template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  Backstage Application and ECS Cluster Service

Parameters:
  Domain:
    Type: String
    Description: 'Application Platform'

  System:
    Type: String
    Description: 'Application System'

  Component:
    Type: String
    Description: 'Application Component'

  CodeBranch:
    Type: String
    Description: 'Name of deployment branch'

  ClusterName:
    Type: AWS::SSM::Parameter::Value<String>
    Description: Name of ECS cluster

  ClusterTaskIamRoleArn:
    Type: AWS::SSM::Parameter::Value<String>
    Description: IAM role ARN for task ECS opperations.

  ClusterAlbListenerArn:
    Type: AWS::SSM::Parameter::Value<String>
    Description: Name of ECS cluster

  ClusterSecurityGroupId:
    Type: AWS::SSM::Parameter::Value<String>
    Description: ID of cluster security group

  ContainerRepo:
    Type: String
    Description: ECR repository name

  ContainerOrg:
    Type: String
    Description: ECR organization name

  ContainerImage:
    Type: String
    Description: Container image

  ContainerTag:
    Type: String
    Description: Container tag

  ContainerCpu:
    Type: Number
    Description: Container CPU allocation units. 1024 is 1 CPU. Value may equal fraction of a CPU.

  ContainerMemory:
    Type: Number
    Description: Container memory in megabytes

  ContainerDesiredCount:
    Type: Number
    Description: How many copies of the service task to run

  ContainerPort:
    Type: Number
    Description: Port container will listen on

  AlbRulePriority:
    Type: Number
    Description: The priority for the routing rule added to the load balancer.

  AlbRulePath:
    Type: String
    Description: A path on the public load balancer that this service
      should be connected to. Use * to send all load balancer
      traffic to this service.

  VpcId:
    Type: AWS::SSM::Parameter::Value<String>
    Description: Account VPC ID

  VpcSubnets:
    Type: AWS::SSM::Parameter::Value<CommaDelimitedList>
    Description: Account subnets

  # Backstage Application Configuration parameters
  PgHost:
    Type: String
    Description: PostgreSQL host

  PgPort:
    Type: String
    Description: PostgreSQL port

  PgUser:
    Type: String
    Description: PostgreSQL user

  PgPassword:
    Type: String
    Description: PostgreSQL password
    NoEcho: true

  AuthGoogleClientId:
    Type: String
    Description: Google OAuth client ID
    NoEcho: true

  AuthGoogleClientSecret:
    Type: String
    Description: Google OAuth client secret
    NoEcho: true

  BackstageAppUrl:
    Type: String
    Description: URL of application frontend

  BackstageBackendUrl:
    Type: String
    Description: URL of application backend

  ServerlessOpsCatalogApiUrl:
    Type: String
    Description: ServerlessOps catalog API URL

  ServerlessOpsAuthEndpoint:
    Type: String
    Description: ServerlessOps auth endpoint

  ServerlessOpsAuthClientId:
    Type: String
    Description: ServerlessOps auth client ID

  ServerlessOpsAuthClientSecret:
    Type: String
    Description: ServerlessOps auth client secret
    NoEcho: true


Resources:
  TaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      RuntimePlatform:
        CpuArchitecture: X86_64
        OperatingSystemFamily: LINUX
      Family: !Sub ${Component}-${CodeBranch}
      Cpu: !Ref ContainerCpu
      Memory: !Ref ContainerMemory
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      ExecutionRoleArn: !Ref ClusterTaskIamRoleArn
      TaskRoleArn: !Ref TaskIamRole
      ContainerDefinitions:
        - Name: !Ref Component
          Image: !Sub '${ContainerRepo}/${ContainerOrg}/${ContainerImage}:${ContainerTag}'
          PortMappings:
            - ContainerPort: !Ref ContainerPort
          Environment:
            - Name: POSTGRES_HOST
              Value: !Ref PgHost
            - Name: POSTGRES_PORT
              Value: !Ref PgPort
            - Name: POSTGRES_USER
              Value: !Ref PgUser
            - Name: POSTGRES_PASSWORD
              Value: !Ref PgPassword
            - Name: AUTH_GOOGLE_CLIENT_ID
              Value: !Ref AuthGoogleClientId
            - Name: AUTH_GOOGLE_CLIENT_SECRET
              Value: !Ref AuthGoogleClientSecret
            - Name: BACKSTAGE_APP_URL
              Value: !Ref BackstageAppUrl
            - Name: BACKSTAGE_BACKEND_URL
              Value: !Ref BackstageBackendUrl
            - Name: BACKSTAGE_BACKEND_PORT
              Value: !Ref ContainerPort
            - Name: SERVERLESSOPS_CATALOG_API_URL
              Value: !Ref ServerlessOpsCatalogApiUrl
            - Name: SERVERLESSOPS_AUTH_ENDPOINT
              Value: !Ref ServerlessOpsAuthEndpoint
            - Name: SERVERLESSOPS_AUTH_CLIENT_ID
              Value: !Ref ServerlessOpsAuthClientId
            - Name: SERVERLESSOPS_AUTH_CLIENT_SECRET
              Value: !Ref ServerlessOpsAuthClientSecret
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-create-group: true
              awslogs-group: !Sub '/aws/ecs/${ClusterName}/${AWS::StackName}'
              awslogs-region: !Ref AWS::Region
              awslogs-stream-prefix: app

  Service:
    Type: AWS::ECS::Service
    Properties:
      ServiceName: !Ref Component
      Cluster: !Ref ClusterName
      LaunchType: FARGATE
      CapacityProviderStrategy:
        - CapacityProvider: FARGATE_SPOT
          Weight: 1
      EnableECSManagedTags: true
      PropagateTags: TASK_DEFINITION
      EnableExecuteCommand: true
      DeploymentConfiguration:
        MaximumPercent: 200
        MinimumHealthyPercent: 75
        DeploymentCircuitBreaker:
          Enable: true
          Rollback: true
      DesiredCount: !Ref ContainerDesiredCount
      NetworkConfiguration:
        AwsvpcConfiguration:
          SecurityGroups:
            - !Ref ClusterSecurityGroupId
          Subnets: !Ref VpcSubnets
          AssignPublicIp: ENABLED   # Enabled because this runs in public subnet
      TaskDefinition: !Ref TaskDefinition
      LoadBalancers:
        - ContainerName: !Ref Component
          ContainerPort: !Ref ContainerPort
          TargetGroupArn: !Ref AlbTargetGroup
      HealthCheckGracePeriodSeconds: 60

  AlbTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckIntervalSeconds: 5
      HealthCheckPath: /
      HealthCheckProtocol: HTTP
      HealthCheckTimeoutSeconds: 4
      HealthyThresholdCount: 2
      TargetType: ip
      Port: !Ref ContainerPort
      Protocol: HTTP
      UnhealthyThresholdCount: 2
      VpcId: !Ref VpcId

  AlbListenerRule:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      Actions:
        - TargetGroupArn: !Ref AlbTargetGroup
          Type: forward
      Conditions:
        - Field: path-pattern
          Values:
            - !Ref AlbRulePath
      ListenerArn: !Ref ClusterAlbListenerArn
      Priority: !Ref AlbRulePriority

  TaskIamRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies: []