@aws-cdk/aws-apprunner-alpha

AWS::AppRunner Construct Library

Version 2.273.0-alpha.0

Separate package

@aws-cdk/aws-apprunner-alpha is not part of aws-cdk-lib — install it separately:

npm install @aws-cdk/aws-apprunner-alpha
pip install aws-cdk.aws-apprunner-alpha

This module is experimental (alpha): its API may change in any release, without a major version bump.

---

The APIs of higher level constructs in this module are experimental and under active development. They are subject to non-backward compatible changes or removal in any future version. These are not subject to the Semantic Versioning model and breaking changes will be announced in the release notes. This means that while you may use them, you may need to update your source code when upgrading to a newer version of this package.

---

This module is part of the AWS Cloud Development Kit project.

import * as apprunner from '@aws-cdk/aws-apprunner-alpha';

import aws_cdk.aws_apprunner_alpha as apprunner

import software.amazon.awscdk.services.apprunner.alpha.*;

using Amazon.CDK.AWS.AppRunner.Alpha;

import apprunner "github.com/aws/aws-cdk-go/awscdkapprunneralpha"

Introduction

AWS App Runner is a fully managed service that makes it easy for developers to quickly deploy containerized web applications and APIs, at scale and with no prior infrastructure experience required. Start with your source code or a container image. App Runner automatically builds and deploys the web application and load balances traffic with encryption. App Runner also scales up or down automatically to meet your traffic needs. With App Runner, rather than thinking about servers or scaling, you have more time to focus on your applications.

Service

The Service construct allows you to create AWS App Runner services with ECR Public, ECR or Github with the source property in the following scenarios:

• Source.fromEcr() - To define the source repository from ECR.
• Source.fromEcrPublic() - To define the source repository from ECR Public.
• Source.fromGitHub() - To define the source repository from the Github repository.
• Source.fromAsset() - To define the source from local asset directory.

The Service construct implements IGrantable.

ECR Public

To create a Service with ECR Public:

new apprunner.Service(this, 'Service', {
  source: apprunner.Source.fromEcrPublic({
    imageConfiguration: { port: 8000 },
    imageIdentifier: 'public.ecr.aws/aws-containers/hello-app-runner:latest',
  }),
});

apprunner.Service(self, "Service",
    source=apprunner.Source.from_ecr_public(
        image_configuration=apprunner.ImageConfiguration(port=8000),
        image_identifier="public.ecr.aws/aws-containers/hello-app-runner:latest"
    )
)

Service.Builder.create(this, "Service")
        .source(Source.fromEcrPublic(EcrPublicProps.builder()
                .imageConfiguration(ImageConfiguration.builder().port(8000).build())
                .imageIdentifier("public.ecr.aws/aws-containers/hello-app-runner:latest")
                .build()))
        .build();

new Service(this, "Service", new ServiceProps {
    Source = Source.FromEcrPublic(new EcrPublicProps {
        ImageConfiguration = new ImageConfiguration { Port = 8000 },
        ImageIdentifier = "public.ecr.aws/aws-containers/hello-app-runner:latest"
    })
});

apprunner.NewService(this, jsii.String("Service"), &ServiceProps{
	Source: apprunner.Source_FromEcrPublic(&EcrPublicProps{
		ImageConfiguration: &ImageConfiguration{
			Port: jsii.Number(8000),
		},
		ImageIdentifier: jsii.String("public.ecr.aws/aws-containers/hello-app-runner:latest"),
	}),
})

ECR

To create a Service from an existing ECR repository:

import * as ecr from 'aws-cdk-lib/aws-ecr';

new apprunner.Service(this, 'Service', {
  source: apprunner.Source.fromEcr({
    imageConfiguration: { port: 80 },
    repository: ecr.Repository.fromRepositoryName(this, 'NginxRepository', 'nginx'),
    tagOrDigest: 'latest',
  }),
});

import aws_cdk.aws_ecr as ecr


apprunner.Service(self, "Service",
    source=apprunner.Source.from_ecr(
        image_configuration=apprunner.ImageConfiguration(port=80),
        repository=ecr.Repository.from_repository_name(self, "NginxRepository", "nginx"),
        tag_or_digest="latest"
    )
)

import software.amazon.awscdk.services.ecr.*;


Service.Builder.create(this, "Service")
        .source(Source.fromEcr(EcrProps.builder()
                .imageConfiguration(ImageConfiguration.builder().port(80).build())
                .repository(Repository.fromRepositoryName(this, "NginxRepository", "nginx"))
                .tagOrDigest("latest")
                .build()))
        .build();

using Amazon.CDK.AWS.ECR;


new Service(this, "Service", new ServiceProps {
    Source = Source.FromEcr(new EcrProps {
        ImageConfiguration = new ImageConfiguration { Port = 80 },
        Repository = Repository.FromRepositoryName(this, "NginxRepository", "nginx"),
        TagOrDigest = "latest"
    })
});

import ecr "github.com/aws/aws-cdk-go/awscdk"


apprunner.NewService(this, jsii.String("Service"), &ServiceProps{
	Source: apprunner.Source_FromEcr(&EcrProps{
		ImageConfiguration: &ImageConfiguration{
			Port: jsii.Number(80),
		},
		Repository: ecr.Repository_FromRepositoryName(this, jsii.String("NginxRepository"), jsii.String("nginx")),
		TagOrDigest: jsii.String("latest"),
	}),
})

To create a Service from local docker image asset directory built and pushed to Amazon ECR:

You can specify whether to enable continuous integration from the source repository with the autoDeploymentsEnabled flag.

import * as assets from 'aws-cdk-lib/aws-ecr-assets';

const imageAsset = new assets.DockerImageAsset(this, 'ImageAssets', {
  directory: path.join(__dirname, 'docker.assets'),
});
new apprunner.Service(this, 'Service', {
  source: apprunner.Source.fromAsset({
    imageConfiguration: { port: 8000 },
    asset: imageAsset,
  }),
  autoDeploymentsEnabled: true,
});

import aws_cdk.aws_ecr_assets as assets


image_asset = assets.DockerImageAsset(self, "ImageAssets",
    directory=path.join(__dirname, "docker.assets")
)
apprunner.Service(self, "Service",
    source=apprunner.Source.from_asset(
        image_configuration=apprunner.ImageConfiguration(port=8000),
        asset=image_asset
    ),
    auto_deployments_enabled=True
)

import software.amazon.awscdk.services.ecr.assets.*;


