api-service.ts

import { CfnOutput, Duration, StackProps } from "aws-cdk-lib";
import * as cloudwatch from "aws-cdk-lib/aws-cloudwatch";
import { Metric } from "aws-cdk-lib/aws-cloudwatch";
import { SnsAction } from "aws-cdk-lib/aws-cloudwatch-actions";
import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
import * as ec2 from "aws-cdk-lib/aws-ec2";
import { Repository } from "aws-cdk-lib/aws-ecr";
import * as ecs from "aws-cdk-lib/aws-ecs";
import { FargateService } from "aws-cdk-lib/aws-ecs";
import * as ecs_patterns from "aws-cdk-lib/aws-ecs-patterns";
import {
  ApplicationProtocol,
  NetworkLoadBalancer,
  NetworkTargetGroup,
  Protocol,
} from "aws-cdk-lib/aws-elasticloadbalancingv2";
import { AlbTarget } from "aws-cdk-lib/aws-elasticloadbalancingv2-targets";
import * as iam from "aws-cdk-lib/aws-iam";
import { IFunction as ILambda } from "aws-cdk-lib/aws-lambda";
import { LogGroup } from "aws-cdk-lib/aws-logs";
import * as rds from "aws-cdk-lib/aws-rds";
import * as r53 from "aws-cdk-lib/aws-route53";
import * as r53_targets from "aws-cdk-lib/aws-route53-targets";
import * as s3 from "aws-cdk-lib/aws-s3";
import * as secret from "aws-cdk-lib/aws-secretsmanager";
import { ISecret } from "aws-cdk-lib/aws-secretsmanager";
import { IQueue } from "aws-cdk-lib/aws-sqs";
import { Construct } from "constructs";
import { EnvConfig } from "../../config/env-config";
import { DnsZones } from "../shared/dns";
import { Secrets, secretsToECS } from "../shared/secrets";
import { provideAccessToQueue } from "../shared/sqs";
import { isProd, isSandbox } from "../shared/util";

interface ApiServiceProps extends StackProps {
  config: EnvConfig;
  version: string | undefined;
}

export function createAPIService({
  stack,
  props,
  secrets,
  vpc,
  dbCredsSecret,
  dbReadReplicaEndpoint,
  dynamoDBTokenTable,
  alarmAction,
  dnsZones,
  fhirServerUrl,
  fhirServerQueueUrl,
  fhirConverterQueueUrl,
  fhirConverterServiceUrl,
  cdaToVisualizationLambda,
  documentDownloaderLambda,
  outboundPatientDiscoveryLambda,
  outboundDocumentQueryLambda,
  outboundDocumentRetrievalLambda,
  medicalDocumentsUploadBucket,
  fhirToMedicalRecordLambda,
  fhirToCdaConverterLambda,
  searchIngestionQueue,
  searchEndpoint,
  searchAuth,
  searchIndexName,
  appConfigEnvVars,
  cookieStore,
}: {
  stack: Construct;
  props: ApiServiceProps;
  secrets: Secrets;
  vpc: ec2.IVpc;
  dbCredsSecret: secret.ISecret;
  dbReadReplicaEndpoint: rds.Endpoint;
  dynamoDBTokenTable: dynamodb.Table;
  alarmAction: SnsAction | undefined;
  dnsZones: DnsZones;
  fhirServerUrl: string;
  fhirServerQueueUrl: string | undefined;
  fhirConverterQueueUrl: string | undefined;
  fhirConverterServiceUrl: string | undefined;
  cdaToVisualizationLambda: ILambda;
  documentDownloaderLambda: ILambda;
  outboundPatientDiscoveryLambda: ILambda;
  outboundDocumentQueryLambda: ILambda;
  outboundDocumentRetrievalLambda: ILambda;
  medicalDocumentsUploadBucket: s3.Bucket;
  fhirToMedicalRecordLambda: ILambda | undefined;
  fhirToCdaConverterLambda: ILambda | undefined;
  searchIngestionQueue: IQueue;
  searchEndpoint: string;
  searchAuth: { userName: string; secret: ISecret };
  searchIndexName: string;
  appConfigEnvVars: {
    appId: string;
    configId: string;
  };
  cookieStore: secret.ISecret | undefined;
}): {
  cluster: ecs.Cluster;
  service: ecs_patterns.NetworkLoadBalancedFargateService;
  serverAddress: string;
  loadBalancerAddress: string;
  apiServiceAdditional: FargateService;
} {
  // Create a new Amazon Elastic Container Service (ECS) cluster
  const cluster = new ecs.Cluster(stack, "APICluster", { vpc, containerInsights: true });

