Package: pharindoko.cdk-internal-gateway
CDK Internal GatewayUse this CDK construct to createinternal serverless applications.Useful for larger companies to create internal  serverless applications that are not exposed to the internet and only accessible from the internal network.InstallationUsing Typescript for aws cdknpmicdk-internal-gatewayUsing Python for aws cdkpipinstallpharindoko.cdk-internal-gatewayArchitectureTechnical DetailsModularized approach with separate constructsattach multiple InternalApiGateway and InternalWebsite constructs to the same Internal Service to save costs and keep flexibilityInternal Service Construct (mandatory construct):creates an internal application loadbalancerforwards traffic to VPC endpoint for execute-apiredirect http to httpsgenerates custom domains for the API Gatewaygenerates certificates for the loadbalancer listenerInternal Api Gateway Construct:provides a securely configured apigateway resource out of the boxattach your aws components to the internal apigateway resourcesets api gateway to PRIVATE modesets resource policies to only allow traffic from vpc endpointattaches custom domains to the API Gatewayattaches certificates to the the API Gateway and the loadbalancerInternal Website Construct:makes your website internally accessibleredeploys your website with a single cdk deployprovides a securely configured private s3 bucket out of boxworks with SPA applications (written with Vue, Angular) and static websitesis an extension of the InternalApiGateway ConstructRequirementsCDK V2 (2.46.0)A VPCA VPC Endpoint for execute-apiA Hosted ZoneInternally accessible subnets (for the load balancer)UsageLet`s assume we create a simple internal api for our company and start with a single lambda function...Create a file called/lib/my-new-stack.tsimport{aws_apigatewayasapigateway,aws_ec2asec2,aws_lambdaaslambda,aws_route53asroute53,Stack,StackProps}from'aws-cdk-lib';import{HttpMethod}from'aws-cdk-lib/aws-events';import{InternalApiGateway,InternalApiGatewayProps,InternalService}from'cdk-internal-gateway';import{Construct}from'constructs';import*aspathfrom'path';//CreateanewstackthatinheritsfromtheInternalApiGatewayConstructexportclassServerlessStackextendsInternalApiGateway{constructor(scope:Construct,id:string,props:InternalApiGatewayProps){super(scope,id,props);//Theinternalapigatewayisavailableasmembervariable//Attachyourlambdafunctiontothethis.apiGatewayconstdefaultLambdaJavascript=this.apiGateway.root.resourceForPath("hey-js");constdefaultHandlerJavascript=newlambda.Function(this,`backendLambdaJavascript`,{functionName:`js-lambda`,runtime:lambda.Runtime.NODEJS_14_X,handler:"index.handler",code:lambda.Code.fromAsset(path.join(__dirname,"../src")),});defaultLambdaJavascript.addMethod(HttpMethod.GET,newapigateway.LambdaIntegration(defaultHandlerJavascript));}}//CreateanewstackthatcontainsthewholeservicewithallnestedstacksexportclassServiceStackextendsStack{constructor(scope:Construct,id:string,props:StackProps){super(scope,id,props);//getallparameterstocreatetheinternalservicestackconstvpc=ec2.Vpc.fromLookup(this,'vpcLookup',{vpcId:'vpc-1234567890'});constsubnetSelection={subnets:['subnet-0b1e1c6c7d8e9f0a2','subnet-0b1e1c6c7d8e9f0a3'].map((ip,index)=>ec2.Subnet.fromSubnetId(this,`Subnet${index}`,ip),),};consthostedZone=route53.HostedZone.fromLookup(this,'hostedzone',{domainName:'test.aws1234.com',privateZone:true,vpcId:vpc.vpcId,});constvpcEndpoint=ec2.InterfaceVpcEndpoint.fromInterfaceVpcEndpointAttributes(this,'vpcEndpoint',{port:443,vpcEndpointId:'vpce-1234567890',},);//createtheinternalservicestackconstserviceStack=newInternalService(this,'InternalServiceStack',{hostedZone:hostedZone,subnetSelection:subnetSelection,vpcEndpointIPAddresses:['192.168.2.1','192.168.2.2'],vpc:vpc,subjectAlternativeNames:['internal.example.com'],subDomain:"internal-service"})//createyourstackthatinheritsfromtheInternalApiGatewaynewServerlessStack(this,'MyProjectStack',{domains:serviceStack.domains,stage:"dev",vpcEndpoint:vpcEndpoint,})//createanotherstackthatinheritsfromtheInternalApiGateway......}}Reference the newly createdServiceStackin the default/bin/{project}.tsfile e.g. like thisnewServiceStack(app,'MyProjectStack',{env:{account:process.env.CDK_DEPLOY_ACCOUNT||process.env.CDK_DEFAULT_ACCOUNT,region:process.env.CDK_DEPLOY_REGION||process.env.CDK_DEFAULT_REGION}CostsYou have to expect basic infra costs for 2 components in this setup:CountTypeEstimated Costs1 xapplication load balancer20 $2 xnetwork interfaces for the vpc endpoint16 $A shared vpc can lower the costs as vpc endpoint and their network interfaces can be used together...