Skip to content

Commit be5d2f5

Browse files
dineshSajwandineshSajwan
authored
feat(vpcendpoint): added nat gateway for lambda and removed loggroup check for summarization (#757)
1 parent 163d015 commit be5d2f5

File tree

10 files changed

+13715
-846
lines changed

10 files changed

+13715
-846
lines changed

‎package-lock.json‎

Lines changed: 12846 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎src/common/helpers/vpc-helper.ts‎

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,7 @@ export function buildVpc(scope: Construct, props: BuildVpcProps): IVpc {
112112
return props?.existingVpc;
113113
}
114114

115-
let defaultVpcProps = createDefaultIsolatedVpcProps();
115+
let defaultVpcProps = createDefaultVpcProps();
116116

117117
let cumulativeProps: VpcProps = defaultVpcProps;
118118

@@ -229,16 +229,27 @@ function AddInterfaceEndpoint(scope: Construct, vpc: IVpc, service: EndpointDefi
229229
});
230230
}
231231

232-
export function createDefaultIsolatedVpcProps(): VpcProps {
232+
export function createDefaultVpcProps(): VpcProps {
233233
return {
234-
natGateways: 0,
235234
subnetConfiguration: [
236235
{
237-
cidrMask: 18,
238-
name: 'isolated',
236+
cidrMask: 24,
237+
name: 'public',
238+
subnetType: SubnetType.PUBLIC,
239+
},
240+
{
241+
cidrMask: 24,
242+
name: 'private_isolated',
239243
subnetType: SubnetType.PRIVATE_ISOLATED,
240244
},
245+
{
246+
cidrMask: 24,
247+
name: 'private_egress',
248+
subnetType: SubnetType.PRIVATE_WITH_EGRESS,
249+
},
241250
],
251+
ipAddresses: ec2.IpAddresses.cidr('10.0.0.0/16'),
252+
242253
} as VpcProps;
243254
}
244255

‎src/patterns/gen-ai/aws-qa-appsync-opensearch/index.ts‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -221,7 +221,6 @@ export class QaAppsyncOpensearch extends BaseClass {
221221
vpc_helper.AddAwsServiceEndpoint(scope, this.vpc, [
222222
vpc_helper.ServiceEndpointTypeEnum.S3,
223223
vpc_helper.ServiceEndpointTypeEnum.BEDROCK_RUNTIME,
224-
vpc_helper.ServiceEndpointTypeEnum.APP_SYNC,
225224
]);
226225
}
227226

@@ -541,7 +540,7 @@ export class QaAppsyncOpensearch extends BaseClass {
541540
description: 'Lambda function for question answering',
542541
vpc: this.vpc,
543542
tracing: this.lambdaTracing,
544-
vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
543+
vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
545544
securityGroups: [this.securityGroup],
546545
memorySize: lambdaMemorySizeLimiter(this, 1_769 * 4),
547546
timeout: Duration.minutes(15),

‎src/patterns/gen-ai/aws-rag-appsync-stepfn-kendra/index.ts‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ import {
4141
} from '../../../common/helpers/kendra-helper';
4242
import { buildDockerLambdaFunction } from '../../../common/helpers/lambda-builder-helper';
4343
import { lambdaMemorySizeLimiter } from '../../../common/helpers/utils';
44-
import { AddAwsServiceEndpoint, buildVpc, createDefaultIsolatedVpcProps, ServiceEndpointTypeEnum } from '../../../common/helpers/vpc-helper';
44+
import { AddAwsServiceEndpoint, buildVpc, createDefaultVpcProps, ServiceEndpointTypeEnum } from '../../../common/helpers/vpc-helper';
4545
import { DockerLambdaCustomProps } from '../../../common/props/DockerLambdaCustomProps';
4646

4747
/**
@@ -243,7 +243,7 @@ export class RagAppsyncStepfnKendra extends BaseClass {
243243

