Skip to content

feat(tag-page-rendering)!: Remove EC2 infrastructure - #16965

Merged
akash1810 merged 7 commits into
mainfrom
rm-tag-page-rendering-ec2
Oct 23, 2026
Merged

akash1810 merged 7 commits into
mainfrom
rm-tag-page-rendering-ec2

Conversation

@akash1810

@akash1810 akash1810 commented Oct 19, 2026 •

Copy link
Copy Markdown
Member

Note

  • Recommended to review commit by commit.
  • This is a change to the tag-page-rendering infrastructure; it is a no-op for the remaining DCR apps.

What does this change?

Deletes the EC2 infrastructure for tag-page-rendering in CODE and PROD. This has to be done in the same PR due to the way Riff-Raff is implemented.

Important

  • CODE and PROD would need to be to be deployed "dangerously" as we're removing resources that Riff-Raff deems to be holding state, namely AWS::ElasticLoadBalancingV2::TargetGroup and AWS::SNS::Topic resources. I've done this on CODE.
  • Once merged, open PRs should be rebased against main to avoid recreating the infrastructure.
What you'll see upon deploying when not rebased

image

Why?

Since #16922, the EC2 infrastructure is sitting idle and we've been running on ECS only in PROD since #16908.

How has this change been tested?

Since #16922, the EC2 infrastructure is sitting idle. That is, the updated CDK snapshots should provide confidence in this change.

Additionally, we can use cdk diff to create visualise the changes. The output of this is below.

