feat(synthetics): enable auto delete lambdas via custom resource

packages/@aws-cdk/aws-synthetics-alpha/README.md

@@ -102,27 +102,35 @@ const schedule = synthetics.Schedule.cron({
 
 If you want the canary to run just once upon deployment, you can use `Schedule.once()`.
 
-### Canary DeleteLambdaResourcesOnCanaryDeletion
+### Deleting underlying resources on canary deletion
 
-You can specify whether the AWS CloudFormation is to also delete the Lambda functions and layers used by this canary, when the canary is deleted.
+When you delete a lambda, the following underlying resources are isolated in your AWS account:
 
-This can be provisioned by setting the `enableAutoDeleteLambdas` property to `true` when we define the canary.
+  - Lambda Function that runs your canary script
+  - S3 Bucket for artifact storage
+  - IAM roles and policies
+  - Log Groups in CloudWatch Logs.
 
-```ts
-const stack = new Stack();
+To learn more about these underlying resources, see
+[Synthetics Canaries Deletion](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/synthetics_canaries_deletion.html).
+
+In the CDK, you can configure your canary to delete the underlying lambda function when the canary is deleted.
+This can be provisioned by setting the `autoDeleteLambda` property to `true`. Note that this
+will create a custom resource under the hood that takes care of the lambda deletion for you.
 
