template.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: CloudFormation stack for https://runs-on.com

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "App configuration [required]"
        Parameters:
          - GithubOrganization
          - GithubEnterpriseUrl
          - LicenseKey
          - EmailAddress
      - Label:
          default: "VPC configuration [optional]"
        Parameters:
          - VpcCidrBlock
          - VpcCidrSubnetBits
          - VpcEndpoints
          - Private
          - NatGatewayAvailability
          - NatGatewayElasticIPCount
          - Ipv6Enabled
          - VpcFlowLogFormat
          - VpcFlowLogS3BucketArn
          - VpcFlowLogRetentionInDays
      - Label:
          default: "Security settings [optional]"
        Parameters:
          - SSHAllowed
          - SSHCidrRange
          - EC2InstanceCustomPolicy
          - DefaultPermissionBoundaryArn
          - ServerPassword
          - DefaultAdmins
          - EncryptEbs
      - Label:
          default: "Alert and monitoring settings [optional]"
        Parameters:
          - AppAlarmDailyMinutes
          - CostReportsEnabled
          - AlertTopicSubscriptionHttpsEndpoint
          - ECInstanceDetailedMonitoring
          - Ec2LogRetentionInDays
          - SqsQueueOldestMessageThresholdSeconds
      - Label:
          default: "Integrations [optional]"
        Parameters:
          - IntegrationStepSecurityApiKey
      - Label:
          default: "Advanced app configuration [optional]"
        Parameters:
          - Environment
          - RunnerCustomTags
          - RunnerDefaultDiskSize
          - RunnerDefaultDiskDeviceName
          - RunnerDefaultVolumeThroughput
          - RunnerLargeDiskSize
          - RunnerLargeDiskDeviceName
          - RunnerLargeVolumeThroughput
          - AppEc2QueueSize
          - AppCPU
          - AppMemory
          - AppRegistry
          - SpotCircuitBreaker
          - S3CacheExpirationInDays
          - CostAllocationTag

Parameters:
  GithubOrganization:
    Type: String
    Description: "For instance if your GitHub organization lives at github.com/my-org, then the value of this parameter should be: my-org"
    MinLength: 1

  GithubEnterpriseUrl:
    Type: String
    Default: ""
    Description: "Leave blank, unless you use a self-hosted GitHub Enterprise Server (GHES) instance. In that case, if your GHES instance lives at https://github.mycompany.com, then the value of this parameter should be: https://github.mycompany.com"

  LicenseKey:
    Type: String
    Description: |
      License key for RunsOn, either as a string or SSM parameter ARN (with the format `arn:aws:ssm:REGION:ACCOUNT:parameter/STACK_NAME/license-key`). Get one at https://runs-on.com/pricing.
    MinLength: 1

  EmailAddress:
    Type: String
    Description: Email address for cost and alert reports. You will receive a confirmation email from AWS at this address during the installation so make sure to use a valid address. You must confirm it if you want to receive cost and alert reports.
    MinLength: 1

  Environment:
    Type: String
    Default: "production"
    MinLength: 1
    Description: "Make RunsOn only listen to jobs with an `env` job label matching this value. Only change this if you know what you are doing. See https://runs-on.com/configuration/environments/ for more details."

  AlertTopicSubscriptionHttpsEndpoint:
    Type: String
    Description: HTTPS endpoint for cost and alert reports.
    Default: ""

  VpcCidrBlock:
    Type: String
    Description: CIDR block for the VPC. Updating this value after creation will require deleting the stack and recreating it.
    Default: 10.1.0.0/16

  VpcCidrSubnetBits:
    Type: Number
    Description: Number of bits to allocate for the subnet. For example, if you specify VpcCidrBlock to a /16 (the default), and this value to 12 (the default), you will have 4 bits, i.e. max 16 subnets in the VPC. Updating this value after creation will require deleting the stack and recreating it.
    Default: 12
    MinValue: 9
    MaxValue: 16

  Ipv6Enabled:
    Type: String
    Default: "false"
    AllowedValues:
      - "true"
      - "false"
    Description: Enable or disable IPv6 for runners. Disabling ipv6 might help with Docker Hub rate limiting issues.

