konokenj.cdk-api-mcp-server 0.39.0__py3-none-any.whl → 0.41.0__py3-none-any.whl

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-codedeploy/integ.deployment-group.ts

@@ -1,240 +1,62 @@
+import * as path from 'path';
 import * as cloudwatch from 'aws-cdk-lib/aws-cloudwatch';
-import * as ec2 from 'aws-cdk-lib/aws-ec2';
-import * as ecs from 'aws-cdk-lib/aws-ecs';
-import * as elbv2 from 'aws-cdk-lib/aws-elasticloadbalancingv2';
+import * as lambda from 'aws-cdk-lib/aws-lambda';
 import * as cdk from 'aws-cdk-lib';
-import * as integ from '@aws-cdk/integ-tests-alpha';
 import * as codedeploy from 'aws-cdk-lib/aws-codedeploy';
+import { STANDARD_NODEJS_RUNTIME } from '../../../config';
 
-/**
- * Follow these instructions to manually test running a CodeDeploy deployment with the resources provisioned in this stack:
- *
- * 1. Deploy the stack:
-```
-$ cdk deploy --app 'node integ.deployment-group.js' aws-cdk-codedeploy-ecs-dg
-```
- *
- * 2. Create a file called `appspec.json` with the following contents, replacing the placeholders with output values from the deployed stack:
-```
-{
-  "version": 0.0,
-  "Resources": [
-    {
-      "TargetService": {
-        "Type": "AWS::ECS::Service",
-        "Properties": {
-          "TaskDefinition": "<PLACEHOLDER - NEW TASK DEFINITION>",
-          "LoadBalancerInfo": {
-            "ContainerName": "Container",
-            "ContainerPort": 80
-          },
-          "PlatformVersion": "LATEST",
-          "NetworkConfiguration": {
-            "awsvpcConfiguration": {
-              "subnets": [
-                "<PLACEHOLDER - SUBNET 1 ID>",
-                "<PLACEHOLDER - SUBNET 2 ID>",
-              ],
-              "securityGroups": [
-                "<PLACEHOLDER - SECURITY GROUP ID>"
-              ],
-              "assignPublicIp": "DISABLED"
-            }
-          }
-        }
-      }
-    }
-  ]
-}
-```
- *
- * 3. Start the deployment:
-```
-$ appspec=$(jq -R -s '.' < appspec.json | sed 's/\\n//g')
-$ aws deploy create-deployment \
-   --application-name <PLACEHOLDER - CODEDEPLOY APPLICATION NAME> \
-   --deployment-group-name <PLACEHOLDER - CODEDEPLOY DEPLOYMENT GROUP NAME> \
-   --description "AWS CDK integ test" \
-   --revision revisionType=AppSpecContent,appSpecContent={content="$appspec"}
-```
- *
- * 4. Wait for the deployment to complete successfully, providing the deployment ID from the previous step:
-```
-$ aws deploy wait deployment-successful --deployment-id <PLACEHOLDER - DEPLOYMENT ID>
-```
- *
- * 5. Destroy the stack:
-```
-$ cdk destroy --app 'node integ.deployment-group.js' aws-cdk-codedeploy-ecs-dg
-```
- */
-
-const app = new cdk.App();
-const stack = new cdk.Stack(app, 'aws-cdk-codedeploy-ecs-dg');
-
-// Network infrastructure
-const vpc = new ec2.Vpc(stack, 'VPC', { maxAzs: 2, restrictDefaultSecurityGroup: false });
-
-// ECS service
-const cluster = new ecs.Cluster(stack, 'EcsCluster', {
-  vpc,
-});
-const taskDefinition = new ecs.FargateTaskDefinition(stack, 'TaskDef');
-taskDefinition.addContainer('Container', {
-  image: ecs.ContainerImage.fromRegistry('public.ecr.aws/ecs-sample-image/amazon-ecs-sample:latest'),
-  portMappings: [{ containerPort: 80 }],
-});
-const service = new ecs.FargateService(stack, 'FargateService', {
-  cluster,
-  taskDefinition,
-  deploymentController: {
-    type: ecs.DeploymentControllerType.CODE_DEPLOY,
+const app = new cdk.App({
+  postCliContext: {
+    '@aws-cdk/aws-lambda:useCdkManagedLogGroup': false,
   },
 });
+const stack = new cdk.Stack(app, 'aws-cdk-codedeploy-lambda');
 
