-
-
Save byteshiva/06d1519d68a66b72796c01e3b1715c57 to your computer and use it in GitHub Desktop.
cloudformation template lab 3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| { | |
| "AWSTemplateFormatVersion": "2010-09-09", | |
| "Description": "AWS CloudFormation template to create the needed AWS resources for Labs 3 & 4 of the ECS Microservices Bootcamp for re:Invent 2015", | |
| "Mappings": { | |
| "AWSRegionToAMI": { | |
| "eu-west-1": { | |
| "AMI": "ami-a10897d6" | |
| }, | |
| "us-east-1": { | |
| "AMI": "ami-1ecae776" | |
| }, | |
| "us-west-2": { | |
| "AMI": "ami-e7527ed7" | |
| } | |
| }, | |
| "EcsNodeAmiMap": { | |
| "eu-west-1": { | |
| "AMI": "ami-7948320e" | |
| }, | |
| "us-east-1": { | |
| "AMI": "ami-8da458e6" | |
| }, | |
| "us-west-2": { | |
| "AMI": "ami-db0306eb" | |
| } | |
| } | |
| }, | |
| "Parameters": { | |
| "AdminServerInstanceType": { | |
| "Type": "String", | |
| "Description": "Admin server instance type", | |
| "Default": "t2.medium", | |
| "AllowedValues": ["t2.micro", "t2.small", "t2.medium", "t2.large"], | |
| "ConstraintDescription": "must be a valid T2 EC2 instance type." | |
| }, | |
| "AdministratorPassword": { | |
| "Type": "String", | |
| "NoEcho": "TRUE" | |
| }, | |
| "EcsInstanceType": { | |
| "Type": "String", | |
| "Description": "ECS instance type", | |
| "Default": "t2.small", | |
| "AllowedValues": ["t2.micro", "t2.small", "t2.medium", "t2.large"], | |
| "ConstraintDescription": "must be a valid T2 EC2 instance type." | |
| }, | |
| "CLIInstanceType": { | |
| "Type": "String", | |
| "Description": "CLI instance type", | |
| "Default": "t2.small", | |
| "AllowedValues": ["t2.micro", "t2.small", "t2.medium", "t2.large"], | |
| "ConstraintDescription": "must be a valid T2 EC2 instance type." | |
| }, | |
| "KeyName": { | |
| "Type": "AWS::EC2::KeyPair::KeyName", | |
| "Description": "Name of an existing EC2 KeyPair to enable SSH access to the EC2 instances" | |
| }, | |
| "SourceCidr": { | |
| "Type": "String", | |
| "Description": "Optional - CIDR/IP range for ECS instance outside access - defaults to 0.0.0.0/0", | |
| "Default": "0.0.0.0/0" | |
| } | |
| }, | |
| "Resources": { | |
| "AdminCluster": { | |
| "Type": "AWS::ECS::Cluster" | |
| }, | |
| "BetaCluster": { | |
| "Type": "AWS::ECS::Cluster" | |
| }, | |
| "Lab3CodeRepo" : { | |
| "Type" : "AWS::S3::Bucket", | |
| "Properties": { | |
| "VersioningConfiguration": { | |
| "Status" : "Enabled" | |
| } | |
| } | |
| }, | |
| "VPC": { | |
| "Type": "AWS::EC2::VPC", | |
| "Properties": { | |
| "CidrBlock": "10.5.0.0/16", | |
| "EnableDnsSupport": "true", | |
| "EnableDnsHostnames": "true", | |
| "Tags": [ | |
| { | |
| "Key": "Name", | |
| "Value": "EcsBootcampVPC" | |
| } | |
| ] | |
| } | |
| }, | |
| "InternetGateway": { | |
| "Type": "AWS::EC2::InternetGateway", | |
| "DependsOn": "VPC" | |
| }, | |
| "AttachGateway": { | |
| "Type": "AWS::EC2::VPCGatewayAttachment", | |
| "DependsOn": [ | |
| "VPC", | |
| "InternetGateway" | |
| ], | |
| "Properties": { | |
| "VpcId": { | |
| "Ref": "VPC" | |
| }, | |
| "InternetGatewayId": { | |
| "Ref": "InternetGateway" | |
| } | |
| } | |
| }, | |
| "PublicSubnet": { | |
| "Type": "AWS::EC2::Subnet", | |
| "DependsOn": "AttachGateway", | |
| "Properties": { | |
| "VpcId": { | |
| "Ref": "VPC" | |
| }, | |
| "CidrBlock": "10.5.0.0/24", | |
| "AvailabilityZone": { | |
| "Fn::Select": [ "0", { "Fn::GetAZs": "" } ] | |
| }, | |
| "Tags": [ | |
| { | |
| "Key": "Name", | |
| "Value": "Public Subnet" | |
| } | |
| ] | |
| } | |
| }, | |
| "PublicRouteTable": { | |
| "Type": "AWS::EC2::RouteTable", | |
| "DependsOn": [ | |
| "VPC", | |
| "AttachGateway" | |
| ], | |
| "Properties": { | |
| "VpcId": { | |
| "Ref": "VPC" | |
| }, | |
| "Tags": [ | |
| { | |
| "Key": "Name", | |
| "Value": "Public" | |
| } | |
| ] | |
| } | |
| }, | |
| "PublicRoute": { | |
| "Type": "AWS::EC2::Route", | |
| "DependsOn": [ | |
| "PublicRouteTable", | |
| "AttachGateway" | |
| ], | |
| "Properties": { | |
| "RouteTableId": { | |
| "Ref": "PublicRouteTable" | |
| }, | |
| "DestinationCidrBlock": "0.0.0.0/0", | |
| "GatewayId": { | |
| "Ref": "InternetGateway" | |
| } | |
| } | |
| }, | |
| "PublicSubnetRouteTableAssociation": { | |
| "Type": "AWS::EC2::SubnetRouteTableAssociation", | |
