# AWS Cloud Development Kit (AWS CDK)

The AWS Cloud Development Kit (AWS CDK) is an open-source software development framework that enables developers to define cloud infrastructure using familiar programming languages and provision it through AWS CloudFormation. Instead of writing verbose YAML or JSON templates, developers can use TypeScript, JavaScript, Python, Java, C#, or Go to define reusable cloud components called "constructs" that are composed into "stacks" forming a CDK application.

The CDK provides a high-level object-oriented abstraction to define AWS resources imperatively, encapsulating AWS best practices and reducing boilerplate logic. The AWS Construct Library includes modules for each AWS service with rich APIs that handle the complexity of integrating various AWS services. Developers use the CDK CLI to synthesize CloudFormation templates, deploy stacks to AWS accounts, and compare changes against deployed infrastructure.

## App - Root CDK Application Construct

The `App` class represents the root of a CDK application and serves as the entry point for defining cloud infrastructure. It manages the construct tree, handles synthesis of CloudFormation templates, and coordinates deployment artifacts.

```typescript
import * as cdk from 'aws-cdk-lib';
import * as s3 from 'aws-cdk-lib/aws-s3';

// Create the CDK app - the root of all constructs
const app = new cdk.App({
  // Optional: Additional context values
  context: {
    'myKey': 'myValue',
  },
  // Optional: Enable analytics reporting
  analyticsReporting: true,
});

// Define a stack within the app
class MyStack extends cdk.Stack {
  constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    new s3.Bucket(this, 'MyBucket', {
      versioned: true,
      removalPolicy: cdk.RemovalPolicy.DESTROY,
    });
  }
}

// Instantiate the stack
new MyStack(app, 'MyStack', {
  env: {
    account: process.env.CDK_DEFAULT_ACCOUNT,
    region: process.env.CDK_DEFAULT_REGION,
  },
});

// Synthesize CloudFormation templates
app.synth();
```

## Stack - CloudFormation Stack Definition

The `Stack` class represents a single CloudFormation stack and serves as the unit of deployment. Stacks contain AWS resources and can be deployed independently. Multiple stacks can share resources through cross-stack references.

```typescript
import * as cdk from 'aws-cdk-lib';
import * as sqs from 'aws-cdk-lib/aws-sqs';
import * as sns from 'aws-cdk-lib/aws-sns';
import * as subscriptions from 'aws-cdk-lib/aws-sns-subscriptions';

class MyApplicationStack extends cdk.Stack {
  public readonly queue: sqs.Queue;

  constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
    super(scope, id, {
      ...props,
      description: 'My application infrastructure stack',
      tags: {
        Environment: 'Production',
        Team: 'Backend',
      },
    });

    // Create an SQS queue
    this.queue = new sqs.Queue(this, 'MyQueue', {
      visibilityTimeout: cdk.Duration.seconds(300),
      retentionPeriod: cdk.Duration.days(14),
    });

    // Create an SNS topic
    const topic = new sns.Topic(this, 'MyTopic', {
      displayName: 'My Application Topic',
    });

    // Subscribe the queue to the topic
    topic.addSubscription(new subscriptions.SqsSubscription(this.queue));

    // Output the queue URL
    new cdk.CfnOutput(this, 'QueueUrl', {
      value: this.queue.queueUrl,
      description: 'URL of the SQS queue',
    });
  }
}

const app = new cdk.App();
new MyApplicationStack(app, 'MyAppStack', {
  env: { account: '123456789012', region: 'us-east-1' },
});
```