-// A second task definition for testing a CodeDeploy deployment of the ECS service to a new task definition
-const taskDefinition2 = new ecs.FargateTaskDefinition(stack, 'TaskDef2');
-taskDefinition2.addContainer('Container', {
-  image: ecs.ContainerImage.fromRegistry('public.ecr.aws/ecs-sample-image/amazon-ecs-sample:latest'),
-  portMappings: [{ containerPort: 80 }],
+const handler = new lambda.Function(stack, 'Handler', {
+  code: lambda.Code.fromAsset(path.join(__dirname, 'handler')),
+  handler: 'index.handler',
+  runtime: STANDARD_NODEJS_RUNTIME,
 });
-service.node.addDependency(taskDefinition2);
-
-// Load balancer
-const loadBalancer = new elbv2.ApplicationLoadBalancer(stack, 'ServiceLB', {
-  vpc,
-  internetFacing: false,
+const version = handler.currentVersion;
+const blueGreenAlias = new lambda.Alias(stack, 'Alias', {
+  aliasName: 'alias',
+  version,
 });
 
-// Listeners
-const prodListener = loadBalancer.addListener('ProdListener', {
-  port: 80, // port for production traffic
-  protocol: elbv2.ApplicationProtocol.HTTP,
+const preHook = new lambda.Function(stack, 'PreHook', {
+  code: lambda.Code.fromAsset(path.join(__dirname, 'preHook')),
+  handler: 'index.handler',
+  runtime: STANDARD_NODEJS_RUNTIME,
 });
-const testListener = loadBalancer.addListener('TestListener', {
-  port: 9002, // port for testing
-  protocol: elbv2.ApplicationProtocol.HTTP,
+const postHook = new lambda.Function(stack, 'PostHook', {
+  code: lambda.Code.fromAsset(path.join(__dirname, 'postHook')),
+  handler: 'index.handler',
+  runtime: STANDARD_NODEJS_RUNTIME,
 });
 
-// Target groups
-const blueTG = prodListener.addTargets('BlueTG', {
-  port: 80,
-  protocol: elbv2.ApplicationProtocol.HTTP,
-  targets: [
-    service.loadBalancerTarget({
-      containerName: 'Container',
-      containerPort: 80,
+new codedeploy.LambdaDeploymentGroup(stack, 'BlueGreenDeployment', {
+  alias: blueGreenAlias,
+  deploymentConfig: codedeploy.LambdaDeploymentConfig.LINEAR_10PERCENT_EVERY_1MINUTE,
+  alarms: [
+    new cloudwatch.Alarm(stack, 'BlueGreenErrors', {
+      comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD,
+      threshold: 1,
+      evaluationPeriods: 1,
+      metric: blueGreenAlias.metricErrors(),
     }),
   ],
-  deregistrationDelay: cdk.Duration.seconds(30),
-  healthCheck: {
-    interval: cdk.Duration.seconds(5),
-    healthyHttpCodes: '200',
-    healthyThresholdCount: 2,
-    unhealthyThresholdCount: 3,
-    timeout: cdk.Duration.seconds(4),
-  },
+  preHook,
+  postHook,
 });
 