CODE cdk diff

IAM Statement Changes
┌───┬───────────────────────────────────────────────────────────────────────────────┬────────┬───────────────────────────────────────────────────────────────────────────────┬───────────────────────────────────────────────────────────────────────────────┬───────────┐
│   │ Resource                                                                      │ Effect │ Action                                                                        │ Principal                                                                     │ Condition │
├───┼───────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────┼───────────┤
│ - │ ${InstanceRoleTagpagerendering171BC2F9.Arn}                                   │ Allow  │ sts:AssumeRole                                                                │ Service:ec2.amazonaws.com                                                     │           │
├───┼───────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────┼───────────┤
│ - │ *                                                                             │ Allow  │ cloudwatch:*                                                                  │ AWS:${InstanceRoleTagpagerendering171BC2F9}                                   │           │
│   │                                                                               │        │ logs:*                                                                        │                                                                               │           │
│ - │ *                                                                             │ Allow  │ ec2messages:AcknowledgeMessage                                                │ AWS:${InstanceRoleTagpagerendering171BC2F9}                                   │           │
│   │                                                                               │        │ ec2messages:DeleteMessage                                                     │                                                                               │           │
│   │                                                                               │        │ ec2messages:FailMessage                                                       │                                                                               │           │
│   │                                                                               │        │ ec2messages:GetEndpoint                                                       │                                                                               │           │
│   │                                                                               │        │ ec2messages:GetMessages                                                       │                                                                               │           │
│   │                                                                               │        │ ec2messages:SendReply                                                         │                                                                               │           │
│   │                                                                               │        │ ssm:DescribeDocumentParameters                                                │                                                                               │           │
│   │                                                                               │        │ ssm:DescribeInstanceProperties                                                │                                                                               │           │
│   │                                                                               │        │ ssm:ListInstanceAssociations                                                  │                                                                               │           │
│   │                                                                               │        │ ssm:UpdateInstanceInformation                                                 │                                                                               │           │
│   │                                                                               │        │ ssmmessages:CreateControlChannel                                              │                                                                               │           │
│   │                                                                               │        │ ssmmessages:CreateDataChannel                                                 │                                                                               │           │
│   │                                                                               │        │ ssmmessages:OpenControlChannel                                                │                                                                               │           │
│   │                                                                               │        │ ssmmessages:OpenDataChannel                                                   │                                                                               │           │
│ - │ *                                                                             │ Allow  │ autoscaling:DescribeAutoScalingGroups                                         │ AWS:${InstanceRoleTagpagerendering171BC2F9}                                   │           │
│   │                                                                               │        │ autoscaling:DescribeAutoScalingInstances                                      │                                                                               │           │
│   │                                                                               │        │ ec2:DescribeInstances                                                         │                                                                               │           │
│   │                                                                               │        │ ec2:DescribeTags                                                              │                                                                               │           │
├───┼───────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────┼───────────┤
│ - │ arn:aws:kinesis:eu-west-1:${AWS::AccountId}:stream/${LoggingStreamName}       │ Allow  │ kinesis:Describe*                                                             │ AWS:${InstanceRoleTagpagerendering171BC2F9}                                   │           │
│   │                                                                               │        │ kinesis:Put*                                                                  │                                                                               │           │
├───┼───────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────┼───────────┤
│ - │ arn:aws:kms:eu-west-1:${AWS::AccountId}:FrontendConfigKey                     │ Allow  │ kms:Decrypt                                                                   │ AWS:${InstanceRoleTagpagerendering171BC2F9}                                   │           │
│   │                                                                               │        │ kms:DescribeKey                                                               │                                                                               │           │
├───┼───────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────┼───────────┤
│ - │ arn:aws:s3:::${DistributionBucketName}/frontend/CODE/tag-page-rendering/*     │ Allow  │ s3:GetObject                                                                  │ AWS:${InstanceRoleTagpagerendering171BC2F9}                                   │           │
├───┼───────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────┼───────────┤
│ - │ arn:aws:ssm:eu-west-1:${AWS::AccountId}:parameter/CODE/frontend/tag-page-rend │ Allow  │ ssm:GetParametersByPath                                                       │ AWS:${InstanceRoleTagpagerendering171BC2F9}                                   │           │
│   │ ering                                                                         │        │                                                                               │                                                                               │           │
├───┼───────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────┼───────────┤
│ - │ arn:aws:ssm:eu-west-1:${AWS::AccountId}:parameter/CODE/frontend/tag-page-rend │ Allow  │ ssm:GetParameter                                                              │ AWS:${InstanceRoleTagpagerendering171BC2F9}                                   │           │
│   │ ering/*                                                                       │        │ ssm:GetParameters                                                             │                                                                               │           │
├───┼───────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────┼───────────┤
│ - │ arn:aws:ssm:eu-west-1:${AWS::AccountId}:parameter/dotcom/*                    │ Allow  │ ssm:GetParameter                                                              │ AWS:${InstanceRoleTagpagerendering171BC2F9}                                   │           │
│   │ arn:aws:ssm:eu-west-1:${AWS::AccountId}:parameter/frontend/*                  │        │ ssm:GetParametersByPath                                                       │                                                                               │           │
└───┴───────────────────────────────────────────────────────────────────────────────┴────────┴───────────────────────────────────────────────────────────────────────────────┴───────────────────────────────────────────────────────────────────────────────┴───────────┘
Security Group Changes
┌───┬───────────────────────────────────────────────────────────────┬─────┬──────────┬───────────────────────────────────────────────────────────────┐
│   │ Group                                                         │ Dir │ Protocol │ Peer                                                          │
├───┼───────────────────────────────────────────────────────────────┼─────┼──────────┼───────────────────────────────────────────────────────────────┤
│ - │ ${GuHttpsEgressSecurityGroupTagpagerenderingDC233ADE.GroupId} │ In  │ TCP 9000 │ ${LoadBalancerTagpagerendering/SecurityGroup.GroupId}         │
│ - │ ${GuHttpsEgressSecurityGroupTagpagerenderingDC233ADE.GroupId} │ In  │ TCP 9000 │ ${InternalIngressSecurityGroupTagpagerendering.GroupId}       │
│ - │ ${GuHttpsEgressSecurityGroupTagpagerenderingDC233ADE.GroupId} │ Out │ TCP 443  │ Everyone (IPv4)                                               │
├───┼───────────────────────────────────────────────────────────────┼─────┼──────────┼───────────────────────────────────────────────────────────────┤
│ - │ ${InternalIngressSecurityGroupTagpagerendering.GroupId}       │ Out │ TCP 9000 │ ${GuHttpsEgressSecurityGroupTagpagerenderingDC233ADE.GroupId} │
├───┼───────────────────────────────────────────────────────────────┼─────┼──────────┼───────────────────────────────────────────────────────────────┤
│ - │ ${LoadBalancerTagpagerendering/SecurityGroup.GroupId}         │ Out │ TCP 9000 │ ${GuHttpsEgressSecurityGroupTagpagerenderingDC233ADE.GroupId} │
└───┴───────────────────────────────────────────────────────────────┴─────┴──────────┴───────────────────────────────────────────────────────────────┘
(NOTE: There may be security-related changes not in this list. See https://github.com/aws/aws-cdk/issues/1299)

Parameters
[-] Parameter AMITagpagerendering: {"Type":"AWS::EC2::Image::Id","Description":"Amazon Machine Image ID for the app tag-page-rendering. Use this in conjunction with AMIgo to keep AMIs up to date."}
                                                                                                                                                                                                                                                                        
