PSD401 template for AWS CDK v2 (TypeScript) apps, built to the district IaC standard (08-iac.md). CDK on AWS is the district rule — no Terraform-on-AWS.
bin/app.ts— district tag set applied mechanically viaTags.of(app)(psd:application,psd:environment,psd:owner,psd:managed-by=cdk,psd:repo,psd:data-classification), and cdk-nag v3 AwsSolutions pack wired through the CDK policy-validation framework (Validations.of(app).addPlugins(...)).lib/storage-stack.ts— one exemplar stateful stack: an S3 bucket with block-public-access, encryption at rest, SSL enforced, versioning, andRemovalPolicy.RETAIN.- Jest tests (
test/storage-stack.test.ts) usingaws-cdk-lib/assertions: ahasResourcePropertiesassertion on the secure defaults and a logical-ID pin test on the bucket (replacement of a stateful resource = data loss). - Committed
cdk.json, PSD CI callers, Dependabot, MIT LICENSE, CLAUDE.md.
- Rename:
package.jsonname; every CHANGEME inbin/app.ts(application, repo, data classification). - Set repo custom properties:
tier(defaultc-experiment),owner,lifecycle: active; add topics (cdk, …). - Review CLAUDE.md, especially the IaC rules — they are review-blocking.
- Verify green:
bun install && bun run test && bun run lint && bun run typecheck && bun run synth(bun is the PSD JS runtime rule;bun.lockis committed). - Replace
StorageStackwith your real stacks. Keep stateful and stateless resources in separate stacks; re-pin logical IDs in tests for every stateful resource you add.
Nobody — human or agent — runs cdk deploy locally. Merged PRs deploy through GitHub Actions with an OIDC role and environment protection; PRs get a cdk diff sticky comment and reviewers read the diff, not the TypeScript. Pin aws-cdk-lib and the aws-cdk CLI independently — they version separately.
| Task | Command |
|---|---|
| Install | bun install |
| Test | bun run test |
| Synth (runs cdk-nag) | bun run synth |
| Diff | bun run diff |
| Lint / Typecheck | bun run lint / bun run typecheck |
Technology Services, Peninsula School District.