-const greenTG = new elbv2.ApplicationTargetGroup(stack, 'GreenTG', {
-  vpc,
-  port: 80,
-  protocol: elbv2.ApplicationProtocol.HTTP,
-  targetType: elbv2.TargetType.IP,
-  deregistrationDelay: cdk.Duration.seconds(30),
-  healthCheck: {
-    interval: cdk.Duration.seconds(5),
-    healthyHttpCodes: '200',
-    healthyThresholdCount: 2,
-    unhealthyThresholdCount: 3,
-    timeout: cdk.Duration.seconds(4),
-  },
-});
-
-testListener.addTargetGroups('GreenTGTest', {
-  targetGroups: [greenTG],
+const secondAlias = new lambda.Alias(stack, 'SecondAlias', {
+  aliasName: 'secondAlias',
+  version,
 });
 
-prodListener.node.addDependency(greenTG);
-testListener.node.addDependency(blueTG);
-service.node.addDependency(testListener);
-service.node.addDependency(greenTG);
-
-// Alarms: monitor 500s and unhealthy hosts on target groups
-const blueUnhealthyHosts = new cloudwatch.Alarm(stack, 'BlueUnhealthyHosts', {
-  alarmName: stack.stackName + '-Unhealthy-Hosts-Blue',
-  metric: blueTG.metricUnhealthyHostCount(),
-  threshold: 1,
-  evaluationPeriods: 2,
-});
-
-const blueApiFailure = new cloudwatch.Alarm(stack, 'Blue5xx', {
-  alarmName: stack.stackName + '-Http-500-Blue',
-  metric: blueTG.metricHttpCodeTarget(
-    elbv2.HttpCodeTarget.TARGET_5XX_COUNT,
-    { period: cdk.Duration.minutes(1) },
-  ),
-  threshold: 1,
-  evaluationPeriods: 1,
-});
-
-const greenUnhealthyHosts = new cloudwatch.Alarm(stack, 'GreenUnhealthyHosts', {
-  alarmName: stack.stackName + '-Unhealthy-Hosts-Green',
-  metric: greenTG.metricUnhealthyHostCount(),
-  threshold: 1,
-  evaluationPeriods: 2,
-});
-
-const greenApiFailure = new cloudwatch.Alarm(stack, 'Green5xx', {
-  alarmName: stack.stackName + '-Http-500-Green',
-  metric: greenTG.metricHttpCodeTarget(
-    elbv2.HttpCodeTarget.TARGET_5XX_COUNT,
-    { period: cdk.Duration.minutes(1) },
-  ),
-  threshold: 1,
-  evaluationPeriods: 1,
-});
-
-// Deployment group
-const deploymentConfig = new codedeploy.EcsDeploymentConfig(stack, 'CanaryConfig', {
-  trafficRouting: codedeploy.TrafficRouting.timeBasedCanary({
-    interval: cdk.Duration.minutes(1),
-    percentage: 20,
-  }),
-});
-
-const dg = new codedeploy.EcsDeploymentGroup(stack, 'BlueGreenDG', {
-  alarms: [
-    blueUnhealthyHosts,
-    blueApiFailure,
-    greenUnhealthyHosts,
-    greenApiFailure,
-  ],
-  service,
-  blueGreenDeploymentConfig: {
-    blueTargetGroup: blueTG,
-    greenTargetGroup: greenTG,
-    listener: prodListener,
-    testListener,
-    terminationWaitTime: cdk.Duration.minutes(1),
-  },
-  deploymentConfig,
-  autoRollback: {
-    stoppedDeployment: true,
-  },
-  ignoreAlarmConfiguration: true,
-});
-
-// Outputs to use for manual testing
-new cdk.CfnOutput(stack, 'NewTaskDefinition', { value: taskDefinition2.taskDefinitionArn });
-new cdk.CfnOutput(stack, 'Subnet1Id', { value: vpc.privateSubnets[0].subnetId });
-new cdk.CfnOutput(stack, 'Subnet2Id', { value: vpc.privateSubnets[1].subnetId });
-new cdk.CfnOutput(stack, 'SecurityGroupId', { value: service.connections.securityGroups[0].securityGroupId });
-new cdk.CfnOutput(stack, 'CodeDeployApplicationName', { value: dg.application.applicationName });
-new cdk.CfnOutput(stack, 'CodeDeployDeploymentGroupName', { value: dg.deploymentGroupName });
-
-new integ.IntegTest(app, 'EcsDeploymentGroupTest', {
-  testCases: [stack],
+new codedeploy.LambdaDeploymentGroup(stack, 'SecondDeployment', {
+  alias: secondAlias,
+  deploymentConfig: codedeploy.LambdaDeploymentConfig.CANARY_10PERCENT_5MINUTES,
 });
 
 app.synth();

