cloudformation.yml

AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  VPCStack:
    Type: String
    Description: VPC Stack Name
  ECSStack:
    Type: String
    Description: ECS Stack Name
  ECRStack:
    Type: String
    Description: ECR Stack Name
  DesiredCount:
    Type: Number
    Default: '2'
    Description: Desired task count
  Path:
    Type: String
    Default: '/service'
    Description: Service path
  Version:
    Type: String
    Default: 'latest'
    Description: Service version
  GitHubOwner:
    Type: String
    Description: GitHub repository owner
    Default: ''
  GitHubRepo:
    Type: String
    Default: aws-codepipeline-nested-stack
    Description: GitHub repository name
    Default: ''
  GitHubToken:
    Type: String
    Description: GitHub repository OAuth token
    Default: ''
  GitHubBranch:
    Type: String
    Description: GitHub repository branch
    Default: ''
  NotificationEmail:
    Type: String
    Description: Build notification email endpoint
    Default: ''
  NotificationSMS:
    Type: String
    Description: Build notification sns endpoint
    Default: ''

Conditions:
  NeedsCICD: !And
    - !Not [!Equals [!Ref GitHubOwner, '']]
    - !Not [!Equals [!Ref GitHubRepo, '']]
    - !Not [!Equals [!Ref GitHubToken, '']]
    - !Not [!Equals [!Ref GitHubBranch, '']]
  NeedsBuildNotification: !Or
    - !Not [!Equals [!Ref NotificationEmail, '']]
    - !Not [!Equals [!Ref NotificationSMS, '']]
  NeedsBuildNotificationEmail:  !Not [!Equals [!Ref NotificationEmail, '']]
  NeedsBuildNotificationSMS:  !Not [!Equals [!Ref NotificationSMS, '']]

Resources:

  CloudWatchLogsGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Ref AWS::StackName
      RetentionInDays: 365

  # This IAM Role grants the service access to register/unregister with the
  # Application Load Balancer (ALB). It is based on the default documented here:
  # http://docs.aws.amazon.com/AmazonECS/latest/developerguide/service_IAM_role.html
  ServiceRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ecs-service-${AWS::StackName}
      Path: /
      AssumeRolePolicyDocument: |
          {
              "Statement": [{
                  "Effect": "Allow",
                  "Principal": { "Service": [ "ecs.amazonaws.com" ]},
                  "Action": [ "sts:AssumeRole" ]
              }]
          }
      Policies:
        - PolicyName: !Sub ecs-service-${AWS::StackName}
          PolicyDocument:
            {
                "Version": "2012-10-17",
                "Statement": [{
                        "Effect": "Allow",
                        "Action": [
                            "ec2:AuthorizeSecurityGroupIngress",
                            "ec2:Describe*",
                            "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
                            "elasticloadbalancing:Describe*",
                            "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
                            "elasticloadbalancing:DeregisterTargets",
                            "elasticloadbalancing:DescribeTargetGroups",
                            "elasticloadbalancing:DescribeTargetHealth",
                            "elasticloadbalancing:RegisterTargets"
                        ],
                        "Resource": "*"
                }]
            }

  TaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: !Ref AWS::StackName
      ContainerDefinitions:
        - Name: !Ref AWS::StackName
          Essential: true
          Image: !Sub
            - "${URL}:${Version}"
            - {
                URL: { "Fn::ImportValue" : {"Fn::Sub": "${ECRStack}-Service1RepositoryUrl" } },
                Version: { "Ref": "Version" }
              }
          Memory: 128
          PortMappings:
            - ContainerPort: 8000
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: !Ref AWS::StackName
              awslogs-region: !Ref AWS::Region

  TargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      VpcId:
        Fn::ImportValue:
          !Sub "${VPCStack}-VPCID"
      Port: 80
      Protocol: HTTP
      Matcher:
        HttpCode: 200-299
      HealthCheckIntervalSeconds: 10
      HealthCheckPath: '/'
      HealthCheckProtocol: HTTP
      HealthCheckTimeoutSeconds: 5
      HealthyThresholdCount: 2

  ListenerRule:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      ListenerArn:
        Fn::ImportValue:
          !Sub "${ECSStack}-LoadBalancerListener"
      Priority: 2
      Conditions:
        - Field: path-pattern
          Values:
            - !Ref Path
      Actions:
        - TargetGroupArn: !Ref TargetGroup
          Type: forward

  Service:
    Type: AWS::ECS::Service
    Properties:
      Cluster:
        Fn::ImportValue:
          !Sub "${ECSStack}-ECSCluster"
      Role: !Ref ServiceRole
      DesiredCount: !Ref DesiredCount
      TaskDefinition: !Ref TaskDefinition
      DeploymentConfiguration:
        MinimumHealthyPercent: 50
      LoadBalancers:
        - ContainerName: !Ref AWS::StackName
          ContainerPort: 8000
          TargetGroupArn: !Ref TargetGroup

  #
  # CI/CD
  #
  ArtifactsBucket:
    Type: AWS::S3::Bucket
    Condition: NeedsCICD
    Properties:
      AccessControl: Private

  #
  # CodeBuild Permissions
  #
  CodeBuildRole:
    Type: AWS::IAM::Role
    Condition: NeedsCICD
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - sts:AssumeRole
            Principal:
              Service:
                - codebuild.amazonaws.com

