Containers
Build and deploy a Spring Boot application to AWS App Runner with a CI/CD pipeline using Terraform
Introduction
Spring Boot is a leading open-source framework for building Java-based web applications. It is designed to get you up and running as quickly as possible, with minimal configuration. Its opinionated take on production-ready applications makes implementing modern best practices intuitive and easy.
AWS App Runner is a fully managed container application service that makes it easy for customers without any prior containers or infrastructure experience to build, deploy, and run containerized web applications and APIs. Customers simply provide source code or a container image, and App Runner automatically builds and deploys the web application, load-balances traffic, and scales on-demand.
In this blog post, we will show how to run a Spring Boot application at scale on AWS App Runner and set up a pipeline for automatic build and deployment. The sample Spring Boot application used in this blog post is the Spring PetClinic application. The PetClinic application is chosen to demonstrate the use of Spring Boot, Spring MVC, and Spring Data in building a simple but powerful database-oriented application. The PetClinic application persists its data in Amazon Relational Database Service (Amazon RDS). The infrastructure is provisioned and managed with Terraform.
Architecture
Prerequisites
Before you build the whole infrastructure, including your CI/CD pipeline, you will need to meet the following prerequisites.
1. AWS account
Ensure you have access to an AWS account and a set of credentials with administrator permissions. Note: In a production environment, we would recommend locking permissions down to the bare minimum needed to operate the pipeline.
2. Create an AWS Cloud9 environment
Log in to the AWS Management Console and search for AWS Cloud9 services in the search bar. Select AWS Cloud9 and create an AWS Cloud9 environment in the us-east-1
region based on Amazon Linux 2.
Solution
Configure the AWS Cloud9 environment
Launch the AWS Cloud9 IDE. Close the Welcome
tab and open a new Terminal
tab.
Create and attach an IAM role for your AWS Cloud9 instance
By default, AWS Cloud9 manages temporary IAM credentials for you. Unfortunately, these are incompatible with Terraform. To get around this, you need to disable AWS Cloud9 temporary credentials, and create and attach an IAM role for your AWS Cloud9 instance.
- Follow this deep link to create an IAM role with Administrator access.
- Confirm that AWS service and EC2 are selected, then choose Next to view permissions.
- Confirm that AdministratorAccess is checked, then choose Next: Tags to assign tags.
- Take the defaults, and choose Next: Review to review.
- Enter workshop-admin for the Name, and choose Create role.
- Follow this deep link to find your AWS Cloud9 EC2 instance.
- Select the instance, then choose Actions / Instance settings / Modify IAM role. Note: If you cannot find this menu option, look under Actions / Security / Modify IAM role
- Choose workshop-admin from the IAM role drop-down, and select Apply.
- Return to your workspace and click the gear icon (in top right corner), or click to open a new tab and choose Open preferences.
- Select AWS settings.
- Turn off AWS managed temporary credentials.
- Close the Preferences tab.
- In the AWS Cloud9 terminal pane, execute the command:
- As a final check, use the GetCallerIdentity CLI command to validate that the AWS Cloud9 IDE is using the correct IAM role.
Upgrade awscli
Ensure you are running the latest version of AWS CLI:
Run aws configure
to configure your region. Leave all the other fields blank. You should have something like:
Install Terraform
Download and install Terraform:
Verify that you can run Terraform:
Install Apache Maven
Set up Apache Maven
Paste the following lines at the end of the file:
Verify the Apache Maven installation:
Clone workshop repository
Clone the source code repository:
Package the application using Apache Maven
The first time you execute this (or any other) command, Maven will need to download the plugins and related dependencies it needs to fulfill the command. From a clean installation of Maven, this can take some time (note: in the output above, it took almost five minutes). If you execute the command again, Maven will now have what it needs, so it won’t need to download anything new and will be able to execute the command quicker.
The compiled java classes were placed in spring-petclinic/target/classes, which is another standard convention employed by Maven. By using the standard conventions, the POM above is small, and you haven’t had to tell Maven explicitly where any of your sources are or where the output should go. By following the standard Maven conventions, you can do a lot with little effort.
