supermarket.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: AWS Native Supermarket (auto-recovering standalone) v5.1.1

Parameters:
  # Required Parameters
  VPC:
    Description: Choose VPC to use
    Type: AWS::EC2::VPC::Id
  LoadBalancerSubnets:
    Description: Provide a list of Subnet IDs for the Chef Servers (must be at least 2 within the specified VPC)
    Type: List<AWS::EC2::Subnet::Id>
  SupermarketSubnet:
    Description: Provide a single Subnet ID for the Supermarket Server (must be within the specified VPC)
    Type: AWS::EC2::Subnet::Id
  SSLCertificateARN:
    Default: 'arn:aws:iam::'
    Description: SSL Certficate ARN for SSL Certficate
    Type: String
  InboundAdminSecurityGroupId:
    Description: Select an existing Security Group in your VPC to define administrative ACLs (SSH, monitoring tools, etc) to the Chef servers
    Type: AWS::EC2::SecurityGroup::Id
  ImageId:
    Description: The AMI ID to be used for launching instances
    Type: AWS::EC2::Image::Id
  KeyName:
    Description: Name of an existing EC2 KeyPair to enable SSH access to the instance
    Type: AWS::EC2::KeyPair::KeyName
  ContactEmail:
    Description: Contact email for Cloudwatch notifications and instance tagging
    Type: String
  ContactDept:
    Description: Contact department for billing purposes
    Type: String
  AlertNotificationTopic:
    Description: AWS SNS Alert notification topic
    Type: String
  ChefUrl:
    Description: The URL of the Chef Server, required for OAuth2.
    Type: String
  ChefOAuth2VerifySSL:
    Description: If the SSL certificate of your chef server is generated by a globally trusted CA, set this to true.
    Type: String
    Default: false
    AllowedValues:
    - true
    - false
  ###############################################################################
  # Performance Settings
  InstanceType:
    Description: EC2 Instance type for Chef Server Frontends (M5 class recommended)
    Default: m5.large
    Type: String
    AllowedValues: [t3.small, t3.medium, t3.large, t3.xlarge, t3.2xlarge,
      m5.large, m5.xlarge, m5.2xlarge, m5.4xlarge, m5.12xlarge, m5.24xlarge,
      c5.large, c5.xlarge, c5.2xlarge, c5.4xlarge, c5.9xlarge, c5.18xlarge]
  DataVolumeSize:
    Description: Amount of storage space to allocate on the OS disk
    Type: Number
    Default: 100
  ###############################################################################
  # Security Settings
  LoadBalancerScheme:
    Description: Network Scheme for the ELB
    Type: String
    Default: internet-facing
    AllowedValues:
    - 'internet-facing'
    - 'internal'
  LoadBalancerSecurityGroupId:
    Description: Supply a security group for your load balancer (leave blank to have it created for you). Using the default security group is recommended.
    Type: String
  FrontendSecurityGroupId:
    Description: Supply a security group for your chef frontends (leave blank to have it created for you). Using the default security group is recommended.
    Type: String
  SupermarketIamRole:
    Description: Supply an IAM Role for the Chef Servers (leave blank to have it created for you). NOTE If you supply your own role, you must also provide an S3 Bucket which that role can access
    Type: String
  ChefSecretsBucket:
    Description: Supply an S3 Bucket name where the Chef secrets are stored
    Type: String
  ChefStackName:
    Description: Supply the name of the Chef Servers stack
    Type: String
  ###############################################################################
  # Other Settings
  Route53HostedZone:
    Type: String
    Default: ''
    Description: Supply a Route 53 Hosted Zone name (eg. mydomain.com) for auto-creating a DNS record. Must NOT end in a dot. (Leave blank to disable)
  Route53RecordName:
    Type: String
    Default: 'supermarket'
    Description: Supply a DNS record name that will be prepended to the Route 53 Hosted Zone
  SystemLogsGroup:
    Description: The logical name of the Cloudwatch Logs log group for systemn logs
    Type: String
  AppLogsGroup:
    Description: The logical name of the Cloudwatch Logs log group for systemn logs
    Type: String

Metadata:
  cfn-lint:
    config:
      ignore_checks:
        - W2507

Conditions:
  CreateRoute53Record:
    !Not [!Equals [ !Ref Route53HostedZone, '' ] ]

Resources:
  ChefInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
      - !Ref SupermarketIamRole

  ChefALB:
    Type: "AWS::ElasticLoadBalancingV2::LoadBalancer"
    Properties:
      SecurityGroups:
        - !Ref LoadBalancerSecurityGroupId
      Subnets: !Ref LoadBalancerSubnets
      Scheme: !Ref LoadBalancerScheme
      Tags:
        - Key: Name
          Value: !Sub ${AWS::StackName}-lb
        - Key: X-Dept
          Value: !Ref ContactDept
        - Key: X-Contact
          Value: !Ref ContactEmail

