Nextnet：基于 AWS CDK 的科学 AI 平台

// AWS Amplify Gen 2，用于无服务器、分布式的 Web 托管等。
const app = new App(this, 'App', {
  appName: 'Core Application',
  sourceCodeProvider: new CodeCommitSourceCodeProvider({ repository }),
  customRules: [CustomRule.SINGLE_PAGE_APPLICATION_REDIRECT],
  …
});

// AWS Cognito，用于用户管理、身份验证和授权
const userPool = new UserPool(this, 'UserPool', {
  customDomain: { domainName: `auth.${domain}` }
  …
});
 
// AWS AppSync，用于无服务器 GraphQL API
const api = new GraphqlApi(this, 'Api', {
  authorizationConfig: {
  defaultAuthorization: { authorizationType: AuthorizationType.USER_POOL }
  }
  …
});

// AWS Bedrock Knowledge Base，用于 RAG
const knowledgeBase = new KnowledgeBaseVector(this, "KnowledgeBase", {
  id: env.KNOWLEDGE_BASE_ID,
  executionRoleArn: env.KNOWLEDGE_BASE_EXECUTION_ROLE_ARN,
});
 
// 集成了 AWS Bedrock 的 AWS Lambda 函数
backend.chat.resources.lambda.addToRolePolicy(
  new PolicyStatement({
    actions: ["bedrock:InvokeModelWithResponseStream"],
    resources: [`arn:aws:bedrock:*::foundation-model/${modelId}`],
  }))		

// 用于不同数据类型的 AWS S3 存储桶
const storage = defineStorage({
  name: "storage",
  access: (allow) => ({
    "profile-pictures/*": [allow.authenticated.to(["read", "write"])],
    "knowledge-base-sources/*": [allow.authenticated.to(["read"])],
  }),
});

// 生产账户
const crossAccountDelegationRole = new Role(this, "CrossAccountRole", {
  assumedBy: new AccountPrincipal("111111111111"),
  roleName: "CrossAccountDelegationRoleCoreApplicationProduction",
});
 
// 开发账户
const devDelegationRole = new Role(this, "DevDelegationRole", {
  assumedBy: new AccountPrincipal("222222222222"),
  roleName: "CrossAccountDelegationRoleCoreApplicationDevelopment",
});

// 特定于环境的配置
if (process.env.ENV === 'prd') {
  const main = app.addBranch('main', {
    …
  });
} else {
  const develop = app.addBranch('develop', {
    basicAuth: BasicAuth.fromCredentials('SOME_USERNAME',
    SecretValue.unsafePlainText(process.env.SOME_PASSWORD)),
    …
  });
}

// 采用按需计费的 DynamoDB
const table = new Table(this, "Table", {
  billingMode: BillingMode.PAY_PER_REQUEST,
  pointInTimeRecovery: true,
});

// 用于提供上下文相关 AI 响应的知识库集成
backend.retrieveAndGenerateResponse.resources.lambda.addToRolePolicy(
  new PolicyStatement({
    actions: ["bedrock:Retrieve", "bedrock:RetrieveAndGenerate"],
    resources: [`arn:aws:bedrock:*:*:knowledge-base/${knowledgeBaseId}`],
  })
);

const crossAccountPolicy = new PolicyDocument({
  statements: [
    new PolicyStatement({
      actions: ["route53:ChangeResourceRecordSets"],
      resources: [hostedZone.hostedZoneArn],
      conditions: {
        "ForAllValues:StringEquals": {
          "route53:ChangeResourceRecordSetsActions": ["UPSERT", "DELETE"],
        },
      },
    }),
  ],
});

new secretsManager.Secret(this, "SecretKey", {
  secretName: "secret-key",
  secretStringValue: SecretValue.unsafePlainText(props.secretKey),
});

// 使用 EventBridge 处理 Stripe 事件
new Payments(backend.createStack('payments'), 'payments', {
  destinationId: env.STRIPE_EVENTBRIDGE_DESTINATION_ID,
  graphqlApi: backend.data.resources.graphqlApi,
  …
});

// 生产配置
if (env.ENV === "prd") {
  this.hostedZone = new PublicHostedZone(this, "HostedZone", {
    zoneName: "domainname.com",
    caaAmazon: true,
  });
} else {
  // 开发配置
  this.hostedZone = new PublicHostedZone(this, "HostedZone", {
    zoneName: `${env.ENV}.domainname.com`,
  });
}

// 用于分布式系统的 AWS X-Ray 追踪
backend.data.resources.cfnResources.cfnGraphqlApi.xrayEnabled = true;
 
// AWS CloudWatch 日志记录
const graphQlApiLogsRole = new Role(backend.data, 'GraphQlApiLogsRole', {
  assumedBy: new ServicePrincipal('appsync.amazonaws.com'),
  managedPolicies: [
    ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSAppSyncPushToCloudWatchLogs')
  ],
  …
});

// 
Object.values(
  backend.data.resources.cfnResources.amplifyDynamoDbTables
).forEach((tableConfig) => {
  tableConfig.pointInTimeRecoveryEnabled = true;
});