How to get the graph plugin to generate a graph?

[anentropic]

I have a Python CDK project

I installed the cdk graph lib and plugin:

• https://pypi.org/project/aws-prototyping-sdk.cdk-graph/
• https://pypi.org/project/aws-prototyping-sdk.cdk-graph-plugin-diagram/

I added it to my app.py:

from typing import cast

import aws_cdk as cdk
from aws_prototyping_sdk.cdk_graph import CdkGraph, ICdkGraphPlugin
from aws_prototyping_sdk.cdk_graph_plugin_diagram import (
    CdkGraphDiagramPlugin,
    DiagramFormat,
)

app = cdk.App()
# ...added stack here as usual ...

graph_plugin = CdkGraphDiagramPlugin(
    diagrams=[
        {
            "name": "cdk_graph_diagram",
            "title": "AWS stack",
            "format": DiagramFormat.PNG,
        }
    ]
)
graph = CdkGraph(app, plugins=[cast(ICdkGraphPlugin, graph_plugin)])

if __name__ == "__main__":
    app.synth()
    graph.report()

I have done a brew install graphviz so that should be ready to go.

Then from the cli I run cdk synth.

I get no errors, but also no graph is output.

[anentropic]

Oh, it does work!

the output files go to cdk.out/cdkgraph/diagram.<the name you specified>.png

it'd be nice if you could specify a different output path and lose the prefix

[anentropic]

one odd thing is it seems to have hallucinated connections to my S3 bucket that don't really exist

at first I thought maybe this was just unfortunate arrow positioning

but I checked in the .dot file that's also generated and no, these are explicit edges between "AssetsBucket" S3 bucket and the "Bastion" (a BastionHostLinux) node and "AwsCustomResourceRole" IAM role node

but they don't have any relation to the S3 bucket in my stack code, either intentional or unintentional AFAICT

[JeremyJonas]

HI @anentropic , great to know it is mostly working for you especially in a python project. Can you confirm if you create the "Assets Bucket", or is that potentially CDK assets bucket?

The default filter/preset is "compact", which tries to create a cleaner and minimal graph - but sometimes collapses in a way that makes it seems that something is referencing something it is not, as it might actually reference the parent or child of the resource it shows in the graph - because the extraneous construct was collapsed to the non-extranesous resource (bucket).

Try removing the compact filter, so you can see the full graph (verbose) to verify the true reference mapping.

Here is example for typescript, not sure exact code for python of hand (see https://aws.github.io/aws-pdk/api/python/cdk-graph-plugin-diagram/index.html).

new CdkGraphDiagramPlugin({
  defaults: {
    filterPlan: {
      preset: FilterPreset.NONE,
    },
  },
});

Also I see you are using the legacy version of PDK, which is not maintained, consider updating to https://pypi.org/project/aws-pdk/ which includes all subprojects in single package.

• https://aws.github.io/aws-pdk/api/python/cdk-graph-plugin-diagram/index.html

Let us know if is truly a rouge reference or from collapsing. Cheers!

[anentropic]

I am pretty sure that AssetsBucket is the one that I created of that name in my stack and not an internal CDK one.

if I use FilterPreset.NONE then AssetsBucket shows up multiple times in the resulting diagram, but without unexpected connections:

if I use FilterPreset.NON_EXTRANEOUS then AssetsBucket appears once and I get a good comprehensive diagram of the cdk infra, but the bucket does have these two unexpected connections as before:

my stack code looks basically like this:

class Website(Stack):
    def __init__(
        self,
        scope: Construct,
        id: str,
        production: bool,
        resource_name_template: str,
        **kwargs,
    ):
        super().__init__(scope, id, **kwargs)

        assets_bucket = s3.Bucket(
            self,
            "AssetsBucket",
            bucket_name=resource_name_template.format("website-assets"),
            access_control=s3.BucketAccessControl.PRIVATE,
            removal_policy=RemovalPolicy.DESTROY,
        )
        assets_bucket.add_cors_rule(
            allowed_origins=["*"],
            allowed_methods=[s3.HttpMethods.GET],
            allowed_headers=["*"],
            exposed_headers=["ETag"],
        )

        RDSMySQLWithProxyAndBastion(
            self,
            "Database",
            resource_prefix=resource_name_template.format("database"),
            db_name="app_db",
            db_username="app_user",
            multi_az=False,
            initializer_image_src_path=str(INFRA_ROOT / "assets/db_init_lambda/src"),
            proxy_debug_logging=not production,
            backup_retention_days=7 if production else 0,
            secret_rotation_days=30,
            allow_delete=not production,
        )

So AFAICT there is no reason to connect the bucket to the bastion EC2 instance and a custom resource IAM role, which are created in the RDSMySQLWithProxyAndBastion construct.

If I look in generated graph.json file there is no obvious connection between these resources either.

(these were generated using latest https://pypi.org/project/aws-pdk/ version)

[anentropic]

FWIW I think it'd be nice splitting out the cdk-graph stuff into separate packages, as I am not using the rest of PDK