AWS MCP ServerのAgent SOP Toolsを利用して既存のCDKコードがWell-Architectedフレームワークに準拠しているかをレビューさせてみた #AWSreInvent

export type LambdaConstructProps = {
  notificationSnsAction: cloudwatch_actions.SnsAction;
  stageName: StageName;
} & nodejs.NodejsFunctionProps;

export class LambdaConstruct extends Construct {
  readonly function: nodejs.NodejsFunction;

  constructor(scope: Construct, id: string, props: LambdaConstructProps) {
    super(scope, id);

    const { bundling, ...rest } = props;
    const defaultBundlingOptions = {
      sourceMap: true,
    };
    const functionName = formatResourceName({
      construct: scope,
      stageName: props.stageName,
      name: id,
      includeDeveloperId: true,
    });
    this.function = new nodejs.NodejsFunction(this, "Resource", {
      functionName,
      handler: "handler",
      tracing: lambda.Tracing.ACTIVE,
      runtime: lambda.Runtime.NODEJS_22_X,
      timeout: Duration.seconds(5),
      // MEMO: デフォルトでは 1769MB(1vCPU相当) を割り当てる
      // @see https://docs.aws.amazon.com/ja_jp/lambda/latest/dg/configuration-function-common.html#configuration-memory-console
      memorySize: 1769,
      logGroup: new aws_logs.LogGroup(this, "LogGroup", {
        logGroupName: `/aws/lambda/${functionName}`,
        removalPolicy: RemovalPolicy.DESTROY, // TODO: 必要に応じて RETAIN に変更
        retention: aws_logs.RetentionDays.SIX_MONTHS, // TODO: 要件に合わせて変更
      }),
      bundling: {
        ...bundling,
        ...defaultBundlingOptions,
      },
      architecture: lambda.Architecture.ARM_64,
      ...rest,
    });

    new LambdaApplicationLogMonitoringConstruct(
      this,
      `${functionName}MetricsMonitoring`,
      {
        notificationSnsAction: props.notificationSnsAction,
        lambdaFunction: this.function,
        functionId: id,
        logLevelErrorProps: {
          threshold: 1,
          evaluationPeriods: 1,
        },
        timeoutErrorProps: {
          threshold: 3,
          evaluationPeriods: 5,
        },
        stageName: props.stageName,
      },
    );
  }
}

import { StageName } from "@classmethod/aws-util";
import { aws_wafv2, aws_s3, aws_cloudwatch_actions } from "aws-cdk-lib";
import { Construct } from "constructs";
import { formatResourceName } from "../util/cdk";
import { WafMetricsMonitoringConstruct } from "./monitoring/waf-metrics";

type WafConstructProps = {
  wafName: string;
  webAclScope: "REGIONAL" | "CLOUDFRONT";
  webAclRules: aws_wafv2.CfnWebACL.RuleProperty[];
  wafLogBucketName: string;
  notificationSnsAction: aws_cloudwatch_actions.SnsAction;
  stageName: StageName;
};

export class WafConstruct extends Construct {
  public readonly webAcl: aws_wafv2.CfnWebACL;

  constructor(scope: Construct, id: string, props: WafConstructProps) {
    super(scope, id);

    const { webAclScope, webAclRules } = props;

    const webAcl = new aws_wafv2.CfnWebACL(this, "WebAcl", {
      name: formatResourceName({
        construct: scope,
        stageName: props.stageName,
        name: props.wafName,
        includeDeveloperId: true,
      }),
      defaultAction: { allow: {} },
      scope: webAclScope,
      visibilityConfig: {
        cloudWatchMetricsEnabled: true,
        sampledRequestsEnabled: true,
        metricName: "WebAcl",
      },
      /**
       * Web ACL に適用するルールリストの設定。以下理由により別ファイルでの管理としています:
       *
       * - Web ACL の適用対象のリソース種類や機能によって、適したルールを選択可能とするため
       * - ルールは継続的な変更が発生する可能性があり、他の WAF に関する実装とライフサイクルを分けるため
       */
      rules: webAclRules,
    });
    this.webAcl = webAcl;