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-ecs/README.md

@@ -2076,84 +2076,37 @@ Amazon ECS supports native blue/green deployments that allow you to deploy new v
 
 [Amazon ECS blue/green deployments](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/deployment-type-blue-green.html)
 
-### Using Escape Hatches for Blue/Green Features
-
-The new blue/green deployment features are added to CloudFormation but not yet available in the CDK L2 constructs, you can use escape hatches to access them through the L1 (CfnService) construct.
-
-#### Load Balancer Advanced Configuration
-
-Configure advanced load balancer settings for blue/green deployments with alternate target groups and listener rules:
-
 ```ts
-declare const service: ecs.FargateService;
-
-const cfnService = service.node.defaultChild as ecs.CfnService;
-cfnService.loadBalancers = [{
-  containerName: 'web',
-  containerPort: 80,
-  targetGroupArn: 'arn:aws:elasticloadbalancing:region:account:targetgroup/production',
-  advancedConfiguration: {
-    alternateTargetGroupArn: 'arn:aws:elasticloadbalancing:region:account:targetgroup/test',
-    productionListenerRule: 'arn:aws:elasticloadbalancing:region:account:listener-rule/production-rule',
-    testListenerRule: 'arn:aws:elasticloadbalancing:region:account:listener-rule/test-rule',
-    roleArn: 'arn:aws:iam::account:role/ecs-blue-green-role'
-  }
-}];
-```
-
-#### Blue/Green Deployment Configuration
-
-Configure deployment strategy with bake time and lifecycle hooks:
-
-```ts
-declare const service: ecs.FargateService;
-
-const cfnService = service.node.defaultChild as ecs.CfnService;
-cfnService.deploymentConfiguration = {
-  maximumPercent: 200,
-  minimumHealthyPercent: 100,
-  strategy: 'BLUE_GREEN',
-  bakeTimeInMinutes: 15,
-  lifecycleHooks: [{
-    hookTargetArn: 'arn:aws:lambda:region:account:function:pre-deployment-hook',
-    roleArn: 'arn:aws:iam::account:role/deployment-hook-role',
-    lifecycleStages: ['PRE_STOP', 'POST_START']
-  }]
-};
-```
-
-#### Service Connect Test Traffic Rules
-
-Configure test traffic routing for Service Connect during blue/green deployments:
+import * as lambda from 'aws-cdk-lib/aws-lambda';
 
-```ts
 declare const cluster: ecs.Cluster;
 declare const taskDefinition: ecs.TaskDefinition;
+declare const lambdaHook: lambda.Function;
+declare const blueTargetGroup: elbv2.ApplicationTargetGroup;
+declare const greenTargetGroup: elbv2.ApplicationTargetGroup;
+declare const prodListenerRule: elbv2.ApplicationListenerRule;
 
 const service = new ecs.FargateService(this, 'Service', {
   cluster,
   taskDefinition,
+  deploymentStrategy: ecs.DeploymentStrategy.BLUE_GREEN,
 });
 
-const cfnService = service.node.defaultChild as ecs.CfnService;
-cfnService.serviceConnectConfiguration = {
-  enabled: true,
-  services: [{
-    portName: 'api',
-    clientAliases: [{
-      port: 80,
-      dnsName: 'my-service',
-      testTrafficRules: {
-        header: {
-          name: 'x-canary-test',
-          value: {
-            exact: 'beta-version'
-          }
-        }
-      }
-    }]
-  }]
-};
+service.addLifecycleHook(new ecs.DeploymentLifecycleLambdaTarget(lambdaHook, 'PreScaleHook', {
+  lifecycleStages: [ecs.DeploymentLifecycleStage.PRE_SCALE_UP],
+}));
+
+const target = service.loadBalancerTarget({
+  containerName: 'nginx',
+  containerPort: 80,
+  protocol: ecs.Protocol.TCP,
+  alternateTarget: new ecs.AlternateTarget('AlternateTarget', {
+    alternateTargetGroup: greenTargetGroup,
+    productionListener: ecs.ListenerRuleConfiguration.applicationListenerRule(prodListenerRule),
+  }),
+});
+
+target.attachToApplicationTargetGroup(blueTargetGroup);
 ```
 
