feat(compute): add AWS Lambda MicroVMs ComputeStrategy backend — P1 (#645)

cdk/bootstrap/BOOTSTRAP_HASH

@@ -1 +1 @@
-b0501c8a57f20e4b5bf50d6fe8bbb934310adc4b64480228565d8392a19d1503
+40d0a8b2343663084f614423fc3e6210761377dedf0bc079956ba7d4cea84c5e

cdk/bootstrap/BOOTSTRAP_VERSION

@@ -1 +1 @@
-1.2.0
+1.3.0

cdk/bootstrap/bootstrap-template.yaml

@@ -1,13 +1,13 @@
 # GENERATED FILE - DO NOT EDIT DIRECTLY
 # This template is generated by: npx tsx scripts/generate-bootstrap-template.ts
-# ABCA Bootstrap Policy Version: 1.2.0
-# ABCA Bootstrap Policy Hash: b0501c8a57f20e4b5bf50d6fe8bbb934310adc4b64480228565d8392a19d1503
+# ABCA Bootstrap Policy Version: 1.3.0
+# ABCA Bootstrap Policy Hash: 40d0a8b2343663084f614423fc3e6210761377dedf0bc079956ba7d4cea84c5e
 #
 # Based on the default CDK bootstrap template with the following modifications:
 #   - BootstrapVariant set to "ABCA: Least-Privilege Bootstrap"
 #   - ComputeTypes parameter added for compute-variant selection
-#   - IncludeComputeEcs condition added
-#   - 5 inline AWS::IAM::ManagedPolicy resources replace AdministratorAccess
+#   - IncludeComputeEcs / IncludeComputeLambdaMicrovms conditions added
+#   - 6 inline AWS::IAM::ManagedPolicy resources replace AdministratorAccess
 #   - CloudFormationExecutionRole references our least-privilege policies
 #   - BootstrapPolicyVersion, BootstrapPolicyHash, BootstrapPolicySet outputs added
 Description: This stack includes resources needed to deploy AWS CDK apps into this environment
@@ -77,7 +77,7 @@ Parameters:
   ComputeTypes:
     Type: CommaDelimitedList
     Default: agentcore
-    Description: 'Comma-separated list of compute backends to enable. Valid values: agentcore, ecs.'
+    Description: 'Comma-separated list of compute backends to enable. Valid values: agentcore, ecs, lambda-microvm.'
 Conditions:
   HasTrustedAccounts:
     Fn::Not:
@@ -148,6 +148,19 @@ Conditions:
           - Fn::Join:
               - ''
               - Ref: ComputeTypes
+  IncludeComputeLambdaMicrovms:
+    Fn::Not:
+      - Fn::Equals:
+          - Fn::Select:
+              - 0
+              - Fn::Split:
+                  - lambda-microvm
+                  - Fn::Join:
+                      - ''
+                      - Ref: ComputeTypes
+          - Fn::Join:
+              - ''
+              - Ref: ComputeTypes
 Resources:
   FileAssetsBucketEncryptionKey:
     Type: AWS::KMS::Key
@@ -728,6 +741,10 @@ Resources:
                 - IncludeComputeEcs
                 - Ref: IaCRoleABCAComputeEcs
                 - Ref: AWS::NoValue
+            - Fn::If:
+                - IncludeComputeLambdaMicrovms
+                - Ref: IaCRoleABCAComputeLambdaMicrovms
+                - Ref: AWS::NoValue
       RoleName:
         Fn::Sub: cdk-${Qualifier}-cfn-exec-role-${AWS::AccountId}-${AWS::Region}
       PermissionsBoundary:
@@ -1342,6 +1359,39 @@ Resources:
         Version: '2012-10-17'
       Description: 'ABCA Bootstrap: IaCRole-ABCA-Compute-ECS permissions for CloudFormation execution role'
     Condition: IncludeComputeEcs
+  IaCRoleABCAComputeLambdaMicrovms:
+    Type: AWS::IAM::ManagedPolicy
+    Properties:
+      ManagedPolicyName:
+        Fn::Sub: cdk-${Qualifier}-IaCRole-ABCA-Compute-LambdaMicrovms-${AWS::AccountId}-${AWS::Region}
+      PolicyDocument:
+        Statement:
+          - Action:
+              - lambda:CreateMicrovmImage
+              - lambda:GetMicrovmImage
+              - lambda:UpdateMicrovmImage
+              - lambda:DeleteMicrovmImage
+              - lambda:ListMicrovmImages
+              - lambda:GetMicrovmImageVersion
+              - lambda:UpdateMicrovmImageVersion
+              - lambda:DeleteMicrovmImageVersion
+              - lambda:ListMicrovmImageVersions
+              - lambda:GetMicrovmImageBuild
+              - lambda:ListMicrovmImageBuilds
+              - lambda:ListManagedMicrovmImages
+              - lambda:ListManagedMicrovmImageVersions
+              - lambda:CreateNetworkConnector
+              - lambda:GetNetworkConnector
+              - lambda:UpdateNetworkConnector
+              - lambda:DeleteNetworkConnector
+              - lambda:ListNetworkConnectors
+              - lambda:PassNetworkConnector
+            Effect: Allow
+            Resource: '*'
+            Sid: LambdaMicrovms
+        Version: '2012-10-17'
+      Description: 'ABCA Bootstrap: IaCRole-ABCA-Compute-LambdaMicrovms permissions for CloudFormation execution role'
+    Condition: IncludeComputeLambdaMicrovms
 Outputs:
   BucketName:
     Description: The name of the S3 bucket owned by the CDK toolkit stack
@@ -1370,10 +1420,10 @@ Outputs:
     Value: '32'
   BootstrapPolicyVersion:
     Description: The version of the ABCA bootstrap policy bundle
-    Value: 1.2.0
+    Value: 1.3.0
   BootstrapPolicyHash:
     Description: SHA-256 hash of the ABCA bootstrap policy bundle for drift detection
-    Value: b0501c8a57f20e4b5bf50d6fe8bbb934310adc4b64480228565d8392a19d1503
+    Value: 40d0a8b2343663084f614423fc3e6210761377dedf0bc079956ba7d4cea84c5e
   BootstrapPolicySet:
     Description: Comma-separated list of active ABCA bootstrap policy names
     Value:
@@ -1387,3 +1437,7 @@ Outputs:
               - IncludeComputeEcs
               - Compute-ECS
               - Ref: AWS::NoValue
+          - Fn::If:
+              - IncludeComputeLambdaMicrovms
+              - Compute-LambdaMicrovms
+              - Ref: AWS::NoValue