Metadata
[~] Metadata gu:cdk:constructs: ["GuDistributionBucketParameter","GuAllowPolicy","GuAllowPolicy","GuAllowPolicy","GuVpcParameter","GuSubnetListParameter","GuSubnetListParameter","GuLoadBalancedAppExperimental","GuInstanceRole","GuSsmSshPolicy","GuDescribeEC2Policy","GuLoggingStreamNameParameter","GuLogShippingPolicy","GuGetDistributablePolicy","GuParameterStoreReadPolicy","GuAmiParameter","GuHttpsEgressSecurityGroup","GuAutoScalingGroup","GuApplicationTargetGroup","GuRiffRaffDeploymentIdParameterExperimental","GuHttpsEgressSecurityGroup","GuApplicationTargetGroup","GuCertificate","GuApplicationLoadBalancer","GuAccessLoggingBucketParameter","GuHttpsApplicationListener","GuSecurityGroup","GuCname"] to ["GuDistributionBucketParameter","GuAllowPolicy","GuAllowPolicy","GuAllowPolicy","GuVpcParameter","GuSubnetListParameter","GuSubnetListParameter","GuLoadBalancedAppExperimental","GuLoggingStreamNameParameter","GuRiffRaffDeploymentIdParameterExperimental","GuLogShippingPolicy","GuParameterStoreReadPolicy","GuHttpsEgressSecurityGroup","GuApplicationTargetGroup","GuCertificate","GuApplicationLoadBalancer","GuAccessLoggingBucketParameter","GuHttpsApplicationListener","GuSecurityGroup","GuCname"]                                                                                                                                  

Resources
[-] AWS::IAM::Role InstanceRoleTagpagerendering171BC2F9 destroy
[-] AWS::IAM::Policy SsmSshPolicy4CFC977E destroy
[-] AWS::IAM::Policy DescribeEC2PolicyFF5F9295 destroy
[-] AWS::IAM::Policy GetDistributablePolicyTagpagerendering346128E3 destroy
[-] AWS::EC2::SecurityGroup GuHttpsEgressSecurityGroupTagpagerenderingDC233ADE destroy
[-] AWS::EC2::SecurityGroupIngress GuHttpsEgressSecurityGroupTagpagerenderingfromTagPageRenderingCODELoadBalancerTagpagerenderingSecurityGroup301E895290002304A373 destroy
[-] AWS::EC2::SecurityGroupIngress GuHttpsEgressSecurityGroupTagpagerenderingfromTagPageRenderingCODEInternalIngressSecurityGroupTagpagerendering0B98E4F9900035DE48AC destroy
[-] AWS::IAM::InstanceProfile frontendCODEtagpagerenderingProfile70961F87 destroy
[-] AWS::EC2::LaunchTemplate frontendCODEtagpagerendering3C218821 destroy
[-] AWS::AutoScaling::AutoScalingGroup AutoScalingGroupTagpagerenderingASG7F7E0748 destroy
[-] AWS::ElasticLoadBalancingV2::TargetGroup TargetGroupTagpagerendering42E428EE destroy
[-] AWS::EC2::SecurityGroupEgress LoadBalancerTagpagerenderingSecurityGrouptoTagPageRenderingCODEGuHttpsEgressSecurityGroupTagpagerendering51E7AF38900020A4AE4F destroy
[-] AWS::ElasticLoadBalancingV2::ListenerRule ListenerTagpagerenderingDeterministicRouteToEc2Rule1C5C95A4 destroy
[-] AWS::ElasticLoadBalancingV2::ListenerRule ListenerTagpagerenderingDeterministicRouteToEcsRuleAB05C756 destroy
[-] AWS::EC2::SecurityGroupEgress InternalIngressSecurityGroupTagpagerenderingtoTagPageRenderingCODEGuHttpsEgressSecurityGroupTagpagerendering51E7AF3890004F95C890 destroy
[~] AWS::IAM::Policy AllowPolicyCloudwatchLogs AllowPolicyCloudwatchLogsA783E5B4