 ## Daemon Scheduling Strategy

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-ecs/integ.availability-zone-rebalancing.ts

@@ -3,30 +3,20 @@ import * as cdk from 'aws-cdk-lib';
 import * as ecs from 'aws-cdk-lib/aws-ecs';
 import { IntegTest } from '@aws-cdk/integ-tests-alpha';
 
-const app = new cdk.App({
-  postCliContext: {
-    '@aws-cdk/aws-lambda:useCdkManagedLogGroup': false,
-    '@aws-cdk/aws-lambda:createNewPoliciesWithAddToRolePolicy': false,
-  },
-});
+const app = new cdk.App();
 const stack = new cdk.Stack(app, 'aws-ecs-integ-availability-zone-rebalancing');
 
 const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2, restrictDefaultSecurityGroup: false });
 
-const cluster = new ecs.Cluster(stack, 'EcsCluster', { vpc });
-
-cluster.addCapacity('DefaultAutoScalingGroup', {
-  instanceType: new ec2.InstanceType('t2.micro'),
-});
+const cluster = new ecs.Cluster(stack, 'Cluster', { vpc });
 
-const taskDefinition = new ecs.Ec2TaskDefinition(stack, 'TaskDef');
+const taskDefinition = new ecs.FargateTaskDefinition(stack, 'TaskDef');
 
 taskDefinition.addContainer('web', {
   image: ecs.ContainerImage.fromRegistry('amazon/amazon-ecs-sample'),
-  memoryLimitMiB: 256,
 });
 
-new ecs.Ec2Service(stack, 'FrontendService', {
+new ecs.FargateService(stack, 'FargateService', {
   cluster,
   taskDefinition,
   availabilityZoneRebalancing: ecs.AvailabilityZoneRebalancing.ENABLED,

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-ecs/integ.blue-green-deployment-strategy.ts

@@ -1,6 +1,5 @@
 import * as ec2 from 'aws-cdk-lib/aws-ec2';
 import * as elbv2 from 'aws-cdk-lib/aws-elasticloadbalancingv2';
-import * as iam from 'aws-cdk-lib/aws-iam';
 import * as lambda from 'aws-cdk-lib/aws-lambda';
 import * as cdk from 'aws-cdk-lib';
 import * as ecs from 'aws-cdk-lib/aws-ecs';
@@ -89,45 +88,6 @@ const prodListenerRule = new elbv2.ApplicationListenerRule(stack, 'ALBProduction
   ]),
 });
 
-// Create granular IAM roles
-const ecsTaskExecutionRole = new iam.Role(stack, 'EcsTaskExecutionRole', {
-  assumedBy: new iam.ServicePrincipal('ecs-tasks.amazonaws.com'),
-  managedPolicies: [
-    iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AmazonECSTaskExecutionRolePolicy'),
-  ],
-});
-
-// Create Blue/Green deployment service role
-const ecsServiceRole = new iam.Role(stack, 'ServiceRole', {
-  assumedBy: new iam.CompositePrincipal(
-    new iam.ServicePrincipal('ecs.amazonaws.com'),
-  ),
-  managedPolicies: [
-    iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AmazonEC2ContainerServiceRole'),
-  ],
-  inlinePolicies: {
-    LambdaInvokePolicy: new iam.PolicyDocument({
-      statements: [
-        new iam.PolicyStatement({
-          actions: ['lambda:InvokeFunction'],
-          resources: ['*'],
-        }),
-      ],
-    }),
-    ELBPolicy: new iam.PolicyDocument({
-      statements: [
-        new iam.PolicyStatement({
-          actions: [
-            'elasticloadbalancing:ModifyRule',
-            'elasticloadbalancing:ModifyListener',
-          ],
-          resources: [prodListenerRule.listenerRuleArn],
-        }),
-      ],
-    }),
-  },
-});
-
 // Create Lambda hook
 const lambdaHook = new lambda.Function(stack, 'LambdaHook', {
   handler: 'index.handler',
@@ -138,13 +98,10 @@ const lambdaHook = new lambda.Function(stack, 'LambdaHook', {
     };`),
 });
 
-lambdaHook.grantInvoke(ecsServiceRole);
-
 // Create task definition
 const taskDefinition = new ecs.FargateTaskDefinition(stack, 'TaskDef', {
   memoryLimitMiB: 512,
   cpu: 256,
-  executionRole: ecsTaskExecutionRole,
 });
 
 // Add container to task definition
@@ -163,39 +120,24 @@ const service = new ecs.FargateService(stack, 'Service', {
   cluster,
   taskDefinition,
   securityGroups: [ecsSecurityGroup],
+  deploymentStrategy: ecs.DeploymentStrategy.BLUE_GREEN,
 });
 
-service.attachToApplicationTargetGroup(blueTargetGroup);
+service.addLifecycleHook(new ecs.DeploymentLifecycleLambdaTarget(lambdaHook, 'PreScaleUp', {
+  lifecycleStages: [ecs.DeploymentLifecycleStage.PRE_SCALE_UP],
+}));
 
-// Use escape hatching to set B/G deployment properties
-const cfnService = service.node.defaultChild as ecs.CfnService;
-cfnService.addPropertyOverride('DeploymentController', {
-  Type: 'ECS',
-});
-
-cfnService.addPropertyOverride('DeploymentConfiguration', {
-  DeploymentCircuitBreaker: {
-    Enable: false,
-    Rollback: false,
-  },
-  MaximumPercent: 200,
-  MinimumHealthyPercent: 100,
-  Strategy: 'BLUE_GREEN',
-  BakeTimeInMinutes: 0,
-  LifecycleHooks: [{
-    HookTargetArn: lambdaHook.functionArn,
-    RoleArn: ecsServiceRole.roleArn,
-    LifecycleStages: ['POST_TEST_TRAFFIC_SHIFT'],
-  }],
+const target = service.loadBalancerTarget({
+  containerName: 'nginx',
+  containerPort: 80,
+  protocol: ecs.Protocol.TCP,
+  alternateTarget: new ecs.AlternateTarget('LBAlternateOptions', {
+    alternateTargetGroup: greenTargetGroup,
+    productionListener: ecs.ListenerRuleConfiguration.applicationListenerRule(prodListenerRule),
+  }),
 });
 
-cfnService.addPropertyOverride('LoadBalancers.0', {
-  AdvancedConfiguration: {
-    AlternateTargetGroupArn: greenTargetGroup.targetGroupArn,
-    RoleArn: ecsServiceRole.roleArn,
-    ProductionListenerRule: prodListenerRule.listenerRuleArn,
-  },
-});
+target.attachToApplicationTargetGroup(blueTargetGroup);
 
 // Create integration test
 new integ.IntegTest(app, 'aws-ecs-blue-green', {

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-ecs/integ.enable-execute-command.ts