244244
if (props.deployVpc || props.existingVpc) {
245245
this.vpc = buildVpc(scope, {
246-
defaultVpcProps: createDefaultIsolatedVpcProps(),
246+
defaultVpcProps: createDefaultVpcProps(),
247247
existingVpc: props.existingVpc,
248248
userVpcProps: props.vpcProps,
249249
constructVpcProps: {
@@ -396,7 +396,7 @@ export class RagAppsyncStepfnKendra extends BaseClass {
396396
description: 'Lambda function for pre-signed links generation',
397397
vpc: this.vpc,
398398
tracing: this.lambdaTracing,
399-
vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
399+
vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
400400
securityGroups: [this.securityGroup],
401401
memorySize: lambdaMemorySizeLimiter(this, 1_769),
402402
timeout: Duration.minutes(15),
@@ -419,7 +419,7 @@ export class RagAppsyncStepfnKendra extends BaseClass {
419419
description: 'Lambda function for Kendra sync job starting',
420420
vpc: this.vpc,
421421
tracing: this.lambdaTracing,
422-
vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
422+
vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
423423
securityGroups: [this.securityGroup],
424424
memorySize: lambdaMemorySizeLimiter(this, 1_769),
425425
timeout: Duration.minutes(15),
@@ -442,7 +442,7 @@ export class RagAppsyncStepfnKendra extends BaseClass {
442442
description: 'Lambda function for getting kendra sync status',
443443
vpc: this.vpc,
444444
tracing: this.lambdaTracing,
445-
vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
445+
vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
446446
securityGroups: [this.securityGroup],
447447
memorySize: lambdaMemorySizeLimiter(this, 1_769),
448448
timeout: Duration.minutes(15),
@@ -464,7 +464,7 @@ export class RagAppsyncStepfnKendra extends BaseClass {
464464
description: 'Lambda function for Kendra job status updates',
465465
vpc: this.vpc,
466466
tracing: this.lambdaTracing,
467-
vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
467+
vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
468468
securityGroups: [this.securityGroup],
469469
memorySize: lambdaMemorySizeLimiter(this, 1_769),
470470
timeout: Duration.minutes(15),
@@ -497,7 +497,7 @@ export class RagAppsyncStepfnKendra extends BaseClass {
497497
description: 'Lambda for starting execution',
498498
vpc: this.vpc,
499499
tracing: this.lambdaTracing,
500-
vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
500+
vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
501501
securityGroups: [this.securityGroup],
502502
memorySize: lambdaMemorySizeLimiter(this, 1_769),
503503
timeout: Duration.minutes(15),

‎src/patterns/gen-ai/aws-rag-appsync-stepfn-opensearch/index.ts‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -259,14 +259,12 @@ export class RagAppsyncStepfnOpensearch extends BaseClass {
259259
} else {
260260
this.vpc = vpc_helper.buildVpc(scope, {
261261
defaultVpcProps: props?.vpcProps,
262-
vpcName: 'ragAppSyncStepfnOsVpc',
262+
vpcName: 'ragAppSyncOsVpc',
263263
});
264-
265264
//vpc endpoints
266265
vpc_helper.AddAwsServiceEndpoint(scope, this.vpc, [
267266
vpc_helper.ServiceEndpointTypeEnum.S3,
268267
vpc_helper.ServiceEndpointTypeEnum.BEDROCK_RUNTIME,
269-
vpc_helper.ServiceEndpointTypeEnum.APP_SYNC,
270268
]);
271269
}
272270

