Package: cdk-keycloak
cdk-keycloakCDK construct library that allows you to createKeyCloakon AWS in TypeScript or PythonNoteThis project has been migrated to CDK v2.CDK v1 compatible version is deprecated now.SampleFor Keycloak 17+ versions, please specify hostname for the Keycloak server.import{KeyCloak}from'cdk-keycloak';constapp=newcdk.App();constenv={region:process.env.CDK_DEFAULT_REGION,account:process.env.CDK_DEFAULT_ACCOUNT,};conststack=newcdk.Stack(app,'keycloak-demo',{env});newKeyCloak(stack,'KeyCloak',{hostname:'keycloak.example.com',certificateArn:'arn:aws:acm:us-east-1:123456789012:certificate/293cf875-ca98-4c2e-a797-e1cf6df2553c',keycloakVersion:KeycloakVersion.V22_0_4,});Keycloak version pinningUsekeycloakVersionto specify the version.newKeyCloak(stack,'KeyCloak',{hostname,certificateArn,keycloakVersion:KeycloakVersion.V22_0_4,});To specify any other verion not defined in the construct, useKeycloakVersion.of('x.x.x'). This allows you to specify any new version as soon as it's available. However, as new versions will not always be tested and validated with this construct library, make sure you fully backup and test before you use any new version in the production environment.Aurora Serverless supportTheKeyCloakconstruct provisions theAmaozn RDS cluster for MySQLwith2database instances under the hood, to opt inAmazon Aurora Serverless, useauroraServerlessto opt in Amazon Aurora Serverless cluster. Please note only some regions are supported, checkSupported features in Amazon Aurora by AWS Region and Aurora DB enginefor availability.//AuroraServerlessv1newKeyCloak(stack,'KeyCloak',{hostname,certificateArn,keycloakVersion,auroraServerless:true,});//AuroraServerlessv2newKeyCloak(stack,'KeyCloak',{hostname,certificateArn,keycloakVersion,auroraServerlessV2:true,});Behind the scene, a default RDS cluster for MySQL with 2 database instances will be created.Opt-in for Single RDS instanceTo create single RDS instance for your testing or development environment, usesingleDbInstanceto turn on the
single db instance deployment.Plesae note this is not recommended for production environment.newKeyCloak(stack,'KeyCloak',{hostname,certificateArn,keycloakVersion,singleDbInstance:true,});Service Auto ScalingDefineautoScaleTaskfor the ecs service task autoscaling. For example:newKeyCloak(stack,'KeyCloak',{hostname,certificateArn,keycloakVersion,auroraServerlessV2:true,nodeCount:2,autoScaleTask:{min:2,max:10,targetCpuUtilization:60,},});Customize fargate task settingsDefinetaskCpuortaskMemoryfor overriding the defaults for the ecs service task.
Could be useful for development environments. For example:newKeyCloak(stack,'KeyCloak',{hostname,certificateArn,keycloakVersion,nodeCount:1,taskCpu:512,taskMemory:2048,});Deploy in existing Vpc SubnetsYou can deploy the workload in the existing Vpc and subnets. ThepublicSubnetsare for the ALB,privateSubnetsfor the keycloak container tasks anddatabaseSubnetsfor the database.The best practice is to specify isolated subnets fordatabaseSubnets, however, in some cases might have no existing isolates subnets then the private subnets are also acceptable.Consider the sample below:newKeyCloak(stack,'KeyCloak',{hostname:'keycloak.example.com',keycloakVersion:KeycloakVersion.V22_0_4,certificateArn:'arn:aws:acm:us-east-1:123456789012:certificate/293cf875-ca98-4c2e-a797-e1cf6df2553c',vpc:ec2.Vpc.fromLookup(stack,'Vpc',{vpcId:'vpc-0417e46d'}),publicSubnets:{subnets:[ec2.Subnet.fromSubnetId(stack,'pub-1a','subnet-5bbe7b32'),ec2.Subnet.fromSubnetId(stack,'pub-1b','subnet-0428367c'),ec2.Subnet.fromSubnetId(stack,'pub-1c','subnet-1586a75f'),],},privateSubnets:{subnets:[ec2.Subnet.fromSubnetId(stack,'priv-1a','subnet-0e9460dbcfc4cf6ee'),ec2.Subnet.fromSubnetId(stack,'priv-1b','subnet-0562f666bdf5c29af'),ec2.Subnet.fromSubnetId(stack,'priv-1c','subnet-00ab15c0022872f06'),],},databaseSubnets:{subnets:[ec2.Subnet.fromSubnetId(stack,'db-1a','subnet-0e9460dbcfc4cf6ee'),ec2.Subnet.fromSubnetId(stack,'db-1b','subnet-0562f666bdf5c29af'),ec2.Subnet.fromSubnetId(stack,'db-1c','subnet-00ab15c0022872f06'),],},});AWS China RegionsThis library support AWS China regionscn-north-1andcn-northwest-1and will auto select local docker image mirror to accelerate the image pulling. You don't have to do anything.SecuritySeeCONTRIBUTINGfor more information.LicenseThis project is licensed under the Apache-2.0 License.