CDKのデプロイ待ち時間を1/6に！高速デプロイツール「cdkd」の実力を測ってみた

#!/usr/bin/env node
import 'source-map-support/register';
import * as cdk from 'aws-cdk-lib';
import { BenchStack } from '../lib/stack';

const app = new cdk.App();
const vpcId = app.node.tryGetContext('vpcId');
const subnetId = app.node.tryGetContext('subnetId');
const amiId = app.node.tryGetContext('amiId');

if (!vpcId || !subnetId || !amiId) {
  throw new Error('Required: -c vpcId=xxx -c subnetId=xxx -c amiId=xxx');
}

new BenchStack(app, 'BenchEc2IamStack', { vpcId, subnetId, amiId });

{
  "app": "npx ts-node --prefer-ts-exts bin/app.ts",
  "versionReporting": false
}

import * as cdk from 'aws-cdk-lib';
import * as iam from 'aws-cdk-lib/aws-iam';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import { Construct } from 'constructs';

interface BenchStackProps extends cdk.StackProps {
  vpcId: string;
  subnetId: string;
  amiId: string;
}

export class BenchStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: BenchStackProps) {
    super(scope, id, props);

    const role = new iam.CfnRole(this, 'BenchRole', {
      assumeRolePolicyDocument: {
        Version: '2012-10-17',
        Statement: [{ Effect: 'Allow', Principal: { Service: 'ec2.amazonaws.com' }, Action: 'sts:AssumeRole' }],
      },
    });

    new iam.CfnPolicy(this, 'BenchPolicy', {
      policyName: 'bench-policy',
      roles: [role.ref],
      policyDocument: {
        Version: '2012-10-17',
        Statement: [{ Effect: 'Allow', Action: 's3:GetObject', Resource: '*' }],
      },
    });

    const instanceProfile = new iam.CfnInstanceProfile(this, 'BenchInstanceProfile', {
      roles: [role.ref],
    });

    const sg = new ec2.CfnSecurityGroup(this, 'BenchSecurityGroup', {
      groupDescription: 'Benchmark security group',
      vpcId: props.vpcId,
    });

    new ec2.CfnInstance(this, 'BenchInstance', {
      instanceType: 't3.micro',
      imageId: props.amiId,
      subnetId: props.subnetId,
      iamInstanceProfile: instanceProfile.ref,
      securityGroupIds: [sg.attrGroupId],
      tags: [{ key: 'Name', value: 'bench-test' }],
    });
  }
}

#!/bin/bash
set -euo pipefail

VPC_ID="${1:?Usage: $0 <vpc-id> <subnet-id> <ami-id>}"
SUBNET_ID="${2:?}"
AMI_ID="${3:?}"
RUN_ID="bench-$(date +%s)"
ROLE_NAME="bench-role-${RUN_ID}"
PROFILE_NAME="bench-profile-${RUN_ID}"

START=$(date +%s)
ts() { local e=$(( $(date +%s) - START )); printf '[%02d:%02d]' $((e/60)) $((e%60)); }

echo "$(ts) === Optimized CLI deploy (parallel + retry) ==="

# Phase 1: Role + SecurityGroup in parallel
echo "$(ts) Creating IAM Role & SecurityGroup (parallel)..."
aws iam create-role --role-name "$ROLE_NAME" \
  --assume-role-policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"ec2.amazonaws.com"},"Action":"sts:AssumeRole"}]}' \
  --no-cli-pager > /dev/null &
ROLE_PID=$!

SG_ID=$(aws ec2 create-security-group --group-name "bench-sg-${RUN_ID}" \
  --description "Benchmark SG" --vpc-id "$VPC_ID" --query 'GroupId' --output text)
echo "$(ts) SecurityGroup created: ${SG_ID}"
wait $ROLE_PID
echo "$(ts) IAM Role created: ${ROLE_NAME}"

# Phase 2: Policy + InstanceProfile in parallel (depend on Role)
echo "$(ts) Creating Policy & InstanceProfile (parallel)..."
aws iam put-role-policy --role-name "$ROLE_NAME" --policy-name "bench-policy" \
  --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"*"}]}' &
POLICY_PID=$!

aws iam create-instance-profile --instance-profile-name "$PROFILE_NAME" --no-cli-pager > /dev/null
aws iam add-role-to-instance-profile --instance-profile-name "$PROFILE_NAME" --role-name "$ROLE_NAME"
echo "$(ts) InstanceProfile created: ${PROFILE_NAME}"
wait $POLICY_PID
echo "$(ts) Policy attached"

# Phase 3: EC2 Instance (retry for IAM propagation)
echo "$(ts) Launching EC2 Instance (with IAM propagation retry)..."
PROFILE_ARN=$(aws iam get-instance-profile --instance-profile-name "$PROFILE_NAME" \
  --query 'InstanceProfile.Arn' --output text)

INSTANCE_ID=""
for i in 1 2 3 4 5 6 7 8 9 10; do
  INSTANCE_ID=$(aws ec2 run-instances --instance-type t3.micro --image-id "$AMI_ID" \
    --subnet-id "$SUBNET_ID" --iam-instance-profile "Arn=${PROFILE_ARN}" \
    --security-group-ids "$SG_ID" \
    --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=bench-test}]" \
    --query 'Instances[0].InstanceId' --output text 2>/dev/null) && break
  echo "$(ts) Retry ${i}: IAM not propagated yet (waiting $((i*2))s)..."
  sleep $((i * 2))
done

[ -z "$INSTANCE_ID" ] && echo "ERROR: Failed to launch instance" && exit 1
echo "$(ts) EC2 Instance launched: ${INSTANCE_ID}"

# Phase 4: Wait for running
echo "$(ts) Waiting for instance running..."
aws ec2 wait instance-running --instance-ids "$INSTANCE_ID"

END=$(date +%s)
echo "$(ts) === Done: $((END - START))s ==="

FROM node:20-slim

RUN apt-get update && apt-get install -y --no-install-recommends \
    curl unzip jq bash ca-certificates python3 \
  && rm -rf /var/lib/apt/lists/*

# AWS CLI v2 (aarch64の場合。x86_64なら URL を変更)
RUN curl -sL "https://awscli.amazonaws.com/awscli-exe-linux-aarch64.zip" -o /tmp/awscli.zip \
  && unzip -q /tmp/awscli.zip -d /tmp \
  && /tmp/aws/install \
  && rm -rf /tmp/aws /tmp/awscli.zip

# CDK + cdkd
RUN npm install -g aws-cdk @go-to-k/cdkd

WORKDIR /benchmark
COPY . .
RUN cd cdk-app && npm install

ENTRYPOINT ["/bin/bash"]

# ビルド
docker build -t bench-ec2-iam .

# cdkd bootstrap（初回のみ）
docker run --rm -v ~/.aws:/root/.aws -e AWS_REGION=ap-northeast-1 \
  bench-ec2-iam -c "cdkd bootstrap"

# cdkd デプロイ
docker run --rm -v ~/.aws:/root/.aws -e AWS_REGION=ap-northeast-1 \
  -w /benchmark/cdk-app \
  bench-ec2-iam -c "cdkd deploy -c vpcId=<vpc-id> -c subnetId=<subnet-id> -c amiId=<ami-id>"