@@ -461,7 +459,7 @@ export class RagAppsyncStepfnOpensearch extends BaseClass {
461459
description: 'Lambda function for validating input files formats',
462460
vpc: this.vpc,
463461
tracing: this.lambdaTracing,
464-
vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
462+
vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
465463
securityGroups: [this.securityGroup],
466464
memorySize: lambdaMemorySizeLimiter(this, 1_769 * 4),
467465
timeout: Duration.minutes(15),
@@ -614,7 +612,7 @@ export class RagAppsyncStepfnOpensearch extends BaseClass {
614612
description: 'Lambda function for converting files from their input format to text',
615613
vpc: this.vpc,
616614
tracing: this.lambdaTracing,
617-
vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
615+
vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
618616
securityGroups: [this.securityGroup],
619617
memorySize: lambdaMemorySizeLimiter(this, 1_769 * 4),
620618
timeout: Duration.minutes(15),
@@ -746,7 +744,7 @@ export class RagAppsyncStepfnOpensearch extends BaseClass {
746744
description: 'Lambda function for creating documents chunks, embeddings and storing them in Amazon Opensearch',
747745
vpc: this.vpc,
748746
tracing: this.lambdaTracing,
749-
vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
747+
vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
750748
securityGroups: [this.securityGroup],
751749
memorySize: lambdaMemorySizeLimiter(this, 1_769 * 4),
752750
timeout: Duration.minutes(15),

‎src/patterns/gen-ai/aws-summarization-appsync-stepfn/index.ts‎

Lines changed: 10 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -258,7 +258,10 @@ export class SummarizationAppsyncStepfn extends BaseClass {
258258
if (props?.existingVpc) {
259259
this.vpc = props.existingVpc;
260260
} else {
261-
this.vpc = new ec2.Vpc(this, 'Vpc', props.vpcProps);
261+
this.vpc = vpc_helper.buildVpc(scope, {
262+
defaultVpcProps: props?.vpcProps,
263+
vpcName: 'sumAppSyncStepFnVpc',
264+
});
262265
// vpc endpoints
263266
vpc_helper.AddAwsServiceEndpoint(scope, this.vpc, [vpc_helper.ServiceEndpointTypeEnum.S3,
264267
vpc_helper.ServiceEndpointTypeEnum.BEDROCK_RUNTIME, vpc_helper.ServiceEndpointTypeEnum.REKOGNITION]);
@@ -800,6 +803,11 @@ export class SummarizationAppsyncStepfn extends BaseClass {
800803
const logGroupName = generatePhysicalNameV2(this, logGroupPrefix,
801804
{ maxLength: maxGeneratedNameLength, lower: true });
802805

806+
const summarizationLogGroup = new logs.LogGroup(this, 'summarizationLogGroup', {
807+
logGroupName: logGroupName,
808+
retention: logs.RetentionDays.ONE_WEEK,
809+
removalPolicy: RemovalPolicy.DESTROY,
810+
});
803811

804812
// step function definition
805813
const definition = inputValidationTask.next(
@@ -816,7 +824,7 @@ export class SummarizationAppsyncStepfn extends BaseClass {
816824
definitionBody: sfn.DefinitionBody.fromChainable(definition),
817825
timeout: Duration.minutes(15),
818826
logs: {
819-
destination: getLoggroup(this, logGroupName),
827+
destination: summarizationLogGroup,
820828
level: sfn.LogLevel.ALL,
821829
},
822830
tracingEnabled: this.enablexray,
@@ -875,17 +883,3 @@ export class SummarizationAppsyncStepfn extends BaseClass {
875883
}
876884
}
877885

878-
function getLoggroup(stack: Construct, logGroupName: string) {
879-
const existingLogGroup = logs.LogGroup.fromLogGroupName(
880-
stack, 'ExistingSummarizationLogGroup', logGroupName);
881-
882-
if (existingLogGroup.logGroupName) {
883-
return existingLogGroup;
884-
} else {
885-
return new logs.LogGroup(stack, 'SummarizationLogGroup', {
886-
logGroupName: logGroupName,
887-
retention: logs.RetentionDays.ONE_MONTH,
888-
removalPolicy: RemovalPolicy.DESTROY,
889-
});
890-
}
891-
}