  // Create an ECR repo where we'll deploy our Docker images to, and where ECS will pull from
  const ecrRepo = new Repository(stack, "APIRepo", {
    repositoryName: "metriport/api",
  });
  new CfnOutput(stack, "APIECRRepoURI", {
    description: "API ECR repository URI",
    value: ecrRepo.repositoryUri,
  });

  const connectWidgetUrlEnvVar = isSandbox(props.config)
    ? props.config.connectWidgetUrl
    : `https://${props.config.connectWidget.subdomain}.${props.config.connectWidget.domain}/`;

  const iheGateway = props.config.iheGateway;

  const coverageEnhancementConfig = props.config.commonwell.coverageEnhancement;
  const dbReadReplicaEndpointAsString = JSON.stringify({
    host: dbReadReplicaEndpoint.hostname,
    port: dbReadReplicaEndpoint.port,
  });
  // Run some servers on fargate containers
  const listenerPort = 80;
  const containerPort = 8080;
  const logGroup = LogGroup.fromLogGroupArn(stack, "ApiLogGroup", props.config.logArn);
  // TODO RENAME to remove "Alb"
  const fargateServiceAlb = new ecs_patterns.ApplicationLoadBalancedFargateService(
    stack,
    "APIFargateServiceAlb",
    {
      cluster: cluster,
      // Watch out for the combination of vCPUs and memory, more vCPU requires more memory
      // https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#task_size
      cpu: isProd(props.config) ? 2048 : 1024,
      desiredCount: isProd(props.config) ? 2 : 1,
      taskImageOptions: {
        image: ecs.ContainerImage.fromEcrRepository(ecrRepo, "latest"),
        containerPort,
        containerName: "API-Server",
        logDriver: ecs.LogDrivers.awsLogs({
          logGroup,
          streamPrefix: "APIFargateService",
        }),
        secrets: {
          DB_CREDS: ecs.Secret.fromSecretsManager(dbCredsSecret),
          SEARCH_PASSWORD: ecs.Secret.fromSecretsManager(searchAuth.secret),
          ...secretsToECS(secrets),
        },
        environment: {
          NODE_ENV: "production", // Determines its being run in the cloud, the logical env is set on ENV_TYPE
          ENV_TYPE: props.config.environmentType, // staging, production, sandbox
          ...(props.version ? { METRIPORT_VERSION: props.version } : undefined),
          AWS_REGION: props.config.region,
          DB_READ_REPLICA_ENDPOINT: dbReadReplicaEndpointAsString,
          TOKEN_TABLE_NAME: dynamoDBTokenTable.tableName,
          API_URL: `https://${props.config.subdomain}.${props.config.domain}`,
          ...(props.config.apiGatewayUsagePlanId
            ? { API_GW_USAGE_PLAN_ID: props.config.apiGatewayUsagePlanId }
            : {}),
          CONNECT_WIDGET_URL: connectWidgetUrlEnvVar,
          SYSTEM_ROOT_OID: props.config.systemRootOID,
          SYSTEM_ROOT_ORG_NAME: props.config.systemRootOrgName,
          ...props.config.commonwell.envVars,
          ...(props.config.slack ? props.config.slack : undefined),
          ...(props.config.sentryDSN ? { SENTRY_DSN: props.config.sentryDSN } : undefined),
          ...(props.config.usageReportUrl && {
            USAGE_URL: props.config.usageReportUrl,
          }),
          ...(props.config.medicalDocumentsBucketName && {
