ファイルアップロードの理想像を求めて 1. システム概要編

{
  "name": "cdk-test-app",
  "version": "0.1.0",
  "bin": {
    "cdk-test-app": "bin/cdk-test-app.js"
  },
  "scripts": {
    "build": "tsc",
    "watch": "tsc -w",
    "test": "jest",
    "cdk": "cdk"
  },
  "devDependencies": {
    "@types/jest": "^29.4.0",
    "@types/node": "18.14.6",
    "aws-cdk": "2.78.0",
    "jest": "^29.5.0",
    "ts-jest": "^29.0.5",
    "ts-node": "^10.9.1",
    "typescript": "~4.9.5"
  },
  "dependencies": {
    "@aws-sdk/client-s3": "^3.335.0",
    "@aws-sdk/s3-request-presigner": "^3.335.0",
    "@types/aws-lambda": "^8.10.115",
    "aws-cdk-lib": "2.78.0",
    "aws-lambda": "^1.0.7",
    "cdk-serverless-clamscan": "^2.4.240",
    "constructs": "^10.0.0",
    "source-map-support": "^0.5.21"
  }
}

import * as cdk from "aws-cdk-lib";
import { Construct } from "constructs";
import { Bucket, BucketEncryption } from "aws-cdk-lib/aws-s3";
import { RestApi, LambdaIntegration } from "aws-cdk-lib/aws-apigateway";
import { NodejsFunction } from "aws-cdk-lib/aws-lambda-nodejs";
import { LambdaDestination } from "aws-cdk-lib/aws-lambda-destinations";
import { join } from "path";
import { ServerlessClamscan } from "cdk-serverless-clamscan";
import * as cloudfront from "aws-cdk-lib/aws-cloudfront";
import { S3Origin } from "aws-cdk-lib/aws-cloudfront-origins";
import * as iam from "aws-cdk-lib/aws-iam";

export class CdkTestAppStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const inputBucket = this.createBucket("cdk-test-app-input-bucket");

    const outputBucket = this.createBucket("cdk-test-app-output-bucket");

    const api = new RestApi(this, "CdkTestAppApi");

    const fileResource = api.root.addResource("file");

    const fileGetLambda = this.createLambda(
      "fileGet",
      join(__dirname, "services", "file", "Get.ts"),
      { INPUT_BUCKET_NAME: inputBucket.bucketName }
    );
    inputBucket.grantWrite(fileGetLambda);
    const fileGetLambdaIntegration = new LambdaIntegration(fileGetLambda);
    fileResource.addMethod("GET", fileGetLambdaIntegration);

    const fileMoveLambda = this.createLambda(
      "fileMove",
      join(__dirname, "workers", "file", "Move.ts"),
      { OUTPUT_BUCKET_NAME: outputBucket.bucketName }
    );

    inputBucket.grantRead(fileMoveLambda);
    outputBucket.grantPut(fileMoveLambda);
    new ServerlessClamscan(this, "S3ClamAV", {
      buckets: [inputBucket],
      onResult: new LambdaDestination(fileMoveLambda),
    });

    const cloudFrontIdentity = new cloudfront.OriginAccessIdentity(
      this,
      "CdkTestAppIdentity"
    );
    const outputBucketPolicyStatement = new iam.PolicyStatement({
      actions: ["s3:GetObject"],
      effect: iam.Effect.ALLOW,
      principals: [
        new iam.CanonicalUserPrincipal(
          cloudFrontIdentity.cloudFrontOriginAccessIdentityS3CanonicalUserId
        ),
      ],
      resources: [`${outputBucket.bucketArn}/*`],
    });
    outputBucket.addToResourcePolicy(outputBucketPolicyStatement);

    new cloudfront.CloudFrontWebDistribution(this, "CdkTestAppDist", {
      originConfigs: [
        {
          s3OriginSource: {
            s3BucketSource: outputBucket,
            originAccessIdentity: cloudFrontIdentity,
          },
          behaviors: [
            {
              isDefaultBehavior: true,
              viewerProtocolPolicy:
                cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
            },
          ],
        },
      ],
    });
  }

  private createBucket = (name: string): Bucket => {
    const shortStackId = cdk.Fn.select(2, cdk.Fn.split("/", this.stackId));
    const suffix = cdk.Fn.select(4, cdk.Fn.split("-", shortStackId));

    const bucket = new Bucket(this, name, {
      encryption: BucketEncryption.S3_MANAGED,
      enforceSSL: true,
      bucketName: `${name}-${suffix}`,
      publicReadAccess: false,
      blockPublicAccess: {
        blockPublicAcls: true,
        blockPublicPolicy: true,
        ignorePublicAcls: true,
        restrictPublicBuckets: true,
      },
      versioned: true,
      removalPolicy: cdk.RemovalPolicy.DESTROY,
    });
    return bucket;
  };

  private createLambda = (
    id: string,
    entry: string,
    environment?: { [key: string]: string },
    handler?: string
  ): NodejsFunction =>
    new NodejsFunction(this, id, {
      entry,
      handler: handler || "handler",
      functionName: id,
      environment,
    });
}

import {
  APIGatewayProxyHandlerV2,
  APIGatewayProxyEventV2,
  APIGatewayProxyResultV2,
} from "aws-lambda";
import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";
import { getSignedUrl } from "@aws-sdk/s3-request-presigner";

const client = new S3Client({});
const INPUT_BUCKET_NAME = process.env.INPUT_BUCKET_NAME!;

export const handler: APIGatewayProxyHandlerV2 = async (
  event: APIGatewayProxyEventV2
): Promise<APIGatewayProxyResultV2> => {
  const result: APIGatewayProxyResultV2 = {
    statusCode: 200,
    body: JSON.stringify({}),
  };

  const command = new PutObjectCommand({
    Bucket: INPUT_BUCKET_NAME,
    Key: event.queryStringParameters!.filename,
  });
  const url = await getSignedUrl(client, command, {
    expiresIn: 60,
  });

  result.body = JSON.stringify({ url });

  return result;
};

import { Handler } from "aws-lambda";
import { S3Client, CopyObjectCommand } from "@aws-sdk/client-s3";
import { getSignedUrl } from "@aws-sdk/s3-request-presigner";

const client = new S3Client({});
const OUTPUT_BUCKET_NAME = process.env.OUTPUT_BUCKET_NAME!;

export const handler: Handler = async (event: any): Promise<any> => {
  const result = event.responsePayload.status === "CLEAN";

  console.log(event);
  console.log(`ウイルスチェック結果: 検知${result ? "なし" : "あり"}`);

  if (result) {
    const command = new CopyObjectCommand({
      Bucket: OUTPUT_BUCKET_NAME,
      Key: event.responsePayload.input_key,
      CopySource: `${event.responsePayload.input_bucket}/${event.responsePayload.input_key}`,
    });
    await client.send(command);
  }

  return result;
};