AWS AppConfig Construct Library

This module is part of the AWS Cloud Development Kit project.

For a high level overview of what AWS AppConfig is and how it works, please take a look here: What is AWS AppConfig?

Basic Hosted Configuration Use Case

The main way most AWS AppConfig users utilize the service is through hosted configuration, which involves storing configuration data directly within AWS AppConfig.

An example use case:

app = AWSCDK::AppConfig::Application.new(self, "MyApp")
env = AWSCDK::AppConfig::Environment.new(self, "MyEnv", {
    application: app,
})

AWSCDK::AppConfig::HostedConfiguration.new(self, "MyHostedConfig", {
    application: app,
    deploy_to: [env],
    content: AWSCDK::AppConfig::ConfigurationContent.from_inline_text("This is my configuration content."),
})

This will create the application and environment for your configuration and then deploy your configuration to the specified environment.

For more information about what these resources are: Creating feature flags and free form configuration data in AWS AppConfig.

For more information about deploying configuration: Deploying feature flags and configuration data in AWS AppConfig

For an in-depth walkthrough of specific resources and how to use them, please take a look at the following sections.

Application

AWS AppConfig Application Documentation

In AWS AppConfig, an application is simply an organizational construct like a folder. Configurations and environments are associated with the application.

When creating an application through CDK, the name and description of an application are optional.

Create a simple application:

AWSCDK::AppConfig::Application.new(self, "MyApplication")

Environment

AWS AppConfig Environment Documentation

Basic environment with monitors:

application = nil # AWSCDK::AppConfig::Application
alarm = nil # AWSCDK::CloudWatch::Alarm
composite_alarm = nil # AWSCDK::CloudWatch::CompositeAlarm


AWSCDK::AppConfig::Environment.new(self, "MyEnvironment", {
    application: application,
    monitors: [
        AWSCDK::AppConfig::Monitor.from_cloud_watch_alarm(alarm),
        AWSCDK::AppConfig::Monitor.from_cloud_watch_alarm(composite_alarm),
    ],
})

Environment monitors also support L1 CfnEnvironment.MonitorsProperty constructs through the from_cfn_monitors_property method. However, this is not the recommended approach for CloudWatch alarms because a role will not be auto-generated if not provided.

See About the AWS AppConfig data plane service for more information.

Permissions

You can grant read permission on the environment's configurations with the grantReadConfig method as follows:

require 'aws-cdk-lib'


app = AWSCDK::AppConfig::Application.new(self, "MyAppConfig")
env = AWSCDK::AppConfig::Environment.new(self, "MyEnvironment", {
    application: app,
})

user = AWSCDK::IAM::User.new(self, "MyUser")
env.grant_read_config(user)

Deployment Strategy

AWS AppConfig Deployment Strategy Documentation

A deployment strategy defines how a configuration will roll out. The roll out is defined by four parameters: deployment type, growth factor, deployment duration, and final bake time.

Deployment strategy with predefined values:

AWSCDK::AppConfig::DeploymentStrategy.new(self, "MyDeploymentStrategy", {
    rollout_strategy: AWSCDK::AppConfig::RolloutStrategy.CANARY_10_PERCENT_20_MINUTES,
})

Deployment strategy with custom values:

AWSCDK::AppConfig::DeploymentStrategy.new(self, "MyDeploymentStrategy", {
    rollout_strategy: AWSCDK::AppConfig::RolloutStrategy.linear({
        growth_factor: 20,
        deployment_duration: AWSCDK::Duration.minutes(30),
        final_bake_time: AWSCDK::Duration.minutes(30),
    }),
})

Referencing a deployment strategy by ID:

AWSCDK::AppConfig::DeploymentStrategy.from_deployment_strategy_id(self, "MyImportedDeploymentStrategy", AWSCDK::AppConfig::DeploymentStrategyId.from_string("abc123"))

Referencing an AWS AppConfig predefined deployment strategy by ID:

AWSCDK::AppConfig::DeploymentStrategy.from_deployment_strategy_id(self, "MyImportedPredefinedDeploymentStrategy", AWSCDK::AppConfig::DeploymentStrategyId.CANARY_10_PERCENT_20_MINUTES)

Configuration

A configuration is a higher-level construct that can either be a HostedConfiguration (stored internally through AWS AppConfig) or a SourcedConfiguration (stored in an Amazon S3 bucket, AWS Secrets Manager secrets, Systems Manager (SSM) Parameter Store parameters, SSM documents, or AWS CodePipeline). This construct manages deployments on creation.