 └─ [~] Roles
     └─ @@ -1,8 +1,5 @@
        [ ] [
        [ ]   {
        [-]     "Ref": "InstanceRoleTagpagerendering171BC2F9"
        [-]   },
        [-]   {
        [ ]     "Ref": "EcsTaskDefinitionTaskRoleB7B6D8DD"
        [ ]   }
        [ ] ]
[~] AWS::IAM::Policy AllowPolicyDescribeDecryptKms AllowPolicyDescribeDecryptKmsE91286F3
 └─ [~] Roles
     └─ @@ -1,8 +1,5 @@
        [ ] [
        [ ]   {
        [-]     "Ref": "InstanceRoleTagpagerendering171BC2F9"
        [-]   },
        [-]   {
        [ ]     "Ref": "EcsTaskDefinitionTaskRoleB7B6D8DD"
        [ ]   }
        [ ] ]
[~] AWS::IAM::Policy AllowPolicyGetSsmParamsByPath AllowPolicyGetSsmParamsByPathB54B2DE8
 └─ [~] Roles
     └─ @@ -1,8 +1,5 @@
        [ ] [
        [ ]   {
        [-]     "Ref": "InstanceRoleTagpagerendering171BC2F9"
        [-]   },
        [-]   {
        [ ]     "Ref": "EcsTaskDefinitionTaskRoleB7B6D8DD"
        [ ]   }
        [ ] ]
[~] AWS::IAM::Policy GuLogShippingPolicy GuLogShippingPolicy981BFE5A
 └─ [~] Roles
     └─ @@ -1,8 +1,5 @@
        [ ] [
        [ ]   {
        [-]     "Ref": "InstanceRoleTagpagerendering171BC2F9"
        [-]   },
        [-]   {
        [ ]     "Ref": "EcsTaskDefinitionTaskRoleB7B6D8DD"
        [ ]   }
        [ ] ]
[~] AWS::IAM::Policy ParameterStoreReadTagpagerendering ParameterStoreReadTagpagerendering4CA7B6E3
 └─ [~] Roles
     └─ @@ -1,8 +1,5 @@
        [ ] [
        [ ]   {
        [-]     "Ref": "InstanceRoleTagpagerendering171BC2F9"
        [-]   },
        [-]   {
        [ ]     "Ref": "EcsTaskDefinitionTaskRoleB7B6D8DD"
        [ ]   }
        [ ] ]
[~] AWS::ECS::Service EcsService/Service EcsService81FC6EF6
 └─ [~] DependsOn
     └─ @@ -1,7 +1,5 @@
        [ ] [
        [ ]   "EcsTaskDefinitionTaskRoleB7B6D8DD",
        [ ]   "EcsTaskDefinitionTaskRoleDefaultPolicy1FD2F057",
        [-]   "ListenerTagpagerendering92E57078",
        [-]   "ListenerTagpagerenderingDeterministicRouteToEc2Rule1C5C95A4",
        [-]   "ListenerTagpagerenderingDeterministicRouteToEcsRuleAB05C756"
        [+]   "ListenerTagpagerendering92E57078"
        [ ] ]
[~] AWS::ElasticLoadBalancingV2::Listener ListenerTagpagerendering ListenerTagpagerendering92E57078
 └─ [~] DefaultActions
     └─ @@ -1,20 +1,7 @@
        [ ] [
        [ ]   {
        [-]     "ForwardConfig": {
        [-]       "TargetGroups": [
        [-]         {
        [-]           "TargetGroupArn": {
        [-]             "Ref": "TargetGroupTagpagerendering42E428EE"
        [-]           },
        [-]           "Weight": 0
        [-]         },
        [-]         {
        [-]           "TargetGroupArn": {
        [-]             "Ref": "TagpagerenderingEcsTargetGroupTagpagerendering0976D2E5"
        [-]           },
        [-]           "Weight": 1
        [-]         }
        [-]       ]
        [+]     "TargetGroupArn": {
        [+]       "Ref": "TagpagerenderingEcsTargetGroupTagpagerendering0976D2E5"
        [ ]     },
        [ ]     "Type": "forward"
        [ ]   }