DockerImageAsset imageAsset = DockerImageAsset.Builder.create(this, "ImageAssets")
        .directory(join(__dirname, "docker.assets"))
        .build();
Service.Builder.create(this, "Service")
        .source(Source.fromAsset(AssetProps.builder()
                .imageConfiguration(ImageConfiguration.builder().port(8000).build())
                .asset(imageAsset)
                .build()))
        .autoDeploymentsEnabled(true)
        .build();

using Amazon.CDK.AWS.Ecr.Assets;


var imageAsset = new DockerImageAsset(this, "ImageAssets", new DockerImageAssetProps {
    Directory = Join(__dirname, "docker.assets")
});
new Service(this, "Service", new ServiceProps {
    Source = Source.FromAsset(new AssetProps {
        ImageConfiguration = new ImageConfiguration { Port = 8000 },
        Asset = imageAsset
    }),
    AutoDeploymentsEnabled = true
});

import assets "github.com/aws/aws-cdk-go/awscdk"


imageAsset := assets.NewDockerImageAsset(this, jsii.String("ImageAssets"), &DockerImageAssetProps{
	Directory: path.join(__dirname, jsii.String("docker.assets")),
})
apprunner.NewService(this, jsii.String("Service"), &ServiceProps{
	Source: apprunner.Source_FromAsset(&AssetProps{
		ImageConfiguration: &ImageConfiguration{
			Port: jsii.Number(8000),
		},
		Asset: imageAsset,
	}),
	AutoDeploymentsEnabled: jsii.Boolean(true),
})

GitHub

To create a Service from the GitHub repository, you need to specify an existing App Runner Connection.

See Managing App Runner connections for more details.

new apprunner.Service(this, 'Service', {
  source: apprunner.Source.fromGitHub({
    repositoryUrl: 'https://github.com/aws-containers/hello-app-runner',
    branch: 'main',
    configurationSource: apprunner.ConfigurationSourceType.REPOSITORY,
    connection: apprunner.GitHubConnection.fromConnectionArn('CONNECTION_ARN'),
  }),
});

apprunner.Service(self, "Service",
    source=apprunner.Source.from_git_hub(
        repository_url="https://github.com/aws-containers/hello-app-runner",
        branch="main",
        configuration_source=apprunner.ConfigurationSourceType.REPOSITORY,
        connection=apprunner.GitHubConnection.from_connection_arn("CONNECTION_ARN")
    )
)

Service.Builder.create(this, "Service")
        .source(Source.fromGitHub(GithubRepositoryProps.builder()
                .repositoryUrl("https://github.com/aws-containers/hello-app-runner")
                .branch("main")
                .configurationSource(ConfigurationSourceType.REPOSITORY)
                .connection(GitHubConnection.fromConnectionArn("CONNECTION_ARN"))
                .build()))
        .build();

new Service(this, "Service", new ServiceProps {
    Source = Source.FromGitHub(new GithubRepositoryProps {
        RepositoryUrl = "https://github.com/aws-containers/hello-app-runner",
        Branch = "main",
        ConfigurationSource = ConfigurationSourceType.REPOSITORY,
        Connection = GitHubConnection.FromConnectionArn("CONNECTION_ARN")
    })
});

apprunner.NewService(this, jsii.String("Service"), &ServiceProps{
	Source: apprunner.Source_FromGitHub(&GithubRepositoryProps{
		RepositoryUrl: jsii.String("https://github.com/aws-containers/hello-app-runner"),
		Branch: jsii.String("main"),
		ConfigurationSource: apprunner.ConfigurationSourceType_REPOSITORY,
		Connection: apprunner.GitHubConnection_FromConnectionArn(jsii.String("CONNECTION_ARN")),
	}),
})

Use codeConfigurationValues to override configuration values with the API configuration source type.

new apprunner.Service(this, 'Service', {
  source: apprunner.Source.fromGitHub({
    repositoryUrl: 'https://github.com/aws-containers/hello-app-runner',
    branch: 'main',
    configurationSource: apprunner.ConfigurationSourceType.API,
    codeConfigurationValues: {
      runtime: apprunner.Runtime.PYTHON_3,
      port: '8000',
      startCommand: 'python app.py',
      buildCommand: 'yum install -y pycairo && pip install -r requirements.txt',
    },
    connection: apprunner.GitHubConnection.fromConnectionArn('CONNECTION_ARN'),
  }),
});

apprunner.Service(self, "Service",
    source=apprunner.Source.from_git_hub(
        repository_url="https://github.com/aws-containers/hello-app-runner",
        branch="main",
        configuration_source=apprunner.ConfigurationSourceType.API,
        code_configuration_values=apprunner.CodeConfigurationValues(
            runtime=apprunner.Runtime.PYTHON_3,
            port="8000",
            start_command="python app.py",
            build_command="yum install -y pycairo && pip install -r requirements.txt"
        ),
        connection=apprunner.GitHubConnection.from_connection_arn("CONNECTION_ARN")
    )
)

Service.Builder.create(this, "Service")
        .source(Source.fromGitHub(GithubRepositoryProps.builder()
                .repositoryUrl("https://github.com/aws-containers/hello-app-runner")
                .branch("main")
                .configurationSource(ConfigurationSourceType.API)
                .codeConfigurationValues(CodeConfigurationValues.builder()
                        .runtime(Runtime.PYTHON_3)
                        .port("8000")
                        .startCommand("python app.py")
                        .buildCommand("yum install -y pycairo && pip install -r requirements.txt")
                        .build())
                .connection(GitHubConnection.fromConnectionArn("CONNECTION_ARN"))
                .build()))
        .build();

new Service(this, "Service", new ServiceProps {
    Source = Source.FromGitHub(new GithubRepositoryProps {
        RepositoryUrl = "https://github.com/aws-containers/hello-app-runner",
        Branch = "main",
        ConfigurationSource = ConfigurationSourceType.API,
        CodeConfigurationValues = new CodeConfigurationValues {
            Runtime = Runtime.PYTHON_3,
            Port = "8000",
            StartCommand = "python app.py",
            BuildCommand = "yum install -y pycairo && pip install -r requirements.txt"
        },
        Connection = GitHubConnection.FromConnectionArn("CONNECTION_ARN")
    })
});

apprunner.NewService(this, jsii.String("Service"), &ServiceProps{
	Source: apprunner.Source_FromGitHub(&GithubRepositoryProps{
		RepositoryUrl: jsii.String("https://github.com/aws-containers/hello-app-runner"),
		Branch: jsii.String("main"),
		ConfigurationSource: apprunner.ConfigurationSourceType_API,
		CodeConfigurationValues: &CodeConfigurationValues{
			Runtime: apprunner.Runtime_PYTHON_3(),
			Port: jsii.String("8000"),
			StartCommand: jsii.String("python app.py"),
			BuildCommand: jsii.String("yum install -y pycairo && pip install -r requirements.txt"),
		},
		Connection: apprunner.GitHubConnection_FromConnectionArn(jsii.String("CONNECTION_ARN")),
	}),
})

IAM Roles

You are allowed to define instanceRole and accessRole for the Service.

instanceRole - The IAM role that provides permissions to your App Runner service. These are permissions that your code needs when it calls any AWS APIs. If not defined, a new instance role will be generated when required.