  CodeBuildRolePolicy:
    Type: AWS::IAM::Policy
    Condition: NeedsCICD
    Properties:
      PolicyName: CodeBuildRolePolicy
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - logs:CreateLogGroup
              - logs:CreateLogStream
              - logs:PutLogEvents
            Resource: '*'
          - Effect: Allow
            Action:
              - s3:*
            Resource:
              - !Sub 'arn:aws:s3:::${ArtifactsBucket}'
              - !Sub 'arn:aws:s3:::${ArtifactsBucket}/*'
          - Effect: Allow
            Action:
              - ecr:GetAuthorizationToken
            Resource: '*'
          - Effect: Allow
            Action:
              - ecr:GetDownloadUrlForLayer
              - ecr:BatchGetImage
              - ecr:BatchCheckLayerAvailability
              - ecr:PutImage
              - ecr:InitiateLayerUpload
              - ecr:UploadLayerPart
              - ecr:CompleteLayerUpload
            Resource: !Sub
              - "arn:aws:ecr:${Region}:${AccountId}:repository/${Repository}"
              - {
                  Region: { "Ref": "AWS::Region" },
                  AccountId: { "Ref": "AWS::AccountId" },
                  Repository: { "Fn::ImportValue" : {"Fn::Sub": "${ECRStack}-Service1Repository" } }
                }
          - Effect: Allow
            Action:
              - sns:Publish
            Resource: !Sub 'arn:aws:sns:${AWS::Region}:${AWS::AccountId}:*'
      Roles:
        - !Ref CodeBuildRole

  #
  # CodeBuild
  #
  CodeBuildProject:
    Type: AWS::CodeBuild::Project
    Condition: NeedsCICD
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/docker:1.12.1
        Type: LINUX_CONTAINER
        EnvironmentVariables:
          - Name: AWS_DEFAULT_REGION
            Value: !Ref AWS::Region
          - Name: REPOSITORY_URI
            Value: { "Fn::ImportValue" : {"Fn::Sub": "${ECRStack}-Service1RepositoryUrl" } }
          - Name: APP
            Value: !Ref AWS::StackName
          - Name: SNS_TOPIC_ARN
            Value: !If [NeedsBuildNotification, !Ref "BuildTopic", '']
      Name:
        Fn::Join:
          - ''
          - - Ref: AWS::StackName
            - '-code-build'
      ServiceRole: !GetAtt CodeBuildRole.Arn
      Source:
        Type: CODEPIPELINE
        BuildSpec: buildspec.yml
      TimeoutInMinutes: 5 # must be between 5 minutes and 8 hours

  #
  # CodePipeline Permissions
  #
  CodePipelineRole:
    Type: AWS::IAM::Role
    Condition: NeedsCICD
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - sts:AssumeRole
            Principal:
              Service:
                - codepipeline.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AdministratorAccess

  #
  # CodePipeline
  #
  CodePipeline:
    Type: AWS::CodePipeline::Pipeline
    Condition: NeedsCICD
    Properties:
      ArtifactStore:
        Type: S3
        Location: !Ref ArtifactsBucket
      RoleArn: !GetAtt CodePipelineRole.Arn
      Stages:
      - Name: Source
        Actions:
        - Name: Source
          ActionTypeId:
            Category: Source
            Owner: ThirdParty
            Version: 1
            Provider: GitHub
          Configuration:
            Owner: !Ref GitHubOwner
            Repo: !Ref GitHubRepo
            Branch: !Ref GitHubBranch
            OAuthToken: !Ref GitHubToken
          OutputArtifacts:
            - Name: SourceOutput
          RunOrder: 1
      - Name: Build
        Actions:
          - Name: BuildPushImage
            ActionTypeId:
              Category: Build
              Owner: AWS
              Provider: CodeBuild
              Version: 1
            Configuration:
              ProjectName: !Ref CodeBuildProject
            InputArtifacts:
              - Name: SourceOutput
            OutputArtifacts:
              - Name: BuildOutput

  #
  # Build Notification
  #
  BuildTopic:
    Type: AWS::SNS::Topic
    Condition: NeedsBuildNotification
    Properties:
      TopicName: !Sub "${AWS::StackName}-build-notifications"

  EmailSubscription:
    Type: AWS::SNS::Subscription
    Condition: NeedsBuildNotificationEmail
    Properties:
      Endpoint: !Ref NotificationEmail
      Protocol: email
      TopicArn: !Ref BuildTopic

  SMSSubscription:
    Type: AWS::SNS::Subscription
    Condition: NeedsBuildNotificationSMS
    Properties:
      Endpoint: !Ref NotificationSMS
      Protocol: sms
      TopicArn: !Ref BuildTopic

Outputs:
  Service:
    Value: !Ref 'Service'
    Export:
      Name: !Sub '${AWS::StackName}-Service'
  TaskDefinition:
    Value: !Ref 'TaskDefinition'
    Export:
      Name: !Sub '${AWS::StackName}-TaskDefinition'
  CloudWatchLogsGroup:
    Value: !Ref 'CloudWatchLogsGroup'
    Export:
      Name: !Sub '${AWS::StackName}-CloudWatchLogsGroup'