            MEDICAL_DOCUMENTS_BUCKET_NAME: props.config.medicalDocumentsBucketName,
          }),
          ...(props.config.medicalDocumentsUploadBucketName && {
            MEDICAL_DOCUMENTS_UPLOADS_BUCKET_NAME: props.config.medicalDocumentsUploadBucketName,
          }),
          ...(isSandbox(props.config) && {
            SANDBOX_SEED_DATA_BUCKET_NAME: props.config.sandboxSeedDataBucketName,
          }),
          CONVERT_DOC_LAMBDA_NAME: cdaToVisualizationLambda.functionName,
          DOCUMENT_DOWNLOADER_LAMBDA_NAME: documentDownloaderLambda.functionName,
          ...(iheGateway
            ? {
                IHE_GW_URL: `http:https://${iheGateway.outboundSubdomain}.${props.config.domain}`,
                IHE_GW_PORT_PD: iheGateway.outboundPorts.patientDiscovery.toString(),
                IHE_GW_PORT_DQ: iheGateway.outboundPorts.documentQuery.toString(),
                IHE_GW_PORT_DR: iheGateway.outboundPorts.documentRetrieval.toString(),
              }
            : undefined),
          OUTBOUND_PATIENT_DISCOVERY_LAMBDA_NAME: outboundPatientDiscoveryLambda.functionName,
          OUTBOUND_DOC_QUERY_LAMBDA_NAME: outboundDocumentQueryLambda.functionName,
          OUTBOUND_DOC_RETRIEVAL_LAMBDA_NAME: outboundDocumentRetrievalLambda.functionName,
          ...(fhirToMedicalRecordLambda && {
            FHIR_TO_MEDICAL_RECORD_LAMBDA_NAME: fhirToMedicalRecordLambda.functionName,
          }),
          ...(fhirToCdaConverterLambda && {
            FHIR_TO_CDA_CONVERTER_LAMBDA_NAME: fhirToCdaConverterLambda.functionName,
          }),
          FHIR_SERVER_URL: fhirServerUrl,
          ...(fhirServerQueueUrl && {
            FHIR_SERVER_QUEUE_URL: fhirServerQueueUrl,
          }),
          ...(fhirConverterQueueUrl && {
            FHIR_CONVERTER_QUEUE_URL: fhirConverterQueueUrl,
          }),
          ...(fhirConverterServiceUrl && {
            FHIR_CONVERTER_SERVER_URL: fhirConverterServiceUrl,
          }),
          SEARCH_INGESTION_QUEUE_URL: searchIngestionQueue.queueUrl,
          SEARCH_ENDPOINT: searchEndpoint,
          SEARCH_USERNAME: searchAuth.userName,
          SEARCH_INDEX: searchIndexName,
          ...(props.config.carequality?.envVars?.CQ_ORG_URLS && {
            CQ_ORG_URLS: props.config.carequality.envVars.CQ_ORG_URLS,
          }),
          ...(props.config.carequality?.envVars?.CQ_URLS_TO_EXCLUDE && {
            CQ_URLS_TO_EXCLUDE: props.config.carequality.envVars.CQ_URLS_TO_EXCLUDE,
          }),
          ...(props.config.locationService && {
            PLACE_INDEX_NAME: props.config.locationService.placeIndexName,
            PLACE_INDEX_REGION: props.config.locationService.placeIndexRegion,
          }),
          // app config
          APPCONFIG_APPLICATION_ID: appConfigEnvVars.appId,
          APPCONFIG_CONFIGURATION_ID: appConfigEnvVars.configId,
          ...(coverageEnhancementConfig && {
            CW_MANAGEMENT_URL: coverageEnhancementConfig.managementUrl,
          }),
          ...(cookieStore && {
            CW_MANAGEMENT_COOKIE_SECRET_ARN: cookieStore.secretArn,
          }),
