGroups: [this.targetGroup],
      conditions: [
        elbv2.ListenerCondition.pathPatterns(this.listenerRulePathPatterns),
      ],
      priority: this.listenerRulePriority,
    });
  };

  private readonly createLogGroup = (): void => {
    const logGroupId = `${this.appId}-task-definition-log-group`;
    this.logGroup = new logs.LogGroup(this.scope, logGroupId, {
      logGroupName: logGroupId,
      retention: logs.RetentionDays.TWO_WEEKS,
    });
  };

  private readonly createLogDriver = (): void => {
    this.logDriver = new ecs.AwsLogDriver({
      streamPrefix: this.containerName,
      mode: ecs.AwsLogDriverMode.NON_BLOCKING,
      logGroup: this.logGroup,
    });
  };

  private readonly addContainer = (): void => {
    const image = ecs.EcrImage.fromDockerImageAsset(
      this.ecrWrapper.dockerImageAsset
    );
    this.taskDefinition.addContainer(this.containerName, {
      image,
      containerName: this.containerName,
      cpu: this.cpu,
      memoryLimitMiB: this.memoryLimitMiB,
      portMappings: [
        {
          containerPort: 80,
        },
      ],
      logging: this.logDriver,
    });

  private readonly createSourceStream = (): void => {
    const sourceStreamId = `${this.appId}-source-stream`;
    this.scourceStream = new kinesis.Stream(this.scope, sourceStreamId, {
      streamName: sourceStreamId,
      streamMode: kinesis.StreamMode.ON_DEMAND,
    });
  };

  private readonly addSubscriptionFilter = (): void => {
    const filterId = `${this.appId}-filter`;
    this.taskDefinitionWrapper.logGroup.addSubscriptionFilter(filterId, {
      filterName: filterId,
      destination: new logsDestinations.KinesisDestination(this.scourceStream),
      filterPattern: logs.FilterPattern.allEvents(),
    });
  };

  private readonly createRole = (): void => {
    const roleId = `${this.appId}-delivery-stream-role`;
    this.role = new iam.Role(this.scope, roleId, {
      assumedBy: new iam.ServicePrincipal("firehose.amazonaws.com"),
      roleName: roleId,
    });
    this.grantedByStream = this.scourceStream.grant(
      this.role,
      "kinesis:DescribeStream",
      "kinesis:GetShardIterator",
      "kinesis:GetRecords"
    );
    this.role.addToPolicy(
      new iam.PolicyStatement({
        actions: [
          "s3:AbortMultipartUpload",
          "s3:GetBucketLocation",
          "s3:GetObject",
          "s3:ListBucket",
          "s3:ListBucketMultipartUploads",
          "s3:PutObject",
        ],
        effect: iam.Effect.ALLOW,
        resources: [
          this.s3Wrapper.bucket.bucketArn,
          `${this.s3Wrapper.bucket.bucketArn}/*`,
        ],
      })
    );
    this.role.addToPolicy(
      new iam.PolicyStatement({
        actions: ["logs:PutLogEvents"],
        effect: iam.Effect.ALLOW,
        resources: [this.taskDefinitionWrapper.logGroup.logGroupArn],
      })
    );
  };

  private readonly createDeliveryStream = (): void => {
    const deliveryStreamId = `${this.appId}-delivery-stream`;
    const deliveryStream = new kinesisfirehose.CfnDeliveryStream(
      this.scope,
      deliveryStreamId,
      {
        deliveryStreamName: deliveryStreamId,
        deliveryStreamType: "KinesisStreamAsSource",
        kinesisStreamSourceConfiguration: {
          kinesisStreamArn: this.scourceStream.streamArn,
          roleArn: this.role.roleArn,
        },
        s3DestinationConfiguration: {
          bucketArn: this.s3Wrapper.bucket.bucketArn,
          roleArn: this.role.roleArn,
        },
      }
    );
    this.grantedByStream.applyBefore(deliveryStream);
  };