今月 GA された AWS DevOps Agent のスペース作成から GitHub 連携までを AWS CDK で実装してみた

lib/constructs/devops-agent/
├── agent-space-role/
├── operator-role/
├── aws-association/
├── github-association/
└── index.ts

npm install aws-cdk-lib@latest aws-cdk@latest constructs@latest

aws devops-agent list-services
# {
#     "services": [
#         {
#             "serviceId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", # ←これ
#             "serviceType": "github",
#             "additionalServiceDetails": {
#                 "github": {
#                     "owner": "your-owner",
#                     "ownerType": "user"
#                 }
#             }
#         }
#     ]
# }

import * as devopsagent from "aws-cdk-lib/aws-devopsagent";
import { Construct } from "constructs";

import { commonParameter } from "../../../bin/parameter";
import { AgentSpaceRoleConstruct } from "./agent-space-role";
import { AwsAssociationConstruct } from "./aws-association";
import {
  GitHubAssociationConstruct,
  GitHubAssociationProps,
} from "./github-association";
import { OperatorRoleConstruct } from "./operator-role";

interface DevOpsAgentConstructProps {
  githubAssociations: GitHubAssociationProps;
}

/**
 * DevOps Agent リソース実装
 * @see https://github.com/aws-samples/sample-aws-devops-agent-cdk/blob/main/lib/devops-agent-stack.ts
 */
export class DevOpsAgentConstruct extends Construct {
  constructor(scope: Construct, id: string, props: DevOpsAgentConstructProps) {
    super(scope, id);

    const { githubAssociations } = props;
    const { projectNamePascalCase } = commonParameter;

    /**
     * Operator 用ロールと Agent Space 用監視ロールの作成
     */
    const agentSpaceRole = new AgentSpaceRoleConstruct(this, "AgentSpaceRole");
    const operatorRole = new OperatorRoleConstruct(this, "OperatorRole");

    const agentSpace = new devopsagent.CfnAgentSpace(this, "AgentSpace", {
      name: `${projectNamePascalCase}AgentSpace`,
      operatorApp: {
        iam: {
          operatorAppRoleArn: operatorRole.role.roleArn,
        },
      },
    });

    /**
     * Agent Space と AWS リソースの関連付け
     */
    const awsAssociation = new AwsAssociationConstruct(this, "Association", {
      agentSpace,
      agentSpaceRole: agentSpaceRole.role,
    });
    awsAssociation.association.addDependency(agentSpace);

    /**
     * Agent Space と GitHub リポジトリの関連付け
     */
    const gitHubAssociation = new GitHubAssociationConstruct(
      this,
      "GitHubAssociation",
      {
        agentSpace,
        githubAssociations,
      },
    );
    gitHubAssociation.association.addDependency(agentSpace);
  }
}

import * as cdk from "aws-cdk-lib";
import * as iam from "aws-cdk-lib/aws-iam";
import { Construct } from "constructs";

/**
 * Agent Space 用の監視ロール実装
 * @see https://github.com/aws-samples/sample-aws-devops-agent-cdk/blob/main/lib/devops-agent-stack.ts
 * @see https://docs.aws.amazon.com/ja_jp/devopsagent/latest/userguide/configuring-capabilities-for-aws-devops-agent-migrating-from-public-preview-to-general-availability.html#step-1-update-monitoring-roles
 */
export class AgentSpaceRoleConstruct extends Construct {
  public readonly role: iam.Role;

  constructor(scope: Construct, id: string) {
    super(scope, id);

    const stack = cdk.Stack.of(this);

    this.role = new iam.Role(this, "Default", {
      assumedBy: new iam.ServicePrincipal("aidevops.amazonaws.com", {
        conditions: {
          StringEquals: {
            "aws:SourceAccount": stack.account,
          },
          ArnLike: {
            "aws:SourceArn": stack.formatArn({
              service: "aidevops",
              resource: "agentspace",
              resourceName: "*", // 循環参照回避のためワイルドカードで指定
            }),
          },
        },
      }),
      managedPolicies: [
        /**
         * Agent Space 用のアクセス許可を付与するマネージドポリシーをアタッチ
         * @see https://docs.aws.amazon.com/ja_jp/devopsagent/latest/userguide/configuring-capabilities-for-aws-devops-agent-migrating-from-public-preview-to-general-availability.html#new-managed-policies
         */
        iam.ManagedPolicy.fromAwsManagedPolicyName("AIDevOpsAgentAccessPolicy"),
      ],
      inlinePolicies: {
        AllowCreateServiceLinkedRoles: new iam.PolicyDocument({
          statements: [
            /**
             * 以下を参考にサービスリンクロール作成権限を追加
             * @see https://docs.aws.amazon.com/ja_jp/devopsagent/latest/userguide/configuring-capabilities-for-aws-devops-agent-migrating-from-public-preview-to-general-availability.html#step-1-update-monitoring-roles
             */
            new iam.PolicyStatement({
              actions: ["iam:CreateServiceLinkedRole"],
              resources: [
                stack.formatArn({
                  service: "iam",
                  region: "",
                  resource: "role",
                  resourceName:
                    "aws-service-role/resource-explorer-2.amazonaws.com/AWSServiceRoleForResourceExplorer",
                }),
              ],
            }),
          ],
        }),
      },
    });
  }
}

import * as cdk from "aws-cdk-lib";
import * as iam from "aws-cdk-lib/aws-iam";
import { Construct } from "constructs";

