.dev.cloudformation.yml

AWSTemplateFormatVersion: '2010-09-09'

Metadata:
  License: Apache-2.0

Parameters:
  DBUserPassword:
    Description: The password to be used by the database user
    NoEcho: true
    Type: String

  ECRRepositoryStackName:
    Description: The name of the ECRRepository cloudformation stack to associate with this service
    Type: String

  EcsServiceDesiredCount:
    Description: The desired number of api tasks to run for the ECS service
    Default: 1
    Type: Number

  ServicesVpcStackName:
    Description: The name of the ServicesVPC cloudformation stack to associate with this service
    Type: String

Resources:
  ApplicationLoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Scheme: internet-facing
      Subnets:
        - Fn::ImportValue:
            !Sub ${ServicesVpcStackName}:ExternalSubnet:UsEast1a
        - Fn::ImportValue:
            !Sub ${ServicesVpcStackName}:ExternalSubnet:UsEast1b
        - Fn::ImportValue:
            !Sub ${ServicesVpcStackName}:ExternalSubnet:UsEast1c
        - Fn::ImportValue:
            !Sub ${ServicesVpcStackName}:ExternalSubnet:UsEast1d
        - Fn::ImportValue:
            !Sub ${ServicesVpcStackName}:ExternalSubnet:UsEast1e
        - Fn::ImportValue:
            !Sub ${ServicesVpcStackName}:ExternalSubnet:UsEast1f
      Tags:
        - Key: Application
          Value: Api
        - Key: Name
          Value: !Ref AWS::StackName
        - Key: Stack
          Value: !Ref AWS::StackName
      Type: application
      IpAddressType: dualstack

  ALBHTTPListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - TargetGroupArn: !Ref ALBTargetGroup
          Type: forward
      LoadBalancerArn: !Ref ApplicationLoadBalancer
      Port: 80
      Protocol: HTTP

  ALBTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckPath: '/info/health'
      HealthCheckPort: 4000
      HealthCheckProtocol: HTTP
      Port: 4000
      Protocol: HTTP
      Tags:
        - Key: Application
          Value: Api
        - Key: Name
          Value: !Ref AWS::StackName
        - Key: Stack
          Value: !Ref AWS::StackName
      TargetType: ip
      VpcId:
        Fn::ImportValue:
          !Sub ${ServicesVpcStackName}:ServicesVpc

  DBSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Database instances are in this group.
      SecurityGroupEgress:
        - CidrIp:
            Fn::ImportValue:
              !Sub ${ServicesVpcStackName}:ServicesVpc:Cidr
          FromPort: -1
          IpProtocol: "-1"
          ToPort: -1
        - CidrIpv6:
            Fn::ImportValue:
              !Sub ${ServicesVpcStackName}:ServicesVpc:CidrIpv6
          FromPort: -1
          IpProtocol: "-1"
          ToPort: -1
      SecurityGroupIngress:
        - CidrIp:
            Fn::ImportValue:
              !Sub ${ServicesVpcStackName}:ServicesVpc:Cidr
          FromPort: 5432
          IpProtocol: tcp
          ToPort: 5432
        - CidrIpv6:
            Fn::ImportValue:
              !Sub ${ServicesVpcStackName}:ServicesVpc:CidrIpv6
          FromPort: 5432
          IpProtocol: tcp
          ToPort: 5432
      Tags:
        - Key: Application
          Value: Api
        - Key: Name
          Value: !Sub ${AWS::StackName}:DB
        - Key: Stack
          Value: !Ref AWS::StackName
      VpcId:
        Fn::ImportValue:
          !Sub ${ServicesVpcStackName}:ServicesVpc

