feat: Sample Node.js REST API with AWS CDK — EC2 + API Gateway, GitLab CI/CD

[devin-ai-integration]

Summary

Adds a new sample-nodejs-cdk-api/ project — a plain JavaScript (CommonJS) Node.js REST API deployed on EC2 behind API Gateway HTTP API, using AWS CDK for infrastructure and GitLab CI/CD for automated deployment. Zero cold start — Express.js runs continuously on EC2 via PM2 (auto-restart, log management, boot persistence).

Architecture:

Client → API Gateway HTTP API → EC2 (t3.micro, Express.js on port 3000, managed by PM2)

Key components:

• Express.js REST API with CRUD /api/items endpoints on EC2
• CDK stack: VPC + EC2 + Security Group + API Gateway HTTP API (direct HTTP proxy to EC2 — no VPC Link, no NLB)
• S3 Asset deployment: CDK uploads src/ and package.json as S3 assets; EC2 UserData downloads and runs them — single source of truth, no duplicated app code
• PM2 process manager: EC2 UserData installs PM2, starts the app with pm2 start, saves the process list, and configures pm2 startup for boot persistence
• .gitlab-ci.yml with validate → test → build → deploy stages (dev/staging/prod)
• Jest tests (9 passing) asserting CDK-synthesized CloudFormation resources

Review & Testing Checklist for Human

• S3 Asset unzip path on EC2: UserData runs unzip -o /tmp/app-code.zip -d /home/ec2-user/app/src/. The directory structure inside the zip depends on how CDK packages the src/ directory. If CDK nests it, files may land at .../src/src/app.js instead of .../src/app.js. Deploy to a test account and verify the extracted file paths — this is the highest-risk item since it determines whether the app actually starts.
• EC2 public IP/DNS instability: The API Gateway integration uses instance.instancePublicDnsName, which changes when the EC2 instance is stopped and restarted. This silently breaks the API Gateway route. Consider adding an Elastic IP to stabilize the integration URI.
• Unnecessary production dependencies on EC2: The deployed package.json includes aws-cdk-lib and constructs as regular dependencies. These are only needed for CDK synthesis, not at Express runtime, but npm install --omit=dev will still install them (~200 MB). Consider a separate runtime package.json or moving CDK libs to devDependencies.
• Security — SSH open to 0.0.0.0/0: The security group allows SSH (port 22) from anyIpv4(). For production, restrict to specific CIDRs or remove entirely (SSM Session Manager is already configured via the IAM role).
• Not deployed to AWS: Lint and Jest pass, local dev server works. However, this has not been deployed to an actual AWS account. The full EC2 bootstrap (Node.js install via nodesource, S3 download, npm install, PM2 setup) is untested against a real Amazon Linux 2023 instance.
• GitLab CI working directory: The .gitlab-ci.yml assumes it runs at the project root, but the code lives in sample-nodejs-cdk-api/. If this stays as a subdirectory, every CI job needs a cd sample-nodejs-cdk-api or equivalent.

Suggested test plan:

1. Clone the branch, cd sample-nodejs-cdk-api && npm install
2. Run npm run dev and hit http://localhost:3000/api/items to verify CRUD locally
3. Run npx cdk synth --context env=dev and inspect the CloudFormation template — check the UserData script for correct S3 paths and PM2 commands
4. Deploy to a sandbox AWS account: npx cdk deploy --context env=dev
5. SSH into EC2, run pm2 list and pm2 logs to verify PM2 is running the app
6. Verify /home/ec2-user/app/src/ contains the expected files (app.js, local.js, routes/)
7. Verify both the API Gateway URL and direct EC2 URL (http://<public-ip>:3000/) return valid responses
8. Reboot the EC2 instance and confirm PM2 restarts the app automatically

Notes

• The .gitlab-ci.yml is designed for a standalone repo. If this subdirectory layout is kept, each CI job needs working_dir: sample-nodejs-cdk-api or equivalent.
• Cost: EC2 t3.micro ~$8.50/month (free tier eligible) + API Gateway HTTP API $1/million requests.
• In-memory data store: Items are stored in a Map — data is lost on EC2 restart. Intentional for a sample app; swap in DynamoDB/RDS for persistence.

Link to Devin session: https://partner-workshops.devinenterprise.com/sessions/898695fe95d84a8fa616c239eedd0166

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 5 additional findings.