HostedConfiguration

A hosted configuration represents configuration stored in the AWS AppConfig hosted configuration store. A hosted configuration takes in the configuration content and associated AWS AppConfig application. On construction of a hosted configuration, the configuration is deployed.

You can define hosted configuration content using any of the following ConfigurationContent methods:

• from_file - Defines the hosted configuration content from a file (you can specify a relative path). The content type will be determined by the file extension unless specified.

application = nil # AWSCDK::AppConfig::Application


AWSCDK::AppConfig::HostedConfiguration.new(self, "MyHostedConfiguration", {
    application: application,
    content: AWSCDK::AppConfig::ConfigurationContent.from_file("config.json"),
})

• from_inline_text - Defines the hosted configuration from inline text. The content type will be set as text/plain.

application = nil # AWSCDK::AppConfig::Application


AWSCDK::AppConfig::HostedConfiguration.new(self, "MyHostedConfiguration", {
    application: application,
    content: AWSCDK::AppConfig::ConfigurationContent.from_inline_text("This is my configuration content."),
})

• from_inline_json - Defines the hosted configuration from inline JSON. The content type will be set as application/json unless specified.

application = nil # AWSCDK::AppConfig::Application


AWSCDK::AppConfig::HostedConfiguration.new(self, "MyHostedConfiguration", {
    application: application,
    content: AWSCDK::AppConfig::ConfigurationContent.from_inline_json("{}"),
})

• from_inline_yaml - Defines the hosted configuration from inline YAML. The content type will be set as application/x-yaml.

application = nil # AWSCDK::AppConfig::Application


AWSCDK::AppConfig::HostedConfiguration.new(self, "MyHostedConfiguration", {
    application: application,
    content: AWSCDK::AppConfig::ConfigurationContent.from_inline_yaml("MyConfig: This is my content."),
})

• from_inline - Defines the hosted configuration from user-specified content types. The content type will be set as application/octet-stream unless specified.

application = nil # AWSCDK::AppConfig::Application


AWSCDK::AppConfig::HostedConfiguration.new(self, "MyHostedConfiguration", {
    application: application,
    content: AWSCDK::AppConfig::ConfigurationContent.from_inline("This is my configuration content."),
})

AWS AppConfig supports the following types of configuration profiles.

• Feature flag: Use a feature flag configuration to turn on new features that require a timely deployment, such as a product launch or announcement.
• Freeform: Use a freeform configuration to carefully introduce changes to your application.

A hosted configuration with type:

application = nil # AWSCDK::AppConfig::Application


AWSCDK::AppConfig::HostedConfiguration.new(self, "MyHostedConfiguration", {
    application: application,
    content: AWSCDK::AppConfig::ConfigurationContent.from_inline_text("This is my configuration content."),
    type: AWSCDK::AppConfig::ConfigurationType::FEATURE_FLAGS,
})

When you create a configuration and configuration profile, you can specify up to two validators. A validator ensures that your configuration data is syntactically and semantically correct. You can create validators in either JSON Schema or as an AWS Lambda function. See About validators for more information.

When you import a JSON Schema validator from a file, you can pass in a relative path.

A hosted configuration with validators:

application = nil # AWSCDK::AppConfig::Application
fn = nil # AWSCDK::Lambda::Function


AWSCDK::AppConfig::HostedConfiguration.new(self, "MyHostedConfiguration", {
    application: application,
    content: AWSCDK::AppConfig::ConfigurationContent.from_inline_text("This is my configuration content."),
    validators: [
        AWSCDK::AppConfig::JsonSchemaValidator.from_file("schema.json"),
        AWSCDK::AppConfig::LambdaValidator.from_function(fn),
    ],
})

You can attach a deployment strategy (as described in the previous section) to your configuration to specify how you want your configuration to roll out.