-const canary = new synthetics.Canary(stack, 'Canary', {
+```ts
+const canary = new synthetics.Canary(this, 'Canary', {
   test: synthetics.Test.custom({
     handler: 'index.handler',
     code: synthetics.Code.fromInline('/* Synthetics handler code'),
   }),
-  enableAutoDeleteLambdas: true,
+  autoDeleteLambda: true,
   runtime: synthetics.Runtime.SYNTHETICS_NODEJS_PUPPETEER_4_0,
 });
 ```
 
-Synthetic Canaries create additional resources under the hood beyond Lambda functions. Setting `enableAutoDeleteLambdas: true` will take care of
-cleaning up Lambda functions on deletion, but you still have to manually delete other resources like S3 buckets and CloudWatch logs.
+Setting `autoDeleteLambda: true` will take care of cleaning up Lambda functions on deletion,
+but you still have to manually delete other resources like S3 buckets and CloudWatch logs.
 
 ### Configuring the Canary Script
 

packages/@aws-cdk/aws-synthetics-alpha/lib/canary.ts

@@ -10,6 +10,11 @@ import { Runtime } from './runtime';
 import { Schedule } from './schedule';
 import { CloudWatchSyntheticsMetrics } from 'aws-cdk-lib/aws-synthetics/lib/synthetics-canned-metrics.generated';
 import { CfnCanary } from 'aws-cdk-lib/aws-synthetics';
+import { CustomResource, CustomResourceProvider, CustomResourceProviderRuntime } from 'aws-cdk-lib/core';
+import * as path from 'path';
+
+const AUTO_DELETE_LAMBDA_RESOURCE_TYPE = 'Custom::SyntheticsAutoDeleteLambda';
+const AUTO_DELETE_LAMBDA_TAG = 'aws-cdk:auto-delete-lambda';
 
 /**
  * Specify a test that the canary should run
@@ -195,9 +200,17 @@ export interface CanaryProps {
    * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-synthetics-canary.html#cfn-synthetics-canary-deletelambdaresourcesoncanarydeletion
    *
    * @default false
+   * @deprecated use autoDeleteLambda instead
    */
   readonly enableAutoDeleteLambdas?: boolean;
 
+  /**
+   * Whether or not to delete the lambda resource when the canary is deleted
+   *
+   * @default false
+   */
+  readonly autoDeleteLambda?: boolean;
+
   /**
    * Lifecycle rules for the generated canary artifact bucket. Has no effect
    * if a bucket is passed to `artifactsBucketLocation`. If you pass a bucket
@@ -248,6 +261,7 @@ export class Canary extends cdk.Resource implements ec2.IConnectable {
    * @internal
    */
   private readonly _connections?: ec2.Connections;
+  private readonly _resource: CfnCanary;
 
   public constructor(scope: Construct, id: string, props: CanaryProps) {
     if (props.canaryName && !cdk.Token.isUnresolved(props.canaryName)) {
@@ -285,12 +299,49 @@ export class Canary extends cdk.Resource implements ec2.IConnectable {
       code: this.createCode(props),
       runConfig: this.createRunConfig(props),
       vpcConfig: this.createVpcConfig(props),
-      deleteLambdaResourcesOnCanaryDeletion: props.enableAutoDeleteLambdas,
     });
+    this._resource = resource;
 
     this.canaryId = resource.attrId;
     this.canaryState = resource.attrState;
     this.canaryName = this.getResourceNameAttribute(resource.ref);
+
+    if (props.autoDeleteLambda ?? props.enableAutoDeleteLambdas) {
+      this.enableAutoDeleteLambda();
+    }
+  }
+
+  private enableAutoDeleteLambda() {
+    const provider = CustomResourceProvider.getOrCreateProvider(this, AUTO_DELETE_LAMBDA_RESOURCE_TYPE, {
+      codeDirectory: path.join(__dirname, '..', 'custom-resource-handlers', 'dist', 'aws-synthetics-alpha', 'auto-delete-lambda-handler'),
+      useCfnResponseWrapper: false,
+      runtime: CustomResourceProviderRuntime.NODEJS_18_X,
+      description: `Lambda function for auto-deleting lambda created by ${this.canaryName}.`,
+      policyStatements: [{
+        Effect: 'Allow',
+        Action: ['lambda:DeleteFunction'],
+        Resource: this.lambdaArn(),
+      }, {
+        Effect: 'Allow',
+        Action: ['synthetics:GetCanary'],
+        Resource: '*',
+      }],
+    });
+
+    new CustomResource(this, 'AutoDeleteObjectsCustomResource', {
+      resourceType: AUTO_DELETE_LAMBDA_RESOURCE_TYPE,
+      serviceToken: provider.serviceToken,
+      properties: {
+        CanaryName: this.canaryName,
+      },
+    });
+
+    // We also tag the canary to record the fact that we want it autodeleted.
+    // The custom resource will check this tag before actually doing the delete.
+    // Because tagging and untagging will ALWAYS happen before the CR is deleted,
+    // we can set `autoDeleteLambda: false` without the removal of the CR emptying
+    // the lambda as a side effect.
+    cdk.Tags.of(this._resource).add(AUTO_DELETE_LAMBDA_TAG, 'true');