  ChefALBListener:
    Type: "AWS::ElasticLoadBalancingV2::Listener"
    Properties:
        Certificates:
          - CertificateArn: !Ref SSLCertificateARN
        LoadBalancerArn: !Ref ChefALB
        Port: 443
        Protocol: HTTPS
        SslPolicy: ELBSecurityPolicy-TLS-1-2-2017-01
        DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref ChefTargetGroup

  ChefTargetGroup:
      Type: "AWS::ElasticLoadBalancingV2::TargetGroup"
      Properties:
        HealthCheckIntervalSeconds: 30
        UnhealthyThresholdCount: 2
        HealthyThresholdCount: 5
        HealthCheckPath: /
        VpcId: !Ref VPC
        Port: 443
        Protocol: HTTPS
        Targets:
        - Id: !Ref SupermarketServer
          Port: 443
        TargetGroupAttributes:
          - Key: stickiness.enabled
            Value: 'true'
          - Key: stickiness.type
            Value: lb_cookie
        Tags:
          - Key: X-Dept
            Value: !Ref ContactDept
          - Key: X-Contact
            Value: !Ref ContactEmail

  SupermarketServer:
    Type: AWS::EC2::Instance
    Properties:
      EbsOptimized: true
      BlockDeviceMappings:
      - DeviceName: /dev/xvda
        Ebs:
          VolumeSize: !Ref DataVolumeSize
          VolumeType: gp2
          DeleteOnTermination: true
      IamInstanceProfile: !Ref ChefInstanceProfile
      ImageId: !Ref ImageId
      InstanceType: !Ref InstanceType
      KeyName: !Ref KeyName
      Monitoring: true
      SubnetId: !Ref SupermarketSubnet
      SecurityGroupIds:
      - !Ref FrontendSecurityGroupId
      - !Ref InboundAdminSecurityGroupId
      Tags:
      - Key: Name
        Value: !Sub ${AWS::StackName}-singleton
      - Key: X-Dept
        Value: !Ref ContactDept
      - Key: X-Contact
        Value: !Ref ContactEmail
      UserData:
        "Fn::Base64": !Sub |
          #!/bin/bash -ex
          trap '/opt/aws/bin/cfn-signal -e 1 --region ${AWS::Region} --stack ${AWS::StackName} --resource SupermarketServer' ERR
          # Execute AWS::CloudFormation::Init
          /opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource SupermarketServer --region ${AWS::Region}
          /opt/aws/bin/cfn-signal -e 0 --region ${AWS::Region} --stack ${AWS::StackName} --resource SupermarketServer
    CreationPolicy:
      ResourceSignal:
        Count: 1
        Timeout: PT10M
    Metadata:
      AWS::CloudFormation::Init:
        configSets:
          default: [awslogs, supermarket_setup, nightly_snapshots, final_stage]
        supermarket_setup:
          commands:
            02_write_supermarket_json:
              command: !Sub
              - |
                aws s3 cp s3://${ChefSecretsBucket}/${ChefStackName}/etc_opscode/oc-id-applications/supermarket.json /tmp/supermarket.json
                OAUTH2_APP_ID=$(cat /tmp/supermarket.json | jq -r ".uid")
                OAUTH2_SECRET=$(cat /tmp/supermarket.json | jq -r ".secret")

