import * as cdk from 'aws-cdk-lib';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as ecs from 'aws-cdk-lib/aws-ecs';
import * as elbv2 from 'aws-cdk-lib/aws-elasticloadbalancingv2';
import * as codedeploy from 'aws-cdk-lib/aws-codedeploy';
import * as cloudwatch from 'aws-cdk-lib/aws-cloudwatch';
import * as iam from 'aws-cdk-lib/aws-iam';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import { Construct } from 'constructs';

export interface EcsBlueGreenStackProps extends cdk.StackProps {
readonly environment: string;
readonly ecrRepositoryArn: string;
}

export class EcsBlueGreenStack extends cdk.Stack {
constructor(scope: Construct, id: string, props: EcsBlueGreenStackProps) {
super(scope, id, props);

// 1. Enterprise Network Topology
const vpc = new ec2.Vpc(this, 'EnterpriseVpc', {
maxAzs: 3,
ipAddresses: ec2.IpAddresses.cidr('10.0.0.0/16'),
subnetConfiguration: [
{
cidrMask: 24,
name: 'IngressPublic',
subnetType: ec2.SubnetType.PUBLIC,
},
{
cidrMask: 22,
name: 'ApplicationPrivate',
subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
},
{
cidrMask: 24,
name: 'DataIsolated',
subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
}
],
});

// 2. Compute Container Cluster Configuration
const cluster = new ecs.Cluster(this, 'ProductionCluster', {
vpc,
clusterName: `${props.environment}-core-compute`,
containerInsights: true,
});

// 3. Application Load Balancer & Security Posture
const albSecurityGroup = new ec2.SecurityGroup(this, 'AlbSecurityGroup', {
vpc,
description: 'Restrict access to load balancer entry points',
allowAllOutbound: true,
});
albSecurityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(80), 'Allow production HTTP traffic');
albSecurityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(8080), 'Allow developer/pipeline test traffic');

const alb = new elbv2.ApplicationLoadBalancer(this, 'PublicAlb', {
vpc,
internetFacing: true,
securityGroup: albSecurityGroup,
loadBalancerName: `${props.environment}-edge-alb`,
});

// 4. Target Group Structuring for Routing Topologies
const targetGroupBlue = new elbv2.ApplicationTargetGroup(this, 'TargetGroupBlue', {
vpc,
port: 80,
protocol: elbv2.ApplicationProtocol.HTTP,
targetType: elbv2.TargetType.IP,
deregistrationDelay: cdk.Duration.seconds(30),
healthCheck: {
path: '/healthz',
healthyThresholdCount: 2,
unhealthyThresholdCount: 3,
interval: cdk.Duration.seconds(15),
timeout: cdk.Duration.seconds(5),
},
});

const targetGroupGreen = new elbv2.ApplicationTargetGroup(this, 'TargetGroupGreen', {
vpc,
port: 80,
protocol: elbv2.ApplicationProtocol.HTTP,
targetType: elbv2.TargetType.IP,
deregistrationDelay: cdk.Duration.seconds(30),
healthCheck: {
path: '/healthz',
healthyThresholdCount: 2,
unhealthyThresholdCount: 3,
interval: cdk.Duration.seconds(15),
timeout: cdk.Duration.seconds(5),
},
});

// 5. Ingress Traffic Routers (Listeners)
const productionListener = alb.addListener('ProductionTrafficListener', {
port: 80,
protocol: elbv2.ApplicationProtocol.HTTP,
defaultTargetGroups: [targetGroupBlue],
});

const testingListener = alb.addListener('TestingTrafficListener', {
port: 8080,
protocol: elbv2.ApplicationProtocol.HTTP,
defaultTargetGroups: [targetGroupGreen],
});

// 6. Logical Task Definitions & Container Execution IAM Roles
const taskExecutionRole = new iam.Role(this, 'TaskExecutionRole', {
assumedBy: new iam.ServicePrincipal('://amazonaws.com'),
managedPolicies: [
iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AmazonECSTaskExecutionRolePolicy'),
],
});

const fargateTaskDefinition = new ecs.FargateTaskDefinition(this, 'ApplicationTaskDef', {
memoryLimitMiB: 2048,
cpu: 512,
executionRole: taskExecutionRole,
});

const webContainer = fargateTaskDefinition.addContainer('ApplicationContainer', {
image: ecs.ContainerImage.fromRegistry('nginxdemos/hello:plain-text'),
logging: ecs.LogDrivers.awsLogs({ streamPrefix: 'AppServer' }),
environment: {
DEPLOY_ENV: props.environment,
},
});
webContainer.addPortMappings({ containerPort: 80 });

// 7. Base Fargate Service Definition
const fargateService = new ecs.FargateService(this, 'CoreFargateService', {
cluster,
taskDefinition: fargateTaskDefinition,
desiredCount: 3,
deploymentController: {
type: ecs.DeploymentControllerType.CODE_DEPLOY,
},
vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
});

// Explicitly link the primary target group to the container
fargateService.attachToApplicationTargetGroup(targetGroupBlue);

// 8. Resiliency Monitoring: Telemetry-Driven Metrics & Automated Alarms
const alb5xxAlarm = new cloudwatch.Alarm(this, 'AlbHighErrorRateAlarm', {
metric: targetGroupBlue.metricHttpCodeTarget(elbv2.HttpCodeTarget.TARGET_5XX_COUNT, {
period: cdk.Duration.minutes(1),
statistic: 'Sum',
}),
threshold: 5,
evaluationPeriods: 1,
datapointsToAlarm: 1,
alarmDescription: 'Triggers active deployment rollback if target application 5XX errors cross acceptable bounds.',
treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
});

// 9. Automated Lifecycle Deployment Configuration via CodeDeploy
const integrationTestLambda = new lambda.Function(this, 'DeploymentValidationHook', {
runtime: lambda.Runtime.NODEJS_20_X,
handler: 'index.handler',
code: lambda.Code.fromInline(`
const { CodeDeployClient, PutLifecycleEventHookExecutionStatusCommand } = require("@aws-sdk/client-codedeploy");
const client = new CodeDeployClient();

exports.handler = async (event) => {
console.log("Received Execution Event Context:", JSON.stringify(event, null, 2));
const deploymentId = event.DeploymentId;
const lifecycleEventHookExecutionId = event.LifecycleEventHookExecutionId;

let status = "Succeeded";
// Custom testing or validation validation loop here

const command = new PutLifecycleEventHookExecutionStatusCommand({
deploymentId,
lifecycleEventHookExecutionId,
status
});
await client.send(command);
return { statusCode: 200 };
};
`),
});
integrationTestLambda.addToRolePolicy(new iam.PolicyStatement({
actions: ['codedeploy:PutLifecycleEventHookExecutionStatus'],
resources: ['*'],
}));

new codedeploy.EcsDeploymentGroup(this, 'EcsOrchestrationDeploymentGroup', {
service: fargateService,
blueGreenDeploymentConfig: {
blueTargetGroup,
greenTargetGroup,
listener: productionListener,
testListener: testingListener,
},
deploymentConfig: codedeploy.EcsDeploymentConfig.CANARY_10PERCENT_5MINUTES,
alarms: [alb5xxAlarm],
});
}
}