feat: validate CDK apps before deployment

.projenrc.py

@@ -17,6 +17,8 @@
 python_version = "3.13"
 python_major, python_minor = map(int, python_version.split("."))
 python_requires = f">={python_version},<{python_major}.{python_minor + 1}"
+cdk_version = "2.263.0"
+cdk_cli_version = "2.1130.0"
 
 # Define the AWS region for the CDK app and github workflows
 # Default to us-east-1 if AWS_REGION is not set in your environment variables
@@ -26,16 +28,25 @@
     author_email="danny@towardsthecloud.com",
     author_name="Danny Steenman",
     cdk_version_pinning=True,
-    cdk_version="2.254.0",  # Find the latest CDK version here: https://pypi.org/project/aws-cdk-lib
-    cdk_cli_version="2.1117.0",  # Find the latest CDK CLI version https://pypi.org/project/aws-cdk-cli/
+    cdk_version=cdk_version,  # Find the latest CDK version here: https://pypi.org/project/aws-cdk-lib
+    cdk_cli_version=cdk_cli_version,  # Find the latest CDK CLI version https://pypi.org/project/aws-cdk-cli/
+    context={
+        "@aws-cdk/core:annotationsInValidationReport": True,
+        "@aws-cdk/core:validateAgainstDefaultRules": True,
+    },
     module_name=python_module_name,
     name=project_name,
     projen_command="uv run projen",
     description="Create and deploy an AWS CDK app on your AWS account in less than 5 minutes using GitHub actions!",
     version="2.101.0",
     app_entrypoint=f"{python_module_name}/app.py",
     deps=["aws-cdk-github-oidc"],
-    dev_deps=["projen@0.99.62", "ruff", "ty"],  # Find the latest projen version here: https://pypi.org/project/projen/
+    dev_deps=[
+        "projen@0.99.62",
+        "pytest@9.0.3",
+        "ruff",
+        "ty",
+    ],  # Find the latest projen version here: https://pypi.org/project/projen/
     uv=True,
     uv_options={
         "python_exec": f"python{python_version}",
@@ -47,7 +58,18 @@
     github_options={
         "pull_request_lint_options": {
             "semantic_title_options": {
-                "types": ["feat", "fix", "chore", "refactor", "perf", "docs", "style", "test", "build", "ci"],
+                "types": [
+                    "feat",
+                    "fix",
+                    "chore",
+                    "refactor",
+                    "perf",
+                    "docs",
+                    "style",
+                    "test",
+                    "build",
+                    "ci",
+                ],
             },
         },
     },
@@ -73,6 +95,14 @@
 # Set the CDK_DEFAULT_REGION environment variable for the projen tasks,
 # so the CDK CLI knows which region to use
 project.tasks.add_environment("CDK_DEFAULT_REGION", aws_region)
+project.test_task.env("PYTHONPATH", python_module_name)
+
+project.add_task(
+    "validate",
+    description="Validate the CDK app offline against the default CloudFormation rules",
+    exec="cdk --unstable=validate validate --no-online",
+    receive_args=True,
+)
 
 # Define the target AWS accounts for the different environments
 target_accounts = {
@@ -113,7 +143,9 @@
 )
 
 # Add auto-merge step to the auto-approve workflow
-auto_approve_workflow = project.try_find_object_file(".github/workflows/auto-approve.yml")
+auto_approve_workflow = project.try_find_object_file(
+    ".github/workflows/auto-approve.yml"
+)
 if auto_approve_workflow:
     auto_approve_workflow.add_override("jobs.approve.permissions.contents", "write")
     # Add checkout step before the merge step
@@ -143,6 +175,6 @@
         )
 
         # Adds GitHub action workflows for deploying the CDK stacks to the target AWS account
-        github_cicd(gh, account, env, python_version, aws_region)
+        github_cicd(gh, account, env, python_version, aws_region, cdk_cli_version)
 
 project.synth()

src/bin/cicd_helper.py

@@ -1,10 +1,13 @@
 from projen import github
 
 
-def github_cicd(gh, account, env, python_version, aws_region):
+def github_cicd(gh, account, env, python_version, aws_region, cdk_cli_version):
     # Add a GitHub workflow for deploying the CDK stacks to the AWS account
     cdk_deployment_workflow = github.GithubWorkflow(gh, f"cdk-deploy-{env}")
-    cdk_deployment_workflow.on(push={"branches": ["main"]} if env != "production" else None, workflow_dispatch={})
+    cdk_deployment_workflow.on(
+        push={"branches": ["main"]} if env != "production" else None,
+        workflow_dispatch={},
+    )
 
     cdk_deployment_workflow.add_jobs(
         {
@@ -46,11 +49,11 @@ def github_cicd(gh, account, env, python_version, aws_region):
                     },
                     {
                         "name": "Install cdk cli",
-                        "run": "npm install -g aws-cdk",
+                        "run": f"npm install -g aws-cdk@{cdk_cli_version}",
                     },
                     {
-                        "name": f"Run CDK synth for the {env.upper()} environment",
-                        "run": f"uv run projen {env}:synth",
+                        "name": f"Validate CDK for the {env.upper()} environment",
+                        "run": f"uv run projen {env}:validate",
                     },
                     {
                         "name": f"Deploy CDK to the {env.upper()} environment on AWS account {account}",

src/bin/env_helper.py

@@ -1,25 +1,26 @@
-from typing import Dict
-
 from projen.awscdk import AwsCdkPythonApp
 
 
-def cdk_action_task(project: AwsCdkPythonApp, target_account: Dict[str, str]):
-    task_actions = ["synth", "diff", "deploy", "destroy"]
+def cdk_action_task(project: AwsCdkPythonApp, target_account: dict[str, str]):
     stack_name_pattern = f"*Stack-{target_account['ENVIRONMENT']}"
+    action_commands = {
+        "synth": ("cdk synth", False),
+        "validate": ("cdk --unstable=validate validate", True),
+        "diff": (f"cdk diff --require-approval never {stack_name_pattern}", False),
+        "deploy": (f"cdk deploy --require-approval never {stack_name_pattern}", False),
+        "destroy": (f"cdk destroy --force {stack_name_pattern}", False),
+    }
 
-    for action in task_actions:
+    for action, (exec_command, receive_args) in action_commands.items():
         task_name = f"{target_account['ENVIRONMENT']}:{action}"
         task_description = f"{action.capitalize()} the stacks on the {target_account['ENVIRONMENT'].upper()} account"
 
-        exec_command = f"cdk {action} --require-approval never {stack_name_pattern}"
-        if action == "destroy":
-            exec_command = f"cdk destroy --force {stack_name_pattern}"
-        if action == "synth":
-            exec_command = "cdk synth"
-
-        project.add_task(
+        task = project.add_task(
             task_name,
             description=task_description,
             env=target_account,
-            exec=exec_command,
         )
+        if receive_args:
+            task.exec(exec_command, receive_args=True)
+        else:
+            task.exec(exec_command)