✨  Number of stacks with differences: 1

PROD cdk diff

IAM Statement Changes
┌───┬───────────────────────────────────────────────────────────────────────────────┬────────┬───────────────────────────────────────────────────────────────────────────────┬───────────────────────────────────────────────────────────────────────────────┬───────────┐
│   │ Resource                                                                      │ Effect │ Action                                                                        │ Principal                                                                     │ Condition │
├───┼───────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────┼───────────┤
│ - │ ${InstanceRoleTagpagerendering171BC2F9.Arn}                                   │ Allow  │ sts:AssumeRole                                                                │ Service:ec2.amazonaws.com                                                     │           │
├───┼───────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────┼───────────┤
│ - │ *                                                                             │ Allow  │ cloudwatch:*                                                                  │ AWS:${InstanceRoleTagpagerendering171BC2F9}                                   │           │
│   │                                                                               │        │ logs:*                                                                        │                                                                               │           │
│ - │ *                                                                             │ Allow  │ ec2messages:AcknowledgeMessage                                                │ AWS:${InstanceRoleTagpagerendering171BC2F9}                                   │           │
│   │                                                                               │        │ ec2messages:DeleteMessage                                                     │                                                                               │           │
│   │                                                                               │        │ ec2messages:FailMessage                                                       │                                                                               │           │
│   │                                                                               │        │ ec2messages:GetEndpoint                                                       │                                                                               │           │
│   │                                                                               │        │ ec2messages:GetMessages                                                       │                                                                               │           │
│   │                                                                               │        │ ec2messages:SendReply                                                         │                                                                               │           │
│   │                                                                               │        │ ssm:DescribeDocumentParameters                                                │                                                                               │           │
│   │                                                                               │        │ ssm:DescribeInstanceProperties                                                │                                                                               │           │
│   │                                                                               │        │ ssm:ListInstanceAssociations                                                  │                                                                               │           │
│   │                                                                               │        │ ssm:UpdateInstanceInformation                                                 │                                                                               │           │
│   │                                                                               │        │ ssmmessages:CreateControlChannel                                              │                                                                               │           │
│   │                                                                               │        │ ssmmessages:CreateDataChannel                                                 │                                                                               │           │
│   │                                                                               │        │ ssmmessages:OpenControlChannel                                                │                                                                               │           │
│   │                                                                               │        │ ssmmessages:OpenDataChannel                                                   │                                                                               │           │
│ - │ *                                                                             │ Allow  │ autoscaling:DescribeAutoScalingGroups                                         │ AWS:${InstanceRoleTagpagerendering171BC2F9}                                   │           │
│   │                                                                               │        │ autoscaling:DescribeAutoScalingInstances                                      │                                                                               │           │
│   │                                                                               │        │ ec2:DescribeInstances                                                         │                                                                               │           │
│   │                                                                               │        │ ec2:DescribeTags                                                              │                                                                               │           │
├───┼───────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────┼───────────┤
│ - │ arn:aws:kinesis:eu-west-1:${AWS::AccountId}:stream/${LoggingStreamName}       │ Allow  │ kinesis:Describe*                                                             │ AWS:${InstanceRoleTagpagerendering171BC2F9}                                   │           │
│   │                                                                               │        │ kinesis:Put*                                                                  │                                                                               │           │
├───┼───────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────┼───────────┤
│ - │ arn:aws:kms:eu-west-1:${AWS::AccountId}:FrontendConfigKey                     │ Allow  │ kms:Decrypt                                                                   │ AWS:${InstanceRoleTagpagerendering171BC2F9}                                   │           │
│   │                                                                               │        │ kms:DescribeKey                                                               │                                                                               │           │
├───┼───────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────┼───────────┤
│ - │ arn:aws:s3:::${DistributionBucketName}/frontend/PROD/tag-page-rendering/*     │ Allow  │ s3:GetObject                                                                  │ AWS:${InstanceRoleTagpagerendering171BC2F9}                                   │           │
├───┼───────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────┼───────────┤
│ - │ arn:aws:ssm:eu-west-1:${AWS::AccountId}:parameter/PROD/frontend/tag-page-rend │ Allow  │ ssm:GetParametersByPath                                                       │ AWS:${InstanceRoleTagpagerendering171BC2F9}                                   │           │
│   │ ering                                                                         │        │                                                                               │                                                                               │           │
├───┼───────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────┼───────────┤
│ - │ arn:aws:ssm:eu-west-1:${AWS::AccountId}:parameter/PROD/frontend/tag-page-rend │ Allow  │ ssm:GetParameter                                                              │ AWS:${InstanceRoleTagpagerendering171BC2F9}                                   │           │
│   │ ering/*                                                                       │        │ ssm:GetParameters                                                             │                                                                               │           │
├───┼───────────────────────────────────────────────────────────────────────────────┼────────┼───────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────┼───────────┤
│ - │ arn:aws:ssm:eu-west-1:${AWS::AccountId}:parameter/dotcom/*                    │ Allow  │ ssm:GetParameter                                                              │ AWS:${InstanceRoleTagpagerendering171BC2F9}                                   │           │
│   │ arn:aws:ssm:eu-west-1:${AWS::AccountId}:parameter/frontend/*                  │        │ ssm:GetParametersByPath                                                       │                                                                               │           │
└───┴───────────────────────────────────────────────────────────────────────────────┴────────┴───────────────────────────────────────────────────────────────────────────────┴───────────────────────────────────────────────────────────────────────────────┴───────────┘
Security Group Changes
┌───┬───────────────────────────────────────────────────────────────┬─────┬──────────┬───────────────────────────────────────────────────────────────┐
│   │ Group                                                         │ Dir │ Protocol │ Peer                                                          │
├───┼───────────────────────────────────────────────────────────────┼─────┼──────────┼───────────────────────────────────────────────────────────────┤
│ - │ ${GuHttpsEgressSecurityGroupTagpagerenderingDC233ADE.GroupId} │ In  │ TCP 9000 │ ${LoadBalancerTagpagerendering/SecurityGroup.GroupId}         │
│ - │ ${GuHttpsEgressSecurityGroupTagpagerenderingDC233ADE.GroupId} │ In  │ TCP 9000 │ ${InternalIngressSecurityGroupTagpagerendering.GroupId}       │
│ - │ ${GuHttpsEgressSecurityGroupTagpagerenderingDC233ADE.GroupId} │ Out │ TCP 443  │ Everyone (IPv4)                                               │
├───┼───────────────────────────────────────────────────────────────┼─────┼──────────┼───────────────────────────────────────────────────────────────┤
│ - │ ${InternalIngressSecurityGroupTagpagerendering.GroupId}       │ Out │ TCP 9000 │ ${GuHttpsEgressSecurityGroupTagpagerenderingDC233ADE.GroupId} │
├───┼───────────────────────────────────────────────────────────────┼─────┼──────────┼───────────────────────────────────────────────────────────────┤
│ - │ ${LoadBalancerTagpagerendering/SecurityGroup.GroupId}         │ Out │ TCP 9000 │ ${GuHttpsEgressSecurityGroupTagpagerenderingDC233ADE.GroupId} │
└───┴───────────────────────────────────────────────────────────────┴─────┴──────────┴───────────────────────────────────────────────────────────────┘
(NOTE: There may be security-related changes not in this list. See https://github.com/aws/aws-cdk/issues/1299)