    /**
     * WAF ログはコストを考慮しS3へ保存
     */
    const wafBucket = new aws_s3.Bucket(this, "WafLogBucket", {
      bucketName: formatResourceName({
        construct: scope,
        stageName: props.stageName,
        name: props.wafLogBucketName,
        includeDeveloperId: true,
        useSuffixStyle: true,
      }),
      accessControl: aws_s3.BucketAccessControl.PRIVATE,
      versioned: true,
      publicReadAccess: false,
      blockPublicAccess: aws_s3.BlockPublicAccess.BLOCK_ALL,
    });
    /**
     * WAF ログ出力設定
     */
    new aws_wafv2.CfnLoggingConfiguration(this, "WafLoggingConfiguration", {
      logDestinationConfigs: [wafBucket.bucketArn],
      resourceArn: webAcl.attrArn,
      loggingFilter: {
        Filters: [
          {
            Behavior: "KEEP",
            Requirement: "MEETS_ANY",
            Conditions: [
              {
                ActionCondition: {
                  Action: "BLOCK",
                },
              },
              {
                ActionCondition: {
                  Action: "COUNT",
                },
              },
              {
                ActionCondition: {
                  Action: "EXCLUDED_AS_COUNT",
                },
              },
            ],
          },
        ],
        DefaultBehavior: "DROP",
      },
    });

    new WafMetricsMonitoringConstruct(this, "WafMetricsMonitoring", {
      notificationSnsAction: props.notificationSnsAction,
      webAclList: [webAcl],
    });
  }
}

type ApiGatewayMetricsMonitoringConstructConstructProps = {
  /**
   * アラート通知先の SNS アクション。
   */
  readonly notificationSnsAction: aws_cloudwatch_actions.SnsAction;
  /**
   * 監視対象の REST API のリスト
   */
  readonly restApiList: aws_apigateway.RestApi[];

  /**
   * ステージ名
   */
  readonly stageName: StageName;
};

export class ApiGatewayMetricsMonitoringConstruct extends Construct {
  readonly stageName: StageName;

  constructor(
    scope: Construct,
    id: string,
    props: ApiGatewayMetricsMonitoringConstructConstructProps,
  ) {
    super(scope, id);

    const { notificationSnsAction, restApiList } = props;
    this.stageName = props.stageName;

    // 各 REST API の監視アラームを作成
    restApiList.forEach((restApi) => {
      this.createAlarm(scope, restApi, notificationSnsAction);
    });
  }

  /**
   * REST API の監視アラームを作成
   * @param scope
   * @param restApi
   * @param notificationSnsAction
   */
  private createAlarm = (
    scope: Construct,
    restApi: aws_apigateway.RestApi,
    notificationSnsAction: aws_cloudwatch_actions.SnsAction,
  ) => {
    const restApiConstructId = getConstructId(restApi);

    /**
     * サーバーエラーの監視
     * @see https://docs.aws.amazon.com/ja_jp/apigateway/latest/developerguide/api-gateway-metrics-and-dimensions.html
     */
    const errorAlarm = new aws_cloudwatch.Alarm(
      this,
      `${restApiConstructId}5XXErrorAlarm`,
      {
        alarmName: formatResourceName({
          construct: scope,
          stageName: this.stageName,
          name: `ApiGateway${restApiConstructId}5XXError`,
          includeDeveloperId: true,
        }),
        metric: new aws_cloudwatch.Metric({
          namespace: "AWS/ApiGateway",
          metricName: "5XXError",
          dimensionsMap: {
            ApiName: restApi.restApiName,
          },
          period: Duration.seconds(30),
          statistic: aws_cloudwatch.Stats.SUM,
        }),
        threshold: 10, // TODO: 必要に応じて調整する
        evaluationPeriods: 1,
        treatMissingData: aws_cloudwatch.TreatMissingData.NOT_BREACHING,
      },
    );
    errorAlarm.addAlarmAction(notificationSnsAction);
    errorAlarm.addOkAction(notificationSnsAction);
  };
}