                mkdir -p /etc/supermarket
                jq -n \
                  --arg uid $OAUTH2_APP_ID \
                  --arg secret $OAUTH2_SECRET \
                  '{"fqdn": "${FQDN}", "chef_server_url": "${ChefUrl}", "chef_oauth2_app_id": $uid, "chef_oauth2_secret": $secret, "chef_oauth2_verify_ssl": "${ChefOAuth2VerifySSL}", "features": "tools, gravatar, collaborator_groups"}' \
                  > /etc/supermarket/supermarket.json
              - { FQDN: !If [CreateRoute53Record, !Ref SupermarketDNSRecord, !GetAtt ChefALB.DNSName] }
            03_configure_supermarket:
              command: |
                rpm -ivh /var/cache/marketplace/supermarket.rpm
                supermarket-ctl reconfigure
            05_configure_cloudwatch_monitoring:
              command: |
                crontab -l | { cat; echo "*/5 * * * * /opt/cloudwatch_monitoring/aws-scripts-mon/mon-put-instance-data.pl --mem-util --disk-space-util --disk-path=/ --from-cron"; } | crontab -
        nightly_snapshots:
          commands:
            create_nightly_backup_cronjob:
              command: |
                crontab -l | { cat; echo "55 23 * * * root /usr/local/bin/ebs-snapshot.sh"; } | crontab -
        awslogs:
          files:
            /etc/awslogs/awscli.conf:
              content: !Sub |
                [default]
                region = ${AWS::Region}
                [plugins]
                cwlogs = cwlogs
              mode: '000644'
              owner: root
              group: root
            /etc/awslogs/awslogs.conf:
              content: !Sub |
                [general]
                state_file = /var/lib/awslogs/agent-state
                [/var/log/messages]
                datetime_format = %b %d %H:%M:%S
                file = /var/log/messages
                log_stream_name = {instance_id}
                log_group_name = ${SystemLogsGroup}
                [/var/log/secure]
                datetime_format = %b %d %H:%M:%S
                file = /var/log/secure
                log_stream_name = {instance_id}
                log_group_name = ${SystemLogsGroup}
                [/var/log/cron]
                datetime_format = %b %d %H:%M:%S
                file = /var/log/cron
                log_stream_name = {instance_id}
                log_group_name = ${SystemLogsGroup}
                [/var/log/cloud-init.log]
                datetime_format = %b %d %H:%M:%S
                file = /var/log/cloud-init.log
                log_stream_name = {instance_id}
                log_group_name = ${SystemLogsGroup}
                [/var/log/cfn-init.log]
                datetime_format = %Y-%m-%d %H:%M:%S
                file = /var/log/cfn-init.log
                log_stream_name = {instance_id}
                log_group_name = ${SystemLogsGroup}
                [/var/log/cfn-init-cmd.log]
                datetime_format = %Y-%m-%d %H:%M:%S
                file = /var/log/cfn-init-cmd.log
                log_stream_name = {instance_id}
                log_group_name = ${SystemLogsGroup}
                [/var/log/cloud-init-output.log]
                file = /var/log/cloud-init-output.log
                log_stream_name = {instance_id}
                log_group_name = ${SystemLogsGroup}
                [/var/log/dmesg]
                file = /var/log/dmesg
                log_stream_name = {instance_id}
                log_group_name = ${SystemLogsGroup}
                [/var/log/supermarket/nginx/access.log]
                log_group_name = ${AppLogsGroup}
                log_stream_name = {instance_id}
                file = /var/log/opscode/nginx/access.log
                [/var/log/supermarket/postgresql/current]
                file = /var/log/supermarket/postgresql/current
                log_group_name = ${AppLogsGroup}
                log_stream_name = {instance_id}
                [/var/log/supermarket/rails/current]
                file = /var/log/supermarket/rails/current
                log_group_name = ${AppLogsGroup}
                log_stream_name = {instance_id}
                [/var/log/supermarket/redis/current]
                file = /var/log/supermarket/redis/current
                log_group_name = ${AppLogsGroup}
                log_stream_name = {instance_id}
                [/var/log/supermarket/sidekiq/current]
                file = /var/log/supermarket/sidekiq/current
                log_group_name = ${AppLogsGroup}
                log_stream_name = {instance_id}
              mode: '000644'
              owner: root
              group: root
          commands:
            01_setup:
              command: !Sub |
                mkdir -p /var/lib/awslogs
                python /var/cache/marketplace/awslogs-agent-setup.py --region ${AWS::Region} --non-interactive -c /etc/awslogs/awslogs.conf
        final_stage:
          commands:
            09_cleanup:
              command: |
                # clean up the chef package cache, to maximize available disk space after install
                if [ -d /var/cache/marketplace ]; then
                    rm -f /var/cache/marketplace/*.rpm
                    rm -f /var/cache/marketplace/*.aib
                fi

# EC2 System AutoRecovery
# https://aws.amazon.com/blogs/aws/new-auto-recovery-for-amazon-ec2/
#########################################################################################
  RecoveryAlarm:
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmName: !Sub EC2AutoRecoveryAlarm-${AWS::StackName}
      AlarmDescription: 'Recovering instance when underlying hardware fails.'
      Namespace: 'AWS/EC2'
      MetricName: StatusCheckFailed_System
      Statistic: Minimum
      Period: 60
      EvaluationPeriods: 5
      ComparisonOperator: GreaterThanThreshold
      Threshold: 0
      AlarmActions:
      - !Sub 'arn:aws:automate:${AWS::Region}:ec2:recover'
      - !Ref AlertNotificationTopic
      Dimensions:
      - Name: InstanceId
        Value: !Ref SupermarketServer