| "DependsOn": [ | |
| "PublicRouteTable", | |
| "PublicSubnet", | |
| "AttachGateway" | |
| ], | |
| "Properties": { | |
| "SubnetId": { | |
| "Ref": "PublicSubnet" | |
| }, | |
| "RouteTableId": { | |
| "Ref": "PublicRouteTable" | |
| } | |
| } | |
| }, | |
| "ConsulAgentSecurityGroup": { | |
| "Type": "AWS::EC2::SecurityGroup", | |
| "Properties": { | |
| "GroupDescription": "Consul Agent Security Group", | |
| "VpcId": { | |
| "Ref": "VPC" | |
| }, | |
| "Tags": [{ | |
| "Key": "Name", | |
| "Value": "ConsulAgentSG" | |
| }] | |
| } | |
| }, | |
| "RootRole": { | |
| "Type": "AWS::IAM::Role", | |
| "Properties": { | |
| "AssumeRolePolicyDocument": { | |
| "Version": "2012-10-17", | |
| "Statement": [ | |
| { | |
| "Effect": "Allow", | |
| "Principal": {"Service": ["ec2.amazonaws.com"] }, | |
| "Action": ["sts:AssumeRole"] | |
| } | |
| ] | |
| }, | |
| "Path": "/", | |
| "Policies": [ | |
| { | |
| "PolicyName": "root", | |
| "PolicyDocument": { | |
| "Version": "2012-10-17", | |
| "Statement": [ | |
| { | |
| "Effect": "Allow", | |
| "Action": "*", | |
| "Resource": "*" | |
| } | |
| ] | |
| } | |
| } | |
| ] | |
| } | |
| }, | |
| "RootInstanceProfile": { | |
| "Type": "AWS::IAM::InstanceProfile", | |
| "Properties": { | |
| "Path": "/", | |
| "Roles": [{"Ref": "RootRole"} ] | |
| } | |
| }, | |
| "ConsulServerSecurityGroup": { | |
| "Type": "AWS::EC2::SecurityGroup", | |
| "Properties": { | |
| "GroupDescription": "Consul Server Security Group", | |
| "VpcId": { | |
| "Ref": "VPC" | |
| }, | |
| "SecurityGroupIngress": | |
| [ | |
| { | |
| "IpProtocol": "tcp", | |
| "FromPort": "8300", | |
| "ToPort": "8300", | |
| "SourceSecurityGroupId": { | |
| "Ref": "ConsulAgentSecurityGroup" | |
| } | |
| }, | |
| { | |
| "IpProtocol": "tcp", | |
| "FromPort": "8500", | |
| "ToPort": "8500", | |
| "CidrIp": "0.0.0.0/0" | |
| } | |
| ], | |
| "Tags": [{ | |
| "Key": "Name", | |
| "Value": "ConsulServerSG" | |
| }] | |
| } | |
| }, | |
| "ConsulAgentSecurityGroupIngressTcpEphemeral": { | |
| "DependsOn": ["ConsulAgentSecurityGroup"], | |
| "Type": "AWS::EC2::SecurityGroupIngress", | |
| "Properties": { | |
| "GroupId": { | |
| "Ref": "ConsulAgentSecurityGroup" | |
| }, | |
| "IpProtocol": "tcp", | |
| "FromPort": "32768", | |
| "ToPort": "65535", | |
| "SourceSecurityGroupId": { | |
| "Ref": "ConsulAgentSecurityGroup" | |
| } | |
| } | |
| }, | |
| "ConsulAgentSecurityGroupIngressUdpEphemeral": { | |
| "DependsOn": ["ConsulAgentSecurityGroup"], | |
| "Type": "AWS::EC2::SecurityGroupIngress", | |
| "Properties": { | |
| "GroupId": { | |
| "Ref": "ConsulAgentSecurityGroup" | |
| }, | |
| "IpProtocol": "udp", | |
| "FromPort": "32768", | |
| "ToPort": "65535", | |
| "SourceSecurityGroupId": { | |
| "Ref": "ConsulAgentSecurityGroup" | |
| } | |
| } | |
| }, | |
| "ConsulAgentSecurityGroupIngressDnsUdp": { | |
| "DependsOn": ["ConsulAgentSecurityGroup"], | |
| "Type": "AWS::EC2::SecurityGroupIngress", | |
| "Properties": { | |
| "GroupId": { | |
| "Ref": "ConsulAgentSecurityGroup" | |
| }, | |
| "IpProtocol": "udp", | |
| "FromPort": "8600", | |
| "ToPort": "8600", | |
| "SourceSecurityGroupId": { | |
| "Ref": "ConsulAgentSecurityGroup" | |
| } | |
| } | |
| }, | |
| "ConsulAgentSecurityGroupIngressDnsTcp": { | |
| "DependsOn": ["ConsulAgentSecurityGroup"], | |
| "Type": "AWS::EC2::SecurityGroupIngress", | |
| "Properties": { | |
| "GroupId": { | |
| "Ref": "ConsulAgentSecurityGroup" | |
| }, | |
| "IpProtocol": "tcp", | |
| "FromPort": "8600", | |
| "ToPort": "8600", | |
| "SourceSecurityGroupId": { | |
| "Ref": "ConsulAgentSecurityGroup" | |
| } | |
| } | |
| }, | |
| "ConsulAgentSecurityGroupIngressHttp": { | |
| "DependsOn": ["ConsulAgentSecurityGroup"], | |
| "Type": "AWS::EC2::SecurityGroupIngress", | |
| "Properties": { | |
| "GroupId": { | |
| "Ref": "ConsulAgentSecurityGroup" | |
| }, | |
| "IpProtocol": "tcp", | |
| "FromPort": "8500", | |
| "ToPort": "8500", | |
| "SourceSecurityGroupId": { | |
| "Ref": "ConsulAgentSecurityGroup" | |
| } | |
| } | |
| }, | |
| "ConsulAgentSecurityGroupIngressCli": { | |
| "DependsOn": ["ConsulAgentSecurityGroup"], | |
| "Type": "AWS::EC2::SecurityGroupIngress", | |
| "Properties": { | |
| "GroupId": { | |
| "Ref": "ConsulAgentSecurityGroup" | |
| }, | |
| "IpProtocol": "tcp", | |