A hosted configuration with a deployment strategy:

application = nil # AWSCDK::AppConfig::Application


AWSCDK::AppConfig::HostedConfiguration.new(self, "MyHostedConfiguration", {
    application: application,
    content: AWSCDK::AppConfig::ConfigurationContent.from_inline_text("This is my configuration content."),
    deployment_strategy: AWSCDK::AppConfig::DeploymentStrategy.new(self, "MyDeploymentStrategy", {
        rollout_strategy: AWSCDK::AppConfig::RolloutStrategy.linear({
            growth_factor: 15,
            deployment_duration: AWSCDK::Duration.minutes(30),
            final_bake_time: AWSCDK::Duration.minutes(15),
        }),
    }),
})

The deploy_to parameter is used to specify which environments to deploy the configuration to.

A hosted configuration with deploy_to:

application = nil # AWSCDK::AppConfig::Application
env = nil # AWSCDK::AppConfig::Environment


AWSCDK::AppConfig::HostedConfiguration.new(self, "MyHostedConfiguration", {
    application: application,
    content: AWSCDK::AppConfig::ConfigurationContent.from_inline_text("This is my configuration content."),
    deploy_to: [env],
})

When more than one configuration is set to deploy to the same environment, the deployments will occur one at a time. This is done to satisfy AppConfig's constraint:

[!NOTE] You can only deploy one configuration at a time to an environment. However, you can deploy one configuration each to different environments at the same time.

The deployment order matches the order in which the configurations are declared.

app = AWSCDK::AppConfig::Application.new(self, "MyApp")
env = AWSCDK::AppConfig::Environment.new(self, "MyEnv", {
    application: app,
})

AWSCDK::AppConfig::HostedConfiguration.new(self, "MyFirstHostedConfig", {
    application: app,
    deploy_to: [env],
    content: AWSCDK::AppConfig::ConfigurationContent.from_inline_text("This is my first configuration content."),
})

AWSCDK::AppConfig::HostedConfiguration.new(self, "MySecondHostedConfig", {
    application: app,
    deploy_to: [env],
    content: AWSCDK::AppConfig::ConfigurationContent.from_inline_text("This is my second configuration content."),
})

If an application would benefit from a deployment order that differs from the declared order, you can defer the decision by using IEnvironment.addDeployment rather than the deploy_to property. In this example, first_config will be deployed before second_config.

app = AWSCDK::AppConfig::Application.new(self, "MyApp")
env = AWSCDK::AppConfig::Environment.new(self, "MyEnv", {
    application: app,
})

second_config = AWSCDK::AppConfig::HostedConfiguration.new(self, "MySecondHostedConfig", {
    application: app,
    content: AWSCDK::AppConfig::ConfigurationContent.from_inline_text("This is my second configuration content."),
})

first_config = AWSCDK::AppConfig::HostedConfiguration.new(self, "MyFirstHostedConfig", {
    application: app,
    deploy_to: [env],
    content: AWSCDK::AppConfig::ConfigurationContent.from_inline_text("This is my first configuration content."),
})

env.add_deployment(second_config)

Alternatively, you can defer multiple deployments in favor of IEnvironment.addDeployments, which allows you to declare multiple configurations in the order they will be deployed. In this example the deployment order will be first_config, then second_config, and finally third_config.

app = AWSCDK::AppConfig::Application.new(self, "MyApp")
env = AWSCDK::AppConfig::Environment.new(self, "MyEnv", {
    application: app,
})

second_config = AWSCDK::AppConfig::HostedConfiguration.new(self, "MySecondHostedConfig", {
    application: app,
    content: AWSCDK::AppConfig::ConfigurationContent.from_inline_text("This is my second configuration content."),
})

third_config = AWSCDK::AppConfig::HostedConfiguration.new(self, "MyThirdHostedConfig", {
    application: app,
    content: AWSCDK::AppConfig::ConfigurationContent.from_inline_text("This is my third configuration content."),
})

first_config = AWSCDK::AppConfig::HostedConfiguration.new(self, "MyFirstHostedConfig", {
    application: app,
    content: AWSCDK::AppConfig::ConfigurationContent.from_inline_text("This is my first configuration content."),
})

env.add_deployments(first_config, second_config, third_config)

Any mix of deploy_to, add_deployment, and add_deployments is permitted. The declaration order will be respected regardless of the approach used.