To add IAM policy statements to this role, use addToRolePolicy():

import * as iam from 'aws-cdk-lib/aws-iam';

const service = new apprunner.Service(this, 'Service', {
  source: apprunner.Source.fromEcrPublic({
    imageConfiguration: { port: 8000 },
    imageIdentifier: 'public.ecr.aws/aws-containers/hello-app-runner:latest',
  }),
});

service.addToRolePolicy(new iam.PolicyStatement({
  effect: iam.Effect.ALLOW,
  actions: ['s3:GetObject'],
  resources: ['*'],
}))

import aws_cdk.aws_iam as iam


service = apprunner.Service(self, "Service",
    source=apprunner.Source.from_ecr_public(
        image_configuration=apprunner.ImageConfiguration(port=8000),
        image_identifier="public.ecr.aws/aws-containers/hello-app-runner:latest"
    )
)

service.add_to_role_policy(iam.PolicyStatement(
    effect=iam.Effect.ALLOW,
    actions=["s3:GetObject"],
    resources=["*"]
))

import software.amazon.awscdk.services.iam.*;


Service service = Service.Builder.create(this, "Service")
        .source(Source.fromEcrPublic(EcrPublicProps.builder()
                .imageConfiguration(ImageConfiguration.builder().port(8000).build())
                .imageIdentifier("public.ecr.aws/aws-containers/hello-app-runner:latest")
                .build()))
        .build();

service.addToRolePolicy(PolicyStatement.Builder.create()
        .effect(Effect.ALLOW)
        .actions(List.of("s3:GetObject"))
        .resources(List.of("*"))
        .build());

using Amazon.CDK.AWS.IAM;


var service = new Service(this, "Service", new ServiceProps {
    Source = Source.FromEcrPublic(new EcrPublicProps {
        ImageConfiguration = new ImageConfiguration { Port = 8000 },
        ImageIdentifier = "public.ecr.aws/aws-containers/hello-app-runner:latest"
    })
});

service.AddToRolePolicy(new PolicyStatement(new PolicyStatementProps {
    Effect = Effect.ALLOW,
    Actions = new [] { "s3:GetObject" },
    Resources = new [] { "*" }
}));

import "github.com/aws/aws-cdk-go/awscdk"


service := apprunner.NewService(this, jsii.String("Service"), &ServiceProps{
	Source: apprunner.Source_FromEcrPublic(&EcrPublicProps{
		ImageConfiguration: &ImageConfiguration{
			Port: jsii.Number(8000),
		},
		ImageIdentifier: jsii.String("public.ecr.aws/aws-containers/hello-app-runner:latest"),
	}),
})

service.AddToRolePolicy(iam.NewPolicyStatement(&PolicyStatementProps{
	Effect: iam.Effect_ALLOW,
	Actions: []*string{
		jsii.String("s3:GetObject"),
	},
	Resources: []*string{
		jsii.String("*"),
	},
}))

accessRole - The IAM role that grants the App Runner service access to a source repository. It's required for ECR image repositories (but not for ECR Public repositories). If not defined, a new access role will be generated when required.

See App Runner IAM Roles for more details.

Auto Scaling Configuration

To associate an App Runner service with a custom Auto Scaling Configuration, define autoScalingConfiguration for the service.

const autoScalingConfiguration = new apprunner.AutoScalingConfiguration(this, 'AutoScalingConfiguration', {
  autoScalingConfigurationName: 'MyAutoScalingConfiguration',
  maxConcurrency: 150,
  maxSize: 20,
  minSize: 5,
});

new apprunner.Service(this, 'DemoService', {
  source: apprunner.Source.fromEcrPublic({
    imageConfiguration: { port: 8000 },
    imageIdentifier: 'public.ecr.aws/aws-containers/hello-app-runner:latest',
  }),
  autoScalingConfiguration,
});

auto_scaling_configuration = apprunner.AutoScalingConfiguration(self, "AutoScalingConfiguration",
    auto_scaling_configuration_name="MyAutoScalingConfiguration",
    max_concurrency=150,
    max_size=20,
    min_size=5
)

apprunner.Service(self, "DemoService",
    source=apprunner.Source.from_ecr_public(
        image_configuration=apprunner.ImageConfiguration(port=8000),
        image_identifier="public.ecr.aws/aws-containers/hello-app-runner:latest"
    ),
    auto_scaling_configuration=auto_scaling_configuration
)

AutoScalingConfiguration autoScalingConfiguration = AutoScalingConfiguration.Builder.create(this, "AutoScalingConfiguration")
        .autoScalingConfigurationName("MyAutoScalingConfiguration")
        .maxConcurrency(150)
        .maxSize(20)
        .minSize(5)
        .build();