| "FromPort": "8400", | |
| "ToPort": "8400", | |
| "SourceSecurityGroupId": { | |
| "Ref": "ConsulAgentSecurityGroup" | |
| } | |
| } | |
| }, | |
| "ConsulAgentSecurityGroupIngressSerfLanUdp": { | |
| "DependsOn": ["ConsulAgentSecurityGroup"], | |
| "Type": "AWS::EC2::SecurityGroupIngress", | |
| "Properties": { | |
| "GroupId": { | |
| "Ref": "ConsulAgentSecurityGroup" | |
| }, | |
| "IpProtocol": "udp", | |
| "FromPort": "8301", | |
| "ToPort": "8301", | |
| "SourceSecurityGroupId": { | |
| "Ref": "ConsulAgentSecurityGroup" | |
| } | |
| } | |
| }, | |
| "ConsulAgentSecurityGroupIngressSerfLanTcp": { | |
| "DependsOn": ["ConsulAgentSecurityGroup"], | |
| "Type": "AWS::EC2::SecurityGroupIngress", | |
| "Properties": { | |
| "GroupId": { | |
| "Ref": "ConsulAgentSecurityGroup" | |
| }, | |
| "IpProtocol": "tcp", | |
| "FromPort": "8301", | |
| "ToPort": "8301", | |
| "SourceSecurityGroupId": { | |
| "Ref": "ConsulAgentSecurityGroup" | |
| } | |
| } | |
| }, | |
| "ConsulServerSecurityGroupIngressSerfWanTcp": { | |
| "DependsOn": ["ConsulServerSecurityGroup"], | |
| "Type": "AWS::EC2::SecurityGroupIngress", | |
| "Properties": { | |
| "GroupId": { | |
| "Ref": "ConsulServerSecurityGroup" | |
| }, | |
| "IpProtocol": "tcp", | |
| "FromPort": "8302", | |
| "ToPort": "8302", | |
| "SourceSecurityGroupId": { | |
| "Ref": "ConsulServerSecurityGroup" | |
| } | |
| } | |
| }, | |
| "ConsulServerSecurityGroupIngressSerfWanUdp": { | |
| "DependsOn": ["ConsulServerSecurityGroup"], | |
| "Type": "AWS::EC2::SecurityGroupIngress", | |
| "Properties": { | |
| "GroupId": { | |
| "Ref": "ConsulServerSecurityGroup" | |
| }, | |
| "IpProtocol": "udp", | |
| "FromPort": "8302", | |
| "ToPort": "8302", | |
| "SourceSecurityGroupId": { | |
| "Ref": "ConsulServerSecurityGroup" | |
| } | |
| } | |
| }, | |
| "CommonSecurityGroup": { | |
| "Type": "AWS::EC2::SecurityGroup", | |
| "Properties": { | |
| "GroupDescription": "Common Security Group for ECS Instances", | |
| "VpcId": { | |
| "Ref": "VPC" | |
| }, | |
| "SecurityGroupIngress": [ | |
| { | |
| "IpProtocol": "tcp", | |
| "FromPort": "22", | |
| "ToPort": "22", | |
| "CidrIp": { | |
| "Ref": "SourceCidr" | |
| } | |
| }, | |
| { | |
| "IpProtocol": "tcp", | |
| "FromPort": "80", | |
| "ToPort": "80", | |
| "CidrIp": "0.0.0.0/0" | |
| }, | |
| { | |
| "IpProtocol": "tcp", | |
| "FromPort": "443", | |
| "ToPort": "443", | |
| "CidrIp": "0.0.0.0/0" | |
| }, | |
| { | |
| "IpProtocol": "tcp", | |
| "FromPort": "1", | |
| "ToPort": "65535", | |
| "SourceSecurityGroupId": { | |
| "Ref": "TestSecurityGroup" | |
| } | |
| }, | |
| { | |
| "IpProtocol": "udp", | |
| "FromPort": "53", | |
| "ToPort": "53", | |
| "SourceSecurityGroupId": { | |
| "Ref": "TestSecurityGroup" | |
| } | |
| } | |
| ]} | |
| }, | |
| "TestSecurityGroup": { | |
| "Type": "AWS::EC2::SecurityGroup", | |
| "Properties": { | |
| "GroupDescription": "Security Group for testing ECS Instances", | |
| "VpcId": { | |
| "Ref": "VPC" | |
| } | |
| } | |
| }, | |
| "CLISecurityGroup": { | |
| "Type": "AWS::EC2::SecurityGroup", | |
| "Properties": { | |
| "GroupDescription": "CLI Security Group", | |
| "VpcId": { | |
| "Ref": "VPC" | |
| }, | |
| "SecurityGroupIngress": [ | |
| { | |
| "IpProtocol": "tcp", | |
| "FromPort": "22", | |
| "ToPort": "22", | |
| "CidrIp": { | |
| "Ref": "SourceCidr" | |
| } | |
| }] | |
| } | |
| }, | |
| "ElbSecurityGroup": { | |
| "Type": "AWS::EC2::SecurityGroup", | |
| "Properties": { | |
| "GroupDescription": "ECS Service ELB Security Group", | |
| "VpcId": { | |
| "Ref": "VPC" | |
| }, | |
| "SecurityGroupIngress" : [ { | |
| "IpProtocol" : "tcp", | |
| "FromPort" : "80", | |
| "ToPort" : "80", | |
| "CidrIp" : "0.0.0.0/0" | |
| } ], | |
| "Tags": [{ | |
| "Key": "Name", | |
| "Value": "EcsServiceElbSG" | |
| }] | |
| } | |
| }, | |
| "AdminServerRole": { | |
| "Type": "AWS::IAM::Role", | |
| "Properties": { | |
| "AssumeRolePolicyDocument": { | |
| "Version": "2012-10-17", | |
| "Statement": [{ | |
| "Effect": "Allow", | |
| "Principal": { | |
| "Service": [ | |
| "ec2.amazonaws.com" | |
| ] | |
| }, | |
| "Action": [ | |
| "sts:AssumeRole" | |
| ] | |
| }] | |
| }, | |
| "Path": "/", | |
| "Policies": [{ | |
| "PolicyName": "root", | |
| "PolicyDocument": { | |
