CDK, SAM and Service Catalog

What it is

CloudFormation templates are plain data, so reuse is limited. Three tools build on CloudFormation to raise the level: the AWS Cloud Development Kit (CDK), the AWS Serverless Application Model (SAM) and AWS Service Catalog.

The CDK lets you write infrastructure in a programming language. SAM is a shorthand for serverless applications. Service Catalog lets an administrator publish approved templates that other people can launch.

How it works

CDK concepts

A CDK app contains stacks, and stacks contain constructs. A construct is a reusable building block, and constructs come in three levels.

CDK supports TypeScript, JavaScript, Python, Java, C# and Go. Because it is real code, you get loops, functions, classes, unit tests and package versioning.

import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as s3 from 'aws-cdk-lib/aws-s3';

class DataStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);
    new s3.Bucket(this, 'Logs', {
      versioned: true,
      removalPolicy: cdk.RemovalPolicy.RETAIN,
    });
  }
}

const app = new cdk.App();
new DataStack(app, 'DataStack');

The CDK workflow

cdk bootstrap aws://111122223333/us-east-1
cdk synth
cdk diff
cdk deploy

cdk synth writes the CloudFormation template to the cdk.out folder. cdk diff compares it with the deployed stack. cdk deploy uploads assets and runs the CloudFormation deployment.

Bootstrapping prepares an account and Region once. It creates a stack, usually named CDKToolkit, with an S3 bucket and an ECR repository for assets and IAM roles that the deployment uses. Every target account and Region needs it before a CDK deploy.

CDK Pipelines builds a CodePipeline for your CDK app. The pipeline can update itself when its own definition changes, so adding a stage is a code change.

SAM

SAM is an extension of CloudFormation. A template declares Transform: AWS::Serverless-2016-10-31, and then short resource types expand into full resources.

Transform: AWS::Serverless-2016-10-31
Resources:
  ItemsFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: app.handler
      Runtime: python3.12
      Events:
        Get:
          Type: Api
          Properties:
            Path: /items
            Method: get

Common types include AWS::Serverless::Function, Api, HttpApi, SimpleTable and StateMachine. The SAM command line tool adds local testing and packaging.

sam build
sam local invoke ItemsFunction --event event.json
sam deploy --guided

SAM also provides the DeploymentPreference setting that shifts Lambda traffic gradually through CodeDeploy.

Service Catalog

Service Catalog gives teams self service access to approved infrastructure. An administrator builds products from CloudFormation templates, groups them into portfolios and grants access to IAM users, groups or roles.

Portfolios can be shared with other accounts and across an organization. Users launch a product and the result is a provisioned product, tracked and updatable as a unit.

Choosing