‎test/patterns/gen-ai/aws-rag-appsync-stepfn-kendra/vpc-helper.test.ts‎

Lines changed: 23 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ import { App, Stack, Aspects } from 'aws-cdk-lib';
1414
import { Match, Template } from 'aws-cdk-lib/assertions';
1515
import { Vpc } from 'aws-cdk-lib/aws-ec2';
1616
import { AwsSolutionsChecks } from 'cdk-nag';
17-
import { buildVpc, AddAwsServiceEndpoint, createDefaultIsolatedVpcProps, ServiceEndpointTypeEnum } from '../../../../src/common/helpers/vpc-helper';
17+
import { buildVpc, AddAwsServiceEndpoint, createDefaultVpcProps, ServiceEndpointTypeEnum } from '../../../../src/common/helpers/vpc-helper';
1818

1919
describe('VPC Utilities', () => {
2020
let app: App;
@@ -28,7 +28,7 @@ describe('VPC Utilities', () => {
2828

2929
describe('buildVpc', () => {
3030
it('creates a VPC with default isolated configuration', () => {
31-
buildVpc(stack, { defaultVpcProps: createDefaultIsolatedVpcProps(), vpcName: 'testVpc' });
31+
buildVpc(stack, { defaultVpcProps: createDefaultVpcProps(), vpcName: 'testVpc' });
3232

3333
// Assert VPC is created with expected properties
3434
const template = Template.fromStack(stack);
@@ -39,14 +39,30 @@ describe('VPC Utilities', () => {
3939

4040
// Assert subnets are created as expected
4141
template.hasResourceProperties('AWS::EC2::Subnet', {
42-
CidrBlock: Match.stringLikeRegexp('^(10\.0\.0\.0|10\.0\.64\.0)\/18$'),
43-
MapPublicIpOnLaunch: false,
44-
VpcId: Match.anyValue(), // Use anyValue if you're not asserting the exact VPC ID
45-
// If you need to assert on Tags, ensure they match the expected structure
42+
CidrBlock: Match.stringLikeRegexp('^10\.0\.[0-5]\.0\/24$'),
43+
VpcId: Match.anyValue(),
4644
Tags: Match.arrayWith([
47-
Match.objectLike({ Key: 'aws-cdk:subnet-name', Value: 'isolated' }),
45+
Match.objectLike({
46+
Key: 'aws-cdk:subnet-name',
47+
Value: Match.stringLikeRegexp('^(private_isolated|private_egress|public)$'),
48+
}),
4849
]),
4950
});
51+
52+
// Assert that we have the expected number of subnets
53+
template.resourceCountIs('AWS::EC2::Subnet', 6);
54+
55+
// Assert that we have subnets with each expected type
56+
['private_isolated', 'private_egress', 'public'].forEach(subnetType => {
57+
template.hasResourceProperties('AWS::EC2::Subnet', {
58+
Tags: Match.arrayWith([
59+
Match.objectLike({
60+
Key: 'aws-cdk:subnet-name',
61+
Value: subnetType,
62+
}),
63+
]),
64+
});
65+
});
5066
});
5167

5268
});

‎test/patterns/gen-ai/aws-rag-appsync-stepfn-opensearch/aws-rag-appsync-stepfn-opensearch-serverless.test.ts‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,10 +49,15 @@ describe('RAG Appsync Stepfn Open search construct', () => {
4949
cidrMask: 24,
5050
},
5151
{
52-
name: 'private',
52+
name: 'isolated',
5353
subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
5454
cidrMask: 24,
5555
},
56+
{
57+
name: 'private',
58+
subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
59+
cidrMask: 24,
60+
},
5661
],
5762
},
5863
);

‎test/patterns/gen-ai/aws-rag-appsync-stepfn-opensearch/aws-rag-appsync-stepfn-opensearch.test.ts‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,10 +50,15 @@ describe('RAG Appsync Stepfn Open search construct', () => {
5050
cidrMask: 24,
5151
},
5252
{
53-
name: 'private',
53+
name: 'isolated',
5454
subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
5555
cidrMask: 24,
5656
},
57+
{
58+
name: 'private',
59+
subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
60+
cidrMask: 24,
61+
},
5762
],
5863
},
5964
);

0 commit comments

Comments
 (0)