eight-rnd-ops

Infrastructure code to manage the R&D AWS account. Published as an npm package consumed by service repos.

Stacks

• rnd-ecs — ECS Fargate cluster, shared private ALB, Route53 DNS
• anyscale-private-v2 — Anyscale cloud eight-rnd-anyscale (cld_j15ib9rk6a52nkvw7hgmp34t89), private subnets only, VPN-gated
• anyscale-private — (deprecated) Anyscale cloud v1 eight-anyscale-production, public subnets. Migration to v2 complete — pending resource cleanup (without full stack teardown to protect VPC)

Commands

npm run build                   # Build after code changes
npx cdk synth <stack>           # Generate CloudFormation template
npx cdk diff <stack>            # Preview changes (safe, read-only)

Never run cdk deploy without explicit approval. Deployments are done manually.

Library

The cdk-lib/ directory is published as an npm package (eight-rnd-ops). Service repos consume it for shared constructs:

• EightRndServiceConstruct — Fargate service with ALB routing, Datadog logging, secrets
• EightRndWorkerConstruct — Background worker (no ALB listener), Datadog logging, secrets

Anyscale Cloud Setup

Deploy

1. cdk deploy anyscale-private-v2
2. Apply MemoryDB parameter fix (CloudFormation ignores parameters on CREATE):

   aws memorydb update-parameter-group --profile anyscale \
     --parameter-group-name <cloudId>-memorydb-pg \
     --parameter-name-values "ParameterName=maxmemory-policy,ParameterValue=allkeys-lru"

3. Register cloud with Anyscale — see cdk-scripts/register_anyscale_cloud.sh

Post-registration

After anyscale cloud register, Anyscale adds an ExternalId condition to the access role trust policy. This is expected — the CDK stack creates the role without ExternalId, and Anyscale updates it with the cloud ID during registration.

Current cloud: eight-rnd-anyscale / cld_j15ib9rk6a52nkvw7hgmp34t89

ECS Service Migration (Private ALB)

All services on eight-rnd-ops >= 0.2.0 route through the private (internal) ALB. The public ALB is deprecated and will be removed once all services are migrated.

To migrate a service:

1. Bump eight-rnd-ops to 0.2.1+ in the service's cdk/package.json
2. Run npm install && npm run build in the cdk/ directory
3. cdk diff to verify the ALB routing change
4. Deploy