| "Version": "2012-10-17", | |
| "Statement": [ | |
| { | |
| "Effect": "Allow", | |
| "Action": "ecs:*", | |
| "Resource": "*" | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": "codepipeline:*", | |
| "Resource": "*" | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": "cloudformation:Describe*", | |
| "Resource": "*" | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": "ec2:Describe*", | |
| "Resource": "*" | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": "elasticloadbalancing:*", | |
| "Resource": "*" | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": "codedeploy:*", | |
| "Resource": "*" | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": "iam:PassRole", | |
| "Resource": "*" | |
| }, | |
| { | |
| "Action": [ | |
| "s3:GetObject", | |
| "s3:GetObjectVersion", | |
| "s3:ListObjects" | |
| ], | |
| "Effect": "Allow", | |
| "Resource": "*" | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": ["s3:ListBucket"], | |
| "Resource": { "Fn::Join" : ["", ["arn:aws:s3:::", { "Ref": "Lab3CodeRepo" } ]] } | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": [ | |
| "s3:PutObject", | |
| "s3:GetObject", | |
| "s3:DeleteObject" | |
| ], | |
| "Resource": { "Fn::Join" : ["", ["arn:aws:s3:::", { "Ref": "Lab3CodeRepo" }, "/*" ]] } | |
| } | |
| ] | |
| }}] | |
| } | |
| }, | |
| "AdminServerInstanceProfile": { | |
| "Type": "AWS::IAM::InstanceProfile", | |
| "Properties": { | |
| "Path": "/", | |
| "Roles": [{ | |
| "Ref": "AdminServerRole" | |
| }] | |
| } | |
| }, | |
| "EcsInstanceRole": { | |
| "Type": "AWS::IAM::Role", | |
| "Properties": { | |
| "AssumeRolePolicyDocument": { | |
| "Version": "2012-10-17", | |
| "Statement": [{ | |
| "Effect": "Allow", | |
| "Principal": { | |
| "Service": [ | |
| "ec2.amazonaws.com" | |
| ] | |
| }, | |
| "Action": [ | |
| "sts:AssumeRole" | |
| ] | |
| }] | |
| }, | |
| "Path": "/", | |
| "Policies": [{ | |
| "PolicyName": "root", | |
| "PolicyDocument": { | |
| "Version": "2012-10-17", | |
| "Statement": [{ | |
| "Effect": "Allow", | |
| "Action": "ecs:*", | |
| "Resource": "*" | |
| }, { | |
| "Effect": "Allow", | |
| "Action": "ec2:DescribeInstances", | |
| "Resource": "*" | |
| } | |
| ] | |
| }}] | |
| } | |
| }, | |
| "EcsInstanceProfile": { | |
| "Type": "AWS::IAM::InstanceProfile", | |
| "Properties": { | |
| "Path": "/", | |
| "Roles": [{ | |
| "Ref": "EcsInstanceRole" | |
| }] | |
| } | |
| }, | |
| "CodeDeployRole": { | |
| "Type": "AWS::IAM::Role", | |
| "Properties": { | |
| "AssumeRolePolicyDocument": { | |
| "Version": "2012-10-17", | |
| "Statement": [{ | |
| "Effect": "Allow", | |
| "Principal": { | |
| "Service": [ | |
| "codedeploy.us-east-1.amazonaws.com", | |
| "codedeploy.eu-west-1.amazonaws.com", | |
| "codedeploy.us-west-2.amazonaws.com" | |
| ] | |
| }, | |
| "Action": [ | |
| "sts:AssumeRole" | |
| ] | |
| }] | |
| }, | |
| "Path": "/", | |
| "ManagedPolicyArns": [ | |
| "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRole" | |
| ] | |
| } | |
| }, | |
| "CodePipelinesRole": { | |
| "Type": "AWS::IAM::Role", | |
| "Properties": { | |
| "AssumeRolePolicyDocument": { | |
| "Version": "2012-10-17", | |
| "Statement": [{ | |
| "Effect": "Allow", | |
| "Principal": { | |
| "Service": [ | |
| "codepipeline.amazonaws.com" | |
| ] | |
| }, | |
| "Action": [ | |
| "sts:AssumeRole" | |
| ] | |
| }] | |
| }, | |
| "Path": "/", | |
| "Policies": [ | |
| { | |
| "PolicyName": "root", | |
| "PolicyDocument": { | |
| "Statement": [ | |
| { | |
| "Action": [ | |
| "s3:GetObject", | |
| "s3:GetObjectVersion", | |
| "s3:GetBucketVersioning" | |
| ], | |
| "Resource": "*", | |
| "Effect": "Allow" | |
| }, | |
| { | |
| "Action": [ | |
| "s3:PutObject" | |
| ], | |
| "Resource": [ | |
| "arn:aws:s3:::codepipeline*", | |
| "arn:aws:s3:::elasticbeanstalk*", | |
| { "Fn::Join" : ["", ["arn:aws:s3:::", { "Ref": "Lab3CodeRepo" }, "*" ]] } | |
| ], | |
| "Effect": "Allow" | |
| }, | |
| { | |
| "Action": [ | |
| "codedeploy:CreateDeployment", | |
| "codedeploy:GetApplicationRevision", | |
| "codedeploy:GetDeployment", | |
| "codedeploy:GetDeploymentConfig", | |
| "codedeploy:RegisterApplicationRevision" | |
| ], | |
| "Resource": "*", | |
| "Effect": "Allow" | |
| }, | |
| { | |
| "Action": [ | |
| "elasticbeanstalk:CreateApplicationVersion", | |