cdk/bootstrap/policies/compute-lambda-microvm.json

@@ -0,0 +1,31 @@
+{
+  "Statement": [
+    {
+      "Action": [
+        "lambda:CreateMicrovmImage",
+        "lambda:GetMicrovmImage",
+        "lambda:UpdateMicrovmImage",
+        "lambda:DeleteMicrovmImage",
+        "lambda:ListMicrovmImages",
+        "lambda:GetMicrovmImageVersion",
+        "lambda:UpdateMicrovmImageVersion",
+        "lambda:DeleteMicrovmImageVersion",
+        "lambda:ListMicrovmImageVersions",
+        "lambda:GetMicrovmImageBuild",
+        "lambda:ListMicrovmImageBuilds",
+        "lambda:ListManagedMicrovmImages",
+        "lambda:ListManagedMicrovmImageVersions",
+        "lambda:CreateNetworkConnector",
+        "lambda:GetNetworkConnector",
+        "lambda:UpdateNetworkConnector",
+        "lambda:DeleteNetworkConnector",
+        "lambda:ListNetworkConnectors",
+        "lambda:PassNetworkConnector"
+      ],
+      "Effect": "Allow",
+      "Resource": "*",
+      "Sid": "LambdaMicrovms"
+    }
+  ],
+  "Version": "2012-10-17"
+}

cdk/mise.toml

@@ -47,7 +47,7 @@ run = "npx cdk deploy"
 # parameter directly on the CDKToolkit stack:
 #   aws cloudformation update-stack --stack-name CDKToolkit --use-previous-template \
 #     --capabilities CAPABILITY_NAMED_IAM \
-#     --parameters ParameterKey=ComputeTypes,ParameterValue=agentcore\,ecs
+#     --parameters ParameterKey=ComputeTypes,ParameterValue=agentcore\,ecs\,lambda-microvm
 #   # verify: aws cloudformation describe-stacks --stack-name CDKToolkit --query 'Stacks[0].Parameters'
 [tasks.bootstrap]
 description = "Bootstrap CDK with least-privilege policies (ComputeTypes=agentcore; for ECS set the ComputeTypes CFN param on CDKToolkit — see comment above the task)"