[!IMPORTANT] If none of these options are utilized, there will not be any deployments.

You can use customer managed key to encrypt a hosted configuration. For mora information, see Data encryption at rest for AWS AppConfig.

application = nil # AWSCDK::AppConfig::Application
kms_key = nil # AWSCDK::KMS::Key


AWSCDK::AppConfig::HostedConfiguration.new(self, "MyHostedConfiguration", {
    application: application,
    content: AWSCDK::AppConfig::ConfigurationContent.from_inline_text("This is my configuration content."),
    type: AWSCDK::AppConfig::ConfigurationType::FEATURE_FLAGS,
    kms_key: kms_key,
})

SourcedConfiguration

A sourced configuration represents configuration stored in any of the following:

• Amazon S3 bucket
• AWS Secrets Manager secret
• Systems Manager
• (SSM) Parameter Store parameter
• SSM document
• AWS CodePipeline.

A sourced configuration takes in the location source construct and optionally a version number to deploy. On construction of a sourced configuration, the configuration is deployed only if a version number is specified.

S3

Use an Amazon S3 bucket to store a configuration.

application = nil # AWSCDK::AppConfig::Application


bucket = AWSCDK::S3::Bucket.new(self, "MyBucket", {
    versioned: true,
})

AWSCDK::AppConfig::SourcedConfiguration.new(self, "MySourcedConfiguration", {
    application: application,
    location: AWSCDK::AppConfig::ConfigurationSource.from_bucket(bucket, "path/to/file.json"),
})

Use an encrypted bucket:

application = nil # AWSCDK::AppConfig::Application


bucket = AWSCDK::S3::Bucket.new(self, "MyBucket", {
    versioned: true,
    encryption: AWSCDK::S3::BucketEncryption::KMS,
})

AWSCDK::AppConfig::SourcedConfiguration.new(self, "MySourcedConfiguration", {
    application: application,
    location: AWSCDK::AppConfig::ConfigurationSource.from_bucket(bucket, "path/to/file.json"),
})

AWS Secrets Manager secret

Use a Secrets Manager secret to store a configuration.

application = nil # AWSCDK::AppConfig::Application
secret = nil # AWSCDK::SecretsManager::Secret


AWSCDK::AppConfig::SourcedConfiguration.new(self, "MySourcedConfiguration", {
    application: application,
    location: AWSCDK::AppConfig::ConfigurationSource.from_secret(secret),
})

SSM Parameter Store parameter

Use an SSM parameter to store a configuration.

application = nil # AWSCDK::AppConfig::Application
parameter = nil # AWSCDK::SSM::StringParameter


AWSCDK::AppConfig::SourcedConfiguration.new(self, "MySourcedConfiguration", {
    application: application,
    location: AWSCDK::AppConfig::ConfigurationSource.from_parameter(parameter),
    version_number: "1",
})

SSM document

Use an SSM document to store a configuration.

application = nil # AWSCDK::AppConfig::Application
document = nil # AWSCDK::SSM::CfnDocument


AWSCDK::AppConfig::SourcedConfiguration.new(self, "MySourcedConfiguration", {
    application: application,
    location: AWSCDK::AppConfig::ConfigurationSource.from_cfn_document(document),
})

AWS CodePipeline

Use an AWS CodePipeline pipeline to store a configuration.

application = nil # AWSCDK::AppConfig::Application
pipeline = nil # AWSCDK::Codepipeline::Pipeline


AWSCDK::AppConfig::SourcedConfiguration.new(self, "MySourcedConfiguration", {
    application: application,
    location: AWSCDK::AppConfig::ConfigurationSource.from_pipeline(pipeline),
})

Similar to a hosted configuration, a sourced configuration can optionally take in a type, validators, a deploy_to parameter, and a deployment strategy.