| "elasticbeanstalk:DescribeApplicationVersions", | |
| "elasticbeanstalk:DescribeEnvironments", | |
| "elasticbeanstalk:DescribeEvents", | |
| "elasticbeanstalk:UpdateEnvironment", | |
| "autoscaling:DescribeAutoScalingGroups", | |
| "autoscaling:DescribeLaunchConfigurations", | |
| "autoscaling:DescribeScalingActivities", | |
| "autoscaling:ResumeProcesses", | |
| "autoscaling:SuspendProcesses", | |
| "cloudformation:GetTemplate", | |
| "cloudformation:DescribeStackResource", | |
| "cloudformation:DescribeStackResources", | |
| "cloudformation:DescribeStackEvents", | |
| "cloudformation:DescribeStacks", | |
| "cloudformation:UpdateStack", | |
| "ec2:DescribeInstances", | |
| "ec2:DescribeImages", | |
| "ec2:DescribeAddresses", | |
| "ec2:DescribeSubnets", | |
| "ec2:DescribeVpcs", | |
| "ec2:DescribeSecurityGroups", | |
| "ec2:DescribeKeyPairs", | |
| "elasticloadbalancing:DescribeLoadBalancers", | |
| "rds:DescribeDBInstances", | |
| "rds:DescribeOrderableDBInstanceOptions", | |
| "sns:ListSubscriptionsByTopic" | |
| ], | |
| "Resource": "*", | |
| "Effect": "Allow" | |
| }, | |
| { | |
| "Action": [ | |
| "lambda:invokefunction", | |
| "lambda:listfunctions" | |
| ], | |
| "Resource": "*", | |
| "Effect": "Allow" | |
| }, | |
| { | |
| "Action": [ | |
| "s3:ListBucket", | |
| "s3:GetBucketPolicy", | |
| "s3:GetObjectAcl", | |
| "s3:PutObjectAcl", | |
| "s3:DeleteObject" | |
| ], | |
| "Resource": [ "arn:aws:s3:::elasticbeanstalk*", | |
| { "Fn::Join" : ["", ["arn:aws:s3:::", { "Ref": "Lab3CodeRepo" }, "*" ]] } ], | |
| "Effect": "Allow" | |
| } | |
| ], | |
| "Version": "2012-10-17" | |
| } | |
| } | |
| ] | |
| } | |
| }, | |
| "EcsServiceRole": { | |
| "Type": "AWS::IAM::Role", | |
| "Properties": { | |
| "AssumeRolePolicyDocument": { | |
| "Version": "2012-10-17", | |
| "Statement": [{ | |
| "Effect": "Allow", | |
| "Principal": { | |
| "Service": [ | |
| "ecs.amazonaws.com" | |
| ] | |
| }, | |
| "Action": [ | |
| "sts:AssumeRole" | |
| ] | |
| }] | |
| }, | |
| "Path": "/", | |
| "Policies": [ | |
| { | |
| "PolicyName": "root", | |
| "PolicyDocument": { | |
| "Statement": [ | |
| { | |
| "Effect": "Allow", | |
| "Action": [ | |
| "elasticloadbalancing:Describe*", | |
| "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", | |
| "elasticloadbalancing:RegisterInstancesWithLoadBalancer", | |
| "ec2:Describe*", | |
| "ec2:AuthorizeSecurityGroupIngress" | |
| ], | |
| "Resource": [ "*" ] | |
| } | |
| ], | |
| "Version": "2012-10-17" | |
| } | |
| } | |
| ] | |
| } | |
| }, | |
| "AdminServer": { | |
| "Type": "AWS::EC2::Instance", | |
| "DependsOn": "AdminCluster", | |
| "Metadata": { | |
| "AWS::CloudFormation::Init": { | |
| "configSets" : { | |
| "InstallAndRun" : [ "Install", "Configure" ] | |
| }, | |
| "Install": { | |
| "packages" : { | |
| "yum" : { | |
| "docker" : [], | |
| "jq" : [], | |
| "ecs-init" : [], | |
| "httpd-tools": [] | |
| } | |
| }, | |
| "files" : { | |
| "/etc/sysconfig/docker" : { | |
| "content" : { "Fn::Join" : [ "", [ | |
| "OPTIONS='--dns 172.17.42.1 --dns 10.5.0.2 --dns-search service.consul -H tcp://0.0.0.0:2375 -H unix:///var/run/docker.sock'" | |
| ]]}, | |
| "mode" : "000755", | |
| "owner" : "root", | |
| "group" : "root" | |
| }, | |
| "/etc/consul/consul.json": { | |
| "content" : { "Fn::Join" : [ "", [ | |
| "{ \"leave_on_terminate\": true, \"recursors\": [ \"10.5.0.2\" ] }" | |
| ]]}, | |
| "mode" : "000755", | |
| "owner" : "root", | |
| "group" : "root" | |
| }, | |
| "/etc/nginx/nginx.conf": { | |
| "content" : { "Fn::Join" : [ "\n", [ | |
| "worker_processes 1;", | |
| "events { worker_connections 1024; }", | |
| "http {", | |
| " sendfile on;", | |
| " gzip on;", | |
| " gzip_http_version 1.0;", | |
| " gzip_proxied any;", | |
| " gzip_min_length 500;", | |
| " gzip_disable \"MSIE [1-6]\\.\";", | |
| " gzip_types text/plain text/xml text/css", | |
| " text/comma-separated-values", | |
| " text/javascript", | |
| " application/x-javascript", | |
| " application/atom+xml;", | |
| " # List of application servers", | |
| " upstream app_servers {", | |
| " server jenkins:8080;", | |
| " }", | |
| " # Configuration for the server", | |
| " server {", | |
| " # Running port", | |
| " listen 80;", | |
| " # Proxying the connections connections", | |
