cfn.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: Acquisition Health Monitor
Mappings:
  Constants:
    App:
      Value: acquisition-health-monitor
    ShortName:
      Value: acq-health-mon
    Stack:
      Value: playground
  StageVariables:
    CODE:
      InstanceType: "t4g.small"
      DNSName: acquisition-health-monitor.code.dev-gutools.co.uk
    PROD:
      InstanceType: "t4g.small"
      DNSName: acquisition-health-monitor.gutools.co.uk

Parameters:
  CertArn:
    Type: String
    Description: ACM Certificate for app use
  MembershipAccessRoleArn:
    Type: String
    Description: Membership account role arn
  PublicSubnets:
    Type: List<AWS::EC2::Subnet::Id>
    Description: The public subnets of the VPC for the loadbalancer
  VpcId:
    Type: AWS::EC2::VPC::Id
    Description: The VPC
  Stage:
    Type: String
    AllowedValues:
      - CODE
      - PROD
    Description: Environment name
  AMI:
    Description: AMI used by the instances
    Type: AWS::EC2::Image::Id
  DistBucket:
    Type: String
    Description: The name of the s3 bucket containing the server artifact
  PrivateVpcSubnets:
    Description: Private subnets to use for EC2 instances
    Type: List<AWS::EC2::Subnet::Id>

Resources:
  AppRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: root
          PolicyDocument:
            Statement:
              - Action: s3:GetObject
                Effect: Allow
                Resource: !Sub arn:aws:s3:::${DistBucket}/*
              - Action:
                  - autoscaling:DescribeAutoScalingInstances
                  - autoscaling:DescribeAutoScalingGroups
                  - ec2:DescribeTags
                Effect: Allow
                Resource: '*'
              - Action:
                  - cloudwatch:*
                  - logs:*
                Effect: Allow
                Resource: '*'
              - Effect: Allow
                Action:
                  - kinesis:PutRecord
                  - kinesis:PutRecords
                  - kinesis:DescribeStream
                Resource: !Sub arn:aws:kinesis:${AWS::Region}:${AWS::AccountId}:stream/mobile-log-aggregation-${Stage}
              - Effect: Allow
                Resource: "*"
                Action:
                  - ec2messages:AcknowledgeMessage
                  - ec2messages:DeleteMessage
                  - ec2messages:FailMessage
                  - ec2messages:GetEndpoint
                  - ec2messages:GetMessages
                  - ec2messages:SendReply
                  - ssm:UpdateInstanceInformation
                  - ssm:ListInstanceAssociations
                  - ssm:DescribeInstanceProperties
                  - ssm:DescribeDocumentParameters
                  - ssmmessages:CreateControlChannel
                  - ssmmessages:CreateDataChannel
                  - ssmmessages:OpenControlChannel
                  - ssmmessages:OpenDataChannel
              - Action:
                  - ssm:GetParametersByPath
                Effect: Allow
                Resource: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/acquisition/CODE/playground
              - Action: sts:AssumeRole
                Effect: Allow
                Resource: !Ref MembershipAccessRoleArn

  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - !Ref AppRole

  ElasticLoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Name: !Join
        - '-'
        - - !FindInMap [ Constants, Stack, Value ]
          - !Ref Stage
          - 'acq-health-mon'
      Subnets: !Ref PublicSubnets
      SecurityGroups:
        - !Ref LoadBalancerSecurityGroup
      Tags:
        - Key: Stack
          Value: !FindInMap [ Constants, Stack, Value ]
        - Key: App
          Value: !FindInMap [ Constants, App, Value ]
        - Key: Stage
          Value: !Ref Stage

  LoadBalancerListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - Type: forward
          TargetGroupArn:
            Ref: TargetGroup
      LoadBalancerArn:
        Ref: ElasticLoadBalancer
      Certificates:
        - CertificateArn: !Ref CertArn
      Port: 443
      Protocol: HTTPS

  TargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Name: !Join
        - '-'
        - - !FindInMap [ Constants, Stack, Value ]
          - !Ref Stage
          - !FindInMap [ Constants, ShortName, Value ]
      Port: 9000
      Protocol: HTTP
      HealthCheckIntervalSeconds: 10
      HealthCheckPath: /healthcheck
      HealthCheckPort: 9000
      HealthCheckProtocol: HTTP
      HealthCheckTimeoutSeconds: 5
      HealthyThresholdCount: 2
      UnhealthyThresholdCount: 2
      VpcId: !Ref VpcId
      TargetGroupAttributes:
        - Key: deregistration_delay.timeout_seconds
          Value: '20'
    DependsOn:
      - ElasticLoadBalancer

  LoadBalancerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Open up HTTP access to load balancer
      VpcId: !Ref VpcId
      SecurityGroupEgress:
        - CidrIp: 0.0.0.0/0
          FromPort: 9000
          IpProtocol: tcp
          ToPort: 9000
      SecurityGroupIngress:
        - CidrIp: 0.0.0.0/0
          FromPort: 443
          IpProtocol: tcp
          ToPort: 443

  InstanceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Open up HTTP access to load balancer
      SecurityGroupEgress:
        - CidrIp: 0.0.0.0/0
          FromPort: 80
          IpProtocol: tcp
          ToPort: 80
        - CidrIp: 0.0.0.0/0
          FromPort: 443
          IpProtocol: tcp
          ToPort: 443
      SecurityGroupIngress:
        - FromPort: 9000
          IpProtocol: tcp
          SourceSecurityGroupId: !Ref LoadBalancerSecurityGroup
          ToPort: 9000
      VpcId: !Ref VpcId

  PrivateAcquisitionHealthMonitorAutoscalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      VPCZoneIdentifier: !Ref PrivateVpcSubnets
      HealthCheckGracePeriod: 400
      HealthCheckType: ELB
      LaunchConfigurationName: !Ref AcquisitionHealthMonitorLaunchConfig
      TargetGroupARNs:
        - !Ref TargetGroup
      MaxSize: 2
      MinSize: 1
      Tags:
        - Key: Stage
          PropagateAtLaunch: true
          Value: !Ref Stage
        - Key: Stack
          PropagateAtLaunch: true
          Value:
            !FindInMap [ Constants, Stack, Value ]
        - Key: App
          PropagateAtLaunch: true
          Value:
            !FindInMap [ Constants, App, Value ]
        - Key: Name
          Value: !Join
            - '-'
            - - !FindInMap [ Constants, Stack, Value ]
              - !Ref Stage
              - !FindInMap [ Constants, App, Value ]
          PropagateAtLaunch: 'true'

  AcquisitionHealthMonitorLaunchConfig:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      AssociatePublicIpAddress: False
      IamInstanceProfile: !Ref InstanceProfile
      ImageId: !Ref AMI
      InstanceType: !FindInMap [ StageVariables, !Ref Stage, InstanceType ]
      SecurityGroups:
        - !Ref InstanceSecurityGroup
      UserData:
        Fn::Base64: !Sub
          - |+
            #!/bin/bash -ev
            aws --region ${AWS::Region} s3 cp s3://${DistBucket}/playground/${Stage}/acquisition-health-monitor/acquisition-health-monitor_1.0-SNAPSHOT_all.deb /tmp
            dpkg -i /tmp/acquisition-health-monitor_1.0-SNAPSHOT_all.deb
            /opt/cloudwatch-logs/configure-logs application ${Stack} ${Stage} ${App} /var/log/acquisition-health-monitor/application.log '%Y-%m-%dT%H:%M:%S,%f%z'
          - {
            Stack: !FindInMap [ Constants, Stack, Value ],
            App: !FindInMap [ Constants, App, Value ]
          }

  LoadBalancerDNSRecord:
    Type: Guardian::DNS::RecordSet
    Properties:
      Name: !FindInMap [ StageVariables, !Ref Stage, DNSName ]
      ResourceRecords:
        - !GetAtt ElasticLoadBalancer.DNSName
      TTL: 3600
      RecordType: CNAME
      Stage: !Ref Stage