/**
 * オペレーター用ロール実装
 * @see https://github.com/aws-samples/sample-aws-devops-agent-cdk/blob/main/lib/devops-agent-stack.ts
 */
export class OperatorRoleConstruct extends Construct {
  public readonly role: iam.Role;

  constructor(scope: Construct, id: string) {
    super(scope, id);

    const stack = cdk.Stack.of(this);
    const accountId = stack.account;

    /**
     * AIDevOps サービスプリンシパルの許可条件
     */
    const principalConditions = {
      StringEquals: {
        "aws:SourceAccount": accountId,
      },
      ArnLike: {
        "aws:SourceArn": stack.formatArn({
          service: "aidevops",
          resource: "agentspace",
          resourceName: "*", // 循環参照回避のためワイルドカードで指定
        }),
      },
    };

    const servicePrincipal = new iam.ServicePrincipal(
      "aidevops.amazonaws.com",
      { conditions: principalConditions },
    );

    this.role = new iam.Role(this, "Default", {
      assumedBy: servicePrincipal,
      managedPolicies: [
        /**
         * オペレーターアプリ用のアクセス許可を付与するマネージドポリシーをアタッチ
         * @see https://docs.aws.amazon.com/ja_jp/devopsagent/latest/userguide/configuring-capabilities-for-aws-devops-agent-migrating-from-public-preview-to-general-availability.html#new-managed-policies
         */
        iam.ManagedPolicy.fromAwsManagedPolicyName(
          "AIDevOpsOperatorAppAccessPolicy",
        ),
      ],
    });

    /**
     * sts:TagSession を許可するステートメントを追加
     * @see https://docs.aws.amazon.com/ja_jp/devopsagent/latest/userguide/configuring-capabilities-for-aws-devops-agent-migrating-from-public-preview-to-general-availability.html#step-2-update-the-operator-role-iam
     */
    this.role.assumeRolePolicy?.addStatements(
      new iam.PolicyStatement({
        actions: ["sts:TagSession"],
        principals: [servicePrincipal],
        conditions: principalConditions,
      }),
    );
  }
}

import { Stack } from "aws-cdk-lib";
import * as devopsagent from "aws-cdk-lib/aws-devopsagent";
import * as iam from "aws-cdk-lib/aws-iam";
import { Construct } from "constructs";

interface AwsAssociationConstructProps {
  agentSpace: devopsagent.CfnAgentSpace;
  agentSpaceRole: iam.IRole;
}

/**
 * DevOps Agent と AWS リソースの関連付け実装
 */
export class AwsAssociationConstruct extends Construct {
  public readonly association: devopsagent.CfnAssociation;

  constructor(
    scope: Construct,
    id: string,
    props: AwsAssociationConstructProps,
  ) {
    super(scope, id);
    const accountId = Stack.of(this).account;

    this.association = new devopsagent.CfnAssociation(this, "Default", {
      agentSpaceId: props.agentSpace.ref,
      serviceId: "aws",
      configuration: {
        aws: {
          assumableRoleArn: props.agentSpaceRole.roleArn,
          accountId,
          // 関連付け対象に応じて monitor / source を指定する。
          // このスタックでは DevOps Agent に監視させる対象 AWS アカウント自身を
          // 関連付けているため、monitor を指定する。
          accountType: "monitor",
        },
      },
    });
  }
}

# serviceId の確認
aws devops-agent list-services
# {
#     "services": [
#         {
#             "serviceId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", # ←これ
#             "serviceType": "github",
#             "additionalServiceDetails": {
#                 "github": {
#                     "owner": "your-owner",
#                     "ownerType": "user"
#                 }
#             }
#         }
#     ]
# }

# repoId（9桁の数値 ID）の確認
gh api repos/<owner>/<repo> --jq .id

devOpsAgent: {
  githubAssociations: {
    serviceId: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", // `aws devops-agent list-services` で確認した UUID
    owner: "your-org",
    ownerType: "organization or user",
    repoName: "your-repo",
    repoId: "123456789", // `gh api repos/<owner>/<repoName> --jq .id` で確認した数値 ID
  },
},

import * as devopsagent from "aws-cdk-lib/aws-devopsagent";
import { Construct } from "constructs";

export interface GitHubAssociationProps
  extends devopsagent.CfnAssociation.GitHubConfigurationProperty {
  serviceId: string;
}

interface GitHubAssociationConstructProps {
  agentSpace: devopsagent.CfnAgentSpace;
  githubAssociations: GitHubAssociationProps;
}

/**
 * DevOps Agent と GitHub の関連付け実装
 */
export class GitHubAssociationConstruct extends Construct {
  public readonly association: devopsagent.CfnAssociation;

  constructor(
    scope: Construct,
    id: string,
    props: GitHubAssociationConstructProps,
  ) {
    super(scope, id);

    const { agentSpace, githubAssociations } = props;
    const { serviceId, owner, ownerType, repoId, repoName } =
      githubAssociations;

    this.association = new devopsagent.CfnAssociation(this, "Default", {
      agentSpaceId: agentSpace.ref,
      serviceId,
      configuration: {
        gitHub: {
          ownerType,
          owner,
          repoId,
          repoName,
        },
      },
    });
  }
}

AgentSpace → operatorRole.roleArn（を参照）
operatorRole → agentSpace.attrArn（を参照）← 循環！

ArnLike: {
  "aws:SourceArn": stack.formatArn({
    service: "aidevops",
    resource: "agentspace",
    resourceName: "*", // 循環参照回避のためワイルドカードで指定
  }),
},