          ...(props.config.iheGateway?.trustStoreBucketName && {
            CQ_TRUST_BUNDLE_BUCKET_NAME: props.config.iheGateway.trustStoreBucketName,
          }),
        },
      },
      memoryLimitMiB: isProd(props.config) ? 4096 : 2048,
      healthCheckGracePeriod: Duration.seconds(60),
      protocol: ApplicationProtocol.HTTP,
      listenerPort,
      publicLoadBalancer: false,
    }
  );
  // TODO DEPRECATED start
  const fargateService = new ecs_patterns.NetworkLoadBalancedFargateService(
    stack,
    "APIFargateService",
    {
      cluster: cluster,
      // Watch out for the combination of vCPUs and memory, more vCPU requires more memory
      // https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#task_size
      cpu: isProd(props.config) ? 2048 : 1024,
      desiredCount: isProd(props.config) ? 2 : 1,
      taskImageOptions: {
        image: ecs.ContainerImage.fromEcrRepository(ecrRepo, "latest"),
        containerPort: 8080,
        containerName: "API-Server",
        secrets: {
          DB_CREDS: ecs.Secret.fromSecretsManager(dbCredsSecret),
          SEARCH_PASSWORD: ecs.Secret.fromSecretsManager(searchAuth.secret),
          ...secretsToECS(secrets),
        },
        environment: {
          NODE_ENV: "production", // Determines its being run in the cloud, the logical env is set on ENV_TYPE
          ENV_TYPE: props.config.environmentType, // staging, production, sandbox
          ...(props.version ? { METRIPORT_VERSION: props.version } : undefined),
          AWS_REGION: props.config.region,
          DB_READ_REPLICA_ENDPOINT: dbReadReplicaEndpointAsString,
          TOKEN_TABLE_NAME: dynamoDBTokenTable.tableName,
          API_URL: `https://${props.config.subdomain}.${props.config.domain}`,
          ...(props.config.apiGatewayUsagePlanId
            ? { API_GW_USAGE_PLAN_ID: props.config.apiGatewayUsagePlanId }
            : {}),
          CONNECT_WIDGET_URL: connectWidgetUrlEnvVar,
          SYSTEM_ROOT_OID: props.config.systemRootOID,
          SYSTEM_ROOT_ORG_NAME: props.config.systemRootOrgName,
          ...props.config.commonwell.envVars,
          ...(props.config.slack ? props.config.slack : undefined),
          ...(props.config.sentryDSN ? { SENTRY_DSN: props.config.sentryDSN } : undefined),
          ...(props.config.usageReportUrl && {
            USAGE_URL: props.config.usageReportUrl,
          }),
          ...(props.config.medicalDocumentsBucketName && {
            MEDICAL_DOCUMENTS_BUCKET_NAME: props.config.medicalDocumentsBucketName,
          }),
          ...(props.config.medicalDocumentsUploadBucketName && {
            MEDICAL_DOCUMENTS_UPLOADS_BUCKET_NAME: props.config.medicalDocumentsUploadBucketName,
          }),
          ...(isSandbox(props.config) && {
            SANDBOX_SEED_DATA_BUCKET_NAME: props.config.sandboxSeedDataBucketName,
          }),
          CONVERT_DOC_LAMBDA_NAME: cdaToVisualizationLambda.functionName,
          DOCUMENT_DOWNLOADER_LAMBDA_NAME: documentDownloaderLambda.functionName,
          ...(iheGateway
            ? {
                IHE_GW_URL: `http:https://${iheGateway.outboundSubdomain}.${props.config.domain}`,
