feat(app-staging-synthesizer): clean up staging resources on deletion

lerna.json

@@ -4,6 +4,7 @@
   "packages": [
     "packages/aws-cdk-lib",
     "packages/cdk-assets",
+    "packages/custom-resource-bindings",
     "packages/aws-cdk",
     "packages/cdk",
     "packages/@aws-cdk/*",

package.json

@@ -72,6 +72,7 @@
       "packages/aws-cdk",
       "packages/cdk",
       "packages/cdk-assets",
+      "packages/custom-resource-bindings",
       "packages/@aws-cdk/*",
       "packages/awslint",
       "packages/@aws-cdk-containers/*",
@@ -139,6 +140,8 @@
       "@aws-cdk/pipelines/aws-sdk/**",
       "@aws-cdk/yaml-cfn/yaml",
       "@aws-cdk/yaml-cfn/yaml/**",
+      "aws-cdk-lib/@aws-cdk/custom-resource-bindings",
+      "aws-cdk-lib/@aws-cdk/custom-resource-bindings/**",
       "aws-cdk-lib/@balena/dockerignore",
       "aws-cdk-lib/@balena/dockerignore/**",
       "aws-cdk-lib/case",

packages/@aws-cdk/app-staging-synthesizer-alpha/lib/default-staging-stack.ts

@@ -3,6 +3,9 @@ import * as path from 'path';
 import {
   App,
   ArnFormat,
+  CustomResource,
+  CustomResourceProvider,
+  builtInCustomResourceProviderNodeRuntime,
   BootstraplessSynthesizer,
   DockerImageAssetSource,
   Duration,
@@ -11,6 +14,7 @@ import {
   RemovalPolicy,
   Stack,
   StackProps,
+  Tags,
 } from 'aws-cdk-lib';
 import * as ecr from 'aws-cdk-lib/aws-ecr';
 import * as iam from 'aws-cdk-lib/aws-iam';
@@ -21,6 +25,8 @@ import { BootstrapRole } from './bootstrap-roles';
 import { FileStagingLocation, IStagingResources, IStagingResourcesFactory, ImageStagingLocation } from './staging-stack';
 
 export const DEPLOY_TIME_PREFIX = 'deploy-time/';
+const AUTO_DELETE_OBJECTS_RESOURCE_TYPE = 'Custom::S3AutoDeleteObjects';
+const AUTO_DELETE_OBJECTS_TAG = 'aws-cdk:auto-delete-objects';
 
 /**
  * User configurable options to the DefaultStagingStack.
@@ -353,9 +359,58 @@ export class DefaultStagingStack extends Stack implements IStagingResources {
       expiration: this.props.deployTimeFileAssetLifetime ?? Duration.days(30),
     });
 
+    this.enableAutoDeleteObjects(bucket);
+
     return stagingBucketName;
   }
 
+  private enableAutoDeleteObjects(bucket: s3.Bucket) {
+    const provider = CustomResourceProvider.getOrCreateProvider(this, AUTO_DELETE_OBJECTS_RESOURCE_TYPE, {
+      codeDirectory: path.join(__dirname, '..', 'custom-resource-bindings', 'aws-s3', 'auto-delete-objects-handler'),
+      inlineCode: true,
+      runtime: builtInCustomResourceProviderNodeRuntime(bucket),
+      description: `Lambda function for auto-deleting objects in ${bucket.bucketName} S3 bucket.`,
+    });
+
+    // Use a bucket policy to allow the custom resource to delete
+    // objects in the bucket
+    bucket.addToResourcePolicy(new iam.PolicyStatement({
+      actions: [
+        // list objects
+        's3:GetBucket*',
+        's3:List*',
+        's3:DeleteObject*', // and then delete them
+      ],
+      resources: [
+        bucket.bucketArn,
+        bucket.arnForObjects('*'),
+      ],
+      principals: [new iam.ArnPrincipal(provider.roleArn)],
+    }));
+
+    const customResource = new CustomResource(this, 'AutoDeleteObjectsCustomResource', {
+      resourceType: AUTO_DELETE_OBJECTS_RESOURCE_TYPE,
+      serviceToken: provider.serviceToken,
+      properties: {
+        BucketName: bucket.bucketName,
+      },
+    });
+
+    // Ensure bucket policy is deleted AFTER the custom resource otherwise
+    // we don't have permissions to list and delete in the bucket.
+    // (add a `if` to make TS happy)
+    if (bucket.policy) {
+      customResource.node.addDependency(bucket.policy);
+    }
+
+    // We also tag the bucket to record the fact that we want it autodeleted.
+    // The custom resource will check this tag before actually doing the delete.
+    // Because tagging and untagging will ALWAYS happen before the CR is deleted,
+    // we can set `autoDeleteObjects: false` without the removal of the CR emptying
+    // the bucket as a side effect.
+    Tags.of(bucket).add(AUTO_DELETE_OBJECTS_TAG, 'true');
+  }
+
   /**
    * Returns the well-known name of the repo
    */

packages/@aws-cdk/app-staging-synthesizer-alpha/package.json

@@ -79,6 +79,9 @@
     "announce": false
   },
   "cdk-build": {
+    "pre": [
+      "./scripts/airlift-custom-resource-bindings.sh"
+    ],
     "env": {
       "AWSLINT_BASE_CONSTRUCT": true
     }
@@ -93,7 +96,8 @@
     "@aws-cdk/integ-tests-alpha": "0.0.0",
     "constructs": "^10.0.0",
     "@aws-cdk/cdk-build-tools": "0.0.0",
-    "@aws-cdk/pkglint": "0.0.0"
+    "@aws-cdk/pkglint": "0.0.0",
+    "@aws-cdk/custom-resource-bindings": "0.0.0"
   },
   "peerDependencies": {
     "aws-cdk-lib": "0.0.0",

packages/@aws-cdk/app-staging-synthesizer-alpha/scripts/airlift-custom-resource-bindings.sh

@@ -0,0 +1,13 @@
+#!/bin/bash
+
+scriptdir=$(cd $(dirname $0) && pwd)
+customresourcedir=${scriptdir}/../../../custom-resource-bindings
+packagedir=${scriptdir}/..
+
+cd ${packagedir}
+
+mkdir -p custom-resource-bindings/aws-s3/auto-delete-objects-handler
+mkdir -p custom-resource-bindings/aws-ecr/auto-delete-images-handler
+
+cp ${customresourcedir}/lib/aws-s3/auto-delete-objects-handler/index.js ${packagedir}/custom-resource-bindings/aws-s3/auto-delete-objects-handler
+cp ${customresourcedir}/lib/aws-ecr/auto-delete-images-handler/index.js ${packagedir}/custom-resource-bindings/aws-ecr/auto-delete-images-handler

packages/aws-cdk-lib/aws-ecr/lib/repository.ts

@@ -819,7 +819,7 @@ export class Repository extends RepositoryBase {
     // Use a iam policy to allow the custom resource to list & delete
     // images in the repository and the ability to get all repositories to find the arn needed on delete.
     const provider = CustomResourceProvider.getOrCreateProvider(this, AUTO_DELETE_IMAGES_RESOURCE_TYPE, {
-      codeDirectory: path.join(__dirname, 'auto-delete-images-handler'),
+      codeDirectory: path.join(__dirname, '..', '..', 'custom-resource-bindings', 'lib', 'aws-ecr', 'auto-delete-images-handler'),
       runtime: builtInCustomResourceProviderNodeRuntime(this),
       description: `Lambda function for auto-deleting images in ${this.repositoryName} repository.`,
       policyStatements: [