## Lambda Function - Serverless Compute

The `Function` construct creates AWS Lambda functions with automatic IAM role creation, CloudWatch log groups, and integration with other AWS services through event sources.

```typescript
import * as cdk from 'aws-cdk-lib';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import * as iam from 'aws-cdk-lib/aws-iam';
import * as logs from 'aws-cdk-lib/aws-logs';
import * as path from 'path';

class LambdaStack extends cdk.Stack {
  constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // Simple inline Lambda function
    const inlineFunction = new lambda.Function(this, 'InlineFunction', {
      runtime: lambda.Runtime.NODEJS_20_X,
      handler: 'index.handler',
      code: lambda.Code.fromInline(`
        exports.handler = async (event) => {
          console.log('Event:', JSON.stringify(event, null, 2));
          return {
            statusCode: 200,
            body: JSON.stringify({ message: 'Hello from Lambda!' }),
          };
        };
      `),
      timeout: cdk.Duration.seconds(30),
      memorySize: 256,
      environment: {
        NODE_ENV: 'production',
        LOG_LEVEL: 'info',
      },
      logRetention: logs.RetentionDays.ONE_WEEK,
    });

    // Lambda function from local directory
    const directoryFunction = new lambda.Function(this, 'DirectoryFunction', {
      runtime: lambda.Runtime.PYTHON_3_12,
      handler: 'app.handler',
      code: lambda.Code.fromAsset(path.join(__dirname, 'lambda')),
      timeout: cdk.Duration.minutes(5),
      memorySize: 1024,
      tracing: lambda.Tracing.ACTIVE,
      architecture: lambda.Architecture.ARM_64,
    });

    // Grant additional permissions
    directoryFunction.addToRolePolicy(new iam.PolicyStatement({
      actions: ['s3:GetObject', 's3:PutObject'],
      resources: ['arn:aws:s3:::my-bucket/*'],
    }));

    // Create a function URL for direct HTTPS access
    const functionUrl = inlineFunction.addFunctionUrl({
      authType: lambda.FunctionUrlAuthType.NONE,
      cors: {
        allowedOrigins: ['*'],
        allowedMethods: [lambda.HttpMethod.GET, lambda.HttpMethod.POST],
      },
    });

    new cdk.CfnOutput(this, 'FunctionUrl', {
      value: functionUrl.url,
    });
  }
}
```

## S3 Bucket - Object Storage

The `Bucket` construct creates S3 buckets with configurable encryption, versioning, lifecycle rules, and access policies.

```typescript
import * as cdk from 'aws-cdk-lib';
import * as s3 from 'aws-cdk-lib/aws-s3';
import * as iam from 'aws-cdk-lib/aws-iam';

class S3Stack extends cdk.Stack {
  constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // Create a bucket with versioning and encryption
    const dataBucket = new s3.Bucket(this, 'DataBucket', {
      bucketName: 'my-application-data-bucket',
      versioned: true,
      encryption: s3.BucketEncryption.S3_MANAGED,
      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
      enforceSSL: true,
      removalPolicy: cdk.RemovalPolicy.RETAIN,

      // Lifecycle rules for cost optimization
      lifecycleRules: [
        {
          id: 'MoveToInfrequentAccess',
          transitions: [
            {
              storageClass: s3.StorageClass.INFREQUENT_ACCESS,
              transitionAfter: cdk.Duration.days(30),
            },
            {
              storageClass: s3.StorageClass.GLACIER,
              transitionAfter: cdk.Duration.days(90),
            },
          ],
        },
        {
          id: 'DeleteOldVersions',
          noncurrentVersionExpiration: cdk.Duration.days(365),
        },
      ],

      // Enable access logging
      serverAccessLogsPrefix: 'access-logs/',
    });

    // Static website hosting bucket
    const websiteBucket = new s3.Bucket(this, 'WebsiteBucket', {
      websiteIndexDocument: 'index.html',
      websiteErrorDocument: 'error.html',
      publicReadAccess: true,
      blockPublicAccess: new s3.BlockPublicAccess({
        blockPublicAcls: false,
        ignorePublicAcls: false,
        blockPublicPolicy: false,
        restrictPublicBuckets: false,
      }),
      removalPolicy: cdk.RemovalPolicy.DESTROY,
      autoDeleteObjects: true,
    });

    // Grant read/write access to a Lambda function role
    const lambdaRole = new iam.Role(this, 'LambdaRole', {
      assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
    });
    dataBucket.grantReadWrite(lambdaRole);

    new cdk.CfnOutput(this, 'BucketArn', {
      value: dataBucket.bucketArn,
    });

    new cdk.CfnOutput(this, 'WebsiteUrl', {
      value: websiteBucket.bucketWebsiteUrl,
    });
  }
}
```