                IHE_GW_PORT_PD: iheGateway.outboundPorts.patientDiscovery.toString(),
                IHE_GW_PORT_DQ: iheGateway.outboundPorts.documentQuery.toString(),
                IHE_GW_PORT_DR: iheGateway.outboundPorts.documentRetrieval.toString(),
              }
            : undefined),
          OUTBOUND_PATIENT_DISCOVERY_LAMBDA_NAME: outboundPatientDiscoveryLambda.functionName,
          OUTBOUND_DOC_QUERY_LAMBDA_NAME: outboundDocumentQueryLambda.functionName,
          OUTBOUND_DOC_RETRIEVAL_LAMBDA_NAME: outboundDocumentRetrievalLambda.functionName,
          ...(fhirToMedicalRecordLambda && {
            FHIR_TO_MEDICAL_RECORD_LAMBDA_NAME: fhirToMedicalRecordLambda.functionName,
          }),
          ...(fhirToCdaConverterLambda && {
            FHIR_TO_CDA_CONVERTER_LAMBDA_NAME: fhirToCdaConverterLambda.functionName,
          }),
          FHIR_SERVER_URL: fhirServerUrl,
          ...(fhirServerQueueUrl && {
            FHIR_SERVER_QUEUE_URL: fhirServerQueueUrl,
          }),
          ...(fhirConverterQueueUrl && {
            FHIR_CONVERTER_QUEUE_URL: fhirConverterQueueUrl,
          }),
          ...(fhirConverterServiceUrl && {
            FHIR_CONVERTER_SERVER_URL: fhirConverterServiceUrl,
          }),
          SEARCH_INGESTION_QUEUE_URL: searchIngestionQueue.queueUrl,
          SEARCH_ENDPOINT: searchEndpoint,
          SEARCH_USERNAME: searchAuth.userName,
          SEARCH_INDEX: searchIndexName,
          ...(props.config.carequality?.envVars?.CQ_ORG_URLS && {
            CQ_ORG_URLS: props.config.carequality.envVars.CQ_ORG_URLS,
          }),
          ...(props.config.carequality?.envVars?.CQ_URLS_TO_EXCLUDE && {
            CQ_URLS_TO_EXCLUDE: props.config.carequality.envVars.CQ_URLS_TO_EXCLUDE,
          }),
          ...(props.config.locationService && {
            PLACE_INDEX_NAME: props.config.locationService.placeIndexName,
            PLACE_INDEX_REGION: props.config.locationService.placeIndexRegion,
          }),
          // app config
          APPCONFIG_APPLICATION_ID: appConfigEnvVars.appId,
          APPCONFIG_CONFIGURATION_ID: appConfigEnvVars.configId,
          ...(coverageEnhancementConfig && {
            CW_MANAGEMENT_URL: coverageEnhancementConfig.managementUrl,
          }),
          ...(cookieStore && {
            CW_MANAGEMENT_COOKIE_SECRET_ARN: cookieStore.secretArn,
          }),
          ...(props.config.iheGateway?.trustStoreBucketName && {
            CQ_TRUST_BUNDLE_BUCKET_NAME: props.config.iheGateway.trustStoreBucketName,
          }),
        },
      },
      memoryLimitMiB: isProd(props.config) ? 4096 : 2048,
      healthCheckGracePeriod: Duration.seconds(60),
      publicLoadBalancer: false,
    }
  );
  // TODO DEPRECATED end
  const serverAddress = fargateService.loadBalancer.loadBalancerDnsName;
  const apiUrl = `${props.config.subdomain}.${props.config.domain}`;
  new r53.ARecord(stack, "APIDomainPrivateRecord", {
    recordName: apiUrl,
    zone: dnsZones.privateZone,
    target: r53.RecordTarget.fromAlias(
      new r53_targets.LoadBalancerTarget(fargateService.loadBalancer)
    ),
  });

