CDK Skylight is a set of Level 3 constructs for the Microsoft products on AWS ecosystem (Windows OS, SQL Server, Active Directory, Windows Containers, Amazon FSx for Windows, and so on). CDK Skylight Constructs are a natural fit for Platform Teams building Platform as a Product.
A few examples are:
All those examples are built with CDK Skylight libraries and can be used separately with maximum flexibility to change the default settings.
CDK Skylight is set to address repetitive tasks and best practices involved with managing, deploying, and integrating those apps. In addition to the complexity of integrating the AWS side products, Microsoft technologies such as SQL, AD, Windows OS require OS-level integration and optimization. Skylight help in both the "AWS-side" and the "OS-side," offering a complete end-to-end configuration and integration solution of AWS products.
The primary persona to use CDK Skylight is the platform team owners to customize the stacks and provide them to the application owners teams.
As a vision, Project CDK-Skylight targets all Windows EC2 customers in all stages, specifically developers developing features integrated with the Microsoft-products ecosystem (SQL Server, Active Directory, Windows OS, etc.)
CDK Skylight helps in all application lifecycle stages, starting from the developer machine to running production workloads. With CDK Skylight, the time it takes to move between stages and integrate new services is reduced dramatically.
npm install cdk-skylight
In your CDK App
import * as skylight from "cdk-skylight";
new skylight.authentication.AwsManagedMicrosoftAdR53(scope: Construct, id: string, props: IAwsManagedMicrosoftAdProps)
Library of Custom Compute components
A Domain Windows Node Construct represents one Windows EC2 instance configured with Active Directory.
The DomainWindowsNode can be customized to different instance sizes and additional permissions set just like any other EC2 Instance. You can use this construct to run elevated domain tasks with domain permissions or run your application in a single instance setup.
The machine will be joined to the provided Active Directory domain using a custom CloudFormation bootstrap that will wait until the required reboot to join the domain. Then it will register the machine in SSM and pull tasks from the SSM State manager.
You can send tasks to that machine using the provided methods: runPsCommands() and runPSwithDomainAdmin()
const windowsNodeObject = new skylight.compute.DomainWindowsNode(
stack,
'WindowsNode',
{
vpc: vpc,
madSsmParameters: {}, //pointer to the Secret that holds the Domain Admin username and password
}
);
// Special Methods:
windowsNodeObject.runPsCommands(['echo hello-world'], 'hello');
windowsNodeObject.runPSwithDomainAdmin(
['Write-Host hello-world'],
'hello-withPS'
);
windowsNodeObject.openRDP('1.1.1.1/32');
Library of Custom Authentication components
Managed AD with Secret stored in secret manager
The secret saved to SSM parameter store so others can use it with other Constructs (Such as Windows node or FSx) The provided VPC or the new created VPC will be configured to forward DNS requests to the Managed AD with Route53 Resolvers
The construct also creates (optionally) t3.nano machine that is part of the domain that can be used to run admin-tasks (such as createADGroup) The createADGroup() method creates an Active Directory permission group in the domain, using the domain admin user.
Please note: When calling createADGroup() API, a Lambda will be created to start the worker machine (Using AWS-SDK), then each command will be scheduled with State Manager, and the instance will be shut down after complete.
const ad = new skylight.authentication.AwsManagedMicrosoftAd(
stack,
'AwsManagedMicrosoftAdR53',
{
vpc: vpc,
edition: 'Enterprise', // Optional
secret: new Secret(stack, 'test-secret'), // Optional
domainName: 'test-domain', // Optional
secretName: 'custom-secret-name', // Optional
createWorker: false, // Optional
}
);
ad.managedActiveDirectory.createADGroup(
'MyADGroup', // AD group name
'My AD Group Created by CDK-Skylight!' //AD Description
);
AwsManagedMicrosoftAdR53 represents an integration pattern of Managed AD and Route 53 Resolver in a specific VPC, it will create Managed AD with the provided Secret (Secrets Manager) or generates a new Secret.
Example:
const ad = new skylight.authentication.AwsManagedMicrosoftAdR53(
stack,
'AwsManagedMicrosoftAdR53',
{
vpc: vpc,
}
);
A FSxWindows represents an integration pattern of Amazon FSx and Managed AD in a specific VPC. The Construct creates Amazon FSx for Windows
The construct also creates t3.nano machine that is part of the domain that can be used to run admin-tasks (such as createFolder) The createFolder() method creates an SMB Folder in the FSx filesystem, using the domain admin user.
Please note: When calling createFolder() API, a Lambda will be created to start the worker machine (Using AWS-SDK), then each command will be scheduled with State Manager, and the instance will be shut down after complete.
Example:
this.fsxWindows = new skylight.storage.FSxWindows(this, 'FSx', {
vpc: vpc,
adParametersStore: adParametersStore,
});
this.fsxWindows.createFolder('myFolderStorageOnFSx');
The stack creates the Windows Autoscaling group with domain join script and the SSM Documents for gMSA and Global Mapping.
const cluster = new WindowsEKSCluster(stack, 'ElasticCluster', {
vpc: new aws_ec2.Vpc(stack, 'MyVpc', {}),
}); // Creates EKS Cluster with Windows support
This stack takes the PersistentStorage stack as input and creates the EKS cluster with permissions to operate EKS clusters.
const myNodes = new WindowsEKSNodes(stack, 'WindowsEKSNodes', {
// Creates AutoScaling group for Windows Support
vpc: new aws_ec2.Vpc(stack, 'MyVpc', {}),
});
myNodes.addAdDependency(secretObject);
myNodes.addStorageDependency(secretObject, storageMount);
myNodes.addEKSDependency(eks_cluster.eksCluster);
myNodes.addLocalCredFile(secretObject, 'myEKSNodes', 'myWebApp');