| " location / {", | |
| " auth_basic \"Restricted\"; #For Basic Auth", | |
| " auth_basic_user_file /etc/nginx/.htpasswd; #For Basic Auth", | |
| " proxy_pass http://app_servers;", | |
| " proxy_redirect off;", | |
| " proxy_set_header Host $host;", | |
| " proxy_set_header X-Real-IP $remote_addr;", | |
| " proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;", | |
| " proxy_set_header X-Forwarded-Host $server_name;", | |
| " }", | |
| " }", | |
| "}" | |
| ]]}, | |
| "mode" : "000755", | |
| "owner" : "root", | |
| "group" : "root" | |
| }, | |
| "/etc/ecs/ecs.config": { | |
| "content" : { "Fn::Join" : [ "", [ | |
| "ECS_CLUSTER=", | |
| { "Ref": "AdminCluster" } | |
| ]]}, | |
| "mode" : "000755", | |
| "owner" : "root", | |
| "group" : "root" | |
| } | |
| }, | |
| "commands" : { | |
| "01_create_jenkins_volumes": { | |
| "command" : { "Fn::Join" : ["\n", [ "#!/bin/bash", | |
| "mkdir -p /data/jenkins_home", | |
| "chmod 777 /data/jenkins_home" | |
| ]] } | |
| }, | |
| "02_create_codedeploy_volumes": { | |
| "command" : { "Fn::Join" : ["\n", [ "#!/bin/bash", | |
| "mkdir -p /opt/codedeploy-agent/state", | |
| "chmod 777 /opt/codedeploy-agent/state", | |
| "mkdir -p /opt/codedeploy-agent/deployment-root", | |
| "chmod 777 /opt/codedeploy-agent/deployment-root", | |
| "mkdir -p /var/log/aws/codedeploy-agent", | |
| "chmod 777 /var/log/aws/codedeploy-agent", | |
| "mkdir -p /opt/ecs-deployer", | |
| "chmod 777 /opt/ecs-deployer" | |
| ]] } | |
| }, | |
| "03_create_nginx_volumes": { | |
| "command" : { "Fn::Join" : ["\n", [ "#!/bin/bash", | |
| "mkdir -p /etc/nginx", | |
| "chmod 777 /etc/nginx" | |
| ]] } | |
| }, | |
| "04_create_consul_volumes": { | |
| "command" : { "Fn::Join" : ["\n", [ "#!/bin/bash", | |
| "mkdir -p /opt/consul", | |
| "chmod 777 /opt/consul" | |
| ]] } | |
| } | |
| }, | |
| "services" : { | |
| "sysvinit" : { | |
| "docker": { | |
| "enabled" : "true", | |
| "ensureRunning" : "true" | |
| } | |
| } | |
| } | |
| }, | |
| "Configure": { | |
| "commands" : { | |
| "01_restart_docker" : { | |
| "command" : { "Fn::Join" : ["", ["service docker restart"]] } | |
| }, | |
| "02_add_user_to_docker_group" : { | |
| "command" : { "Fn::Join" : ["", ["usermod -a -G docker ec2-user"]] } | |
| }, | |
| "03_start_ecs_agent" : { | |
| "command" : { "Fn::Join" : ["", ["start ecs"]] } | |
| }, | |
| "04_create_http_password" : { | |
| "command" : { "Fn::Join" : ["", ["htpasswd -b -c /etc/nginx/.htpasswd awsstudent ", { "Ref": "AdministratorPassword" }]] } | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| "Properties": { | |
| "ImageId": { | |
| "Fn::FindInMap": ["AWSRegionToAMI", { | |
| "Ref": "AWS::Region" | |
| }, "AMI"] | |
| }, | |
| "InstanceType": { | |
| "Ref": "AdminServerInstanceType" | |
| }, | |
| "IamInstanceProfile": { | |
| "Ref": "AdminServerInstanceProfile" | |
| }, | |
| "KeyName": { | |
| "Ref": "KeyName" | |
| }, | |
| "BlockDeviceMappings" : [ | |
| { | |
| "DeviceName" : "/dev/xvda", | |
| "Ebs" : { | |
| "VolumeSize" : "100", | |
| "VolumeType":"gp2" | |
| } | |
| } | |
| ], | |
| "NetworkInterfaces": [{ | |
| "GroupSet": [{ | |
| "Ref": "ConsulServerSecurityGroup" | |
| },{ | |
| "Ref": "ConsulAgentSecurityGroup" | |
| },{ | |
| "Ref": "CommonSecurityGroup" | |
| },{ | |
| "Ref": "TestSecurityGroup" | |
| }], | |
| "AssociatePublicIpAddress": "true", | |
| "DeviceIndex": "0", | |
| "DeleteOnTermination": "true", | |
| "SubnetId": { | |
| "Ref": "PublicSubnet" | |
| } | |
| }], | |
| "Tags": [{ | |
| "Key": "Name", | |
| "Value": "Lab3AdminServer" | |
| }, | |
| { | |
| "Key": "Application", | |
| "Value": "EcsDeployer" | |
| }], | |
| "UserData" : { "Fn::Base64" : { "Fn::Join" : ["", [ | |
| "#!/bin/bash -xe\n", | |
| "yum update -y\n", | |
| "yum update -y aws-cfn-bootstrap\n", | |
| "# Install the files and packages from the metadata\n", | |
| "/opt/aws/bin/cfn-init -v ", | |
| " --stack ", { "Ref" : "AWS::StackName" }, | |
| " --resource AdminServer ", | |
| " --configsets InstallAndRun ", | |
| " --region ", { "Ref" : "AWS::Region" },"\n", | |
| "# Signal the status from cfn-init\n", | |
| "/opt/aws/bin/cfn-signal -e $? ", | |
| " --stack ", { "Ref" : "AWS::StackName" }, | |
| " --resource AdminServer ", | |
| " --region ", { "Ref" : "AWS::Region" }, "\n" | |
| ]]}} | |