Service.Builder.create(this, "DemoService")
        .source(Source.fromEcrPublic(EcrPublicProps.builder()
                .imageConfiguration(ImageConfiguration.builder().port(8000).build())
                .imageIdentifier("public.ecr.aws/aws-containers/hello-app-runner:latest")
                .build()))
        .autoScalingConfiguration(autoScalingConfiguration)
        .build();

var autoScalingConfiguration = new AutoScalingConfiguration(this, "AutoScalingConfiguration", new AutoScalingConfigurationProps {
    AutoScalingConfigurationName = "MyAutoScalingConfiguration",
    MaxConcurrency = 150,
    MaxSize = 20,
    MinSize = 5
});

new Service(this, "DemoService", new ServiceProps {
    Source = Source.FromEcrPublic(new EcrPublicProps {
        ImageConfiguration = new ImageConfiguration { Port = 8000 },
        ImageIdentifier = "public.ecr.aws/aws-containers/hello-app-runner:latest"
    }),
    AutoScalingConfiguration = autoScalingConfiguration
});

autoScalingConfiguration := apprunner.NewAutoScalingConfiguration(this, jsii.String("AutoScalingConfiguration"), &AutoScalingConfigurationProps{
	AutoScalingConfigurationName: jsii.String("MyAutoScalingConfiguration"),
	MaxConcurrency: jsii.Number(150),
	MaxSize: jsii.Number(20),
	MinSize: jsii.Number(5),
})

apprunner.NewService(this, jsii.String("DemoService"), &ServiceProps{
	Source: apprunner.Source_FromEcrPublic(&EcrPublicProps{
		ImageConfiguration: &ImageConfiguration{
			Port: jsii.Number(8000),
		},
		ImageIdentifier: jsii.String("public.ecr.aws/aws-containers/hello-app-runner:latest"),
	}),
	AutoScalingConfiguration: AutoScalingConfiguration,
})

VPC Connector

To associate an App Runner service with a custom VPC, define vpcConnector for the service.

import * as ec2 from 'aws-cdk-lib/aws-ec2';

const vpc = new ec2.Vpc(this, 'Vpc', {
  ipAddresses: ec2.IpAddresses.cidr('10.0.0.0/16')
});

const vpcConnector = new apprunner.VpcConnector(this, 'VpcConnector', {
  vpc,
  vpcSubnets: vpc.selectSubnets({ subnetType: ec2.SubnetType.PUBLIC }),
  vpcConnectorName: 'MyVpcConnector',
});

new apprunner.Service(this, 'Service', {
  source: apprunner.Source.fromEcrPublic({
    imageConfiguration: { port: 8000 },
    imageIdentifier: 'public.ecr.aws/aws-containers/hello-app-runner:latest',
  }),
  vpcConnector,
});

import aws_cdk.aws_ec2 as ec2


vpc = ec2.Vpc(self, "Vpc",
    ip_addresses=ec2.IpAddresses.cidr("10.0.0.0/16")
)

vpc_connector = apprunner.VpcConnector(self, "VpcConnector",
    vpc=vpc,
    vpc_subnets=vpc.select_subnets(subnet_type=ec2.SubnetType.PUBLIC),
    vpc_connector_name="MyVpcConnector"
)

apprunner.Service(self, "Service",
    source=apprunner.Source.from_ecr_public(
        image_configuration=apprunner.ImageConfiguration(port=8000),
        image_identifier="public.ecr.aws/aws-containers/hello-app-runner:latest"
    ),
    vpc_connector=vpc_connector
)

import software.amazon.awscdk.services.ec2.*;


Vpc vpc = Vpc.Builder.create(this, "Vpc")
        .ipAddresses(IpAddresses.cidr("10.0.0.0/16"))
        .build();

VpcConnector vpcConnector = VpcConnector.Builder.create(this, "VpcConnector")
        .vpc(vpc)
        .vpcSubnets(vpc.selectSubnets(SubnetSelection.builder().subnetType(SubnetType.PUBLIC).build()))
        .vpcConnectorName("MyVpcConnector")
        .build();

Service.Builder.create(this, "Service")
        .source(Source.fromEcrPublic(EcrPublicProps.builder()
                .imageConfiguration(ImageConfiguration.builder().port(8000).build())
                .imageIdentifier("public.ecr.aws/aws-containers/hello-app-runner:latest")
                .build()))
        .vpcConnector(vpcConnector)
        .build();

using Amazon.CDK.AWS.EC2;


var vpc = new Vpc(this, "Vpc", new VpcProps {
    IpAddresses = IpAddresses.Cidr("10.0.0.0/16")
});

var vpcConnector = new VpcConnector(this, "VpcConnector", new VpcConnectorProps {
    Vpc = vpc,
    VpcSubnets = vpc.SelectSubnets(new SubnetSelection { SubnetType = SubnetType.PUBLIC }),
    VpcConnectorName = "MyVpcConnector"
});

new Service(this, "Service", new ServiceProps {
    Source = Source.FromEcrPublic(new EcrPublicProps {
        ImageConfiguration = new ImageConfiguration { Port = 8000 },
        ImageIdentifier = "public.ecr.aws/aws-containers/hello-app-runner:latest"
    }),
    VpcConnector = vpcConnector
});

import "github.com/aws/aws-cdk-go/awscdk"


vpc := ec2.NewVpc(this, jsii.String("Vpc"), &VpcProps{
	IpAddresses: ec2.IpAddresses_Cidr(jsii.String("10.0.0.0/16")),
})

vpcConnector := apprunner.NewVpcConnector(this, jsii.String("VpcConnector"), &VpcConnectorProps{
	Vpc: Vpc,
	VpcSubnets: vpc.selectSubnets(&SubnetSelection{
		SubnetType: ec2.SubnetType_PUBLIC,
	}),
	VpcConnectorName: jsii.String("MyVpcConnector"),
})

apprunner.NewService(this, jsii.String("Service"), &ServiceProps{
	Source: apprunner.Source_FromEcrPublic(&EcrPublicProps{
		ImageConfiguration: &ImageConfiguration{
			Port: jsii.Number(8000),
		},
		ImageIdentifier: jsii.String("public.ecr.aws/aws-containers/hello-app-runner:latest"),
	}),
	VpcConnector: VpcConnector,
})

VPC Ingress Connection

To make your App Runner service private and only accessible from within a VPC use the isPubliclyAccessible property and associate it to a VpcIngressConnection resource.

To set up a VpcIngressConnection, specify a VPC, a VPC Interface Endpoint, and the App Runner service. Also you must set isPubliclyAccessible property in ther Service to false.