Parameters
[-] Parameter AMITagpagerendering: {"Type":"AWS::EC2::Image::Id","Description":"Amazon Machine Image ID for the app tag-page-rendering. Use this in conjunction with AMIgo to keep AMIs up to date."}                                                                                                                                                                                                                                                                        

Metadata
[~] Metadata gu:cdk:constructs: ["GuDistributionBucketParameter","GuAllowPolicy","GuAllowPolicy","GuAllowPolicy","GuVpcParameter","GuSubnetListParameter","GuSubnetListParameter","GuLoadBalancedAppExperimental","GuInstanceRole","GuSsmSshPolicy","GuDescribeEC2Policy","GuLoggingStreamNameParameter","GuLogShippingPolicy","GuGetDistributablePolicy","GuParameterStoreReadPolicy","GuAmiParameter","GuHttpsEgressSecurityGroup","GuAutoScalingGroup","GuApplicationTargetGroup","GuRiffRaffDeploymentIdParameterExperimental","GuHttpsEgressSecurityGroup","GuApplicationTargetGroup","GuCertificate","GuApplicationLoadBalancer","GuAccessLoggingBucketParameter","GuHttpsApplicationListener","GuSecurityGroup","GuAlb5xxPercentageAlarm","GuUnhealthyInstancesAlarm","GuCname"] to ["GuDistributionBucketParameter","GuAllowPolicy","GuAllowPolicy","GuAllowPolicy","GuVpcParameter","GuSubnetListParameter","GuSubnetListParameter","GuLoadBalancedAppExperimental","GuLoggingStreamNameParameter","GuRiffRaffDeploymentIdParameterExperimental","GuLogShippingPolicy","GuParameterStoreReadPolicy","GuHttpsEgressSecurityGroup","GuApplicationTargetGroup","GuCertificate","GuApplicationLoadBalancer","GuAccessLoggingBucketParameter","GuHttpsApplicationListener","GuSecurityGroup","GuAlb5xxPercentageAlarm","GuCname"]                                                  

