通过用户数据引导 Amazon EC2 实例以运行 Python Web 应用程序

cdk --version

# 2.122.0 (build 7e77e02)

npm install -g aws-cdk

mkdir ec2-cdk
cd ec2-cdk
cdk init app --language typescript

# Output:

Applying project template app for typescript
# Welcome to your CDK TypeScript project

This is a blank project for CDK development with TypeScript.

The `cdk.json` file tells the CDK Toolkit how to execute your app.

## Useful commands

* `npm run build` compile typescript to js
* `npm run watch` watch for changes and compile
* `npm run test` perform the jest unit tests
* `cdk deploy` deploy this stack to your default AWS account/region
* `cdk diff` compare deployed stack with current state
* `cdk synth` emits the synthesized CloudFormation template

Initializing a new git repository...
Executing npm install...
npm WARN deprecated w3c-hr-time@1.0.2: Use your platform's native performance.now() and performance.timeOrigin.
npm notice 
npm notice New patch version of npm available! 8.19.2 → 8.19.3
npm notice Changelog: https://github.com/npm/cli/releases/tag/v8.19.3
npm notice Run npm install -g npm@8.19.3 to update!
npm notice 
✅ All done!

import { readFileSync } from 'fs';
import { Vpc, SubnetType, Peer, Port, AmazonLinuxGeneration, 
 AmazonLinuxCpuType, Instance, SecurityGroup, AmazonLinuxImage,
 InstanceClass, InstanceSize, InstanceType
} from 'aws-cdk-lib/aws-ec2';
import { Role, ServicePrincipal, ManagedPolicy } from 'aws-cdk-lib/aws-iam';

const webServerRole = new Role(this, "ec2Role", {
 assumedBy: new ServicePrincipal("ec2.amazonaws.com"),
 });

 // IAM policy attachment to allow access to
 webServerRole.addManagedPolicy(
 ManagedPolicy.fromAwsManagedPolicyName("AmazonSSMManagedInstanceCore")
 );

 webServerRole.addManagedPolicy(
 ManagedPolicy.fromAwsManagedPolicyName("service-role/AmazonEC2RoleforAWSCodeDeploy")
 );

// This VPC has 3 public subnets, and that's it
 const vpc = new Vpc(this, 'main_vpc',{
 subnetConfiguration: [
 {
 cidrMask: 24,
 name: 'pub01',
 subnetType: SubnetType.PUBLIC,
 },
 {
 cidrMask: 24,
 name: 'pub02',
 subnetType: SubnetType.PUBLIC,
 },
 {
 cidrMask: 24,
 name: 'pub03',
 subnetType: SubnetType.PUBLIC,
 }
 ]
 });

// Security Groups
 // This SG will only allow HTTP traffic to the Web server
 const webSg = new SecurityGroup(this, 'web_sg',{
 vpc,
 description: "Allows Inbound HTTP traffic to the web server.",
 allowAllOutbound: true,
 });

 webSg.addIngressRule(
 Peer.anyIpv4(),
 Port.tcp(80)
 );

// the AMI to be used for the EC2 Instance
 const ami = new AmazonLinuxImage({
 generation: AmazonLinuxGeneration.AMAZON_LINUX_2023,
 cpuType: AmazonLinuxCpuType.X86_64,
 });

 // The actual Web EC2 Instance for the web server
 const webServer = new Instance(this, 'web_server',{
 vpc,
 instanceType: InstanceType.of(
 InstanceClass.T2,
 InstanceSize.MICRO,
 ),
 machineImage: ami,
 securityGroup: webSg,
 role: webServerRole,
 });

#!/bin/bash -xe
# Install OS packages
yum update -y
yum groupinstall -y "Development Tools"
amazon-linux-extras install -y nginx1
yum install -y nginx python3.11 python3.11-pip python3.11-devel ruby wget
python3.11 -m pip install pipenv wheel
python3.11 -m pip install uwsgi

# Code Deploy Agent
cd /home/ec2-user
wget https://aws-codedeploy-us-west-2.s3.us-west-2.amazonaws.com/latest/install
chmod +x ./install
./install auto

// User data - used for bootstrapping
 const webSGUserData = readFileSync('./assets/configure_amz_linux_sample_app.sh','utf-8');
 webServer.addUserData(webSGUserData);
 // Tag the instance
 cdk.Tags.of(webServer).add('application-name','python-web')
 cdk.Tags.of(webServer).add('stage','prod')