   }
 
   /**
@@ -402,6 +453,15 @@ export class Canary extends cdk.Resource implements ec2.IConnectable {
     });
   }
 
+  private lambdaArn() {
+    return cdk.Stack.of(this).formatArn({
+      service: 'lambda',
+      resource: 'function',
+      arnFormat: cdk.ArnFormat.COLON_RESOURCE_NAME,
+      resourceName: 'cwsyn-*',
+    });
+  }
+
   /**
    * Returns the code object taken in by the canary resource.
    */

packages/@aws-cdk/aws-synthetics-alpha/package.json

@@ -67,7 +67,10 @@
   "cdk-build": {
     "env": {
       "AWSLINT_BASE_CONSTRUCT": true
-    }
+    },
+    "pre": [
+      "./scripts/airlift-custom-resource-handlers.sh"
+    ]
   },
   "keywords": [
     "aws",
@@ -84,6 +87,7 @@
   "license": "Apache-2.0",
   "devDependencies": {
     "@aws-cdk/cdk-build-tools": "0.0.0",
+    "@aws-cdk/custom-resource-handlers": "0.0.0",
     "@aws-cdk/integ-runner": "0.0.0",
     "@aws-cdk/pkglint": "0.0.0",
     "@aws-cdk/integ-tests-alpha": "0.0.0",

packages/@aws-cdk/aws-synthetics-alpha/scripts/airlift-custom-resource-handlers.sh

@@ -0,0 +1,23 @@
+#!/bin/bash
+
+scriptdir=$(cd $(dirname $0) && pwd)
+customresourcedir=$(node -p "path.dirname(require.resolve('@aws-cdk/custom-resource-handlers/package.json'))")
+awscdklibdir=${scriptdir}/..
+
+list_custom_resources() {
+  for file in $customresourcedir/dist/aws-synthetics-alpha/*/index.js; do
+    echo $file | rev | cut -d "/" -f 2-4 | rev
+  done
+}
+
+customresources=$(list_custom_resources)
+
+echo $customresources
+
+cd $awscdklibdir
+mkdir -p $awscdklibdir/custom-resource-handlers
+
+for cr in $customresources; do
+  mkdir -p $awscdklibdir/custom-resource-handlers/$cr
+  cp $customresourcedir/$cr/index.js $awscdklibdir/custom-resource-handlers/$cr
+done

packages/@aws-cdk/aws-synthetics-alpha/test/canary.test.ts

@@ -36,7 +36,7 @@ testDeprecated('Basic canary properties work', () => {
   });
 });
 
-testDeprecated('Can set `DeleteLambdaResourceOnCanaryDeletion`', () => {
+testDeprecated('autoDeleteLambda introduces custom resource to delete lambda', () => {
   // GIVEN
   const stack = new Stack();
 
@@ -46,14 +46,12 @@ testDeprecated('Can set `DeleteLambdaResourceOnCanaryDeletion`', () => {
       handler: 'index.handler',
       code: synthetics.Code.fromInline('/* Synthetics handler code'),
     }),
-    enableAutoDeleteLambdas: true,
+    autoDeleteLambda: true,
     runtime: synthetics.Runtime.SYNTHETICS_NODEJS_PUPPETEER_3_8,
   });
 
   // THEN
-  Template.fromStack(stack).hasResourceProperties('AWS::Synthetics::Canary', {
-    DeleteLambdaResourcesOnCanaryDeletion: true,
-  });
+  Template.fromStack(stack).resourceCountIs('Custom::SyntheticsAutoDeleteLambda', 1);
 });
 
 testDeprecated('Canary can have generated name', () => {

packages/@aws-cdk/aws-synthetics-alpha/test/integ.canary-auto-delete-lambda.js.snapshot/cdk-synthetics-canary-auto-delete-lambda.assets.json

@@ -0,0 +1,45 @@
+{
+  "version": "33.0.0",
+  "files": {
+    "35ce54dc52d67452e804a0c5cf852e07a4fe1202b8f44657a0b016fdd6037fde": {
+      "source": {
+        "path": "asset.35ce54dc52d67452e804a0c5cf852e07a4fe1202b8f44657a0b016fdd6037fde",
+        "packaging": "zip"
+      },
+      "destinations": {
+        "current_account-current_region": {
+          "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
+          "objectKey": "35ce54dc52d67452e804a0c5cf852e07a4fe1202b8f44657a0b016fdd6037fde.zip",
+          "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
+        }
+      }
+    },
+    "7a1aa4038bfd6218fb1a3abf28d3007c71ea0e2b12db642b5a12434a928c14da": {
+      "source": {
+        "path": "asset.7a1aa4038bfd6218fb1a3abf28d3007c71ea0e2b12db642b5a12434a928c14da",
+        "packaging": "zip"
+      },
+      "destinations": {
+        "current_account-current_region": {
+          "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
+          "objectKey": "7a1aa4038bfd6218fb1a3abf28d3007c71ea0e2b12db642b5a12434a928c14da.zip",
+          "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
+        }
+      }
+    },
+    "b8c7a10e4bcf6d8973de0803384857badfc9357895262fdfa1d9f8016d7fe3f7": {
+      "source": {
+        "path": "cdk-synthetics-canary-auto-delete-lambda.template.json",
+        "packaging": "file"
+      },
+      "destinations": {
+        "current_account-current_region": {
+          "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
+          "objectKey": "b8c7a10e4bcf6d8973de0803384857badfc9357895262fdfa1d9f8016d7fe3f7.json",
+          "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
+        }
+      }
+    }
+  },
+  "dockerImages": {}
+}