  const alb = fargateServiceAlb.loadBalancer;
  const nlb = new NetworkLoadBalancer(stack, `ApiNetworkLoadBalancer`, {
    vpc,
    internetFacing: false,
  });
  const nlbListener = nlb.addListener(`ApiNetworkLoadBalancerListener`, {
    port: listenerPort,
    protocol: Protocol.TCP,
  });
  const nlbTargetGroup = new NetworkTargetGroup(stack, `ApiNetworkTargetGroup`, {
    port: listenerPort,
    protocol: Protocol.TCP,
    vpc,
    targets: [new AlbTarget(alb, listenerPort)],
  });
  nlbListener.addTargetGroups("ApiNetworkLoadBalancerTargetGroup", nlbTargetGroup);

  // Health checks
  const healthcheck = {
    healthyThresholdCount: 2,
    unhealthyThresholdCount: 2,
    interval: Duration.seconds(10),
  };
  fargateServiceAlb.targetGroup.configureHealthCheck(healthcheck);
  nlbTargetGroup.configureHealthCheck({
    ...healthcheck,
    interval: healthcheck.interval.plus(Duration.seconds(3)),
  });

  // Access grant for Aurora DB's secret
  dbCredsSecret.grantRead(fargateService.taskDefinition.taskRole);
  dbCredsSecret.grantRead(fargateServiceAlb.taskDefinition.taskRole);
  // RW grant for Dynamo DB
  dynamoDBTokenTable.grantReadWriteData(fargateService.taskDefinition.taskRole);
  cdaToVisualizationLambda.grantInvoke(fargateService.taskDefinition.taskRole);
  documentDownloaderLambda.grantInvoke(fargateService.taskDefinition.taskRole);
  outboundPatientDiscoveryLambda.grantInvoke(fargateService.taskDefinition.taskRole);
  outboundDocumentQueryLambda.grantInvoke(fargateService.taskDefinition.taskRole);
  outboundDocumentRetrievalLambda.grantInvoke(fargateService.taskDefinition.taskRole);
  fhirToCdaConverterLambda?.grantInvoke(fargateService.taskDefinition.taskRole);
  dynamoDBTokenTable.grantReadWriteData(fargateServiceAlb.taskDefinition.taskRole);
  cdaToVisualizationLambda.grantInvoke(fargateServiceAlb.taskDefinition.taskRole);
  documentDownloaderLambda.grantInvoke(fargateServiceAlb.taskDefinition.taskRole);
  outboundPatientDiscoveryLambda.grantInvoke(fargateServiceAlb.taskDefinition.taskRole);
  outboundDocumentQueryLambda.grantInvoke(fargateServiceAlb.taskDefinition.taskRole);
  outboundDocumentRetrievalLambda.grantInvoke(fargateServiceAlb.taskDefinition.taskRole);
  fhirToCdaConverterLambda?.grantInvoke(fargateServiceAlb.taskDefinition.taskRole);

  // Access grant for medical document buckets
  medicalDocumentsUploadBucket.grantReadWrite(fargateService.taskDefinition.taskRole);
  medicalDocumentsUploadBucket.grantReadWrite(fargateServiceAlb.taskDefinition.taskRole);

  if (fhirToMedicalRecordLambda) {
    fhirToMedicalRecordLambda.grantInvoke(fargateService.taskDefinition.taskRole);
    fhirToMedicalRecordLambda.grantInvoke(fargateServiceAlb.taskDefinition.taskRole);
    cdaToVisualizationLambda.grantInvoke(fhirToMedicalRecordLambda);
  }

  if (cookieStore) {
    cookieStore.grantRead(fargateService.service.taskDefinition.taskRole);
    cookieStore.grantWrite(fargateService.service.taskDefinition.taskRole);
    cookieStore.grantRead(fargateServiceAlb.service.taskDefinition.taskRole);
    cookieStore.grantWrite(fargateServiceAlb.service.taskDefinition.taskRole);
  }

  // Allow access to search services/infra
  provideAccessToQueue({
    accessType: "send",
    queue: searchIngestionQueue,
    resource: fargateService.taskDefinition.taskRole,
  });
  searchAuth.secret.grantRead(fargateService.taskDefinition.taskRole);
  provideAccessToQueue({
    accessType: "send",
    queue: searchIngestionQueue,
    resource: fargateServiceAlb.taskDefinition.taskRole,
  });
  searchAuth.secret.grantRead(fargateServiceAlb.taskDefinition.taskRole);