Resources
[-] AWS::IAM::Role InstanceRoleTagpagerendering171BC2F9 destroy
[-] AWS::IAM::Policy SsmSshPolicy4CFC977E destroy
[-] AWS::IAM::Policy DescribeEC2PolicyFF5F9295 destroy
[-] AWS::IAM::Policy GetDistributablePolicyTagpagerendering346128E3 destroy
[-] AWS::EC2::SecurityGroup GuHttpsEgressSecurityGroupTagpagerenderingDC233ADE destroy
[-] AWS::EC2::SecurityGroupIngress GuHttpsEgressSecurityGroupTagpagerenderingfromTagPageRenderingPRODLoadBalancerTagpagerenderingSecurityGroup55D2582D90005A0A2694 destroy
[-] AWS::EC2::SecurityGroupIngress GuHttpsEgressSecurityGroupTagpagerenderingfromTagPageRenderingPRODInternalIngressSecurityGroupTagpagerendering1CF134899000DECEA4B2 destroy
[-] AWS::IAM::InstanceProfile frontendPRODtagpagerenderingProfile0369CEFE destroy
[-] AWS::EC2::LaunchTemplate frontendPRODtagpagerenderingA0B91C45 destroy
[-] AWS::AutoScaling::AutoScalingGroup AutoScalingGroupTagpagerenderingASG7F7E0748 destroy
[-] AWS::ElasticLoadBalancingV2::TargetGroup TargetGroupTagpagerendering42E428EE destroy
[-] AWS::EC2::SecurityGroupEgress LoadBalancerTagpagerenderingSecurityGrouptoTagPageRenderingPRODGuHttpsEgressSecurityGroupTagpagerendering55A86AD190007FB7F7E9 destroy
[-] AWS::ElasticLoadBalancingV2::ListenerRule ListenerTagpagerenderingDeterministicRouteToEc2Rule1C5C95A4 destroy
[-] AWS::ElasticLoadBalancingV2::ListenerRule ListenerTagpagerenderingDeterministicRouteToEcsRuleAB05C756 destroy
[-] AWS::EC2::SecurityGroupEgress InternalIngressSecurityGroupTagpagerenderingtoTagPageRenderingPRODGuHttpsEgressSecurityGroupTagpagerendering55A86AD190001055A384 destroy
[-] AWS::CloudWatch::Alarm UnhealthyInstancesAlarmTagpagerenderingED314507 destroy
[-] AWS::AutoScaling::ScalingPolicy CPUScaleUpPolicyUpperPolicyDEE5DA77 destroy
[-] AWS::CloudWatch::Alarm CPUScaleUpPolicyUpperAlarm7E15DD91 destroy
[-] AWS::SNS::Topic CPUScalingAlertsTopic9D0083F7 destroy
[-] AWS::SNS::Subscription CPUScalingAlertsSubscriptionEmail170D6D82 destroy
[-] AWS::AutoScaling::ScalingPolicy LatencyScaleUpPolicyUpperPolicy4A22B34C destroy
[-] AWS::CloudWatch::Alarm LatencyScaleUpPolicyUpperAlarmB2CCE62D destroy
[-] AWS::SNS::Topic LatencyScalingAlertsTopic1A322157 destroy
[-] AWS::SNS::Subscription LatencyScalingAlertsSubscriptionEmailF1826DAB destroy
[-] AWS::AutoScaling::ScalingPolicy LatencyScaleDownPolicyLowerPolicy5B8C5A01 destroy
[-] AWS::CloudWatch::Alarm LatencyScaleDownPolicyLowerAlarm3AAA79CF destroy
[~] AWS::IAM::Policy AllowPolicyCloudwatchLogs AllowPolicyCloudwatchLogsA783E5B4
 └─ [~] Roles
     └─ @@ -1,8 +1,5 @@
        [ ] [
        [ ]   {
        [-]     "Ref": "InstanceRoleTagpagerendering171BC2F9"
        [-]   },
        [-]   {
        [ ]     "Ref": "EcsTaskDefinitionTaskRoleB7B6D8DD"
        [ ]   }
        [ ] ]
[~] AWS::IAM::Policy AllowPolicyDescribeDecryptKms AllowPolicyDescribeDecryptKmsE91286F3
 └─ [~] Roles
     └─ @@ -1,8 +1,5 @@
        [ ] [
        [ ]   {
        [-]     "Ref": "InstanceRoleTagpagerendering171BC2F9"
        [-]   },
        [-]   {
        [ ]     "Ref": "EcsTaskDefinitionTaskRoleB7B6D8DD"
        [ ]   }
        [ ] ]
[~] AWS::IAM::Policy AllowPolicyGetSsmParamsByPath AllowPolicyGetSsmParamsByPathB54B2DE8
 └─ [~] Roles
     └─ @@ -1,8 +1,5 @@
        [ ] [
        [ ]   {
        [-]     "Ref": "InstanceRoleTagpagerendering171BC2F9"
        [-]   },
        [-]   {
        [ ]     "Ref": "EcsTaskDefinitionTaskRoleB7B6D8DD"
        [ ]   }
        [ ] ]
[~] AWS::IAM::Policy GuLogShippingPolicy GuLogShippingPolicy981BFE5A
 └─ [~] Roles
     └─ @@ -1,8 +1,5 @@
        [ ] [
        [ ]   {
        [-]     "Ref": "InstanceRoleTagpagerendering171BC2F9"
        [-]   },
        [-]   {
        [ ]     "Ref": "EcsTaskDefinitionTaskRoleB7B6D8DD"
        [ ]   }
        [ ] ]
[~] AWS::IAM::Policy ParameterStoreReadTagpagerendering ParameterStoreReadTagpagerendering4CA7B6E3
 └─ [~] Roles
     └─ @@ -1,8 +1,5 @@
        [ ] [
        [ ]   {
        [-]     "Ref": "InstanceRoleTagpagerendering171BC2F9"
        [-]   },
        [-]   {
        [ ]     "Ref": "EcsTaskDefinitionTaskRoleB7B6D8DD"
        [ ]   }
        [ ] ]
[~] AWS::ECS::Service EcsService/Service EcsService81FC6EF6
 └─ [~] DependsOn
     └─ @@ -1,7 +1,5 @@
        [ ] [
        [ ]   "EcsTaskDefinitionTaskRoleB7B6D8DD",
        [ ]   "EcsTaskDefinitionTaskRoleDefaultPolicy1FD2F057",
        [-]   "ListenerTagpagerendering92E57078",
        [-]   "ListenerTagpagerenderingDeterministicRouteToEc2Rule1C5C95A4",
        [-]   "ListenerTagpagerenderingDeterministicRouteToEcsRuleAB05C756"
        [+]   "ListenerTagpagerendering92E57078"
        [ ] ]
[~] AWS::ElasticLoadBalancingV2::Listener ListenerTagpagerendering ListenerTagpagerendering92E57078
 └─ [~] DefaultActions
     └─ @@ -1,20 +1,7 @@
        [ ] [
        [ ]   {
        [-]     "ForwardConfig": {
        [-]       "TargetGroups": [
        [-]         {
        [-]           "TargetGroupArn": {
        [-]             "Ref": "TargetGroupTagpagerendering42E428EE"
        [-]           },
        [-]           "Weight": 0
        [-]         },
        [-]         {
        [-]           "TargetGroupArn": {
        [-]             "Ref": "TagpagerenderingEcsTargetGroupTagpagerendering0976D2E5"
        [-]           },
        [-]           "Weight": 1
        [-]         }
        [-]       ]
        [+]     "TargetGroupArn": {
        [+]       "Ref": "TagpagerenderingEcsTargetGroupTagpagerendering0976D2E5"
        [ ]     },
        [ ]     "Type": "forward"
        [ ]   }