// Output the public IP address of the EC2 instance
 new cdk.CfnOutput(this, "IP Address", {
 value: webServer.instancePublicIp,
 });

import * as cdk from 'aws-cdk-lib';
import { readFileSync } from 'fs';
import { Construct } from 'constructs';

import { Vpc, SubnetType, Peer, Port, AmazonLinuxGeneration, 
 AmazonLinuxCpuType, Instance, SecurityGroup, AmazonLinuxImage,
 InstanceClass, InstanceSize, InstanceType
} from 'aws-cdk-lib/aws-ec2';

import { Role, ServicePrincipal, ManagedPolicy } from 'aws-cdk-lib/aws-iam';

export class Ec2CdkStack extends cdk.Stack {
 constructor(scope: Construct, id: string, props?: cdk.StackProps) {
 super(scope, id, props);
 // IAM
 // Policy for CodeDeploy bucket access
 // Role that will be attached to the EC2 instance so it can be
 // managed by AWS SSM
 const webServerRole = new Role(this, "ec2Role", {
 assumedBy: new ServicePrincipal("ec2.amazonaws.com"),
 });

 // IAM policy attachment to allow access to
 webServerRole.addManagedPolicy(
 ManagedPolicy.fromAwsManagedPolicyName("AmazonSSMManagedInstanceCore")
 );
 
 webServerRole.addManagedPolicy(
 ManagedPolicy.fromAwsManagedPolicyName("service-role/AmazonEC2RoleforAWSCodeDeploy")
 );

 // VPC
 // This VPC has 3 public subnets, and that's it
 const vpc = new Vpc(this, 'main_vpc',{
 subnetConfiguration: [
 {
 cidrMask: 24,
 name: 'pub01',
 subnetType: SubnetType.PUBLIC,
 },
 {
 cidrMask: 24,
 name: 'pub02',
 subnetType: SubnetType.PUBLIC,
 },
 {
 cidrMask: 24,
 name: 'pub03',
 subnetType: SubnetType.PUBLIC,
 }
 ]
 });

 // Security Groups
 // This SG will only allow HTTP traffic to the Web server
 const webSg = new SecurityGroup(this, 'web_sg',{
 vpc,
 description: "Allows Inbound HTTP traffic to the web server.",
 allowAllOutbound: true,
 });

 webSg.addIngressRule(
 Peer.anyIpv4(),
 Port.tcp(80)
 );
 
 // EC2 Instance
 // This is the Python Web server that we will be using
 // Get the latest AmazonLinux 2 AMI for the given region
 const ami = new AmazonLinuxImage({
 generation: AmazonLinuxGeneration.AMAZON_LINUX_2023,
 cpuType: AmazonLinuxCpuType.X86_64,
 });

 // The actual Web EC2 Instance for the web server
 const webServer = new Instance(this, 'web_server',{
 vpc,
 instanceType: InstanceType.of(
 InstanceClass.T2,
 InstanceSize.MICRO,
 ),
 machineImage: ami,
 securityGroup: webSg,
 role: webServerRole,
 });

 // User data - used for bootstrapping
 const webSGUserData = readFileSync('./assets/configure_amz_linux_sample_app.sh','utf-8');
 webServer.addUserData(webSGUserData);
 // Tag the instance
 cdk.Tags.of(webServer).add('application-name','python-web')
 cdk.Tags.of(webServer).add('stage','prod')

 // Output the public IP address of the EC2 instance
 new cdk.CfnOutput(this, "IP Address", {
 value: webServer.instancePublicIp,
 });
 }
}

aws secretsmanager create-secret \ 
 --name github-oauth-token \ 
 --description "Github access token for cdk" \ 
 --secret-string GITHUB_ACCESS_TOKEN \ 
 --region REGION

import { Pipeline, Artifact } from 'aws-cdk-lib/aws-codepipeline';
import { GitHubSourceAction, CodeBuildAction, CodeDeployServerDeployAction } from 'aws-cdk-lib/aws-codepipeline-actions';
import { PipelineProject, LinuxBuildImage } from 'aws-cdk-lib/aws-codebuild';
import { ServerDeploymentGroup, ServerApplication, InstanceTagSet } from 'aws-cdk-lib/aws-codedeploy';
import { SecretValue } from 'aws-cdk-lib';

// CodePipeline
 const pipeline = new Pipeline(this, 'python_web_pipeline',{
 pipelineName: 'python-webApp',
 crossAccountKeys: false, // solves the encrypted bucket issue
 });

 // STAGES
 // Source Stage
 const sourceStage = pipeline.addStage({
 stageName: 'Source',
 })
 
 // Build Stage
 const buildStage = pipeline.addStage({
 stageName: 'Build',
 })
 
 // Deploy Stage
 const deployStage = pipeline.addStage({
 stageName: 'Deploy',
 })

// Source action
 const sourceOutput = new Artifact();
 const githubSourceAction = new GitHubSourceAction({
 actionName: 'GithubSource',
 oauthToken: SecretValue.secretsManager('github-oauth-token'), // MAKE SURE TO SET UP BEFORE
 owner: 'darko-mesaros', // THIS NEEDS TO BE CHANGED TO YOUR OWN USER ID
 repo: 'sample-python-web-app',
 branch: 'main',
 output: sourceOutput,
 });

 sourceStage.addAction(githubSourceAction);

// Build Action
 const pythonTestProject = new PipelineProject(this, 'pythonTestProject',{
 environment: {
 buildImage: LinuxBuildImage.AMAZON_LINUX_2_5
 }
 });

 const pythonTestOutput = new Artifact();

 const pythonTestAction = new CodeBuildAction({
 actionName: 'TestPython',
 project: pythonTestProject,
 input: sourceOutput,
 outputs: [pythonTestOutput]
 });

 buildStage.addAction(pythonTestAction);

// Deploy Actions
 const pythonDeployApplication = new ServerApplication(this,"python_deploy_application",{
 applicationName: 'python-webApp'
 });

 // Deployment group
 const pythonServerDeploymentGroup = new ServerDeploymentGroup(this,'PythonAppDeployGroup',{
 application: pythonDeployApplication,
 deploymentGroupName: 'PythonAppDeploymentGroup',
 installAgent: true,
 ec2InstanceTags: new InstanceTagSet(
 {
 'application-name': ['python-web'],
 'stage':['prod', 'stage']
 })
 });

 // Deployment action
 const pythonDeployAction = new CodeDeployServerDeployAction({
 actionName: 'PythonAppDeployment',
 input: sourceOutput,
 deploymentGroup: pythonServerDeploymentGroup,
 });

 deployStage.addAction(pythonDeployAction);

import * as cdk from 'aws-cdk-lib';
import { readFileSync } from 'fs';
import { Construct } from 'constructs';

import { Vpc, SubnetType, Peer, Port, AmazonLinuxGeneration, 
 AmazonLinuxCpuType, Instance, SecurityGroup, AmazonLinuxImage,
 InstanceClass, InstanceSize, InstanceType
} from 'aws-cdk-lib/aws-ec2';

import { Role, ServicePrincipal, ManagedPolicy } from 'aws-cdk-lib/aws-iam';
import { Pipeline, Artifact } from 'aws-cdk-lib/aws-codepipeline';
import { GitHubSourceAction, CodeBuildAction, CodeDeployServerDeployAction } from 'aws-cdk-lib/aws-codepipeline-actions';
import { PipelineProject, LinuxBuildImage } from 'aws-cdk-lib/aws-codebuild';
import { ServerDeploymentGroup, ServerApplication, InstanceTagSet } from 'aws-cdk-lib/aws-codedeploy';
import { SecretValue } from 'aws-cdk-lib';

export class Ec2CdkStack extends cdk.Stack {
 constructor(scope: Construct, id: string, props?: cdk.StackProps) {
 super(scope, id, props);
 // IAM
 // Policy for CodeDeploy bucket access
 // Role that will be attached to the EC2 instance so it can be
 // managed by AWS SSM
 const webServerRole = new Role(this, "ec2Role", {
 assumedBy: new ServicePrincipal("ec2.amazonaws.com"),
 });

 // IAM policy attachment to allow access to
 webServerRole.addManagedPolicy(
 ManagedPolicy.fromAwsManagedPolicyName("AmazonSSMManagedInstanceCore")
 );
 
 webServerRole.addManagedPolicy(
 ManagedPolicy.fromAwsManagedPolicyName("service-role/AmazonEC2RoleforAWSCodeDeploy")
 );

 // VPC
 // This VPC has 3 public subnets, and that's it
 const vpc = new Vpc(this, 'main_vpc',{
 subnetConfiguration: [
 {
 cidrMask: 24,
 name: 'pub01',
 subnetType: SubnetType.PUBLIC,
 },
 {
 cidrMask: 24,
 name: 'pub02',
 subnetType: SubnetType.PUBLIC,
 },
 {
 cidrMask: 24,
 name: 'pub03',
 subnetType: SubnetType.PUBLIC,
 }
 ]
 });

