cloudformation-template-with-existing-vpc.yaml

cloudformation-template-with-existing-vpc.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: AWS ECS Infrastructure setup using an existing VPC

Parameters:
    VpcId:
        Description: "The ID of the existing VPC"
        Type: AWS::EC2::VPC::Id

    PublicSubnet1Id:
        Description: "The ID of the existing public subnet 1"
        Type: AWS::EC2::Subnet::Id

    PublicSubnet2Id:
        Description: "The ID of the existing public subnet 2"
        Type: AWS::EC2::Subnet::Id

    ECRRepositoryName:
        Description: The name of the ECR repository
        Type: String
        Default: "application-repository"

    ClusterName:
        Description: The name of the ECS Fargate Cluster
        Type: String
        Default: "EcsFargateCluster"

    ServiceName:
        Description: The name of the ECS Service
        Type: String
        Default: "EcsService"

    TaskFamilyName:
        Description: The family name of the ECS Task Definition
        Type: String
        Default: "TaskDefinition"

    ContainerName:
        Description: The name of the container in the ECS Task Definition
        Type: String
        Default: "application-container"

Resources:
    # Security Group
    SecurityGroup:
        Type: AWS::EC2::SecurityGroup
        Properties:
            GroupDescription: "Default security group for the VPC"
            VpcId: !Ref VpcId
            SecurityGroupIngress:
                - IpProtocol: tcp
                  FromPort: 80
                  ToPort: 80
                  CidrIp: 0.0.0.0/0
                - IpProtocol: tcp
                  FromPort: 443
                  ToPort: 443
                  CidrIp: 0.0.0.0/0
                - IpProtocol: tcp
                  FromPort: 22
                  ToPort: 22
                  CidrIp: 0.0.0.0/0
            SecurityGroupEgress:
                - IpProtocol: "-1"
                  CidrIp: 0.0.0.0/0
            Tags:
                - Key: Name
                  Value: default-sg

    # ECS Fargate Cluster
    ECSFargateCluster:
        Type: AWS::ECS::Cluster
        Properties:
            ClusterName: !Ref ClusterName

    # ECR Repository
    ECRRepository:
        Type: AWS::ECR::Repository
        Properties:
            RepositoryName: !Ref ECRRepositoryName

    # Custom Resource Hook for ECR Cleanup
    ECRCleanupHook:
        Type: "Custom::ECRCleanup"
        Properties:
            ServiceToken: !GetAtt ECRCleanupLambdaFunction.Arn
            RepositoryName: !Ref ECRRepositoryName
        DependsOn: ECRRepository

    # ECS Task Definition
    ECSTaskDefinition:
        Type: AWS::ECS::TaskDefinition
        Properties:
            Family: !Ref TaskFamilyName
            NetworkMode: awsvpc
            RequiresCompatibilities:
                - FARGATE
            Cpu: "512"
            Memory: "1024"
            ExecutionRoleArn: !Ref IAMRoleForECS
            TaskRoleArn: !Ref IAMRoleForECS
            ContainerDefinitions:
                - Name: !Ref ContainerName
                  Image: "nginx:latest"
                  PortMappings:
                      - ContainerPort: 80
                  Environment:
                      - Name: ENVIRONMENT
                        Value: "production"
                  LogConfiguration:
                      LogDriver: awslogs
                      Options:
                          awslogs-group: !Ref CloudWatchLogGroup
                          awslogs-region: !Ref "AWS::Region"
                          awslogs-stream-prefix: ecs

    # ECS Service
    ECSService:
        Type: AWS::ECS::Service
        DependsOn: ALB
        Properties:
            Cluster: !Ref ECSFargateCluster
            ServiceName: !Ref ServiceName
            DesiredCount: 2
            LaunchType: FARGATE
            TaskDefinition: !Ref ECSTaskDefinition
            NetworkConfiguration:
                AwsvpcConfiguration:
                    AssignPublicIp: ENABLED
                    SecurityGroups:
                        - !Ref SecurityGroup
                    Subnets:
                        - !Ref PublicSubnet1Id
                        - !Ref PublicSubnet2Id
            LoadBalancers:
                - ContainerName: !Ref ContainerName
                  ContainerPort: 80
                  TargetGroupArn: !Ref ALBTargetGroup

