1import * as AWS from "@/AWS";
2import * as Core from "@/Test/Core";
3import * as Test from "@/Test/Alchemy";
4import * as autoscaling from "@distilled.cloud/aws/auto-scaling";
5import { describe, expect } from "alchemy-test";
6import * as Effect from "effect/Effect";
7import * as Schedule from "effect/Schedule";
8import * as HttpClient from "effect/http/HttpClient";
9import * as HttpClientRequest from "effect/http/HttpClientRequest";
10import LifecycleTestFunctionLive, {
11 LifecycleTestFunction,
12 lifecycleFleetAsgName,
13 lifecycleHookName,
14} from "./fixtures/lifecycle-handler.ts";
15
16const testOptions = { providers: AWS.providers() };
17const { test, beforeAll, afterAll } = Test.make(testOptions);
18const sharedStack = Core.scratchStack(testOptions, "AutoScalingLifecycle");
19
20const readinessPolicy = Schedule.max([
21 Schedule.fixed("2 seconds"),
22 Schedule.recurs(75),
23]);
24
25let baseUrl: string;
26
27// Deploys a Lambda that (a) creates a LAUNCHING lifecycle hook + EventBridge
28// subscription via `consumeLifecycleActions` and (b) binds
29// `CompleteLifecycleAction`. The fleet is sized to zero so no EC2 instances
30// launch — this verifies the DX wiring (hook creation + binding IAM) without a
31// >90s instance-launch round-trip. The full "instance pauses → Lambda completes
32// CONTINUE → InService" flow is left to a live run with a non-zero desired
33// capacity.
34describe(
35 "AutoScaling LifecycleHook event source + CompleteLifecycleAction",
36 {
37 tags: [
38 "provider:aws",
39 "provider:aws:autoscaling",
40 "provider:aws:ec2",
41 "provider:aws:lambda",
42 "live",
43 ],
44 },
45 () => {
46 beforeAll(
47 Effect.gen(function* () {
48 yield* sharedStack.destroy();
49
50 const { fn } = yield* sharedStack.deploy(
51 Effect.gen(function* () {
52 const fn = yield* LifecycleTestFunction;
53 return { fn };
54 }).pipe(Effect.provide(LifecycleTestFunctionLive)),
55 );
56
57 expect(fn.functionUrl).toBeTruthy();
58 baseUrl = fn.functionUrl!.replace(/\/+$/, "");
59
60 yield* HttpClient.get(`${baseUrl}/health`).pipe(
61 Effect.flatMap((response) =>
62 response.status === 200
63 ? Effect.succeed(response)
64 : Effect.fail(
65 new Error(`Function not ready: ${response.status}`),
66 ),
67 ),
68 Effect.retry({ schedule: readinessPolicy }),
69 );
70 }),
71 { timeout: 300_000 },
72 );
73
74 afterAll(
75 Effect.gen(function* () {
76 yield* sharedStack.destroy();
77 // Assert the fixture ASG is fully gone — the suite must leave nothing.
78 // The hook context has no AWS providers of its own, so provide them
79 // explicitly for the out-of-band distilled call.
80 const remaining = yield* Core.withProviders(
81 autoscaling
82 .describeAutoScalingGroups({
83 AutoScalingGroupNames: [lifecycleFleetAsgName],
84 } as any)
85 .pipe(
86 Effect.map((r) => (r.AutoScalingGroups ?? []).length),
87 Effect.repeat({
88 until: (count) => count === 0,
89 schedule: Schedule.spaced("3 seconds"),
90 times: 10,
91 }),
92 ),
93 testOptions,
94 sharedStack.name,
95 );
96 expect(remaining).toBe(0);
97 }),
98 { timeout: 180_000 },
99 );
100
101 test.provider(
102 "consumeLifecycleActions creates the launch lifecycle hook on the ASG",
103 (_stack) =>
104 Effect.gen(function* () {
105 const hooks = yield* autoscaling.describeLifecycleHooks({
106 AutoScalingGroupName: lifecycleFleetAsgName,
107 LifecycleHookNames: [lifecycleHookName],
108 } as any);
109 const hook = hooks.LifecycleHooks?.[0];
110 expect(hook?.LifecycleHookName).toEqual(lifecycleHookName);
111 expect(hook?.LifecycleTransition).toEqual(
112 "autoscaling:EC2_INSTANCE_LAUNCHING",
113 );
114 expect(hook?.HeartbeatTimeout).toEqual(300);
115 }),
116 );
117
118 test.provider(
119 "CompleteLifecycleAction binding is IAM-wired (no AccessDenied)",
120 (_stack) =>
121 Effect.gen(function* () {
122 // A freshly attached IAM policy is eventually consistent — the first
123 // invocations after deploy can still see AccessDenied. Poll (bounded)
124 // until the call stops failing authorization, then assert.
125 const body = yield* HttpClient.execute(
126 HttpClientRequest.post(`${baseUrl}/complete-bogus`),
127 ).pipe(
128 Effect.flatMap((response) =>
129 response.status === 200
130 ? response.json
131 : Effect.fail(
132 new Error(`Function not ready: ${response.status}`),
133 ),
134 ),
135 Effect.map((json) => json as { ok: boolean; tag: string }),
136 // `repeat` only re-runs successes: a transient 502 from the
137 // Function URL (cold start right after deploy) must be retried
138 // too, the way the /health probe is.
139 Effect.retry({ schedule: Schedule.spaced("3 seconds"), times: 10 }),
140 Effect.repeat({
141 until: (b) =>
142 b.tag !== "AccessDenied" && b.tag !== "AccessDeniedException",
143 schedule: Schedule.spaced("3 seconds"),
144 times: 10,
145 }),
146 );
147 // The SDK call reached AWS with valid credentials/policy: either it
148 // succeeded, or it failed for a resource reason (no active lifecycle
149 // action) — never an authorization failure.
150 expect(["AccessDenied", "AccessDeniedException"]).not.toContain(
151 body.tag,
152 );
153 }),
154 { timeout: 60_000 },
155 );
156 },
157);