How to Deploy Actix Web to AWS

use encore::secrets::Secret;
use encore::storage::postgres::Database;

// RDS on AWS; `encore run` starts Postgres locally and applies ./migrations.
static DB: Database = Database::new("orders").migrations("./migrations");
// Set per environment with `encore secret set`, stored in AWS Secrets Manager.
static PAYMENTS_KEY: Secret = Secret::new("PaymentsApiKey");

CREATE TABLE orders (
    id         BIGSERIAL PRIMARY KEY,
    email      TEXT NOT NULL,
    total_cents BIGINT NOT NULL,
    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
);

use actix_web::{get, post, web, App, HttpResponse, HttpServer, Responder};
use serde::Deserialize;

#[derive(Deserialize)]
struct NewOrder {
    email: String,
    total_cents: i64,
}

#[post("/orders")]
async fn create_order(body: web::Json<NewOrder>) -> impl Responder {
    if PAYMENTS_KEY.value().is_err() {
        return HttpResponse::ServiceUnavailable().body("payments not configured\n");
    }
    match DB
        .query_one(
            "INSERT INTO orders (email, total_cents) VALUES ($1, $2) RETURNING id",
            &[&body.email, &body.total_cents],
        )
        .await
    {
        Ok(row) => {
            let id: i64 = row.get("id");
            HttpResponse::Created().json(serde_json::json!({ "id": id }))
        }
        Err(_) => HttpResponse::InternalServerError().finish(),
    }
}

#[get("/healthz")]
async fn healthz() -> impl Responder {
    HttpResponse::Ok().body("ok\n")
}

#[actix_web::main]
async fn main() -> std::io::Result<()> {
    encore::initialize();
    // Bind to the address Encore assigns, locally and on AWS.
    let addr = std::env::var("ENCORE_LISTEN_ADDR").unwrap_or("0.0.0.0:8080".into());
    HttpServer::new(|| App::new().service(create_order).service(healthz))
        .bind(addr)?
        .run()
        .await
}

FROM rust:1.90 AS build
WORKDIR /src
COPY . .
RUN cargo build --release

FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates \
    && rm -rf /var/lib/apt/lists/* && useradd --system --uid 10001 app
COPY --from=build /src/target/release/orders /usr/local/bin/orders
USER app
EXPOSE 8080
CMD ["orders"]

import * as cdk from "aws-cdk-lib";
import * as ec2 from "aws-cdk-lib/aws-ec2";
import * as ecs from "aws-cdk-lib/aws-ecs";
import * as patterns from "aws-cdk-lib/aws-ecs-patterns";
import * as rds from "aws-cdk-lib/aws-rds";
import * as sm from "aws-cdk-lib/aws-secretsmanager";

export class OrdersStack extends cdk.Stack {
  constructor(scope: cdk.App, id: string) {
    super(scope, id);
    const vpc = new ec2.Vpc(this, "Vpc", { maxAzs: 2 });
    const db = new rds.DatabaseInstance(this, "Db", {
      engine: rds.DatabaseInstanceEngine.postgres({ version: rds.PostgresEngineVersion.VER_17 }),
      vpc,
      storageEncrypted: true,
      credentials: rds.Credentials.fromGeneratedSecret("orders"),
    });
    const paymentsKey = new sm.Secret(this, "PaymentsApiKey");

    const svc = new patterns.ApplicationLoadBalancedFargateService(this, "Api", {
      vpc,
      taskImageOptions: {
        image: ecs.ContainerImage.fromAsset("."),
        containerPort: 8080,
        secrets: {
          PAYMENTS_API_KEY: ecs.Secret.fromSecretsManager(paymentsKey),
          DB_PASSWORD: ecs.Secret.fromSecretsManager(db.secret!, "password"),
        },
        environment: { DB_HOST: db.dbInstanceEndpointAddress },
      },
    });
    svc.targetGroup.configureHealthCheck({ path: "/healthz" });
    // Let the tasks reach Postgres.
    db.connections.allowDefaultPortFrom(svc.service);
  }
}

resource "aws_secretsmanager_secret" "payments_key" {
  name = "orders/payments-api-key"
}

data "aws_iam_policy_document" "read_secret" {
  statement {
    actions   = ["secretsmanager:GetSecretValue"]
    resources = [aws_secretsmanager_secret.payments_key.arn]
  }
}

resource "aws_iam_role_policy" "exec_read_secret" {
  role   = aws_iam_role.task_execution.id
  policy = data.aws_iam_policy_document.read_secret.json
}