  RebootAlarm:
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmName: !Sub EC2AutoRebootAlarm-${AWS::StackName}
      AlarmDescription: 'Reboot instance if it starts failing instance checks'
      Namespace: 'AWS/EC2'
      MetricName: StatusCheckFailed_Instance
      Statistic: Maximum
      Period: 60
      EvaluationPeriods: 2
      ComparisonOperator: GreaterThanThreshold
      Threshold: 0
      AlarmActions:
      - !Sub 'arn:aws:swf:${AWS::Region}:${AWS::AccountId}:action/actions/AWS_EC2.InstanceId.Reboot/1.0'
      - !Ref AlertNotificationTopic
      Dimensions:
      - Name: InstanceId
        Value: !Ref SupermarketServer

# Route 53 Record
#########################################################################################
  SupermarketDNSRecord:
    Type: AWS::Route53::RecordSet
    Condition: CreateRoute53Record
    Properties:
      HostedZoneName: !Sub ${Route53HostedZone}.
      Name: !Sub ${Route53RecordName}.${Route53HostedZone}.
      Comment: !Sub Created by Cloudformation ${AWS::StackName}
      Type: CNAME
      TTL: 900
      ResourceRecords:
      - !GetAtt ChefALB.DNSName

# Monitoring
#########################################################################################
  CPUAlarmHigh:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: !Sub CPUAlarmHigh-${AWS::StackName}
      AlarmDescription: Alarms when CPU > 60% for 5 minutes
      AlarmActions: [!Ref AlertNotificationTopic]
      MetricName: CPUUtilization
      Namespace: AWS/EC2
      ComparisonOperator: GreaterThanOrEqualToThreshold
      EvaluationPeriods: 5
      Period: 60
      Statistic: Average
      Threshold: 60
      Dimensions:
      - Name: InstanceId
        Value: !Ref SupermarketServer

  DiskSpaceUtilizationNvme:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: !Sub DiskSpaceUtilizationNvme-${AWS::StackName}
      AlarmDescription: Alarms when an disk utilization reaches a specified threshold.
      AlarmActions: [!Ref AlertNotificationTopic]
      MetricName: DiskSpaceUtilization
      Namespace: System/Linux
      ComparisonOperator: GreaterThanOrEqualToThreshold
      EvaluationPeriods: 2
      Period: 300
      Statistic: Average
      Threshold: 80
      Unit: Percent
      Dimensions:
      - Name: InstanceId
        Value: !Ref SupermarketServer
      - Name: MountPath
        Value: '/'
      - Name: Filesystem
        Value: '/dev/nvme0n1p1'

  MemoryUtilization:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: !Sub MemoryUtilization-${AWS::StackName}
      AlarmDescription: Alarms when an memory utilization reaches a specified threshold.
      AlarmActions: [!Ref AlertNotificationTopic]
      MetricName: MemoryUtilization
      Namespace: System/Linux
      ComparisonOperator: GreaterThanOrEqualToThreshold
      EvaluationPeriods: 2
      Period: 300
      Statistic: Average
      Threshold: 80
      Unit: Percent
      Dimensions:
      - Name: InstanceId
        Value: !Ref SupermarketServer

  ELB5XXExceeded:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: !Sub AppELB_5XX_Exceeded-${AWS::StackName}
      AlarmDescription: Alarms when an 5xx requests exceed a specified threshold.
      AlarmActions: [!Ref AlertNotificationTopic]
      MetricName: HTTPCode_ELB_5XX_Count
      Namespace: AWS/ApplicationELB
      ComparisonOperator: GreaterThanOrEqualToThreshold
      EvaluationPeriods: 2
      Period: 60
      Statistic: Sum
      Threshold: 10
      Dimensions:
        - Name: LoadBalancer
          Value: !GetAtt ChefALB.LoadBalancerFullName

  TargetGroupUnHealthyHostsAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: !Sub Supermarket-TG-Unhealthy-Hosts-${AWS::StackName}
      AlarmDescription: Alarms when UnHealthyHostCount is greater than threshold.
      AlarmActions: [!Ref AlertNotificationTopic]
      MetricName: UnHealthyHostCount
      Namespace: AWS/ApplicationELB
      ComparisonOperator: GreaterThanOrEqualToThreshold
      EvaluationPeriods: 2
      Period: 60
      Statistic: Sum
      Threshold: 1
      Dimensions:
        - Name: LoadBalancer
          Value: !GetAtt ChefALB.LoadBalancerFullName
        - Name: TargetGroup
          Value: !GetAtt ChefTargetGroup.TargetGroupFullName

Outputs:
  DNSName:
    Description: The DNS name of the load balancer
    Value: !If [CreateRoute53Record, !Sub "${Route53RecordName}.${Route53HostedZone}", !GetAtt ChefALB.DNSName]
    Export:
      Name: !Sub "${AWS::StackName}-DNSName"