A sourced configuration with type:

application = nil # AWSCDK::AppConfig::Application
bucket = nil # AWSCDK::S3::Bucket


AWSCDK::AppConfig::SourcedConfiguration.new(self, "MySourcedConfiguration", {
    application: application,
    location: AWSCDK::AppConfig::ConfigurationSource.from_bucket(bucket, "path/to/file.json"),
    type: AWSCDK::AppConfig::ConfigurationType::FEATURE_FLAGS,
    name: "MyConfig",
    description: "This is my sourced configuration from CDK.",
})

A sourced configuration with validators:

application = nil # AWSCDK::AppConfig::Application
bucket = nil # AWSCDK::S3::Bucket
fn = nil # AWSCDK::Lambda::Function


AWSCDK::AppConfig::SourcedConfiguration.new(self, "MySourcedConfiguration", {
    application: application,
    location: AWSCDK::AppConfig::ConfigurationSource.from_bucket(bucket, "path/to/file.json"),
    validators: [
        AWSCDK::AppConfig::JsonSchemaValidator.from_file("schema.json"),
        AWSCDK::AppConfig::LambdaValidator.from_function(fn),
    ],
})

A sourced configuration with a deployment strategy:

application = nil # AWSCDK::AppConfig::Application
bucket = nil # AWSCDK::S3::Bucket


AWSCDK::AppConfig::SourcedConfiguration.new(self, "MySourcedConfiguration", {
    application: application,
    location: AWSCDK::AppConfig::ConfigurationSource.from_bucket(bucket, "path/to/file.json"),
    deployment_strategy: AWSCDK::AppConfig::DeploymentStrategy.new(self, "MyDeploymentStrategy", {
        rollout_strategy: AWSCDK::AppConfig::RolloutStrategy.linear({
            growth_factor: 15,
            deployment_duration: AWSCDK::Duration.minutes(30),
            final_bake_time: AWSCDK::Duration.minutes(15),
        }),
    }),
})

Deletion Protection Check

You can enable deletion protection on the environment and configuration profile by setting the deletion_protection_check property.

• ACCOUNT_DEFAULT: The default setting, which uses account-level deletion protection. To configure account-level deletion protection, use the UpdateAccountSettings API.
• APPLY: Instructs the deletion protection check to run, even if deletion protection is disabled at the account level. APPLY also forces the deletion protection check to run against resources created in the past hour, which are normally excluded from deletion protection checks.
• BYPASS: Instructs AWS AppConfig to bypass the deletion protection check and delete an environment even if deletion protection would have otherwise prevented it.

application = nil # AWSCDK::AppConfig::Application
alarm = nil # AWSCDK::CloudWatch::Alarm
composite_alarm = nil # AWSCDK::CloudWatch::CompositeAlarm
bucket = nil # AWSCDK::S3::Bucket


# Environment deletion protection check
AWSCDK::AppConfig::Environment.new(self, "MyEnvironment", {
    application: application,
    deletion_protection_check: AWSCDK::AppConfig::DeletionProtectionCheck::APPLY,
})

# configuration profile with deletion protection check
AWSCDK::AppConfig::HostedConfiguration.new(self, "MyHostedConfigFromFile", {
    application: application,
    content: AWSCDK::AppConfig::ConfigurationContent.from_file("config.json"),
    deletion_protection_check: AWSCDK::AppConfig::DeletionProtectionCheck::BYPASS,
})

AWSCDK::AppConfig::SourcedConfiguration.new(self, "MySourcedConfiguration", {
    application: application,
    location: AWSCDK::AppConfig::ConfigurationSource.from_bucket(bucket, "path/to/file.json"),
    deletion_protection_check: AWSCDK::AppConfig::DeletionProtectionCheck::ACCOUNT_DEFAULT,
})

Extension

An extension augments your ability to inject logic or behavior at different points during the AWS AppConfig workflow of creating or deploying a configuration. You can associate these types of tasks with AWS AppConfig applications, environments, and configuration profiles. See: https://docs.aws.amazon.com/appconfig/latest/userguide/working-with-appconfig-extensions.html