✨  Number of stacks with differences: 1

@akash1810 akash1810 added the feature Departmental tracking: work on a new feature label Oct 19, 2026
@github-actions

github-actions Bot commented Oct 19, 2026 •

Copy link
Copy Markdown

@akash1810
akash1810 force-pushed the rm-tag-page-rendering-ec2 branch from 4129069 to 5b955ff Compare October 22, 2026 09:51
@akash1810
akash1810 force-pushed the rm-tag-page-rendering-ec2 branch from 5b955ff to 83019c4 Compare October 22, 2026 09:51
@akash1810
akash1810 marked this pull request as ready for review October 22, 2026 09:53
@akash1810
akash1810 requested a review from a team as a code owner October 22, 2026 09:53
@github-actions

github-actions Bot commented Oct 22, 2026 •

Copy link
Copy Markdown

🚀 Image pushed to AWS ECR

Image digest: sha256:c9a76863d47cf60d0b511fd21bf6c0e8848d0a1b7c54bc58ed3578b8bc562078

🐛 Run the image locally

The following can be used to run the image locally:

# Refer to image using the immutable digest. Find alternatives below.
IMAGE_IDENTIFIER="@sha256:c9a76863d47cf60d0b511fd21bf6c0e8848d0a1b7c54bc58ed3578b8bc562078"

# Refer to image using branch tag
# IMAGE_IDENTIFIER=":branch-rm-tag-page-rendering-ec2"

# Refer to image using build tag
# IMAGE_IDENTIFIER=":build-32800"

# Set environment variables for the AWS CLI
AWS_PROFILE="<A_PROFILE_FROM_JANUS>"
AWS_DEFAULT_REGION="eu-west-1"

IMAGE_ACCOUNT_ID=$(aws ssm get-parameter --name /organisation/accounts/artifacts --query "Parameter.Value" --output text)
REGISTRY="${IMAGE_ACCOUNT_ID}.dkr.ecr.${AWS_DEFAULT_REGION}.amazonaws.com"
IMAGE="${REGISTRY}/guardian/dotcom-rendering/dotcom-rendering${IMAGE_IDENTIFIER}"

# Login to AWS ECR https://docs.aws.amazon.com/AmazonECR/latest/userguide/registry_auth.html
aws ecr get-login-password | docker login --username AWS --password-stdin $REGISTRY

# Pull the image
docker pull $IMAGE

# Run the image. You'll likely need to set additional flags. See https://docs.docker.com/reference/cli/docker/container/run.
docker run $IMAGE

From guardian/actions-ecr.

@arelra arelra left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎉

I can see there is a refactor of EC2 props as part of this PR. Is that strictly required to remove tag-pages EC2 infrastructure?

@akash1810

Copy link
Copy Markdown
Member Author

I can see there is a refactor of EC2 props as part of this PR. Is that strictly required to remove tag-pages EC2 infrastructure?

It is required for this feature (see also fe8fe27). We currently always provision EC2 infrastructure and optionally provision ECS infrastructure. Changes to the EC2 props allow for ECS infra only; the lack of changes to the snapshot demonstrate its no-op characteristic. Happy to break this out into its own PR if desired?

@arelra

arelra commented Oct 22, 2026

Copy link
Copy Markdown
Member

I can see there is a refactor of EC2 props as part of this PR. Is that strictly required to remove tag-pages EC2 infrastructure?

It is required for this feature (see also fe8fe27). We currently always provision EC2 infrastructure and optionally provision ECS infrastructure. Changes to the EC2 props allow for ECS infra only; the lack of changes to the snapshot demonstrate its no-op characteristic. Happy to break this out into its own PR if desired?

Thanks that's okay. Approved

The "cloudformation" template defined in `riff-raff.yaml` assumes the CFN template has AMI parameters.
The template for tag-page-rendering no longer does.
# tag-page-rendering cloudformation
tag-page-rendering-cfn:
template: cloudformation
type: cloud-formation

@akash1810 akash1810 Oct 22, 2026 •

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Break away from the templated deployment configuration which assumes an AMI parameter will be in the CFN template. This causes a deployment error:

User specified parameters that are not in template: AMI. Ensure that you are not specifying a parameter directly or as an AMI parameter.

@akash1810
akash1810 added this pull request to the merge queue Oct 23, 2026
Merged via the queue into main with commit 2064c91 Oct 23, 2026
29 checks passed
@akash1810
akash1810 deleted the rm-tag-page-rendering-ec2 branch October 23, 2026 06:02
amiParameter: AMITagpagerendering
# tag-page-rendering autoscaling
tag-page-rendering:
type: autoscaling

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removal of the autoscaling deployment type means tag-page-rendering is now deployed entirely with CloudFormation. As a result, its deployment is atomic 🎉.

@gu-prout

gu-prout Bot commented Oct 23, 2026

Copy link
Copy Markdown

Seen on PROD (merged by @akash1810 12 minutes and 30 seconds ago) Please check your changes!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

feature Departmental tracking: work on a new feature Seen-on-PROD

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants