cf-stack.yml

AWSTemplateFormatVersion: "2010-09-09"
Description: "This example template shows how to ECS Fargate Cluster with CloudWatch alarms and logs / S3 connectivity. This template creates an Amazon ECS Fargate Cluster, CW Alarms, CW Logs groups, Security Group and etc. You will be billed for the AWS resources used if you create a stack using this template."

Parameters:
  VPC:
    Type: AWS::EC2::VPC::Id
  SubnetA:
    Type: AWS::EC2::Subnet::Id
  SubnetB:
    Type: AWS::EC2::Subnet::Id
  ClusterName:
    Description: Cluster name to be used
    Type: String
    Default: ecs-cluster
  EnvironmentName:
    Description: An environment name that will be prefixed to resource names
    Type: String
    Default: ecs-cluster
  MyResourceName:
    Description: An environment name that will be prefixed to resource names
    Type: String
  ServiceName:
    Description: Service Name to be created.
    Type: String
  AppContainerPort:
    Description: App container port
    Type: Number
  AutoScalingTargetValue:
    Type: Number
    Default: 50
  LoadBalancerPort:
    Type: Number
    Default: 80
  HealthCheckPath:
    Type: String
    Default: /api/
  MinCapacity:
    Type: Number
    Default: 1
  MaxCapacity:
    Type: Number
    Default: 2
  ServiceDesiredCount:
    Type: Number
    Default: 1

Resources:
  ECSCluster:
    Type: AWS::ECS::Cluster
    Properties:
      CapacityProviders:
        - FARGATE
      ClusterName: !Join ["-", [!Ref ServiceName, Cluster]]
      ClusterSettings:
        - Name: containerInsights
          Value: disabled
      DefaultCapacityProviderStrategy:
        - CapacityProvider: FARGATE
          Weight: 1
      Tags:
        - Key: env
          Value: !Ref EnvironmentName

  ECSTaskS3ManagedPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Description: "ECS Task S3 Policy to Read/Write to/from S3"
      ManagedPolicyName:
        {
          "Fn::Join":
            [
              "-",
              ["s3", { "Ref": "AWS::Region" }, { "Ref": "MyResourceName" }],
            ],
        }
      Path: /
      PolicyDocument: |
        {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Action": [
                        "s3:ListBucket"
                    ],
                    "Resource": [
                        "arn:aws:s3:::fluent-bit-ecs-test"
                    ]
                },
                {
                    "Effect": "Allow",
                    "Action": [
                        "s3:GetObject"
                    ],
                    "Resource": [
                        "arn:aws:s3:::fluent-bit-ecs-test/*"
                    ]
                }
            ]
        }

  ECSTaskCloudWatchManagedPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Description: "ECS Task Cloud Watch Policy to create and put log groups and log streams"
      ManagedPolicyName:
        {
          "Fn::Join":
            [
              "-",
              ["CW", { "Ref": "AWS::Region" }, { "Ref": "MyResourceName" }],
            ],
        }
      Path: /
      PolicyDocument: |
        {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Sid": "VisualEditor0",
                    "Effect": "Allow",
                    "Action": [
                        "logs:CreateLogStream",
                        "logs:DescribeLogStreams",
                        "logs:CreateLogGroup"
                    ],
                    "Resource": "arn:aws:logs:eu-west-1:035864429412:log-group:*"
                },
                {
                    "Sid": "VisualEditor1",
                    "Effect": "Allow",
                    "Action": "logs:PutLogEvents",
                    "Resource": "arn:aws:logs:eu-west-1:035864429412:log-group:*:log-stream:*"
                }
            ]
        }

  AutoScalingRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Join ["-", [!Ref ServiceName, AutoScalingRole]]
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action: "sts:AssumeRole"
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceAutoscaleRole"

  ExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: |
        {
          "Version": "2008-10-17",
          "Statement": [
            {
              "Sid": "",
              "Effect": "Allow",
              "Principal": {
                "Service": "ecs-tasks.amazonaws.com"
              },
              "Action": "sts:AssumeRole"
            }
          ]
        }
      Description: "ECS Task Execution ROle Policy"
      ManagedPolicyArns:
        - !Ref ECSTaskS3ManagedPolicy
        - !Ref ECSTaskCloudWatchManagedPolicy
      Path: /
      Policies:
        - PolicyName: !Sub ecs-service-${AWS::StackName}
          PolicyDocument:
            {
              "Version": "2012-10-17",
              "Statement":
                [
                  {
                    "Effect": "Allow",
                    "Action":
                      [
                        "ecr:GetAuthorizationToken",
                        "ecr:BatchCheckLayerAvailability",
                        "ecr:GetDownloadUrlForLayer",
                        "ecr:BatchGetImage",
                        "logs:CreateLogStream",
                        "logs:PutLogEvents",
                      ],
                    "Resource": "*",
                  },
                ],
            }
      RoleName: !Sub ecs-service-${AWS::StackName}
      Tags:
        - Key: env
          Value: !Ref EnvironmentName

  TaskDefinition:
    Type: AWS::ECS::TaskDefinition
    DependsOn:
      - CloudWatchLogsGroup
    Properties:
      RequiresCompatibilities:
        - "FARGATE"
      ContainerDefinitions:
        - Name: !Ref ServiceName
          Essential: true
          Image: "rv0718/fb-app:3"
          # Cpu: 512
          PortMappings:
            - ContainerPort: !Ref AppContainerPort
              HostPort: !Ref AppContainerPort
              Protocol: "tcp"
          # Memory: 256
          Environment:
            - Name: LOG_FILE_PATH
              Value: "/usr/local/tomcat/logs"
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: !Ref CloudWatchLogsGroup
              awslogs-region: !Ref AWS::Region
              awslogs-stream-prefix: "ecs"
      Cpu: 512
      ExecutionRoleArn: !Ref ExecutionRole
      Family: !Join ["-", [!Ref ServiceName, TaskDefinition]]
      Memory: 1024
      NetworkMode: "awsvpc"
      Tags:
        - Key: env
          Value: !Ref EnvironmentName
      TaskRoleArn: !Ref ExecutionRole

  Service:
    Type: AWS::ECS::Service
    # This dependency is needed so that the load balancer is setup correctly in time
    DependsOn:
      - ListenerHTTP
    Properties:
      ServiceName: !Ref ServiceName
      Cluster: !Ref ECSCluster
      TaskDefinition: !Ref TaskDefinition
      DeploymentConfiguration:
        MinimumHealthyPercent: 100
        MaximumPercent: 200
      DesiredCount: !Ref ServiceDesiredCount
      # This may need to be adjusted if the container takes a while to start up
      HealthCheckGracePeriodSeconds: 30
      LaunchType: FARGATE
      NetworkConfiguration:
        AwsvpcConfiguration:
          # change to DISABLED if you're using private subnets that have access to a NAT gateway
          AssignPublicIp: ENABLED
          Subnets:
            - !Ref SubnetA
            - !Ref SubnetB
          SecurityGroups:
            - !Ref ContainerSecurityGroup
      LoadBalancers:
        - ContainerName: !Ref ServiceName
          ContainerPort: !Ref AppContainerPort
          TargetGroupArn: !Ref TargetGroup

  CloudWatchLogsGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Join ['', [/ecs/, !Ref ServiceName, TaskDefinition,!Ref AWS::StackName]]
      RetentionInDays: 365

  ContainerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: !Join ["-", [!Ref ServiceName, ContainerSecurityGroup]]
      GroupName: !Join ["-", [!Ref ServiceName, ContainerSecurityGroup]]
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: !Ref AppContainerPort
          ToPort: !Ref AppContainerPort
          SourceSecurityGroupId: !Ref LoadBalancerSecurityGroup
      SecurityGroupEgress:
        - IpProtocol: "-1"
          FromPort: 0
          ToPort: 0
          CidrIp: 0.0.0.0/0

  LoadBalancerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription:
        !Join ["-", [!Ref ServiceName, LoadBalancerSecurityGroup]]
      GroupName: !Join ["-", [!Ref ServiceName, LoadBalancerSecurityGroup]]
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: !Ref LoadBalancerPort
          ToPort: !Ref LoadBalancerPort
          CidrIp: 0.0.0.0/0
      SecurityGroupEgress:
        - IpProtocol: "-1"
          FromPort: 0
          ToPort: 0
          CidrIp: "0.0.0.0/0"

  TargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckIntervalSeconds: 30
      # will look for a 200 status code by default unless specified otherwise
      HealthCheckPath: !Ref HealthCheckPath
      HealthCheckTimeoutSeconds: 15
      UnhealthyThresholdCount: 2
      HealthyThresholdCount: 3
      # Matcher:
      # - HttpCode: '200'
      Name: !Join ["-", [!Ref ServiceName, TargetGroup]]
      Port: !Ref AppContainerPort
      Protocol: HTTP
      TargetGroupAttributes:
        - Key: deregistration_delay.timeout_seconds
          Value: 60 # default is 300
      # TargetType ip defines that it is a fargate type cluster/target
      TargetType: ip
      VpcId: !Ref VPC
  ListenerHTTP:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - TargetGroupArn: !Ref TargetGroup
          Type: "forward"
      LoadBalancerArn: !Ref LoadBalancer
      Port: !Ref LoadBalancerPort
      Protocol: HTTP
  LoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      LoadBalancerAttributes:
        # this is the default, but is specified here in case it needs to be changed
        - Key: idle_timeout.timeout_seconds
          Value: 60
        - Key: deletion_protection.enabled
          Value: false
      Name: !Join ["-", [!Ref ServiceName, LoadBalancer]]
      Type: "application"
      # "internal" is also an option
      Scheme: internet-facing
      SecurityGroups:
        - !Ref LoadBalancerSecurityGroup
      Subnets:
        - !Ref SubnetA
        - !Ref SubnetB
  AutoScalingTarget:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    Properties:
      MinCapacity: !Ref MinCapacity
      MaxCapacity: !Ref MaxCapacity
      ResourceId: !Join ["/", [service, !Ref ECSCluster, !GetAtt Service.Name]]
      ScalableDimension: ecs:service:DesiredCount
      ServiceNamespace: ecs
      # "The Amazon Resource Name (ARN) of an AWS Identity and Access Management (IAM) role that allows Application Auto Scaling to modify your scalable target."
      RoleARN: !GetAtt AutoScalingRole.Arn
  AutoScalingPolicy:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName: !Join ["-", [!Ref ServiceName, AutoScalingPolicy]]
      PolicyType: TargetTrackingScaling
      ScalingTargetId: !Ref AutoScalingTarget
      TargetTrackingScalingPolicyConfiguration:
        PredefinedMetricSpecification:
          PredefinedMetricType: ECSServiceAverageCPUUtilization
        ScaleInCooldown: 10
        ScaleOutCooldown: 10
        # Keep things at or lower than 50% CPU utilization, for example
        TargetValue: !Ref AutoScalingTargetValue

Outputs:
  Cluster:
    Description: A reference to the ECS cluster
    Value: !Ref ECSCluster
  S3ManagedPolicy:
    Description: A reference to the S3 Managed Policy
    Value: !Ref ECSTaskS3ManagedPolicy
  CWManagedPolicy:
    Description: A reference to the Cloud Watch Managed Policy
    Value: !Ref ECSTaskCloudWatchManagedPolicy
  TaskDefinition:
    Description: A reference to the TaskDefinition
    Value: !Ref TaskDefinition
  CloudWatchLogsGroup:
    Description: A reference to the TaskDefinition
    Value: !Ref CloudWatchLogsGroup
  Endpoint:
    Description: Endpoint
    Value: !Join ["", ["http://", !GetAtt LoadBalancer.DNSName]]