For more information, see Enabling Private endpoint for incoming traffic.

import * as ec2 from 'aws-cdk-lib/aws-ec2';

declare const vpc: ec2.Vpc;

const interfaceVpcEndpoint = new ec2.InterfaceVpcEndpoint(this, 'MyVpcEndpoint', {
  vpc,
  service: ec2.InterfaceVpcEndpointAwsService.APP_RUNNER_REQUESTS,
  privateDnsEnabled: false,
});

const service = new apprunner.Service(this, 'Service', {
  source: apprunner.Source.fromEcrPublic({
    imageConfiguration: {
      port: 8000,
    },
    imageIdentifier: 'public.ecr.aws/aws-containers/hello-app-runner:latest',
  }),
  isPubliclyAccessible: false, // set false
});

new apprunner.VpcIngressConnection(this, 'VpcIngressConnection', {
  vpc,
  interfaceVpcEndpoint,
  service,
});

import aws_cdk.aws_ec2 as ec2

# vpc: ec2.Vpc


interface_vpc_endpoint = ec2.InterfaceVpcEndpoint(self, "MyVpcEndpoint",
    vpc=vpc,
    service=ec2.InterfaceVpcEndpointAwsService.APP_RUNNER_REQUESTS,
    private_dns_enabled=False
)

service = apprunner.Service(self, "Service",
    source=apprunner.Source.from_ecr_public(
        image_configuration=apprunner.ImageConfiguration(
            port=8000
        ),
        image_identifier="public.ecr.aws/aws-containers/hello-app-runner:latest"
    ),
    is_publicly_accessible=False
)

apprunner.VpcIngressConnection(self, "VpcIngressConnection",
    vpc=vpc,
    interface_vpc_endpoint=interface_vpc_endpoint,
    service=service
)

import software.amazon.awscdk.services.ec2.*;

Vpc vpc;


InterfaceVpcEndpoint interfaceVpcEndpoint = InterfaceVpcEndpoint.Builder.create(this, "MyVpcEndpoint")
        .vpc(vpc)
        .service(InterfaceVpcEndpointAwsService.APP_RUNNER_REQUESTS)
        .privateDnsEnabled(false)
        .build();

Service service = Service.Builder.create(this, "Service")
        .source(Source.fromEcrPublic(EcrPublicProps.builder()
                .imageConfiguration(ImageConfiguration.builder()
                        .port(8000)
                        .build())
                .imageIdentifier("public.ecr.aws/aws-containers/hello-app-runner:latest")
                .build()))
        .isPubliclyAccessible(false)
        .build();

VpcIngressConnection.Builder.create(this, "VpcIngressConnection")
        .vpc(vpc)
        .interfaceVpcEndpoint(interfaceVpcEndpoint)
        .service(service)
        .build();

using Amazon.CDK.AWS.EC2;

Vpc vpc;


var interfaceVpcEndpoint = new InterfaceVpcEndpoint(this, "MyVpcEndpoint", new InterfaceVpcEndpointProps {
    Vpc = vpc,
    Service = InterfaceVpcEndpointAwsService.APP_RUNNER_REQUESTS,
    PrivateDnsEnabled = false
});

var service = new Service(this, "Service", new ServiceProps {
    Source = Source.FromEcrPublic(new EcrPublicProps {
        ImageConfiguration = new ImageConfiguration {
            Port = 8000
        },
        ImageIdentifier = "public.ecr.aws/aws-containers/hello-app-runner:latest"
    }),
    IsPubliclyAccessible = false
});

new VpcIngressConnection(this, "VpcIngressConnection", new VpcIngressConnectionProps {
    Vpc = vpc,
    InterfaceVpcEndpoint = interfaceVpcEndpoint,
    Service = service
});

import "github.com/aws/aws-cdk-go/awscdk"

var vpc Vpc


interfaceVpcEndpoint := ec2.NewInterfaceVpcEndpoint(this, jsii.String("MyVpcEndpoint"), &InterfaceVpcEndpointProps{
	Vpc: Vpc,
	Service: ec2.InterfaceVpcEndpointAwsService_APP_RUNNER_REQUESTS(),
	PrivateDnsEnabled: jsii.Boolean(false),
})

service := apprunner.NewService(this, jsii.String("Service"), &ServiceProps{
	Source: apprunner.Source_FromEcrPublic(&EcrPublicProps{
		ImageConfiguration: &ImageConfiguration{
			Port: jsii.Number(8000),
		},
		ImageIdentifier: jsii.String("public.ecr.aws/aws-containers/hello-app-runner:latest"),
	}),
	IsPubliclyAccessible: jsii.Boolean(false),
})

apprunner.NewVpcIngressConnection(this, jsii.String("VpcIngressConnection"), &VpcIngressConnectionProps{
	Vpc: Vpc,
	InterfaceVpcEndpoint: InterfaceVpcEndpoint,
	Service: Service,
})

Dual Stack

To use dual stack (IPv4 and IPv6) for your incoming public network configuration, set ipAddressType to IpAddressType.DUAL_STACK.

new apprunner.Service(this, 'Service', {
  source: apprunner.Source.fromEcrPublic({
    imageConfiguration: { port: 8000 },
    imageIdentifier: 'public.ecr.aws/aws-containers/hello-app-runner:latest',
  }),
  ipAddressType: apprunner.IpAddressType.DUAL_STACK,
});

apprunner.Service(self, "Service",
    source=apprunner.Source.from_ecr_public(
        image_configuration=apprunner.ImageConfiguration(port=8000),
        image_identifier="public.ecr.aws/aws-containers/hello-app-runner:latest"
    ),
    ip_address_type=apprunner.IpAddressType.DUAL_STACK
)

Service.Builder.create(this, "Service")
        .source(Source.fromEcrPublic(EcrPublicProps.builder()
                .imageConfiguration(ImageConfiguration.builder().port(8000).build())
                .imageIdentifier("public.ecr.aws/aws-containers/hello-app-runner:latest")
                .build()))
        .ipAddressType(IpAddressType.DUAL_STACK)
        .build();

new Service(this, "Service", new ServiceProps {
    Source = Source.FromEcrPublic(new EcrPublicProps {
        ImageConfiguration = new ImageConfiguration { Port = 8000 },
        ImageIdentifier = "public.ecr.aws/aws-containers/hello-app-runner:latest"
    }),
    IpAddressType = IpAddressType.DUAL_STACK
});

apprunner.NewService(this, jsii.String("Service"), &ServiceProps{
	Source: apprunner.Source_FromEcrPublic(&EcrPublicProps{
		ImageConfiguration: &ImageConfiguration{
			Port: jsii.Number(8000),
		},
		ImageIdentifier: jsii.String("public.ecr.aws/aws-containers/hello-app-runner:latest"),
	}),
	IpAddressType: apprunner.IpAddressType_DUAL_STACK,
})

Note: Currently, App Runner supports dual stack for only Public endpoint. Only IPv4 is supported for Private endpoint. If you update a service that's using dual-stack Public endpoint to a Private endpoint, your App Runner service will default to support only IPv4 for Private endpoint and fail to receive traffic originating from IPv6 endpoint.

