feat(synthetics): enable auto delete lambdas via custom resource

packages/@aws-cdk/aws-synthetics-alpha/lib/canary.ts

@@ -10,6 +10,11 @@ import { Runtime } from './runtime';
 import { Schedule } from './schedule';
 import { CloudWatchSyntheticsMetrics } from 'aws-cdk-lib/aws-synthetics/lib/synthetics-canned-metrics.generated';
 import { CfnCanary } from 'aws-cdk-lib/aws-synthetics';
+import { CustomResource, CustomResourceProvider, CustomResourceProviderRuntime } from 'aws-cdk-lib/core';
+import * as path from 'path';
+
+const AUTO_DELETE_LAMBDAS_RESOURCE_TYPE = 'Custom::SyntheticsAutoDeleteLambdas';
+const AUTO_DELETE_LAMBDAS_TAG = 'aws-cdk:auto-delete-lambdas';
 
 /**
  * Specify a test that the canary should run
@@ -264,6 +269,7 @@ export class Canary extends cdk.Resource implements ec2.IConnectable {
    * @internal
    */
   private readonly _connections?: ec2.Connections;
+  private readonly _resource: CfnCanary;
 
   public constructor(scope: Construct, id: string, props: CanaryProps) {
     if (props.canaryName && !cdk.Token.isUnresolved(props.canaryName)) {
@@ -301,12 +307,49 @@ export class Canary extends cdk.Resource implements ec2.IConnectable {
       code: this.createCode(props),
       runConfig: this.createRunConfig(props),
       vpcConfig: this.createVpcConfig(props),
-      deleteLambdaResourcesOnCanaryDeletion: props.enableAutoDeleteLambdas,
     });
+    this._resource = resource;
 
     this.canaryId = resource.attrId;
     this.canaryState = resource.attrState;
     this.canaryName = this.getResourceNameAttribute(resource.ref);
+
+    if (props.enableAutoDeleteLambdas) {
+      this.enableAutoDeleteLambdas();
+    }
+  }
+
+  private enableAutoDeleteLambdas() {
+    const provider = CustomResourceProvider.getOrCreateProvider(this, AUTO_DELETE_LAMBDAS_RESOURCE_TYPE, {
+      codeDirectory: path.join(__dirname, '..', 'custom-resource-handlers', 'dist', 'aws-synthetics-alpha', 'auto-delete-lambdas-handler'),
+      useCfnResponseWrapper: false,
+      runtime: CustomResourceProviderRuntime.NODEJS_18_X,
+      description: `Lambda function for auto-deleting lambdas created by ${this.canaryName}.`,
+      policyStatements: [{
+        Effect: 'Allow',
+        Action: ['lambda:DeleteFunction'],
+        Resource: this.lambdaArn(),
+      }, {
+        Effect: 'Allow',
+        Action: ['synthetics:GetCanary'],
+        Resource: '*',
+      }],
+    });
+
+    new CustomResource(this, 'AutoDeleteObjectsCustomResource', {
+      resourceType: AUTO_DELETE_LAMBDAS_RESOURCE_TYPE,
+      serviceToken: provider.serviceToken,
+      properties: {
+        CanaryName: this.canaryName,
+      },
+    });
+
+    // We also tag the canary to record the fact that we want it autodeleted.
+    // The custom resource will check this tag before actually doing the delete.
+    // Because tagging and untagging will ALWAYS happen before the CR is deleted,
+    // we can set `enableAutoDeleteLambdas: false` without the removal of the CR emptying
+    // the lambda as a side effect.
+    cdk.Tags.of(this._resource).add(AUTO_DELETE_LAMBDAS_TAG, 'true');
   }
 
   /**
@@ -418,6 +461,15 @@ export class Canary extends cdk.Resource implements ec2.IConnectable {
     });
   }
 
+  private lambdaArn() {
+    return cdk.Stack.of(this).formatArn({
+      service: 'lambda',
+      resource: 'function',
+      arnFormat: cdk.ArnFormat.COLON_RESOURCE_NAME,
+      resourceName: 'cwsyn-*',
+    });
+  }
+
   /**
    * Returns the code object taken in by the canary resource.
    */

packages/@aws-cdk/aws-synthetics-alpha/package.json

@@ -67,7 +67,10 @@
   "cdk-build": {
     "env": {
       "AWSLINT_BASE_CONSTRUCT": true
-    }
+    },
+    "pre": [
+      "./scripts/airlift-custom-resource-handlers.sh"
+    ]
   },
   "keywords": [
     "aws",
@@ -84,6 +87,7 @@
   "license": "Apache-2.0",
   "devDependencies": {
     "@aws-cdk/cdk-build-tools": "0.0.0",
+    "@aws-cdk/custom-resource-handlers": "0.0.0",
     "@aws-cdk/integ-runner": "0.0.0",
     "@aws-cdk/pkglint": "0.0.0",
     "@aws-cdk/integ-tests-alpha": "0.0.0",

packages/@aws-cdk/aws-synthetics-alpha/scripts/airlift-custom-resource-handlers.sh