  // Setting permissions for AppConfig
  fargateService.taskDefinition.taskRole.attachInlinePolicy(
    new iam.Policy(stack, "OSSAPIPermissionsForAppConfig", {
      statements: [
        new iam.PolicyStatement({
          actions: [
            "appconfig:StartConfigurationSession",
            "appconfig:GetLatestConfiguration",
            "appconfig:GetConfiguration",
            "apigateway:GET",
          ],
          resources: ["*"],
        }),
        new iam.PolicyStatement({
          actions: ["geo:SearchPlaceIndexForText"],
          resources: [`arn:aws:geo:*`],
          effect: iam.Effect.ALLOW,
        }),
      ],
    })
  );
  fargateServiceAlb.taskDefinition.taskRole.attachInlinePolicy(
    new iam.Policy(stack, "ApiPermissionsForAppConfig", {
      statements: [
        new iam.PolicyStatement({
          actions: [
            "appconfig:StartConfigurationSession",
            "appconfig:GetLatestConfiguration",
            "appconfig:GetConfiguration",
            "apigateway:GET",
          ],
          resources: ["*"],
        }),
        new iam.PolicyStatement({
          actions: ["geo:SearchPlaceIndexForText"],
          resources: [`arn:aws:geo:*`],
          effect: iam.Effect.ALLOW,
        }),
      ],
    })
  );

  // CloudWatch Alarms and Notifications

  // Allow the service to publish metrics to cloudwatch
  Metric.grantPutMetricData(fargateService.service.taskDefinition.taskRole);

  const fargateCPUAlarm = fargateService.service
    .metricCpuUtilization()
    .createAlarm(stack, "CPUAlarm", {
      threshold: 80,
      evaluationPeriods: 3,
      datapointsToAlarm: 2,
      treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
    });
  alarmAction && fargateCPUAlarm.addAlarmAction(alarmAction);
  alarmAction && fargateCPUAlarm.addOkAction(alarmAction);

  const fargateMemoryAlarm = fargateService.service
    .metricMemoryUtilization()
    .createAlarm(stack, "MemoryAlarm", {
      threshold: 70,
      evaluationPeriods: 3,
      datapointsToAlarm: 2,
      treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
    });
  alarmAction && fargateMemoryAlarm.addAlarmAction(alarmAction);
  alarmAction && fargateMemoryAlarm.addOkAction(alarmAction);

  // allow the NLB to talk to fargate
  fargateService.service.connections.allowFrom(
    ec2.Peer.ipv4(vpc.vpcCidrBlock),
    ec2.Port.allTraffic(),
    "Allow traffic from within the VPC to the service secure port"
  );
  fargateServiceAlb.service.connections.allowFrom(
    ec2.Peer.ipv4(vpc.vpcCidrBlock),
    ec2.Port.allTraffic(),
    "Allow traffic from within the VPC to the service secure port"
  );
  // TODO: #489 ain't the most secure, but the above code doesn't work as CDK complains we can't use the connections
  // from the cluster created above, should be fine for now as it will only accept connections in the VPC
  fargateService.service.connections.allowFromAnyIpv4(ec2.Port.allTcp());
  fargateServiceAlb.service.connections.allowFromAnyIpv4(ec2.Port.allTcp());

  // TODO DEPRECATED start
  // This speeds up deployments so the tasks are swapped quicker.
  // See for details: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-target-groups.html#deregistration-delay
  fargateService.targetGroup.setAttribute("deregistration_delay.timeout_seconds", "17");

  // This also speeds up deployments so the health checks have a faster turnaround.
  // See for details: https://docs.aws.amazon.com/elasticloadbalancing/latest/network/target-group-health-checks.html
  fargateService.targetGroup.configureHealthCheck({
    healthyThresholdCount: 2,
    interval: Duration.seconds(10),
  });
  // TODO DEPRECATED end

  // hookup autoscaling based on 90% thresholds
  const scaling = fargateService.service.autoScaleTaskCount({
    minCapacity: isProd(props.config) ? 2 : 1,
    maxCapacity: isProd(props.config) ? 10 : 2,
  });
  scaling.scaleOnCpuUtilization("autoscale_cpu", {
    targetUtilizationPercent: 90,
    scaleInCooldown: Duration.minutes(2),
    scaleOutCooldown: Duration.seconds(30),
  });
  scaling.scaleOnMemoryUtilization("autoscale_mem", {
    targetUtilizationPercent: 90,
    scaleInCooldown: Duration.minutes(2),
    scaleOutCooldown: Duration.seconds(30),
  });

  return {
    cluster,
    service: fargateService,
    serverAddress: apiUrl,
    loadBalancerAddress: serverAddress,
    apiServiceAdditional: fargateServiceAlb.service,
  };
}