 // Security Groups
 // This SG will only allow HTTP traffic to the Web server
 const webSg = new SecurityGroup(this, 'web_sg',{
 vpc,
 description: "Allows Inbound HTTP traffic to the web server.",
 allowAllOutbound: true,
 });
 
 webSg.addIngressRule(
 Peer.anyIpv4(),
 Port.tcp(80)
 );
 
 // EC2 Instance
 // This is the Python Web server that we will be using
 // Get the latest AmazonLinux 2 AMI for the given region
 const ami = new AmazonLinuxImage({
 generation: AmazonLinuxGeneration.AMAZON_LINUX_2023,
 cpuType: AmazonLinuxCpuType.X86_64,
 });

 // The actual Web EC2 Instance for the web server
 const webServer = new Instance(this, 'web_server',{
 vpc,
 instanceType: InstanceType.of(
 InstanceClass.T3,
 InstanceSize.MICRO,
 ),
 machineImage: ami,
 securityGroup: webSg,
 role: webServerRole,
 });

 // User data - used for bootstrapping
 const webSGUserData = readFileSync('./assets/configure_amz_linux_sample_app.sh','utf-8');
 webServer.addUserData(webSGUserData);
 // Tag the instance
 cdk.Tags.of(webServer).add('application-name','python-web')
 cdk.Tags.of(webServer).add('stage','prod')
 
 // Pipeline stuff
 // CodePipeline
 const pipeline = new Pipeline(this, 'python_web_pipeline', {
 pipelineName: 'python-webApp',
 crossAccountKeys: false, // solves the encrypted bucket issue
 });

 // STAGES
 // Source Stage
 const sourceStage = pipeline.addStage({
 stageName: 'Source',
 });
 
 // Build Stage
 const buildStage = pipeline.addStage({
 stageName: 'Build',
 });
 
 // Deploy Stage
 const deployStage = pipeline.addStage({
 stageName: 'Deploy',
 });

 // Add some action
 // Source action
 const sourceOutput = new Artifact();
 const githubSourceAction = new GitHubSourceAction({
 actionName: 'GithubSource',
 oauthToken: SecretValue.secretsManager('github-oauth-token'), // SET UP BEFORE
 owner: 'darko-mesaros', // THIS NEEDS TO BE CHANGED TO THE READER
 repo: 'sample-python-web-app',
 branch: 'main',
 output: sourceOutput,
 });

 sourceStage.addAction(githubSourceAction);

 // Build Action
 const pythonTestProject = new PipelineProject(this, 'pythonTestProject', {
 environment: {
 buildImage: LinuxBuildImage.AMAZON_LINUX_2_5
 }
 });
 
 const pythonTestOutput = new Artifact();
 const pythonTestAction = new CodeBuildAction({
 actionName: 'TestPython',
 project: pythonTestProject,
 input: sourceOutput,
 outputs: [pythonTestOutput]
 });

 buildStage.addAction(pythonTestAction);

 // Deploy Actions
 const pythonDeployApplication = new ServerApplication(this,"python_deploy_application", {
 applicationName: 'python-webApp'
 });

 // Deployment group
 const pythonServerDeploymentGroup = new ServerDeploymentGroup(this,'PythonAppDeployGroup', {
 application: pythonDeployApplication,
 deploymentGroupName: 'PythonAppDeploymentGroup',
 installAgent: true,
 ec2InstanceTags: new InstanceTagSet(
 {
 'application-name': ['python-web'],
 'stage':['prod', 'stage']
 })
 });

 // Deployment action
 const pythonDeployAction = new CodeDeployServerDeployAction({
 actionName: 'PythonAppDeployment',
 input: sourceOutput,
 deploymentGroup: pythonServerDeploymentGroup,
 });

 deployStage.addAction(pythonDeployAction);

 // Output the public IP address of the EC2 instance
 new cdk.CfnOutput(this, "IP Address", {
 value: webServer.instancePublicIp,
 });
 }
}

import unittest
from application import application

class TestHello(unittest.TestCase):

 def setUp(self):
 application.testing = True
 self.application = application.test_client()

 def test_hello(self):
 rv = self.application.get('/')
 self.assertEqual(rv.status, '200 OK')

if __name__ == '__main__':
 import xmlrunner
 unittest.main(testRunner=xmlrunner.XMLTestRunner(output='test-reports'))
 unittest.main()

touch tests/__init__.py

version: 0.2

phases:
 install:
 runtime-versions:
 python: 3.11
 commands:
 - echo Entered the install phase...
 - pip install pipenv
 - pipenv install
 finally:
 - echo This always runs even if the update or install command fails 
 build:
 commands:
 - echo Entered the build phase...
 - echo Build started on `date`
 - pipenv run python -m unittest # not an interactive session so we need to run
 finally:
 - echo This always runs even if the install command fails
 post_build:
 commands:
 - echo Entered the post_build phase...
 - echo Build completed on `date`