Secrets Manager

To include environment variables integrated with AWS Secrets Manager, use the environmentSecrets attribute. You can use the addSecret method from the App Runner Service class to include secrets from outside the service definition.

import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
import * as ssm from 'aws-cdk-lib/aws-ssm';

declare const stack: Stack;

const secret = new secretsmanager.Secret(stack, 'Secret');
const parameter = ssm.StringParameter.fromSecureStringParameterAttributes(stack, 'Parameter', {
  parameterName: '/name',
  version: 1,
});

const service = new apprunner.Service(stack, 'Service', {
  source: apprunner.Source.fromEcrPublic({
    imageConfiguration: {
      port: 8000,
      environmentSecrets: {
        SECRET: apprunner.Secret.fromSecretsManager(secret),
        PARAMETER: apprunner.Secret.fromSsmParameter(parameter),
        SECRET_ID: apprunner.Secret.fromSecretsManagerVersion(secret, { versionId: 'version-id' }),
        SECRET_STAGE: apprunner.Secret.fromSecretsManagerVersion(secret, { versionStage: 'version-stage' }),
      },
    },
    imageIdentifier: 'public.ecr.aws/aws-containers/hello-app-runner:latest',
  })
});

service.addSecret('LATER_SECRET', apprunner.Secret.fromSecretsManager(secret, 'field'));

import aws_cdk.aws_secretsmanager as secretsmanager
import aws_cdk.aws_ssm as ssm

# stack: Stack


secret = secretsmanager.Secret(stack, "Secret")
parameter = ssm.StringParameter.from_secure_string_parameter_attributes(stack, "Parameter",
    parameter_name="/name",
    version=1
)

service = apprunner.Service(stack, "Service",
    source=apprunner.Source.from_ecr_public(
        image_configuration=apprunner.ImageConfiguration(
            port=8000,
            environment_secrets={
                "SECRET": apprunner.Secret.from_secrets_manager(secret),
                "PARAMETER": apprunner.Secret.from_ssm_parameter(parameter),
                "SECRET_ID": apprunner.Secret.from_secrets_manager_version(secret, version_id="version-id"),
                "SECRET_STAGE": apprunner.Secret.from_secrets_manager_version(secret, version_stage="version-stage")
            }
        ),
        image_identifier="public.ecr.aws/aws-containers/hello-app-runner:latest"
    )
)

service.add_secret("LATER_SECRET", apprunner.Secret.from_secrets_manager(secret, "field"))

import software.amazon.awscdk.services.secretsmanager.*;
import software.amazon.awscdk.services.ssm.*;

Stack stack;


Secret secret = new Secret(stack, "Secret");
IStringParameter parameter = StringParameter.fromSecureStringParameterAttributes(stack, "Parameter", SecureStringParameterAttributes.builder()
        .parameterName("/name")
        .version(1)
        .build());

Service service = Service.Builder.create(stack, "Service")
        .source(Source.fromEcrPublic(EcrPublicProps.builder()
                .imageConfiguration(ImageConfiguration.builder()
                        .port(8000)
                        .environmentSecrets(Map.of(
                                "SECRET", Secret.fromSecretsManager(secret),
                                "PARAMETER", Secret.fromSsmParameter(parameter),
                                "SECRET_ID", Secret.fromSecretsManagerVersion(secret, SecretVersionInfo.builder().versionId("version-id").build()),
                                "SECRET_STAGE", Secret.fromSecretsManagerVersion(secret, SecretVersionInfo.builder().versionStage("version-stage").build())))
                        .build())
                .imageIdentifier("public.ecr.aws/aws-containers/hello-app-runner:latest")
                .build()))
        .build();

service.addSecret("LATER_SECRET", Secret.fromSecretsManager(secret, "field"));

using Amazon.CDK.AWS.SecretsManager;
using Amazon.CDK.AWS.SSM;

Stack stack;


var secret = new Secret(stack, "Secret");
var parameter = StringParameter.FromSecureStringParameterAttributes(stack, "Parameter", new SecureStringParameterAttributes {
    ParameterName = "/name",
    Version = 1
});

var service = new Service(stack, "Service", new ServiceProps {
    Source = Source.FromEcrPublic(new EcrPublicProps {
        ImageConfiguration = new ImageConfiguration {
            Port = 8000,
            EnvironmentSecrets = new Dictionary<string, Secret> {
                { "SECRET", Secret.FromSecretsManager(secret) },
                { "PARAMETER", Secret.FromSsmParameter(parameter) },
                { "SECRET_ID", Secret.FromSecretsManagerVersion(secret, new SecretVersionInfo { VersionId = "version-id" }) },
                { "SECRET_STAGE", Secret.FromSecretsManagerVersion(secret, new SecretVersionInfo { VersionStage = "version-stage" }) }
            }
        },
        ImageIdentifier = "public.ecr.aws/aws-containers/hello-app-runner:latest"
    })
});

service.AddSecret("LATER_SECRET", Secret.FromSecretsManager(secret, "field"));

import secretsmanager "github.com/aws/aws-cdk-go/awscdk"
import ssm "github.com/aws/aws-cdk-go/awscdk"

var stack Stack


secret := secretsmanager.NewSecret(stack, jsii.String("Secret"))
parameter := ssm.StringParameter_FromSecureStringParameterAttributes(stack, jsii.String("Parameter"), &SecureStringParameterAttributes{
	ParameterName: jsii.String("/name"),
	Version: jsii.Number(1),
})

service := apprunner.NewService(stack, jsii.String("Service"), &ServiceProps{
	Source: apprunner.Source_FromEcrPublic(&EcrPublicProps{
		ImageConfiguration: &ImageConfiguration{
			Port: jsii.Number(8000),
			EnvironmentSecrets: map[string]Secret{
				"SECRET": apprunner.Secret_fromSecretsManager(secret),
				"PARAMETER": apprunner.Secret_fromSsmParameter(parameter),
				"SECRET_ID": apprunner.Secret_fromSecretsManagerVersion(secret, &SecretVersionInfo{
					"versionId": jsii.String("version-id"),
				}),
				"SECRET_STAGE": apprunner.Secret_fromSecretsManagerVersion(secret, &SecretVersionInfo{
					"versionStage": jsii.String("version-stage"),
				}),
			},
		},
		ImageIdentifier: jsii.String("public.ecr.aws/aws-containers/hello-app-runner:latest"),
	}),
})

service.AddSecret(jsii.String("LATER_SECRET"), apprunner.Secret_FromSecretsManager(secret, jsii.String("field")))