@@ -1,53 +1,30 @@
-
-import * as autoscaling from 'aws-cdk-lib/aws-autoscaling';
-import * as s3 from 'aws-cdk-lib/aws-s3';
 import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import * as kms from 'aws-cdk-lib/aws-kms';
+import * as s3 from 'aws-cdk-lib/aws-s3';
 import * as cdk from 'aws-cdk-lib';
+import { Duration } from 'aws-cdk-lib';
 import * as integ from '@aws-cdk/integ-tests-alpha';
 import * as ecs from 'aws-cdk-lib/aws-ecs';
 
 const app = new cdk.App({
   postCliContext: {
-    '@aws-cdk/aws-lambda:useCdkManagedLogGroup': false,
     '@aws-cdk/aws-ecs:reduceEc2FargateCloudWatchPermissions': true,
-    '@aws-cdk/aws-ecs:enableImdsBlockingDeprecatedFeature': false,
-    '@aws-cdk/aws-ecs:disableEcsImdsBlocking': false,
-    '@aws-cdk/aws-lambda:createNewPoliciesWithAddToRolePolicy': false,
   },
 });
 const stack = new cdk.Stack(app, 'aws-ecs-integ-enable-execute-command');
 
-const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2 });
-
-const taskDefinition = new ecs.Ec2TaskDefinition(stack, 'TaskDef');
-
-taskDefinition.addContainer('web', {
-  image: ecs.ContainerImage.fromRegistry('amazon/amazon-ecs-sample'),
-  memoryReservationMiB: 256,
-  portMappings: [
-    {
-      containerPort: 80,
-      hostPort: 8080,
-      protocol: ecs.Protocol.TCP,
-    },
-  ],
-});
+const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2, restrictDefaultSecurityGroup: false });
 
-const execBucket = new s3.Bucket(stack, 'EcsExecBucket');
+const kmsKey = new kms.Key(stack, 'KmsKey');
 
-const cp = new ecs.AsgCapacityProvider(stack, 'EC2CapacityProvider', {
-  autoScalingGroup: new autoscaling.AutoScalingGroup(stack, 'ASG', {
-    vpc,
-    instanceType: new ec2.InstanceType('t2.micro'),
-    machineImage: ecs.EcsOptimizedImage.amazonLinux2(),
-  }),
-  // This is to allow cdk destroy to work; otherwise deletion will hang bc ASG cannot be deleted
-  enableManagedTerminationProtection: false,
+const execBucket = new s3.Bucket(stack, 'EcsExecBucket', {
+  encryptionKey: kmsKey,
 });
 
-const cluster = new ecs.Cluster(stack, 'EC2CPCluster', {
+const cluster = new ecs.Cluster(stack, 'FargateCluster', {
   vpc,
   executeCommandConfiguration: {
+    kmsKey,
     logConfiguration: {
       s3Bucket: execBucket,
       s3EncryptionEnabled: true,
@@ -56,9 +33,19 @@ const cluster = new ecs.Cluster(stack, 'EC2CPCluster', {
     logging: ecs.ExecuteCommandLogging.OVERRIDE,
   },
 });
-cluster.addAsgCapacityProvider(cp);
 
-new ecs.Ec2Service(stack, 'EC2Service', {
+const taskDefinition = new ecs.FargateTaskDefinition(stack, 'TaskDef');
+
+taskDefinition.addContainer('web', {
+  image: ecs.ContainerImage.fromRegistry('amazon/amazon-ecs-sample'),
+  healthCheck: {
+    command: ['CMD-SHELL', 'curl localhost:8000'],
+    interval: Duration.seconds(60),
+    timeout: Duration.seconds(40),
+  },
+});
+
+new ecs.FargateService(stack, 'FargateService', {
   cluster,
   taskDefinition,
   enableExecuteCommand: true,
@@ -66,5 +53,12 @@ new ecs.Ec2Service(stack, 'EC2Service', {
 
 new integ.IntegTest(app, 'enable-execute-command-test', {
   testCases: [stack],
+  diffAssets: true,
+  cdkCommandOptions: {
+    deploy: {
+      args: {
+        rollback: true,
+      },
+    },
+  },
 });
-app.synth();