| }, | |
| "CreationPolicy": { | |
| "ResourceSignal": { | |
| "Count": "1", | |
| "Timeout": "PT15M" | |
| } | |
| } | |
| }, | |
| "CLIInstance": { | |
| "Type": "AWS::EC2::Instance", | |
| "Properties": { | |
| "KeyName": {"Ref": "KeyName"}, | |
| "ImageId": {"Fn::FindInMap": ["AWSRegionToAMI", {"Ref": "AWS::Region"}, "AMI"] }, | |
| "InstanceType": {"Ref": "CLIInstanceType"}, | |
| "NetworkInterfaces": [{ | |
| "GroupSet": [ | |
| { "Ref": "CLISecurityGroup" }, | |
| { "Ref": "ConsulAgentSecurityGroup" }, | |
| { "Ref": "TestSecurityGroup" } | |
| ], | |
| "AssociatePublicIpAddress": "true", | |
| "DeviceIndex": "0", | |
| "DeleteOnTermination": "true", | |
| "SubnetId": { | |
| "Ref": "PublicSubnet" | |
| } | |
| }], | |
| "BlockDeviceMappings" : [ | |
| { | |
| "DeviceName" : "/dev/xvda", | |
| "Ebs" : { | |
| "VolumeSize" : "30", | |
| "VolumeType":"gp2" | |
| } | |
| } | |
| ], | |
| "IamInstanceProfile": {"Ref": "RootInstanceProfile"}, | |
| "Tags": [{"Key": "Name", "Value": "CLI Instance"} ], | |
| "UserData": { | |
| "Fn::Base64": { | |
| "Fn::Join": [ | |
| "\n", | |
| [ | |
| "#!/bin/bash -ex", | |
| "yum -y update", | |
| "yum -y install docker", | |
| "yum -y install jq", | |
| "usermod -a -G docker ec2-user", | |
| "service docker start", | |
| "mkdir -p /home/ec2-user/.aws", | |
| "touch /home/ec2-user/.aws/config", | |
| "wget https://us-east-1-aws-training.s3.amazonaws.com/bootcamp/container-microsvc/lab-3/static/region_config.sh && chmod +x region_config.sh && ./region_config.sh", | |
| "cd /home/ec2-user", | |
| "wget https://us-east-1-aws-training.s3.amazonaws.com/bootcamp/container-microsvc/lab-3/static/lab-3-continuous-deployment.tar.xz", | |
| "tar Jxvf lab-3-continuous-deployment.tar.xz", | |
| "wget https://us-east-1-aws-training.s3.amazonaws.com/bootcamp/container-microsvc/lab-4/static/lab-4-service-discovery-consul.tar.xz", | |
| "tar Jxvf lab-4-service-discovery-consul.tar.xz", | |
| "rm lab-3-continuous-deployment.tar.xz", | |
| "rm lab-4-service-discovery-consul.tar.xz", | |
| "chown -R ec2-user:ec2-user lab-3-continuous-deployment", | |
| "chown -R ec2-user:ec2-user lab-4-service-discovery-consul" | |
| ] | |
| ] | |
| } | |
| } | |
| } | |
| }, | |
| "EcsInstanceLc": { | |
| "Type": "AWS::AutoScaling::LaunchConfiguration", | |
| "DependsOn": "BetaCluster", | |
| "Metadata": { | |
| "AWS::CloudFormation::Init": { | |
| "configSets" : { | |
| "InstallAndRun" : [ "Install", "Configure" ] | |
| }, | |
| "Install": { | |
| "files" : { | |
| "/etc/sysconfig/docker" : { | |
| "content" : { "Fn::Join" : [ "", [ | |
| "OPTIONS='--dns 172.17.42.1 --dns 10.5.0.2 --dns-search service.consul'" | |
| ]]}, | |
| "mode" : "000755", | |
| "owner" : "root", | |
| "group" : "root" | |
| }, | |
| "/etc/consul/consul.json": { | |
| "content" : { "Fn::Join" : [ "", [ | |
| "{ \"leave_on_terminate\": true, \"recursors\": [ \"10.5.0.2\" ] }" | |
| ]]}, | |
| "mode" : "000755", | |
| "owner" : "root", | |
| "group" : "root" | |
| }, | |
| "/etc/ecs/ecs.config": { | |
| "content" : { "Fn::Join" : [ "", [ | |
| "ECS_CLUSTER=", | |
| { "Ref": "BetaCluster" } | |
| ]]}, | |
| "mode" : "000755", | |
| "owner" : "root", | |
| "group" : "root" | |
| } | |
| } | |
| }, | |
| "Configure": { | |
| "commands" : { | |
| "01_restart_docker" : { | |
| "command" : { "Fn::Join": [ "", [ "service docker restart" ] ] } | |
| }, | |
| "02_create_consul_data_dir" : { | |
| "command" : { "Fn::Join" : ["", [ "mkdir -p /opt/consul" ]] } | |
| } | |
| }, | |
| "files" : { | |
| "/etc/cfn/cfn-hup.conf" : { | |
| "content" : { "Fn::Join" : ["", [ | |
| "[main]\n", | |
| "stack=", { "Ref" : "AWS::StackId" }, "\n", | |
| "region=", { "Ref" : "AWS::Region" }, "\n" | |
| ]]}, | |
| "mode" : "000400", | |
| "owner" : "root", | |
| "group" : "root" | |
| }, | |
| "/etc/cfn/hooks.d/cfn-auto-reloader.conf" : { | |
| "content": { "Fn::Join" : ["", [ | |
| "[cfn-auto-reloader-hook]\n", | |
| "triggers=post.update\n", | |
| "path=Resources.ContainerInstances.Metadata.AWS::CloudFormation::Init\n", | |
| "action=/opt/aws/bin/cfn-init -v ", | |
| " --stack ", { "Ref" : "AWS::StackName" }, | |
| " --resource EcsInstanceLc ", | |
| " --region ", { "Ref" : "AWS::Region" }, "\n", | |
| "runas=root\n" | |
| ]]} | |
| } | |
| }, | |