## DynamoDB Table - NoSQL Database

The `TableV2` construct creates DynamoDB tables with support for global secondary indexes, auto-scaling, and global tables for multi-region deployment.

```typescript
import * as cdk from 'aws-cdk-lib';
import * as dynamodb from 'aws-cdk-lib/aws-dynamodb';

class DynamoDBStack extends cdk.Stack {
  constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // Create a DynamoDB table with on-demand billing
    const usersTable = new dynamodb.TableV2(this, 'UsersTable', {
      tableName: 'Users',
      partitionKey: { name: 'userId', type: dynamodb.AttributeType.STRING },
      sortKey: { name: 'createdAt', type: dynamodb.AttributeType.NUMBER },
      billing: dynamodb.Billing.onDemand(),
      removalPolicy: cdk.RemovalPolicy.DESTROY,
      pointInTimeRecoverySpecification: {
        pointInTimeRecoveryEnabled: true,
      },

      // Global Secondary Index for querying by email
      globalSecondaryIndexes: [
        {
          indexName: 'EmailIndex',
          partitionKey: { name: 'email', type: dynamodb.AttributeType.STRING },
          projectionType: dynamodb.ProjectionType.ALL,
        },
        {
          indexName: 'StatusIndex',
          partitionKey: { name: 'status', type: dynamodb.AttributeType.STRING },
          sortKey: { name: 'lastLogin', type: dynamodb.AttributeType.NUMBER },
          projectionType: dynamodb.ProjectionType.INCLUDE,
          nonKeyAttributes: ['userId', 'email', 'name'],
        },
      ],
    });

    // Create a table with provisioned capacity and auto-scaling
    const ordersTable = new dynamodb.TableV2(this, 'OrdersTable', {
      tableName: 'Orders',
      partitionKey: { name: 'orderId', type: dynamodb.AttributeType.STRING },
      billing: dynamodb.Billing.provisioned({
        readCapacity: dynamodb.Capacity.autoscaled({ maxCapacity: 100 }),
        writeCapacity: dynamodb.Capacity.autoscaled({ maxCapacity: 50 }),
      }),
      tableClass: dynamodb.TableClass.STANDARD,
      timeToLiveAttribute: 'expiresAt',
    });

    // Grant permissions to a Lambda function
    // usersTable.grantReadWriteData(myLambdaFunction);

    new cdk.CfnOutput(this, 'UsersTableArn', {
      value: usersTable.tableArn,
    });
  }
}
```

## VPC - Virtual Private Cloud Networking

The `Vpc` construct creates a complete VPC with public and private subnets, NAT gateways, and internet gateways across multiple availability zones.

```typescript
import * as cdk from 'aws-cdk-lib';
import * as ec2 from 'aws-cdk-lib/aws-ec2';

class NetworkStack extends cdk.Stack {
  public readonly vpc: ec2.Vpc;

  constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // Create a VPC with custom subnet configuration
    this.vpc = new ec2.Vpc(this, 'MainVpc', {
      ipAddresses: ec2.IpAddresses.cidr('10.0.0.0/16'),
      maxAzs: 3,
      natGateways: 1, // Cost optimization: use 1 NAT gateway

      subnetConfiguration: [
        {
          name: 'Public',
          subnetType: ec2.SubnetType.PUBLIC,
          cidrMask: 24,
        },
        {
          name: 'Private',
          subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
          cidrMask: 24,
        },
        {
          name: 'Isolated',
          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
          cidrMask: 24,
        },
      ],

      // Enable VPC Flow Logs
      flowLogs: {
        's3': {
          destination: ec2.FlowLogDestination.toS3(),
          trafficType: ec2.FlowLogTrafficType.ALL,
        },
      },
    });

    // Add VPC endpoints for AWS services (avoid NAT costs)
    this.vpc.addGatewayEndpoint('S3Endpoint', {
      service: ec2.GatewayVpcEndpointAwsService.S3,
    });

    this.vpc.addGatewayEndpoint('DynamoDBEndpoint', {
      service: ec2.GatewayVpcEndpointAwsService.DYNAMODB,
    });

    this.vpc.addInterfaceEndpoint('SecretsManagerEndpoint', {
      service: ec2.InterfaceVpcEndpointAwsService.SECRETS_MANAGER,
    });

    // Create a security group
    const webSecurityGroup = new ec2.SecurityGroup(this, 'WebSecurityGroup', {
      vpc: this.vpc,
      description: 'Security group for web servers',
      allowAllOutbound: true,
    });

    webSecurityGroup.addIngressRule(
      ec2.Peer.anyIpv4(),
      ec2.Port.tcp(443),
      'Allow HTTPS traffic'
    );

    new cdk.CfnOutput(this, 'VpcId', {
      value: this.vpc.vpcId,
    });
  }
}
```

## API Gateway REST API

The `RestApi` construct creates Amazon API Gateway REST APIs with Lambda integrations, request validation, and usage plans.

```typescript
import * as cdk from 'aws-cdk-lib';
import * as apigateway from 'aws-cdk-lib/aws-apigateway';
import * as lambda from 'aws-cdk-lib/aws-lambda';

class ApiStack extends cdk.Stack {
  constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // Create a Lambda function for the API
    const handler = new lambda.Function(this, 'ApiHandler', {
      runtime: lambda.Runtime.NODEJS_20_X,
      handler: 'index.handler',
      code: lambda.Code.fromInline(`
        exports.handler = async (event) => {
          const body = JSON.parse(event.body || '{}');
          return {
            statusCode: 200,
            headers: { 'Content-Type': 'application/json' },
            body: JSON.stringify({
              message: 'Success',
              path: event.path,
              method: event.httpMethod,
              data: body,
            }),
          };
        };
      `),
    });

    // Create the REST API
    const api = new apigateway.RestApi(this, 'MyApi', {
      restApiName: 'My Service API',
      description: 'API for my service',
      deployOptions: {
        stageName: 'prod',
        throttlingBurstLimit: 100,
        throttlingRateLimit: 50,
        loggingLevel: apigateway.MethodLoggingLevel.INFO,
        dataTraceEnabled: true,
      },
      defaultCorsPreflightOptions: {
        allowOrigins: apigateway.Cors.ALL_ORIGINS,
        allowMethods: apigateway.Cors.ALL_METHODS,
        allowHeaders: ['Content-Type', 'Authorization'],
      },
    });

    // Create a request model for validation
    const requestModel = api.addModel('RequestModel', {
      contentType: 'application/json',
      modelName: 'RequestModel',
      schema: {
        type: apigateway.JsonSchemaType.OBJECT,
        required: ['name', 'email'],
        properties: {
          name: { type: apigateway.JsonSchemaType.STRING },
          email: { type: apigateway.JsonSchemaType.STRING },
        },
      },
    });

    // Add resources and methods
    const users = api.root.addResource('users');

    // GET /users
    users.addMethod('GET', new apigateway.LambdaIntegration(handler), {
      authorizationType: apigateway.AuthorizationType.IAM,
    });

    // POST /users with request validation
    users.addMethod('POST', new apigateway.LambdaIntegration(handler), {
      requestModels: { 'application/json': requestModel },
      requestValidatorOptions: {
        validateRequestBody: true,
      },
    });

    // GET /users/{userId}
    const user = users.addResource('{userId}');
    user.addMethod('GET', new apigateway.LambdaIntegration(handler));
    user.addMethod('PUT', new apigateway.LambdaIntegration(handler));
    user.addMethod('DELETE', new apigateway.LambdaIntegration(handler));

    // Create a usage plan with API key
    const plan = api.addUsagePlan('UsagePlan', {
      name: 'Standard',
      throttle: {
        rateLimit: 100,
        burstLimit: 200,
      },
      quota: {
        limit: 10000,
        period: apigateway.Period.MONTH,
      },
    });

    const apiKey = api.addApiKey('ApiKey');
    plan.addApiKey(apiKey);
    plan.addApiStage({ stage: api.deploymentStage });

    new cdk.CfnOutput(this, 'ApiUrl', {
      value: api.url,
    });
  }
}
```

## ECS Fargate Service - Container Orchestration

The `FargateService` construct creates containerized applications running on AWS Fargate with load balancing and auto-scaling.

```typescript
import * as cdk from 'aws-cdk-lib';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as ecs from 'aws-cdk-lib/aws-ecs';
import * as ecs_patterns from 'aws-cdk-lib/aws-ecs-patterns';
import * as logs from 'aws-cdk-lib/aws-logs';

class EcsStack extends cdk.Stack {
  constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // Create VPC
    const vpc = new ec2.Vpc(this, 'Vpc', {
      maxAzs: 2,
    });

    // Create ECS Cluster
    const cluster = new ecs.Cluster(this, 'Cluster', {
      vpc,
      clusterName: 'MyAppCluster',
      containerInsightsV2: ecs.ContainerInsights.ENABLED,
    });

    // Create Fargate Task Definition
    const taskDefinition = new ecs.FargateTaskDefinition(this, 'TaskDef', {
      memoryLimitMiB: 512,
      cpu: 256,
    });

    // Add container to task
    const container = taskDefinition.addContainer('AppContainer', {
      image: ecs.ContainerImage.fromRegistry('nginx:latest'),
      logging: ecs.LogDrivers.awsLogs({
        streamPrefix: 'app',
        logRetention: logs.RetentionDays.ONE_WEEK,
      }),
      environment: {
        NODE_ENV: 'production',
      },
      healthCheck: {
        command: ['CMD-SHELL', 'curl -f http://localhost/ || exit 1'],
        interval: cdk.Duration.seconds(30),
        timeout: cdk.Duration.seconds(5),
        retries: 3,
      },
    });

    container.addPortMappings({
      containerPort: 80,
      protocol: ecs.Protocol.TCP,
    });

    // Create Application Load Balanced Fargate Service (high-level pattern)
    const fargateService = new ecs_patterns.ApplicationLoadBalancedFargateService(
      this,
      'FargateService',
      {
        cluster,
        taskDefinition,
        desiredCount: 2,
        publicLoadBalancer: true,
        assignPublicIp: false,
        circuitBreaker: { rollback: true },
      }
    );

    // Configure auto-scaling
    const scaling = fargateService.service.autoScaleTaskCount({
      minCapacity: 2,
      maxCapacity: 10,
    });

    scaling.scaleOnCpuUtilization('CpuScaling', {
      targetUtilizationPercent: 70,
      scaleInCooldown: cdk.Duration.seconds(60),
      scaleOutCooldown: cdk.Duration.seconds(60),
    });

    scaling.scaleOnMemoryUtilization('MemoryScaling', {
      targetUtilizationPercent: 80,
    });

    // Configure health check
    fargateService.targetGroup.configureHealthCheck({
      path: '/health',
      healthyHttpCodes: '200',
      interval: cdk.Duration.seconds(30),
    });

    new cdk.CfnOutput(this, 'LoadBalancerDns', {
      value: fargateService.loadBalancer.loadBalancerDnsName,
    });
  }
}
```

## IAM Role - Identity and Access Management

The `Role` construct creates IAM roles with trust policies and managed permissions for AWS services and cross-account access.

```typescript
import * as cdk from 'aws-cdk-lib';
import * as iam from 'aws-cdk-lib/aws-iam';

class IamStack extends cdk.Stack {
  constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // Create a role for Lambda functions
    const lambdaRole = new iam.Role(this, 'LambdaRole', {
      roleName: 'MyLambdaExecutionRole',
      assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
      description: 'Execution role for Lambda functions',
      maxSessionDuration: cdk.Duration.hours(1),
      managedPolicies: [
        iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaBasicExecutionRole'),
        iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaVPCAccessExecutionRole'),
      ],
    });

    // Add inline policy
    lambdaRole.addToPolicy(new iam.PolicyStatement({
      effect: iam.Effect.ALLOW,
      actions: [
        's3:GetObject',
        's3:PutObject',
        's3:DeleteObject',
      ],
      resources: ['arn:aws:s3:::my-bucket/*'],
    }));

    lambdaRole.addToPolicy(new iam.PolicyStatement({
      effect: iam.Effect.ALLOW,
      actions: [
        'dynamodb:GetItem',
        'dynamodb:PutItem',
        'dynamodb:UpdateItem',
        'dynamodb:DeleteItem',
        'dynamodb:Query',
        'dynamodb:Scan',
      ],
      resources: [
        'arn:aws:dynamodb:*:*:table/MyTable',
        'arn:aws:dynamodb:*:*:table/MyTable/index/*',
      ],
    }));

    // Create a role for cross-account access
    const crossAccountRole = new iam.Role(this, 'CrossAccountRole', {
      assumedBy: new iam.AccountPrincipal('987654321098'),
      externalIds: ['unique-external-id'],
    });

    crossAccountRole.addToPolicy(new iam.PolicyStatement({
      actions: ['s3:ListBucket'],
      resources: ['*'],
    }));

    // Create a role with conditions
    const conditionalRole = new iam.Role(this, 'ConditionalRole', {
      assumedBy: new iam.WebIdentityPrincipal(
        'arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com',
        {
          StringEquals: {
            'token.actions.githubusercontent.com:aud': 'sts.amazonaws.com',
          },
          StringLike: {
            'token.actions.githubusercontent.com:sub': 'repo:myorg/myrepo:*',
          },
        }
      ),
    });

    // Create a managed policy
    const customPolicy = new iam.ManagedPolicy(this, 'CustomPolicy', {
      managedPolicyName: 'MyCustomPolicy',
      statements: [
        new iam.PolicyStatement({
          actions: ['logs:CreateLogGroup', 'logs:CreateLogStream', 'logs:PutLogEvents'],
          resources: ['arn:aws:logs:*:*:*'],
        }),
      ],
    });

    lambdaRole.addManagedPolicy(customPolicy);

    new cdk.CfnOutput(this, 'LambdaRoleArn', {
      value: lambdaRole.roleArn,
    });
  }
}
```

## CDK Assertions - Testing Infrastructure

The `Template` class from the assertions module enables testing CDK applications by validating the synthesized CloudFormation templates.

```typescript
import * as cdk from 'aws-cdk-lib';
import * as s3 from 'aws-cdk-lib/aws-s3';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import { Template, Match, Capture } from 'aws-cdk-lib/assertions';

// Stack to test
class MyStack extends cdk.Stack {
  constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const bucket = new s3.Bucket(this, 'MyBucket', {
      versioned: true,
      encryption: s3.BucketEncryption.S3_MANAGED,
    });

    new lambda.Function(this, 'MyFunction', {
      runtime: lambda.Runtime.NODEJS_20_X,
      handler: 'index.handler',
      code: lambda.Code.fromInline('exports.handler = async () => {}'),
      environment: {
        BUCKET_NAME: bucket.bucketName,
      },
    });
  }
}

// Test file (e.g., my-stack.test.ts)
describe('MyStack', () => {
  let template: Template;

  beforeEach(() => {
    const app = new cdk.App();
    const stack = new MyStack(app, 'TestStack');
    template = Template.fromStack(stack);
  });

  test('creates an S3 bucket with versioning enabled', () => {
    template.hasResourceProperties('AWS::S3::Bucket', {
      VersioningConfiguration: {
        Status: 'Enabled',
      },
    });
  });

  test('creates a Lambda function with correct runtime', () => {
    template.hasResourceProperties('AWS::Lambda::Function', {
      Runtime: 'nodejs20.x',
      Handler: 'index.handler',
    });
  });

  test('Lambda function has bucket name in environment', () => {
    template.hasResourceProperties('AWS::Lambda::Function', {
      Environment: {
        Variables: {
          BUCKET_NAME: Match.anyValue(),
        },
      },
    });
  });

  test('creates exactly one S3 bucket', () => {
    template.resourceCountIs('AWS::S3::Bucket', 1);
  });

  test('bucket has server-side encryption', () => {
    template.hasResourceProperties('AWS::S3::Bucket', {
      BucketEncryption: {
        ServerSideEncryptionConfiguration: Match.arrayWith([
          Match.objectLike({
            ServerSideEncryptionByDefault: {
              SSEAlgorithm: 'AES256',
            },
          }),
        ]),
      },
    });
  });

  test('capture and validate bucket name pattern', () => {
    const bucketCapture = new Capture();
    template.hasResourceProperties('AWS::Lambda::Function', {
      Environment: {
        Variables: {
          BUCKET_NAME: bucketCapture,
        },
      },
    });
    // Validate captured value is a CloudFormation reference
    expect(bucketCapture.asObject()).toHaveProperty('Ref');
  });
});
```

## CDK CLI Commands

The CDK CLI provides commands for managing CDK applications including synthesis, deployment, and infrastructure comparison.

```bash
# Install AWS CDK CLI globally
npm install -g aws-cdk

# Initialize a new CDK project
mkdir my-cdk-app && cd my-cdk-app
cdk init app --language=typescript

# Bootstrap your AWS environment (required once per account/region)
cdk bootstrap aws://123456789012/us-east-1

# Synthesize CloudFormation template (outputs to cdk.out/)
cdk synth

# List all stacks in the app
cdk list

# Show differences between deployed stack and local code
cdk diff

# Deploy a specific stack
cdk deploy MyStack

# Deploy all stacks
cdk deploy --all

# Deploy with automatic approval (no confirmation prompt)
cdk deploy --require-approval never

# Deploy with specific parameters
cdk deploy --parameters MyStack:BucketName=my-bucket

# Deploy to a specific AWS profile
cdk deploy --profile production

# Destroy a stack (with confirmation)
cdk destroy MyStack

# Watch for changes and auto-deploy (development mode)
cdk watch

# Generate CloudFormation template without deploying
cdk synth MyStack > template.yaml

# Show metadata about stacks
cdk metadata MyStack

# Import existing resources into CDK management
cdk import MyStack
```

## Summary

The AWS CDK provides a powerful infrastructure-as-code framework that transforms how developers define and deploy cloud resources. By leveraging familiar programming languages, developers can create reusable constructs, implement complex logic, use IDE features like autocomplete and type checking, and apply software engineering best practices such as testing and version control to infrastructure code. The high-level constructs abstract away CloudFormation complexity while still allowing low-level customization when needed.

The CDK ecosystem supports common architectural patterns through the Construct Library, which includes L1 constructs (direct CloudFormation mappings), L2 constructs (higher-level abstractions with sensible defaults), and L3 patterns (complete solutions for common use cases like load-balanced Fargate services). Integration between constructs is seamless - for example, granting a Lambda function permission to access an S3 bucket requires just one method call that automatically configures the necessary IAM policies. This approach significantly reduces the cognitive load of managing cloud infrastructure and enables faster iteration on application development.