  ECSCluster:
    Type: AWS::ECS::Cluster
    Properties: {}

  ECSService:
    Type: AWS::ECS::Service
    Properties:
      Cluster: !Ref ECSCluster
      DeploymentConfiguration:
        MaximumPercent: 200
        MinimumHealthyPercent: 50
      DesiredCount: !Ref EcsServiceDesiredCount
      LaunchType: FARGATE
      LoadBalancers:
        - ContainerName: ApiService
          ContainerPort: 4000
          TargetGroupArn: !Ref ALBTargetGroup
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: ENABLED
          Subnets:
            - Fn::ImportValue:
                !Sub ${ServicesVpcStackName}:ExternalSubnet:UsEast1a
            - Fn::ImportValue:
                !Sub ${ServicesVpcStackName}:ExternalSubnet:UsEast1b
            - Fn::ImportValue:
                !Sub ${ServicesVpcStackName}:ExternalSubnet:UsEast1c
            - Fn::ImportValue:
                !Sub ${ServicesVpcStackName}:ExternalSubnet:UsEast1d
            - Fn::ImportValue:
                !Sub ${ServicesVpcStackName}:ExternalSubnet:UsEast1e
            - Fn::ImportValue:
                !Sub ${ServicesVpcStackName}:ExternalSubnet:UsEast1f
      ServiceName: !Sub ${AWS::StackName}_Api
      TaskDefinition: !Ref ECSTaskDefinition
    DependsOn:
      - ApplicationLoadBalancer
      - ALBTargetGroup
      - ALBHTTPListener
      - ExecutionIAMRole
      - LogGroup
      - RDSDBInstanceMaster
      - TaskIAMRole

  ECSTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        - Environment:
            - Name: DB_HOSTNAME
              Value: !GetAtt RDSDBInstanceMaster.Endpoint.Address
          Image: !Join
            - ':'
            - - Fn::ImportValue:
                  !Sub ${ECRRepositoryStackName}:ECRRepository:Uri
              - latest
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region: !Ref AWS::Region
              awslogs-group: !Ref LogGroup
              awslogs-stream-prefix: api
          Name: ApiService
          PortMappings:
            - ContainerPort: 4000
              Protocol: tcp
      Cpu: '512'
      ExecutionRoleArn: !GetAtt ExecutionIAMRole.Arn
      Family: !Ref AWS::StackName
      Memory: '1GB'
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      TaskRoleArn: !GetAtt TaskIAMRole.Arn

  ExecutionIAMRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          -
            Effect: Allow
            Principal:
              Service: ecs.amazonaws.com
            Action:
              - sts:AssumeRole
          -
            Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
      Path: '/'
      RoleName: !Join
        - '_'
        - - !Ref AWS::StackName
          - ExecutionIAMRole

  LogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Ref AWS::StackName
      RetentionInDays: 1

  RDSDBInstanceMaster:
    Type: AWS::RDS::DBInstance
    Properties:
      AllocatedStorage: "10"
      AllowMajorVersionUpgrade: true
      AutoMinorVersionUpgrade: true
      BackupRetentionPeriod: "7"
      CopyTagsToSnapshot: true
      DBInstanceClass: "db.t2.micro"
      DBName: api_prod
      DBSubnetGroupName: !Ref RDSDBSubnetGroup
      Engine: postgres
      EngineVersion: "9.6.5"
      MasterUsername: postgres
      MasterUserPassword: !Ref DBUserPassword
      MultiAZ: false
      PreferredBackupWindow: "09:00-09:30"
      PreferredMaintenanceWindow: "Wed:09:30-Wed:10:00"
      PubliclyAccessible: false
      StorageType: gp2
      Tags:
        - Key: Application
          Value: Api
        - Key: Name
          Value: !Ref AWS::StackName
        - Key: Stack
          Value: !Ref AWS::StackName
      VPCSecurityGroups:
        - !Ref DBSecurityGroup

  RDSDBSubnetGroup:
    Type: AWS::RDS::DBSubnetGroup
    Properties:
      DBSubnetGroupDescription: An group of AZ distributed, internal VPC subnets for DB services.
      SubnetIds:
        - Fn::ImportValue:
            !Sub ${ServicesVpcStackName}:InternalSubnet:UsEast1a
        - Fn::ImportValue:
            !Sub ${ServicesVpcStackName}:InternalSubnet:UsEast1b
        - Fn::ImportValue:
            !Sub ${ServicesVpcStackName}:InternalSubnet:UsEast1c
        - Fn::ImportValue:
            !Sub ${ServicesVpcStackName}:InternalSubnet:UsEast1d
        - Fn::ImportValue:
            !Sub ${ServicesVpcStackName}:InternalSubnet:UsEast1e
        - Fn::ImportValue:
            !Sub ${ServicesVpcStackName}:InternalSubnet:UsEast1f
      Tags:
        - Key: Application
          Value: Api
        - Key: Name
          Value: !Ref AWS::StackName
        - Key: Stack
          Value: !Ref AWS::StackName

  TaskIAMRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          -
            Effect: Allow
            Principal:
              Service: ecs.amazonaws.com
            Action:
              - sts:AssumeRole
          -
            Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
      Path: '/'
      RoleName: !Join
        - '_'
        - - !Ref AWS::StackName
          - TaskIAMRole