Build and tag the Petclinic docker image
From the petclinic directory:
Run Petclinic application locally
Run the following inside the AWS Cloud9 terminal:
This will run the application using container port of 80 and will expose the application to host port of 8080. Choose Preview from the top menu and then choose Preview Running Application. It will open a browser displaying the Spring Petclinic application.
Push petclinic docker image to Amazon ECR
Run the following inside the AWS Cloud9 terminal:
Build the infrastructure and pipeline
We shall use Terraform to build the previous architecture, including the AWS CodePipeline.
Note: This workshop will create chargeable resources in your account. When finished, please make sure you clean up resources as instructed at the end.
Set up SSM parameter for DB password
Edit Terraform variables
Edit terraform.tfvars
, leave the aws_profile
as "default"
, and set aws_region
to the correct value for your environment.
Build
Initialize Terraform:
Build the infrastructure and pipeline using Terraform:
Terraform will display an action plan. When asked whether you want to proceed with the actions, enter yes
.
Wait for Terraform to complete the build before proceeding. It will take few minutes to complete “terraform apply.”
Explore the stack you have built
Once the build is complete, you can explore your environment using the AWS console:
- View the RDS database using the Amazon RDS console.
- View the Amazon ECR repo using the Amazon ECR console.
- View the AWS CodeCommit repo using the AWS CodeCommit console.
- View the AWS CodeBuild project using the AWS CodeBuild console.
- View the pipeline using the AWS CodePipeline console.
Note that your pipeline starts in a failed state. That is because there is no code to build in the CodeCommit repo! In the next step, you will push the petclinic app into the repo to trigger the pipeline.
Explore the App Runner service
The details of the App Runner service are in ~/environment/aws-apprunner-terraform/terraform/services.tf
Deploy petclinic application using the pipeline
You will now use git to push the petclinic application through the pipeline.
Set up a local git repo for the petclinic application
Start by switching to the petclinic
directory:
Set up your git username and email address:
Now create a local git repo for petclinic as follows:
Set up the remote CodeCommit repo
An AWS CodeCommit repo was built as part of the pipeline you created. You will now set this up as a remote repo for your local petclinic repo.
For authentication purposes, you can use the AWS IAM git credential helper to generate git credentials based on your IAM role permissions. Run:
From the output of the Terraform build, note the Terraform output: source_repo_clone_url_http
.
Set this up as a remote for your git repo as follows:
You should see something like:
Trigger the pipeline
To trigger the pipeline, push the master branch to the remote as follows:
The pipeline will pull the code, build the docker image, push it to Amazon ECR, and deploy it to your Amazon ECS cluster. This will take a few minutes. You can monitor the pipeline in the AWS CodePipeline console.
Test the application
From the output of the Terraform build, note the Terraform output apprunner_service_url
.
Use this in your browser to access the application.
Push a change through the pipeline and retest
The pipeline can now be used to deploy any changes to the application. You can try this out by changing the welcome message as follows:
Change the value for the welcome string, for example, to “Hello.” Commit the change:
Push the change to trigger pipeline:
As before, you can use the console to observe the progression of the change through the pipeline. Once done, verify that the application is working with the modified welcome message.
Cleaning up
Tearing down the stack
Make sure that you remember to tear down the stack when finished to avoid unnecessary charges. You can free up resources as follows:
When prompted, enter yes
to allow the stack termination to proceed. Once complete, note that you will have to manually empty and delete the S3 bucket used by the pipeline.
Delete the Amazon ECR repo
Conclusion
AWS App Runner makes it easy to run a secure web application at scale with no prior infrastructure experience required such as server configuration, networking, load balancing, autoscaling or safe deployment. Resources and infrastructure components provisioned for your web application are fully managed by AWS and benefit from our security and operational best practices, which enables you to stay completely focused on your application.
The example project used by this blog post demonstrates the set-up of running a Spring Boot application on App Runner, also providing a great stepping stone to start developing your own Spring-based web applications. Check out the AWS App Runner documentation for further information on how to use App Runner, as well as the AWS App Runner developer guide, which includes information on how to get started, best practices, and troubleshooting. You may also evaluate our roadmap and suggest new features on the AWS App Runner Roadmap hosted on GitHub.