@@ -0,0 +1,23 @@
+#!/bin/bash
+
+scriptdir=$(cd $(dirname $0) && pwd)
+customresourcedir=$(node -p "path.dirname(require.resolve('@aws-cdk/custom-resource-handlers/package.json'))")
+awscdklibdir=${scriptdir}/..
+
+list_custom_resources() {
+  for file in $customresourcedir/dist/aws-synthetics-alpha/*/index.js; do
+    echo $file | rev | cut -d "/" -f 2-4 | rev
+  done
+}
+
+customresources=$(list_custom_resources)
+
+echo $customresources
+
+cd $awscdklibdir
+mkdir -p $awscdklibdir/custom-resource-handlers
+
+for cr in $customresources; do
+  mkdir -p $awscdklibdir/custom-resource-handlers/$cr
+  cp $customresourcedir/$cr/index.js $awscdklibdir/custom-resource-handlers/$cr
+done

packages/@aws-cdk/custom-resource-handlers/lib/aws-synthetics-alpha/auto-delete-lambdas-handler/index.ts

@@ -0,0 +1,77 @@
+// eslint-disable-next-line import/no-extraneous-dependencies
+import { LambdaClient, DeleteFunctionCommand } from '@aws-sdk/client-lambda';
+import { SyntheticsClient, GetCanaryCommand } from '@aws-sdk/client-synthetics';
+import { makeHandler } from '../../nodejs-entrypoint';
+
+const AUTO_DELETE_LAMBDA_TAG = 'aws-cdk:auto-delete-lambdas';
+
+const lambda = new LambdaClient({});
+const synthetics = new SyntheticsClient({});
+
+export const handler = makeHandler(autoDeleteHandler);
+
+export async function autoDeleteHandler(event: AWSLambda.CloudFormationCustomResourceEvent) {
+  switch (event.RequestType) {
+    case 'Create':
+      break;
+    case 'Update':
+      return onUpdate(event);
+    case 'Delete':
+      return onDelete(event.ResourceProperties?.CanaryName);
+  }
+};
+
+async function onUpdate(event: AWSLambda.CloudFormationCustomResourceEvent) {
+  const updateEvent = event as AWSLambda.CloudFormationCustomResourceUpdateEvent;
+  const oldCanaryName = updateEvent.OldResourceProperties?.CanaryName;
+  const newCanaryName = updateEvent.ResourceProperties?.CanaryName;
+  const repositoryNameHasChanged = (newCanaryName && oldCanaryName)
+    && (newCanaryName !== oldCanaryName);
+
+  // If the name of the canary has changed, CloudFormation will delete the canary
+  // and create a new one with the new name. So the old lambda will be isolated
+  // and we should try to delete the old lambdae. */
+  if (repositoryNameHasChanged) {
+    return onDelete(oldCanaryName);
+  }
+}
+
+async function onDelete(canaryName: string) {
+  if (!canaryName) {
+    throw new Error('No CanaryName was provided.');
+  }
+
+  try {
+    const response = (await synthetics.send(new GetCanaryCommand({
+      Name: canaryName,
+    })));
+
+    if (!isCanaryTaggedForDeletion(response.Canary?.Tags)) {
+      // eslint-disable-next-line no-console
+      console.log(`Canary does not have '${AUTO_DELETE_LAMBDA_TAG}' tag, skipping deletion.`);
+      return;
+    }
+
+    await lambda.send(new DeleteFunctionCommand({
+      FunctionName: `cwsyn-${canaryName}-${response.Canary?.Id}`,
+    }));
+  } catch (error: any) {
+    if (error.name !== 'ResourceNotFoundException') {
+      throw error;
+    }
+    // Canary or Lambda doesn't exist. Exiting.
+  }
+}
+
+/**
+ * The canary will only be tagged for deletion if it's being deleted in the same
+ * deployment as this Custom Resource.
+ *
+ * If the Custom Resource is ever deleted before the repository, it must be because
+ * `autoDeleteImages` has been switched to false, in which case the tag would have
+ * been removed before we get to this Delete event.
+ */
+function isCanaryTaggedForDeletion(tags?: Record<string, string>): boolean {
+  if (!tags) return false;
+  return Object.keys(tags).some((tag) => tag === AUTO_DELETE_LAMBDA_TAG && tags[tag] === 'true');
+}

packages/@aws-cdk/custom-resource-handlers/package.json

@@ -33,7 +33,9 @@
   },
   "dependencies": {
     "@aws-sdk/client-ecr": "^3.370.0",
-    "@aws-sdk/client-s3": "^3.370.0"
+    "@aws-sdk/client-s3": "^3.370.0",
+    "@aws-sdk/client-lambda": "^3.370.0",
+    "@aws-sdk/client-synthetics": "^3.370.0"
   },
   "repository": {
     "url": "https://github.com/aws/aws-cdk.git",