[cdk-pipelines] Add an example of Lambda with blue/green or canary deployments

[srethira]

Please provide documentation for implementing blue/green or canary deployments using CDK Pipelines.

---

This is a 📕 documentation issue

[rix0rrr]

We don't think Lambda B/G deployments are safe in the general case.

The B/G part of the deployment only works if you change the Lambda source code, not if you change anything about related objects. The easiest to get wrong is the IAM policy. If you change code and remove a permission (which is a simple thing to do in CDK) the policy changes will be deployed in a point-in-time fashion, breaking your old Lambda version that would still be requiring it.

This is a sharp edge that we are afraid a lot of people will get bitten by. As such, you can do this today, but I'm not sure we're ready to recommend it for general use yet.

[rix0rrr]

By the way we do have an example of Lambda B/G deployments here: https://docs.aws.amazon.com/cdk/latest/guide/codepipeline_example.html

[BrianFarnhill]

I was building this for a demo recently actually - code is in one of my repos (purely for demo purposes) - https://github.com/brianfarnhill/Examples.LambdaDeploymentPipeline - have a look at it, it might be useful

[AdamTylerLynch]

I was building this for a demo recently actually - code is in one of my repos (purely for demo purposes) - https://github.com/brianfarnhill/Examples.LambdaDeploymentPipeline - have a look at it, it might be useful

I am not able to access that repo. Is it public?

[BrianFarnhill]

@AdamTylerLynch sorry that was my bad, realised I had a couple of account IDs in there and wanted to take them out. I've been rebuilding that demo in a bit of a different way recently (adds CodeArtifact in for custom CDK constructs too, but that does complicate things a little). It's a work in progress but the guts of that old repo is there again now, in this new URL.

https://github.com/BrianFarnhill/Demos.CDKApiPipeline

[samlaf]

@BrianFarnhill From what I understand, you are using:

• aws-cdk v2
• but the old CdkPipeline api instead of the newer CodePipeline api (see https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.pipelines.CdkPipeline.html)
• you are also using aws_codepipeline and the equivalent codebuild, codedeploy, etc. modules

I thought the whole point of cdk pipelines was that we didn't have to use aws_codepipeline, aws_codebuild, aws_codedeploy, etc. individually.

Is your reason for this choice that cdk pipelines is too limited to be useful alone at the moment? I for example noticed that cdk-pipelines don't seem to use CodeDeploy, so I'm still unsure how to rollback a stack (which is deployed via cloudformation changesets) after a unit-test fails.

[BrianFarnhill]

@samlaf I'm in a bit of a transition in that repo - I dragged everything forward to v2 of the CDK but haven't done the pipeline yet. I do however absolutely plan to use the newer pipeline construct for this though as that will be a lot cleaner from a code perspective.

My use of the the native code* resources is to add things to that core pipeline though, not provision the core resources themselves. For example, I use aws_codepipeline to give me the Artifact class, not to provision a pipeline manually. I use aws_codebuild to give me the ReportGroup and BuildSpec classes. My goal in using the CDK to is to minimise the amount of code I need to write to get to an outcome, and the CDK Pipelines stuff is a brilliant example of that - and where that module doesn't give me exactly what I need I have lots of ways to extend it and tweak it, so I still get the benefit of using the Pipelines module while still ticking all the boxes for my own requirements too.

So to answer the question specifically - the reason for my choice is that I just haven't gotten around to updating the pipeline yet, but absolutely intend to.

[samlaf]

Thank you @BrianFarnhill !
Thanks to your code I was able to add ReportGroups to my pipeline using CodePipeline Api, and I'll be looking to integrate many of your other features too. I watched your repo to get updates when you migrate to the new Api.

[github-actions]

This issue has not received any attention in 1 year. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.