version: 0.0
os: linux
files:
 - source: /
 destination: /var/www/SampleApp
hooks:
 BeforeInstall:
 - location: scripts/setup_dirs.sh
 timeout: 300
 runas: root
 AfterInstall:
 - location: scripts/setup_services.sh
 - location: scripts/pipenv.sh
 timeout: 300
 runas: root
 ApplicationStart:
 - location: scripts/start_server.sh
 timeout: 300
 runas: root

#!/bin/bash -xe
mkdir -p /var/www/SampleApp
chown nginx:nginx /var/www
chown nginx:nginx /var/www/SampleApp

#!/bin/bash -xe
## Install uWSGI as a systemd service, enable it to run at boot, then start it
cp /var/www/SampleApp/sample-app.uwsgi.service /etc/systemd/system/mywebapp.uwsgi.service
mkdir -p /var/log/uwsgi
chown nginx:nginx /var/log/uwsgi
systemctl enable mywebapp.uwsgi.service

## Copy the nginx config file, then ensure nginx starts at boot, and restart it to load the config
cp /var/www/SampleApp/nginx-app.conf /etc/nginx/conf.d/nginx-app.conf
mkdir -p /var/log/nginx
chown nginx:nginx /var/log/nginx
systemctl enable nginx.service

#!/bin/bash -xe

chown nginx:nginx -R /var/www/SampleApp/
cd /var/www/SampleApp
pipenv install

#!/bin/bash -xe
systemctl restart mywebapp.uwsgi.service
systemctl restart nginx.service

[[source]]
name = "pypi"
url = "https://pypi.org/simple"
verify_ssl = true

[dev-packages]

[packages]
flask = "*"
boto3 = "*"
uwsgi = "*"

[requires]
python_version = "3.11"

├── application.config
├── application.py
├── appspec.yml
├── buildspec.yml
├── CODE_OF_CONDUCT.md
├── configure_amz_linux_sample_app.sh
├── CONTRIBUTING.md
├── Dockerfile
├── LICENSE
├── nginx-app.conf
├── Pipfile
├── README.md
├── sample-app.uwsgi.service
├── scripts
│   ├── pipenv.sh
│   ├── setup_dirs.sh
│   ├── setup_services.sh
│   └── start_server.sh
├── start.sh
├── static
│   ├── bootstrap
│   └── jquery
├── templates
│   └── index.html
└── tests
 ├── __init__.py
 ├── __pycache__
 └── test_sample.py

env: { account: process.env.CDK_DEFAULT_ACCOUNT, region: process.env.CDK_DEFAULT_REGION },

cdk bootstrap

#output
⏳ Bootstrapping environment aws://0123456789012/<region>...
✅ Environment aws://0123456789012/<region> bootstrapped
Deploying the stack

cdk deploy

Do you wish to deploy these changes (y/n)? y
PythonEc2BlogpostStack: deploying...
[0%] start: Publishing afe67465ec62603d27d77795221a45e68423c87495467b0265ecdadad80bb5e2:current
[33%] success: Published afe67465ec62603d27d77795221a45e68423c87495467b0265ecdadad80bb5e2:current
[33%] start: Publishing 73887b77b71ab7247eaf6dc4647f03f9f1cf8f0da685460f489ec8f2106d480d:current
[66%] success: Published 73887b77b71ab7247eaf6dc4647f03f9f1cf8f0da685460f489ec8f2106d480d:current
[66%] start: Publishing 13138ebf2da51426144f6f5f4f0ad197787f52aad8b6ceb26ecff68d33cd2b78:current
[100%] success: Published 13138ebf2da51426144f6f5f4f0ad197787f52aad8b6ceb26ecff68d33cd2b78:current
Ec2CdkStack: creating CloudFormation changeset...

✅ PythonEc2BlogpostStack

✨ Deployment time: 27.74s

Outputs:
PythonEc2BlogpostStack.IPAddress = x.x.x.x
Stack ARN:
arn:aws:cloudformation:us-west-2:123456789000:stack/Ec2CdkStack/59f1e560-grunf-11ed-afno1-06f3bbc9cf63

✨ Total time: 29.11s

cdk destroy

# Enter y to approve the changes and delete any stack resources.
PythonEc2BlogpostStack: destroying ...

✅ PythonEc2BlogpostStack: destroyed