cdk/package.json

@@ -21,6 +21,7 @@
     "@aws-sdk/client-dynamodb": "^3.1078.0",
     "@aws-sdk/client-ecs": "^3.1078.0",
     "@aws-sdk/client-lambda": "^3.1078.0",
+    "@aws-sdk/client-lambda-microvms": "^3.1098.0",
     "@aws-sdk/client-s3": "^3.1078.0",
     "@aws-sdk/client-secrets-manager": "^3.1078.0",
     "@aws-sdk/credential-provider-node": "^3.972.61",

cdk/scripts/README.md

@@ -1,3 +1,11 @@
 # CDK helper scripts
 
 Bundling for Lambda assets is handled at synth time; the **`bundle`** task in **`cdk/mise.toml`** is a no-op placeholder for **`cdk/cdk.json`**. Prefer **`mise //cdk:*`** tasks from the repository root (`MISE_EXPERIMENTAL=1`).
+
+| Script | Purpose | Invoke via |
+|--------|---------|------------|
+| `generate-bootstrap-artifacts.ts` | Regenerates `cdk/bootstrap/policies/*.json`, `BOOTSTRAP_VERSION`, `BOOTSTRAP_HASH` from the typed policies in `src/bootstrap/policies/` | `mise //cdk:bootstrap:generate` |
+| `generate-bootstrap-template.ts` | Regenerates `cdk/bootstrap/bootstrap-template.yaml` (least-privilege CDK bootstrap, `ComputeTypes`-gated compute policies) | `mise //cdk:bootstrap:generate` |
+| `package-microvm-artifact.sh` | Packages `agent/` + `contracts/` + `Dockerfile` into the zip artifact an `AWS::Lambda::MicrovmImage` builds from, and uploads it to the CDK-created artifact bucket (ADR-021) | run directly — see the script header for the full bootstrap sequence |
+
+`package-microvm-artifact.sh` exists because CloudFormation cannot produce its own MicroVM `codeArtifact`: the image resource consumes a zip that must already be in S3, and there is no CDK asset type for "zip + Dockerfile a MicroVM image builds from". Everything else on that backend (buckets, roles, network connector, log group, the image resource itself) is CDK-managed in `src/constructs/lambda-microvm-compute.ts`.

cdk/scripts/generate-bootstrap-artifacts.ts

@@ -24,6 +24,7 @@ import {
   applicationPolicy,
   computeAgentcorePolicy,
   computeEcsPolicy,
+  computeLambdaMicrovmPolicy,
   infrastructurePolicy,
   observabilityPolicy,
 } from '../src/bootstrap/policies';
@@ -38,6 +39,7 @@ const policies = [
   { name: 'observability', fn: observabilityPolicy },
   { name: 'compute-agentcore', fn: computeAgentcorePolicy },
   { name: 'compute-ecs', fn: computeEcsPolicy },
+  { name: 'compute-lambda-microvm', fn: computeLambdaMicrovmPolicy },
 ];
 
 for (const { name, fn } of policies) {

cdk/scripts/generate-bootstrap-template.ts

@@ -35,6 +35,7 @@ import {
   applicationPolicy,
   computeAgentcorePolicy,
   computeEcsPolicy,
+  computeLambdaMicrovmPolicy,
   infrastructurePolicy,
   observabilityPolicy,
 } from '../src/bootstrap/policies';
@@ -66,30 +67,36 @@ template.Parameters.ComputeTypes = {
   Type: 'CommaDelimitedList',
   Default: 'agentcore',
   Description:
-    'Comma-separated list of compute backends to enable. Valid values: agentcore, ecs.',
+    'Comma-separated list of compute backends to enable. Valid values: agentcore, ecs, lambda-microvm.',
 };
 
 // --- Step 3: Add conditions ---
-template.Conditions.IncludeComputeEcs = {
-  'Fn::Not': [
-    {
-      'Fn::Equals': [
-        {
-          'Fn::Select': [
-            0,
-            {
-              'Fn::Split': [
-                'ecs',
-                { 'Fn::Join': ['', { Ref: 'ComputeTypes' }] },
-              ],
-            },
-          ],
-        },
-        { 'Fn::Join': ['', { Ref: 'ComputeTypes' }] },
-      ],
-    },
-  ],
-};
+/**
+ * "The joined ComputeTypes list contains `needle`" as a CloudFormation
+ * condition. There is no `Fn::Contains`, so the trick is: split the joined list
+ * on the needle and compare element 0 against the whole string — they differ
+ * only if the needle was actually present. Extracted into a helper (it was
+ * inline for ECS) so a third backend cannot introduce a subtly different
+ * variant of the same expression.
+ */
+function includesComputeType(needle: string): Record<string, unknown> {
+  const joined = { 'Fn::Join': ['', { Ref: 'ComputeTypes' }] };
+  return {
+    'Fn::Not': [
+      {
+        'Fn::Equals': [
+          { 'Fn::Select': [0, { 'Fn::Split': [needle, joined] }] },
+          joined,
+        ],
+      },
+    ],
+  };
+}
+
+template.Conditions.IncludeComputeEcs = includesComputeType('ecs');
+// ADR-021: matched on the full `lambda-microvm` token, NOT a prefix — a bare
+// `Fn::Split` on `lambda` would also fire for any future `lambda*` backend name.
+template.Conditions.IncludeComputeLambdaMicrovms = includesComputeType('lambda-microvm');
 
 // --- Step 4: Add managed policy resources ---
 interface PolicyDef {
@@ -127,6 +134,12 @@ const policyDefs: PolicyDef[] = [
     policyFn: computeEcsPolicy,
     condition: 'IncludeComputeEcs',
   },
+  {
+    logicalId: 'IaCRoleABCAComputeLambdaMicrovms',
+    policyName: 'IaCRole-ABCA-Compute-LambdaMicrovms',
+    policyFn: computeLambdaMicrovmPolicy,
+    condition: 'IncludeComputeLambdaMicrovms',
+  },
 ];
 
 for (const { logicalId, policyName, policyFn, condition } of policyDefs) {
@@ -164,6 +177,13 @@ const coreRefs = [
   { Ref: 'IaCRoleABCAObservability' },
   { Ref: 'IaCRoleABCAComputeAgentcore' },
   { 'Fn::If': ['IncludeComputeEcs', { Ref: 'IaCRoleABCAComputeEcs' }, { Ref: 'AWS::NoValue' }] },
+  {
+    'Fn::If': [
+      'IncludeComputeLambdaMicrovms',
+      { Ref: 'IaCRoleABCAComputeLambdaMicrovms' },
+      { Ref: 'AWS::NoValue' },
+    ],
+  },
 ];
 
 template.Resources.CloudFormationExecutionRole.Properties.ManagedPolicyArns = {
@@ -196,6 +216,13 @@ template.Outputs.BootstrapPolicySet = {
         'Observability',
         'Compute-Agentcore',
         { 'Fn::If': ['IncludeComputeEcs', 'Compute-ECS', { Ref: 'AWS::NoValue' }] },
+        {
+          'Fn::If': [
+            'IncludeComputeLambdaMicrovms',
+            'Compute-LambdaMicrovms',
+            { Ref: 'AWS::NoValue' },
+          ],
+        },
       ],
     ],
   },
@@ -221,8 +248,8 @@ const header = [
   '# Based on the default CDK bootstrap template with the following modifications:',
   '#   - BootstrapVariant set to "ABCA: Least-Privilege Bootstrap"',
   '#   - ComputeTypes parameter added for compute-variant selection',
-  '#   - IncludeComputeEcs condition added',
-  '#   - 5 inline AWS::IAM::ManagedPolicy resources replace AdministratorAccess',
+  '#   - IncludeComputeEcs / IncludeComputeLambdaMicrovms conditions added',
+  '#   - 6 inline AWS::IAM::ManagedPolicy resources replace AdministratorAccess',
   '#   - CloudFormationExecutionRole references our least-privilege policies',
   '#   - BootstrapPolicyVersion, BootstrapPolicyHash, BootstrapPolicySet outputs added',
   '',