    # ALB
    ALB:
        Type: AWS::ElasticLoadBalancingV2::LoadBalancer
        Properties:
            Name: "ALB"
            Subnets:
                - !Ref PublicSubnet1Id
                - !Ref PublicSubnet2Id
            SecurityGroups:
                - !Ref SecurityGroup
            LoadBalancerAttributes:
                - Key: idle_timeout.timeout_seconds
                  Value: "60"

    ALBListener:
        Type: AWS::ElasticLoadBalancingV2::Listener
        Properties:
            LoadBalancerArn: !Ref ALB
            Port: 80
            Protocol: HTTP
            DefaultActions:
                - Type: forward
                  TargetGroupArn: !Ref ALBTargetGroup

    ALBTargetGroup:
        Type: AWS::ElasticLoadBalancingV2::TargetGroup
        Properties:
            VpcId: !Ref VpcId
            Protocol: HTTP
            Port: 80
            TargetType: ip
            HealthCheckEnabled: true
            HealthCheckPath: "/" # Set to a valid endpoint in your application
            HealthCheckIntervalSeconds: 30
            HealthCheckTimeoutSeconds: 5
            HealthyThresholdCount: 2
            UnhealthyThresholdCount: 3
            Matcher:
                HttpCode: "200"
            Name: "TargetGroup"

    # IAM Role for ECS Task
    IAMRoleForECS:
        Type: AWS::IAM::Role
        Properties:
            AssumeRolePolicyDocument:
                Version: "2012-10-17"
                Statement:
                    - Effect: Allow
                      Principal:
                          Service:
                              - ecs-tasks.amazonaws.com
                      Action:
                          - sts:AssumeRole
            Policies:
                - PolicyName: "ECRPullPolicy"
                  PolicyDocument:
                      Version: "2012-10-17"
                      Statement:
                          - Effect: Allow
                            Action:
                                - ecr:GetAuthorizationToken
                                - ecr:GetDownloadUrlForLayer
                                - ecr:BatchGetImage
                                - ecr:BatchCheckLayerAvailability
                            Resource: "*"
                - PolicyName: "CloudWatchLogsPolicy"
                  PolicyDocument:
                      Version: "2012-10-17"
                      Statement:
                          - Effect: Allow
                            Action:
                                - logs:CreateLogStream
                                - logs:PutLogEvents
                                - logs:CreateLogGroup
                            Resource: "*"

    # CloudWatch Log Group
    CloudWatchLogGroup:
        Type: AWS::Logs::LogGroup
        Properties:
            LogGroupName: "/ecs/logs"
            RetentionInDays: 7

    # Lambda Function to Delete ECR Images
    ECRCleanupLambdaRole:
        Type: AWS::IAM::Role
        Properties:
            AssumeRolePolicyDocument:
                Version: "2012-10-17"
                Statement:
                    - Effect: Allow
                      Principal:
                          Service: lambda.amazonaws.com
                      Action: sts:AssumeRole
            Policies:
                - PolicyName: ECRDeletePolicy
                  PolicyDocument:
                      Version: "2012-10-17"
                      Statement:
                          - Effect: Allow
                            Action:
                                - ecr:BatchDeleteImage
                                - ecr:ListImages
                            Resource: !Sub "arn:aws:ecr:${AWS::Region}:${AWS::AccountId}:repository/${ECRRepositoryName}"

    ECRCleanupLambdaFunction:
        Type: AWS::Lambda::Function
        Properties:
            FunctionName: ecr-cleanup-lambda
            Handler: index.handler
            Runtime: python3.9
            Role: !GetAtt ECRCleanupLambdaRole.Arn
            Code:
                ZipFile: |
                    import boto3
                    def handler(event, context):
                        if event['RequestType'] == 'Delete':
                            ecr = boto3.client('ecr')
                            images_to_delete = ecr.list_images(repositoryName=event['repository_name'])['imageIds']
                            if images_to_delete:
                                ecr.batch_delete_image(
                                    repositoryName=event['repository_name'],
                                    imageIds=images_to_delete
                                )
                        return 'Cleanup complete'

Outputs:
    VpcId:
        Value: !Ref VPC
        Description: The VPC Id where the ECS Cluster is deployed.
    ECSFargateCluster:
        Value: !Ref ECSFargateCluster
        Description: The ECS Fargate Cluster created by the template.
    ALBEndpoint:
        Value: !Sub "http://${ALB.DNSName}"
        Description: The HTTP endpoint of the Application Load Balancer.