An extension defines one or more actions, that it performs during an AWS AppConfig workflow. Each action is invoked either when you interact with AWS AppConfig or when AWS AppConfig is performing a process on your behalf. These invocation points are called action points. AWS AppConfig extensions support the following action points:

• PRE_START_DEPLOYMENT
• PRE_CREATE_HOSTED_CONFIGURATION_VERSION
• ON_DEPLOYMENT_START
• ON_DEPLOYMENT_STEP
• ON_DEPLOYMENT_BAKING
• ON_DEPLOYMENT_COMPLETE
• ON_DEPLOYMENT_ROLLED_BACK
• AT_DEPLOYMENT_TICK

See: https://docs.aws.amazon.com/appconfig/latest/userguide/working-with-appconfig-extensions-about.html

AWS Lambda destination

Use an AWS Lambda as the event destination for an extension.

fn = nil # AWSCDK::Lambda::Function


AWSCDK::AppConfig::Extension.new(self, "MyExtension", {
    actions: [
        AWSCDK::AppConfig::Action.new({
            action_points: [AWSCDK::AppConfig::ActionPoint::ON_DEPLOYMENT_START],
            event_destination: AWSCDK::AppConfig::LambdaDestination.new(fn),
        }),
    ],
})

Lambda extension with parameters:

fn = nil # AWSCDK::Lambda::Function


AWSCDK::AppConfig::Extension.new(self, "MyExtension", {
    actions: [
        AWSCDK::AppConfig::Action.new({
            action_points: [AWSCDK::AppConfig::ActionPoint::ON_DEPLOYMENT_START],
            event_destination: AWSCDK::AppConfig::LambdaDestination.new(fn),
        }),
    ],
    parameters: [
        AWSCDK::AppConfig::Parameter.required("testParam", "true"),
        AWSCDK::AppConfig::Parameter.not_required("testNotRequiredParam"),
    ],
})

Amazon Simple Queue Service (SQS) destination

Use a queue as the event destination for an extension.

queue = nil # AWSCDK::SQS::Queue


AWSCDK::AppConfig::Extension.new(self, "MyExtension", {
    actions: [
        AWSCDK::AppConfig::Action.new({
            action_points: [AWSCDK::AppConfig::ActionPoint::ON_DEPLOYMENT_START],
            event_destination: AWSCDK::AppConfig::SQSDestination.new(queue),
        }),
    ],
})

Amazon Simple Notification Service (SNS) destination

Use an SNS topic as the event destination for an extension.

topic = nil # AWSCDK::SNS::Topic


AWSCDK::AppConfig::Extension.new(self, "MyExtension", {
    actions: [
        AWSCDK::AppConfig::Action.new({
            action_points: [AWSCDK::AppConfig::ActionPoint::ON_DEPLOYMENT_START],
            event_destination: AWSCDK::AppConfig::SNSDestination.new(topic),
        }),
    ],
})

Amazon EventBridge destination

Use the default event bus as the event destination for an extension.

bus = AWSCDK::Events::EventBus.from_event_bus_name(self, "MyEventBus", "default")

AWSCDK::AppConfig::Extension.new(self, "MyExtension", {
    actions: [
        AWSCDK::AppConfig::Action.new({
            action_points: [AWSCDK::AppConfig::ActionPoint::ON_DEPLOYMENT_START],
            event_destination: AWSCDK::AppConfig::EventBridgeDestination.new(bus),
        }),
    ],
})

You can also add extensions and their associations directly by calling on_deployment_complete() or any other action point method on the AWS AppConfig application, configuration, or environment resource. To add an association to an existing extension, you can call add_extension() on the resource.

Adding an association to an AWS AppConfig application:

application = nil # AWSCDK::AppConfig::Application
extension = nil # AWSCDK::AppConfig::Extension
lambda_destination = nil # AWSCDK::AppConfig::LambdaDestination


application.add_extension(extension)
application.on_deployment_complete(lambda_destination)