AWS CDK Infrastructure
Relevant source files
The following files were used as context for generating this wiki page:
The AWS Cloud Development Kit (CDK) infrastructure provides a strongly typed TypeScript definition for the AtlasCleanAI Enterprise platform. It automates the deployment of a production-ready environment including networking, container orchestration, databases, and security components. This system ensures environment isolation between staging and production while maintaining architectural consistency.
This infrastructure supports the core platform capabilities such as customer booking, workforce management, and AI-powered scheduling. It creates a multi-tier network architecture that isolates public-facing ingress from private application logic and data persistence layers.
Sources: README.md:1-20, infrastructure/aws/cdk/lib/atlasclean-stack.ts:25-30
Core Infrastructure Architecture
The CDK implementation defines a three-tier VPC architecture. It distributes resources across multiple availability zones to ensure high availability.
Network Topology
The VPC contains three distinct subnet types:
- Public Subnets: Host the Application Load Balancer (ALB) and NAT Gateways.
- Application Subnets: Host the ECS Fargate services. These subnets have egress access to the internet via NAT Gateways.
- Data Subnets: Isolated subnets without internet access, hosting the RDS PostgreSQL instance and ElastiCache Redis replication group.
The diagram shows the logical flow of traffic from the public internet through the load balancer to the application tier, and the isolated communication between the application and data tiers.
Sources: infrastructure/aws/cdk/lib/atlasclean-stack.ts:32-55, infrastructure/terraform/main.tf:46-95
Resource Configuration and Scaling
The infrastructure adjusts its capacity and protection levels based on the stage property (staging vs. production).
Compute and Orchestration
The system uses Amazon ECS with AWS Fargate for serverless container execution.
- Cluster: Enables Container Insights V2 and Fargate capacity providers.
- Service: Runs a Node.js backend container on ARM64 Linux.
- Auto-scaling: Scales tasks based on CPU utilization, targeting 60% usage.
| Component | Staging Configuration | Production Configuration |
|---|---|---|
| NAT Gateways | 1 | 2 |
| ECS Task Count | 1 (min) / 3 (max) | 2 (min) / 8 (max) |
| ECS CPU/Memory | 512 / 1024 MiB | 1024 / 2048 MiB |
| RDS Multi-AZ | Disabled | Enabled |
| Redis Nodes | 1 | 2 |
| Deletion Protection | Disabled | Enabled |
Sources: infrastructure/aws/cdk/lib/atlasclean-stack.ts:57-63, infrastructure/aws/cdk/lib/atlasclean-stack.ts:168-185, infrastructure/aws/cdk/lib/atlasclean-stack.ts:203-214
Data Persistence Layers
The infrastructure provisions a managed PostgreSQL database and a Redis cache.
- RDS (PostgreSQL 15.5): Uses T4g.medium instances in production with 100GB to 500GB of auto-scaling storage. It exports logs to CloudWatch.
- ElastiCache (Redis 7.1): Implements a replication group with transit and at-rest encryption enabled.
Sources: infrastructure/aws/cdk/lib/atlasclean-stack.ts:98-124, infrastructure/aws/cdk/lib/atlasclean-stack.ts:126-150
Security and Identity Management
Security is implemented through least-privilege IAM roles, security groups, and secret management.
Secrets Management
The stack creates and manages secrets via AWS Secrets Manager:
- JWT Secrets: Randomly generated strings for access and refresh tokens.
- Database Credentials: Managed credentials for the
atlascleandatabase user.
IAM Roles
- Task Execution Role: Grants ECS permission to pull images from ECR and read secrets from Secrets Manager.
- Task Role: Provides the running application container with access to required secrets.
The diagram illustrates how secrets are securely retrieved and injected into the application containers via IAM roles.
Sources: infrastructure/aws/cdk/lib/atlasclean-stack.ts:65-81, infrastructure/aws/cdk/lib/atlasclean-stack.ts:152-167
Ingress and Traffic Control
The Application Load Balancer manages external access:
- HTTPS: If a
certificateArnis provided, the listener uses TLS 1.3 and redirects HTTP traffic to HTTPS. - Route53: Creates A-records for the application domain (e.g.,
production.domain.comorstaging.domain.com). - Health Checks: Monitors the
/healthendpoint to ensure container availability.
Sources: infrastructure/aws/cdk/lib/atlasclean-stack.ts:192-237
Deployment Workflows
The CDK project includes npm scripts to handle synthesis and deployment for different environments.
"scripts": {
"build": "tsc --pretty",
"synth": "cdk synth --app \"npx ts-node --prefer-ts-exts bin/atlasclean.ts\"",
"deploy:staging": "cdk deploy AtlasClean-staging --require-approval never -c stage=staging",
"deploy:production": "cdk deploy AtlasClean-production --require-approval never -c stage=production"
}
Sources: infrastructure/aws/cdk/package.json:6-11
Summary
The AWS CDK infrastructure provides a robust, scalable, and secure foundation for the AtlasCleanAI Enterprise platform. By defining infrastructure as code in TypeScript, it ensures that staging and production environments remain synchronized while adhering to AWS best practices for high availability and security isolation. The stack integrates container orchestration (ECS), relational data (RDS), and fast caching (Redis) into a unified deployment unit managed via GitHub Actions.
Sources: README.md:120-130, infrastructure/aws/cdk/lib/atlasclean-stack.ts:1-20