Use a customer managed key

To use a customer managed key for your source encryption, use the kmsKey attribute.

import * as kms from 'aws-cdk-lib/aws-kms';

declare const kmsKey: kms.IKey;

new apprunner.Service(this, 'Service', {
  source: apprunner.Source.fromEcrPublic({
    imageConfiguration: { port: 8000 },
    imageIdentifier: 'public.ecr.aws/aws-containers/hello-app-runner:latest',
  }),
  kmsKey,
});

import aws_cdk.aws_kms as kms

# kms_key: kms.IKey


apprunner.Service(self, "Service",
    source=apprunner.Source.from_ecr_public(
        image_configuration=apprunner.ImageConfiguration(port=8000),
        image_identifier="public.ecr.aws/aws-containers/hello-app-runner:latest"
    ),
    kms_key=kms_key
)

import software.amazon.awscdk.services.kms.*;

IKey kmsKey;


Service.Builder.create(this, "Service")
        .source(Source.fromEcrPublic(EcrPublicProps.builder()
                .imageConfiguration(ImageConfiguration.builder().port(8000).build())
                .imageIdentifier("public.ecr.aws/aws-containers/hello-app-runner:latest")
                .build()))
        .kmsKey(kmsKey)
        .build();

using Amazon.CDK.AWS.KMS;

IKey kmsKey;


new Service(this, "Service", new ServiceProps {
    Source = Source.FromEcrPublic(new EcrPublicProps {
        ImageConfiguration = new ImageConfiguration { Port = 8000 },
        ImageIdentifier = "public.ecr.aws/aws-containers/hello-app-runner:latest"
    }),
    KmsKey = kmsKey
});

import kms "github.com/aws/aws-cdk-go/awscdk"

var kmsKey IKey


apprunner.NewService(this, jsii.String("Service"), &ServiceProps{
	Source: apprunner.Source_FromEcrPublic(&EcrPublicProps{
		ImageConfiguration: &ImageConfiguration{
			Port: jsii.Number(8000),
		},
		ImageIdentifier: jsii.String("public.ecr.aws/aws-containers/hello-app-runner:latest"),
	}),
	KmsKey: KmsKey,
})

HealthCheck

To configure the health check for the service, use the healthCheck attribute.

You can specify it by static methods HealthCheck.http or HealthCheck.tcp.

new apprunner.Service(this, 'Service', {
  source: apprunner.Source.fromEcrPublic({
    imageConfiguration: { port: 8000 },
    imageIdentifier: 'public.ecr.aws/aws-containers/hello-app-runner:latest',
  }),
  healthCheck: apprunner.HealthCheck.http({
    healthyThreshold: 5,
    interval: Duration.seconds(10),
    path: '/',
    timeout: Duration.seconds(10),
    unhealthyThreshold: 10,
  }),
});

apprunner.Service(self, "Service",
    source=apprunner.Source.from_ecr_public(
        image_configuration=apprunner.ImageConfiguration(port=8000),
        image_identifier="public.ecr.aws/aws-containers/hello-app-runner:latest"
    ),
    health_check=apprunner.HealthCheck.http(
        healthy_threshold=5,
        interval=Duration.seconds(10),
        path="/",
        timeout=Duration.seconds(10),
        unhealthy_threshold=10
    )
)

Service.Builder.create(this, "Service")
        .source(Source.fromEcrPublic(EcrPublicProps.builder()
                .imageConfiguration(ImageConfiguration.builder().port(8000).build())
                .imageIdentifier("public.ecr.aws/aws-containers/hello-app-runner:latest")
                .build()))
        .healthCheck(HealthCheck.http(HttpHealthCheckOptions.builder()
                .healthyThreshold(5)
                .interval(Duration.seconds(10))
                .path("/")
                .timeout(Duration.seconds(10))
                .unhealthyThreshold(10)
                .build()))
        .build();

new Service(this, "Service", new ServiceProps {
    Source = Source.FromEcrPublic(new EcrPublicProps {
        ImageConfiguration = new ImageConfiguration { Port = 8000 },
        ImageIdentifier = "public.ecr.aws/aws-containers/hello-app-runner:latest"
    }),
    HealthCheck = HealthCheck.Http(new HttpHealthCheckOptions {
        HealthyThreshold = 5,
        Interval = Duration.Seconds(10),
        Path = "/",
        Timeout = Duration.Seconds(10),
        UnhealthyThreshold = 10
    })
});

apprunner.NewService(this, jsii.String("Service"), &ServiceProps{
	Source: apprunner.Source_FromEcrPublic(&EcrPublicProps{
		ImageConfiguration: &ImageConfiguration{
			Port: jsii.Number(8000),
		},
		ImageIdentifier: jsii.String("public.ecr.aws/aws-containers/hello-app-runner:latest"),
	}),
	HealthCheck: apprunner.HealthCheck_Http(&HttpHealthCheckOptions{
		HealthyThreshold: jsii.Number(5),
		Interval: awscdk.Duration_Seconds(jsii.Number(10)),
		Path: jsii.String("/"),
		Timeout: awscdk.Duration_*Seconds(jsii.Number(10)),
		UnhealthyThreshold: jsii.Number(10),
	}),
})

Observability Configuration

To associate an App Runner service with a custom observability configuration, use the observabilityConfiguration property.

const observabilityConfiguration = new apprunner.ObservabilityConfiguration(this, 'ObservabilityConfiguration', {
  observabilityConfigurationName: 'MyObservabilityConfiguration',
  traceConfigurationVendor: apprunner.TraceConfigurationVendor.AWSXRAY,
});

new apprunner.Service(this, 'DemoService', {
  source: apprunner.Source.fromEcrPublic({
    imageConfiguration: { port: 8000 },
    imageIdentifier: 'public.ecr.aws/aws-containers/hello-app-runner:latest',
  }),
  observabilityConfiguration,
});

observability_configuration = apprunner.ObservabilityConfiguration(self, "ObservabilityConfiguration",
    observability_configuration_name="MyObservabilityConfiguration",
    trace_configuration_vendor=apprunner.TraceConfigurationVendor.AWSXRAY
)

apprunner.Service(self, "DemoService",
    source=apprunner.Source.from_ecr_public(
        image_configuration=apprunner.ImageConfiguration(port=8000),
        image_identifier="public.ecr.aws/aws-containers/hello-app-runner:latest"
    ),
    observability_configuration=observability_configuration
)