| "services" : { | |
| "sysvinit" : { | |
| "cfn-hup" : { "enabled" : "true", "ensureRunning" : "true", "files" : ["/etc/cfn/cfn-hup.conf", "/etc/cfn/hooks.d/cfn-auto-reloader.conf"] } | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| "Properties": { | |
| "ImageId": { | |
| "Fn::FindInMap": ["EcsNodeAmiMap", { "Ref": "AWS::Region" }, "AMI"] | |
| }, | |
| "InstanceType": { | |
| "Ref": "EcsInstanceType" | |
| }, | |
| "AssociatePublicIpAddress": true, | |
| "IamInstanceProfile": { | |
| "Ref": "EcsInstanceProfile" | |
| }, | |
| "KeyName": { | |
| "Ref": "KeyName" | |
| }, | |
| "BlockDeviceMappings" : [ | |
| { | |
| "DeviceName" : "/dev/xvda", | |
| "Ebs" : { | |
| "VolumeSize" : "30", | |
| "VolumeType":"gp2" | |
| } | |
| } | |
| ], | |
| "SecurityGroups": [ | |
| { "Ref": "ConsulAgentSecurityGroup" }, | |
| { "Ref": "CommonSecurityGroup" } | |
| ], | |
| "UserData" : { "Fn::Base64" : { "Fn::Join" : ["", [ | |
| "#!/bin/bash -xe\n", | |
| "yum install -y aws-cfn-bootstrap\n", | |
| "# Install the files and packages from the metadata\n", | |
| "/opt/aws/bin/cfn-init -v ", | |
| " --stack ", { "Ref" : "AWS::StackName" }, | |
| " --resource EcsInstanceLc ", | |
| " --configsets InstallAndRun ", | |
| " --region ", { "Ref" : "AWS::Region" },"\n", | |
| "# Signal the status from cfn-init\n", | |
| "/opt/aws/bin/cfn-signal -e $? ", | |
| " --stack ", { "Ref" : "AWS::StackName" }, | |
| " --resource EcsInstanceLc ", | |
| " --region ", { "Ref" : "AWS::Region" }, "\n" | |
| ]]}} | |
| } | |
| }, | |
| "EcsInstanceAsg": { | |
| "Type": "AWS::AutoScaling::AutoScalingGroup", | |
| "Properties": { | |
| "AvailabilityZones": [ | |
| { "Fn::Select": [ | |
| "0", | |
| { | |
| "Fn::GetAZs": "" | |
| } | |
| ] } | |
| ], | |
| "VPCZoneIdentifier": [ | |
| { "Ref": "PublicSubnet" } | |
| ], | |
| "LaunchConfigurationName": { | |
| "Ref": "EcsInstanceLc" | |
| }, | |
| "MinSize": 1, | |
| "MaxSize": 2, | |
| "DesiredCapacity": 2, | |
| "Tags": [ | |
| { | |
| "Key": "Application", | |
| "Value": { "Ref": "AWS::StackName" }, | |
| "PropagateAtLaunch": "true" | |
| }, | |
| { | |
| "Key": "Name", | |
| "Value": "ECS Instance", | |
| "PropagateAtLaunch": "true" | |
| }] | |
| } | |
| } | |
| }, | |
| "Outputs": { | |
| "AdminCluster": { | |
| "Description": "The name of the Admin ECS Cluster", | |
| "Value": { | |
| "Ref": "AdminCluster" | |
| } | |
| }, | |
| "BetaCluster": { | |
| "Description": "The name of the Beta ECS Cluster", | |
| "Value": { | |
| "Ref": "BetaCluster" | |
| } | |
| }, | |
| "CLIInstance": { | |
| "Description": "DNS name of the CLI Instance", | |
| "Value": { | |
| "Fn::GetAtt": ["CLIInstance", "PublicDnsName"] | |
| } | |
| }, | |
| "JenkinsUrl": { | |
| "Description": "URL of the Jenkins Web GUI", | |
| "Value": { | |
| "Fn::Join" : ["", [ "http://", | |
| {"Fn::GetAtt": ["AdminServer", "PublicDnsName"] }]] | |
| } | |
| }, | |
| "ConsulServerDnsName": { | |
| "Description": "DNS name of the Consul Server", | |
| "Value": { | |
| "Fn::GetAtt": ["AdminServer", "PublicDnsName"] | |
| } | |
| }, | |
| "ElbSecurityGroup": { | |
| "Description": "The ECS Service ELB security group", | |
| "Value": { | |
| "Ref": "ElbSecurityGroup" | |
| } | |
| }, | |
| "AZ": { | |
| "Description": "The AZ of the bootcamp", | |
| "Value": { | |
| "Fn::Select": [ "0", { "Fn::GetAZs": "" } ] | |
| } | |
| }, | |
| "Subnet": { | |
| "Description": "The Subnet of the bootcamp", | |
| "Value": { | |
| "Ref": "PublicSubnet" | |
| } | |
| }, | |
| "CodeRepoBucket": { | |
| "Description": "The S3 bucket where to deploy the code to", | |
| "Value": { | |
| "Ref": "Lab3CodeRepo" | |
| } | |
| }, | |
| "CodeDeployRole": { | |
| "Description": "The role ARN that is given to the AWS CodeDeploy service.", | |
| "Value": { | |
| "Fn::GetAtt" : [ "CodeDeployRole", "Arn" ] | |
| } | |
| }, | |
| "CodePipelinesRole": { | |
| "Description": "The role ARN that is given to the AWS CodePipelines service.", | |
| "Value": { | |
| "Fn::GetAtt" : [ "CodePipelinesRole", "Arn" ] | |
| } | |
| }, | |
| "EcsServiceRole": { | |
| "Description": "The role ARN that is given to the ECS service.", | |
| "Value": { | |
| "Fn::GetAtt" : [ "EcsServiceRole", "Arn" ] | |
| } | |
| } | |
| } | |
| } |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment