DEV Community

Cover image for Hello World, the Production Way: Java, AWS CDK and GitHub Actions
Ritesh Bangal
Ritesh Bangal

Posted on AI-assisted

Hello World, the Production Way: Java, AWS CDK and GitHub Actions

#aws #java #githubactions #serverless

The app is three lines of Java. The path that ships it is the point.

Writing a Hello World Lambda takes five minutes. Shipping it like a real service is the hard part, so this article shows that path, mostly in pictures. Everything is in the aws-cdk-path-to-production repo.

Animation of one release, 1.2.3, moving from commit to production. A push reaches GitHub. App CI and Infra CI check it with no AWS access. A tag publishes the JAR once to Artifactory. A pull request pins it, and AWS CDK synthesizes CloudFormation templates once. The release job signs in to AWS with OIDC, then the same files deploy to Dev, QA after a smoke test, and Prod after tests and a person's approval.

The whole path in 30 seconds: one release, from commit to production.

Two kinds of code

Two kinds of code: app/ builds a versioned JAR with Gradle; infrastructure/ runs cdk synth to produce a CloudFormation template; they meet only at cdk deploy.

The application and infrastructure have separate build pipelines. CDK brings them together during synthesis, and CloudFormation deploys the resulting infrastructure.

This is the entire app:

return new APIGatewayProxyResponseEvent()
        .withStatusCode(200)
        .withBody("Hello, World!");
Enter fullscreen mode Exit fullscreen mode

Three pipelines

Three pipelines: App CI and Infra CI run without AWS access; the Release pipeline signs in with OIDC, deploys and smoke-tests.

App CI builds and tests the Java code, and publishes a versioned JAR when we tag a release. Infra CI validates the infrastructure independently. Only the Release pipeline deploys to AWS.
A tag publishes the JAR once, and a pull request pins which version ships:

LAMBDA_VERSION=1.2.3
LAMBDA_SHA256=<digest printed by App CI>
Enter fullscreen mode Exit fullscreen mode

Bootstrap, then deploy

CDK bootstrap: cdk bootstrap creates the CDKToolkit stack (S3 bucket, IAM roles, ECR repository, SSM version parameter); cdk deploy uses the bucket and roles so CloudFormation can create the API.

cdk bootstrap prepares each AWS account once. cdk synth only writes templates; cdk deploy is what changes AWS.

No stored AWS keys

Signing in without stored keys: the job requests a token from GitHub's OIDC issuer, exchanges it at AWS STS, STS checks the IAM role's trust policy, and returns credentials valid for at most one hour.

GitHub vouches for the job, and AWS returns credentials that expire within an hour. Each environment has its own role, so Dev can't sign in as Prod.

Gated promotion

Promotion gates: deploy Dev, smoke test, deploy QA, smoke and integration tests, production approval, deploy Prod, smoke test and alarms. Each failed gate stops the release.

Same JAR, same infrastructure code, environment-specific templates. CDK synthesizes them once for the release, and the pipeline promotes that release through Dev → QA → Prod. A failed gate stops the release, but it doesn't roll back what's already deployed.

What's real today

What's verified: build, unit tests, CDK tests, synth and cfn-lint run on every push. Publishing, deploying, smoke and QA tests and promotion are ready and run once you connect AWS and Artifactory. API auth, alarms, scoped IAM and separate AWS accounts should be added before real traffic.

The lesson

The app is Hello World. The value is the path that delivers it: swap in a real service, and the pipelines, the pin and the gates stay the same.

GitHub logo riteshbangal / aws-cdk-path-to-production

The path from commit to production for a serverless app on AWS: versioned artifacts, AWS CDK infrastructure in Java, GitHub Actions with OIDC, and gated Dev → QA → Prod promotion. The app is deliberately a Hello World so the delivery path stays the focus.

AWS CDK: the path to production

App CI Infra CI

The path from commit to production for a serverless app on AWS: versioned artifacts, AWS CDK infrastructure in Java, GitHub Actions with OIDC, and gated Dev → QA → Prod promotion.

The app is deliberately a Hello World, so the delivery path stays the focus.

Read the walkthrough: Hello World, the Production Way on DEV.

Animation of one release, 1.2.3, moving from commit to production. A push reaches GitHub. App CI and Infra CI check it with no AWS access. A tag publishes the JAR once to Artifactory. A pull request pins it, and AWS CDK synthesizes CloudFormation templates once. The release job signs in to AWS with OIDC, then the same files deploy to Dev, QA after a smoke test, and Prod after tests and a person's approval.

One release, from commit to production. A static version is also available.

What's in here

app/                    The payload: a Java 21 Lambda that returns "Hello, World!"
infrastructure/         AWS CDK in Java: API Gateway + Lambda, with unit tests
  lambda-artifact.env   The release pin: which JAR version (and SHA-256) to deploy
foundation/             One-time AWS setup: the role GitHub Actions signs in to (OIDC)
scripts/                Fetch/publish the JAR, synth + lint, smoke and QA checks
.github/workflows/      app-ci · infra-ci · release (+ reusable deploy-environment)
docs/                   The reasoning behind each piece, and the
…
View on GitHub

Top comments (0)