ObservabilityConfiguration observabilityConfiguration = ObservabilityConfiguration.Builder.create(this, "ObservabilityConfiguration")
        .observabilityConfigurationName("MyObservabilityConfiguration")
        .traceConfigurationVendor(TraceConfigurationVendor.AWSXRAY)
        .build();

Service.Builder.create(this, "DemoService")
        .source(Source.fromEcrPublic(EcrPublicProps.builder()
                .imageConfiguration(ImageConfiguration.builder().port(8000).build())
                .imageIdentifier("public.ecr.aws/aws-containers/hello-app-runner:latest")
                .build()))
        .observabilityConfiguration(observabilityConfiguration)
        .build();

var observabilityConfiguration = new ObservabilityConfiguration(this, "ObservabilityConfiguration", new ObservabilityConfigurationProps {
    ObservabilityConfigurationName = "MyObservabilityConfiguration",
    TraceConfigurationVendor = TraceConfigurationVendor.AWSXRAY
});

new Service(this, "DemoService", new ServiceProps {
    Source = Source.FromEcrPublic(new EcrPublicProps {
        ImageConfiguration = new ImageConfiguration { Port = 8000 },
        ImageIdentifier = "public.ecr.aws/aws-containers/hello-app-runner:latest"
    }),
    ObservabilityConfiguration = observabilityConfiguration
});

observabilityConfiguration := apprunner.NewObservabilityConfiguration(this, jsii.String("ObservabilityConfiguration"), &ObservabilityConfigurationProps{
	ObservabilityConfigurationName: jsii.String("MyObservabilityConfiguration"),
	TraceConfigurationVendor: apprunner.TraceConfigurationVendor_AWSXRAY,
})

apprunner.NewService(this, jsii.String("DemoService"), &ServiceProps{
	Source: apprunner.Source_FromEcrPublic(&EcrPublicProps{
		ImageConfiguration: &ImageConfiguration{
			Port: jsii.Number(8000),
		},
		ImageIdentifier: jsii.String("public.ecr.aws/aws-containers/hello-app-runner:latest"),
	}),
	ObservabilityConfiguration: ObservabilityConfiguration,
})

Types

Name	Kind	Summary
AutoScalingConfiguration	Construct (L2)	The App Runner Auto Scaling Configuration.
ObservabilityConfiguration	Construct (L2)	The App Runner Observability configuration.
Service	Construct (L2)	The App Runner Service.
VpcConnector	Construct (L2)	The App Runner VPC Connector.
VpcIngressConnection	Construct (L2)	The App Runner VPC Ingress Connection.
AssetProps	Struct	Properties of the image repository for Source.fromAsset().
AssetSource	Class	Represents the source from local assets.
AutoScalingConfigurationAttributes	Struct	Attributes for the App Runner Auto Scaling Configuration.
AutoScalingConfigurationProps	Struct	Properties of the App Runner Auto Scaling Configuration.
CodeConfiguration	Struct	Describes the configuration that AWS App Runner uses to build and run an App Runner service from a source code repository.
CodeConfigurationValues	Struct	Describes the basic configuration needed for building and running an AWS App Runner service.
CodeRepositoryProps	Struct	Properties of the CodeRepository.
ConfigurationSourceType	Enum	The source of the App Runner configuration.
Cpu	Class	The number of CPU units reserved for each instance of your App Runner service.
EcrProps	Struct	Properties of the image repository for Source.fromEcr().
EcrPublicProps	Struct	Properties of the image repository for Source.fromEcrPublic().
EcrPublicSource	Class	Represents the service source from ECR Public.
EcrSource	Class	Represents the service source from ECR.
GitHubConnection	Class	Represents the App Runner connection that enables the App Runner service to connect to a source repository.
GithubRepositoryProps	Struct	Properties of the Github repository for Source.fromGitHub().
GithubSource	Class	Represents the service source from a Github repository.
HealthCheck	Class	Contains static factory methods for creating health checks for different protocols.
HealthCheckProtocolType	Enum	The health check protocol type.
HttpHealthCheckOptions	Struct	Properties used to define HTTP Based healthchecks.
IAutoScalingConfiguration	Interface	Represents the App Runner Auto Scaling Configuration.
ImageConfiguration	Struct	Describes the configuration that AWS App Runner uses to run an App Runner service using an image pulled from a source image repository.
ImageRepository	Struct	Describes a source image repository.
ImageRepositoryType	Enum	The image repository types.
IObservabilityConfiguration	Interface	Represents the App Runner Observability configuration.
IpAddressType	Enum	The IP address type for your incoming public network configuration.
IService	Interface	Represents the App Runner Service.
IVpcConnector	Interface	Represents the App Runner VPC Connector.
IVpcIngressConnection	Interface	Represents the App Runner VPC Ingress Connection.
Memory	Class	The amount of memory reserved for each instance of your App Runner service.
ObservabilityConfigurationAttributes	Struct	Attributes for the App Runner Observability configuration.
ObservabilityConfigurationProps	Struct	Properties of the AppRunner Observability configuration.
Runtime	Class	The code runtimes.
Secret	Class	A secret environment variable.
SecretVersionInfo	Struct	Specify the secret's version id or version stage.
ServiceAttributes	Struct	Attributes for the App Runner Service.
ServiceProps	Struct	Properties of the AppRunner Service.
Source	Class	Represents the App Runner service source.
SourceCodeVersion	Struct	Identifies a version of code that AWS App Runner refers to within a source code repository.
SourceConfig	Struct	Result of binding Source into a Service.
TcpHealthCheckOptions	Struct	Properties used to define TCP Based healthchecks.
TraceConfigurationVendor	Enum	The implementation provider chosen for tracing App Runner services.
VpcConnectorAttributes	Struct	Attributes for the App Runner VPC Connector.
VpcConnectorProps	Struct	Properties of the AppRunner VPC Connector.
VpcIngressConnectionAttributes	Struct	Attributes for the App Runner VPC Ingress Connection.
VpcIngressConnectionProps	Struct	Properties of the AppRunner VPC Ingress Connection.