  SSHAllowed:
    Type: String
    Default: "true"
    AllowedValues:
      - "true"
      - "false"
    Description: Allow inbound SSH connections from the specified CIDR range to the runners.

  SSHCidrRange:
    Type: String
    Default: 0.0.0.0/0
    Description: CIDR range for inbound SSH access. By default, only repository collaborators with admin permission will be able to SSH into the runner instances.
    MinLength: 1

  Private:
    Type: String
    Default: "false"
    AllowedValues:
      - "only"
      - "always"
      - "true"
      - "false"
    Description: "Enable ('true', 'always', 'only') or disable ('false') private networking. If 'true', your jobs can opt-in to launch in private subnets with the `private=true` label, and they will get a static egress IP. If 'always', all jobs will run in private subnets, and they will all get a static egress IP, unless you manually opt-out in your job definition with the `private=false` label. If 'only', then jobs can only launch in private subnets. Note that enabling it will create 1 managed NAT gateway, with the corresponding costs. More details at https://runs-on.com/networking/static-ips/."

  VpcEndpoints:
    Type: String
    Default: "none"
    AllowedValues:
      - "EC2"
      - "ECR"
      - "EC2+ECR"
      - "none"
    Description: "Enable or disable VPC endpoints among: EC2 (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/interface-vpc-endpoints.html), ECR (API + Docker - https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html). Each endpoint incurs ~$21.6/month ($7.2/month per AZ x3)."

  NatGatewayElasticIPCount:
    Type: Number
    Default: 1
    MinValue: 1
    MaxValue: 8
    Description: "Number of Elastic IPv4s to attach to _each_ NAT Gateway. Only applies if Private mode is enabled. Defaults to 1. Maximum of 8. Increasing this number is useful if you launch a large number of runners and are rate-limited by some external services due to the limited number of NAT Gateway IP addresses. Incurs ~$3.6/month additional cost for each Elastic IP. Note that by default you are limited to 2 EIPs per NAT gateway, but can request a quota increase from AWS."

  NatGatewayAvailability:
    Type: String
    Default: SingleAZ
    AllowedValues:
    - SingleAZ
    - MultiAZ
    Description: "Create either a single NAT Gateway (SingleAZ) for all 3 availability zones, or a NAT Gateway per Availability Zone (MultiAZ). Only applies if Private mode is enabled. Each gateway incurs ~$32.4/month, plus bandwidth costs."

  VpcFlowLogFormat:
    Type: String
    Default: ""
    Description: "VPC Flow Log format. If blank, no VPC Flow Logs will be created. If set to `default`, the default format will be used. More details at https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html#flow-logs-fields"

  VpcFlowLogS3BucketArn:
    Type: String
    Default: ""
    Description: "ARN of an S3 bucket to send VPC Flow Logs to in addition to the default CloudWatch logs group. If blank, the logs will only be sent to CloudWatch Logs."

  VpcFlowLogRetentionInDays:
    Type: Number
    Default: 7
    MinValue: 1
    Description: "Retention period in days for VPC Flow Logs."

  DefaultPermissionBoundaryArn:
    Type: String
    Default: ""
    Description: "ARN of an IAM policy that will be assigned as permission boundary to roles created by the stack. If blank, the roles will not have a permission boundary."

  DefaultAdmins:
    Type: String
    Default: ""
    Description: Comma-separated list of GitHub usernames that will always be granted SSH access to all the runner instances (if SSH access is enabled), in addition to any repository admins. If blank, only repository collaborators with admin permission will be able to SSH into the runner instances.

  AppEc2QueueSize:
    Type: Number
    Default: 2
    MinValue: 1
    Description: "Number of queued jobs that can be processed concurrently by RunsOn. Each job takes about 2-3s to process. Increasing this value should be done with caution, as it will increase the number of EC2 instances that will be launched at once, eating into your AWS and GitHub rate limits. New AWS accounts come with a rate-limit of 2 RunInstances call/s, although you can request a higher limit from AWS (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/throttling.html)."

  AppAlarmDailyMinutes:
    Type: Number
    Default: "4000"
    Description: "Trigger an alarm if the cumulative number of minutes consumed during a day is over that number."

  AppCPU:
    Type: Number
    AllowedValues:
      - 256
      - 512
      - 1024
      - 2048
      - 4096
    Default: 256
    Description: CPU units for RunsOn service (256 or higher). You might only need to change this if you have 10k+ jobs per day.

  AppMemory:
    Type: Number
    AllowedValues:
      - 512
      - 1024
      - 2048
      - 3072
      - 4096
      - 6144
      - 8192
    Default: 512
    Description: Memory in MB for RunsOn service (512 or higher). You might only need to change this if you have 10k+ jobs per day.

  AppRegistry:
    Type: String
    Default: "public.ecr.aws/c5h5o9k1/runs-on/runs-on"
    Description: "Docker image (public) registry for the RunsOn service."

  SpotCircuitBreaker:
    Type: String
    Default: "2/15/30"
    AllowedPattern: "^(false|[0-9]+/[0-9]+/[0-9]+)$"
    Description: "Enable (`COUNT/WINDOW_MINUTES/RECOVERY_MINUTES`) or disable (`false`) the spot instance circuit breaker. If enabled, the circuit breaker will prevent the stack from launching new spot instances during RECOVERY_MINUTES if there was at least COUNT spot interruptions during the last WINDOW_MINUTES. For instance 2/15/30 will prevent the stack from launching new spot instances during 30 minutes if there was at least 2 spot interruptions during the last 15 minutes."

  EncryptEbs:
    Type: String
    Default: "false"
    AllowedValues:
      - "true"
      - "false"
    Description: "Encrypt the EBS volumes of the runner instances. Encryption will slow the boot time of runner instances by ~10s."

  RunnerDefaultDiskSize:
    Type: Number
    Default: 40
    MinValue: 40
    Description: Disk size in GB for `disk=default` runners.

  RunnerDefaultDiskDeviceName:
    Type: String
    Default: "/dev/sda1"
    Description: Name of the root volume device name for the `disk=default` runner. Only change this if you plan on using custom AMIs that have a different root volume name.

  RunnerDefaultVolumeThroughput:
    Type: Number
    Default: 400
    MinValue: 125
    MaxValue: 1000
    Description: Volume throughput in MiB/s for `disk=default` runners (helps with faster boot times, but costs more).

  RunnerLargeDiskSize:
    Type: Number
    Default: 80
    MinValue: 40
    Description: Disk size in GB for `disk=large` runners.

  RunnerLargeDiskDeviceName:
    Type: String
    Default: "/dev/sda1"
    Description: Name of the root volume device name for the `disk=large` runner. Only change this if you plan on using custom AMIs that have a different root volume name.

  RunnerLargeVolumeThroughput:
    Type: Number
    Default: 750
    MinValue: 125
    MaxValue: 1000
    Description: Volume throughput in MiB/s for `disk=large` runners (helps with faster boot times, but costs more).

  RunnerCustomTags:
    Type: CommaDelimitedList
    Default: ""
    Description: "Optional custom tags for the runner instances (e.g. 'key1=value1,key2=value2'). Tag keys cannot start with `runs-on`, and can only use letters (a-z, A-Z), numbers (0-9), and the following characters: + - = . , _ : @ (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html#tag-restrictions)"

  CostReportsEnabled:
    Type: String
    Default: "true"
    AllowedValues:
      - "true"
      - "false"
    Description: Enable or disable cost reports sent by email.

  EC2InstanceCustomPolicy:
    Type: String
    Default: ""
    Description: "Optional managed IAM Policy ARN to assign to the EC2 runner instances."

  ECInstanceDetailedMonitoring:
    Type: String
    Default: "false"
    AllowedValues:
      - "true"
      - "false"
    Description: Enable or disable detailed monitoring for EC2 instances (can incur additional costs).

  Ec2LogRetentionInDays:
    Type: Number
    Default: 7
    MinValue: 1
    Description: "Retention period in days for EC2 instance logs."

  SqsQueueOldestMessageThresholdSeconds:
    Type: Number
    Default: 0
    Description: Trigger an alarm per sqs queue if the oldest message in that queue is older than this time in seconds. Leave as 0 to disable SQS alarms.

  ServerPassword:
    Type: String
    Default: ""
    Description: Password for the /metrics Prometheus endpoint (https://runs-on.com/monitoring/metrics/#prometheus-metrics). If blank, the endpoint will be disabled.

  S3CacheExpirationInDays:
    Type: Number
    Default: 10
    Description: "Number of days to keep cache entries in the S3 cache bucket."

  CostAllocationTag:
    Type: String
    Default: "stack"
    Description: "Cost allocation tag to use for all the deployed resources. Updating this after creation will require deleting the stack and recreating it."

  IntegrationStepSecurityApiKey:
    Type: String
    Default: ""
    Description: "API key for Step Security (https://stepsecurity.io/)."

Mappings:
  App:
    Image:
      Tag: "v2.7.2"

Conditions:
  EmailProvided: !Not [!Equals [!Ref EmailAddress, ""]]
  CostReportsEnabled: !Equals [!Ref CostReportsEnabled, "true"]
  AlertTopicSubscriptionHttpsProvided:
    !Not [!Equals [!Ref AlertTopicSubscriptionHttpsEndpoint, ""]]
  HasPrivateSubnet: !Not [!Equals [!Ref Private, "false"]]
  PrivateSubnetIsMultiAZ: !And [!Condition HasPrivateSubnet, !Equals [!Ref NatGatewayAvailability, "MultiAZ"]]
  HasEncryptEbs: !Equals [!Ref EncryptEbs, "true"]
  IsPrivateOnly: !Equals [!Ref Private, "only"]
  CustomPolicyProvided: !Not [!Equals [!Ref EC2InstanceCustomPolicy, ""]]
  ECInstanceDetailedMonitoringEnabled: !Equals ["true", !Ref ECInstanceDetailedMonitoring]
  CreateElasticIP1: !And [!Condition HasPrivateSubnet, !Not [!Equals [!Ref NatGatewayElasticIPCount, 0]]]
  CreateElasticIP2: !And [!Condition HasPrivateSubnet, !Condition CreateElasticIP1, !Not [!Equals [!Ref NatGatewayElasticIPCount, 1]]]
  CreateElasticIP3: !And [!Condition HasPrivateSubnet, !Condition CreateElasticIP2, !Not [!Equals [!Ref NatGatewayElasticIPCount, 2]]]
  CreateElasticIP4: !And [!Condition HasPrivateSubnet, !Condition CreateElasticIP3, !Not [!Equals [!Ref NatGatewayElasticIPCount, 3]]]
  CreateElasticIP5: !And [!Condition HasPrivateSubnet, !Condition CreateElasticIP4, !Not [!Equals [!Ref NatGatewayElasticIPCount, 4]]]
  CreateElasticIP6: !And [!Condition HasPrivateSubnet, !Condition CreateElasticIP5, !Not [!Equals [!Ref NatGatewayElasticIPCount, 5]]]
  CreateElasticIP7: !And [!Condition HasPrivateSubnet, !Condition CreateElasticIP6, !Not [!Equals [!Ref NatGatewayElasticIPCount, 6]]]
  CreateElasticIP8: !And [!Condition HasPrivateSubnet, !Condition CreateElasticIP7, !Not [!Equals [!Ref NatGatewayElasticIPCount, 7]]]
  CreateElasticIP1B: !And [!Condition PrivateSubnetIsMultiAZ, !Condition CreateElasticIP1]
  CreateElasticIP2B: !And [!Condition PrivateSubnetIsMultiAZ, !Condition CreateElasticIP2]
  CreateElasticIP3B: !And [!Condition PrivateSubnetIsMultiAZ, !Condition CreateElasticIP3]
  CreateElasticIP4B: !And [!Condition PrivateSubnetIsMultiAZ, !Condition CreateElasticIP4]
  CreateElasticIP5B: !And [!Condition PrivateSubnetIsMultiAZ, !Condition CreateElasticIP5]
  CreateElasticIP6B: !And [!Condition PrivateSubnetIsMultiAZ, !Condition CreateElasticIP6]
  CreateElasticIP7B: !And [!Condition PrivateSubnetIsMultiAZ, !Condition CreateElasticIP7]
  CreateElasticIP8B: !And [!Condition PrivateSubnetIsMultiAZ, !Condition CreateElasticIP8]
  CreateElasticIP1C: !And [!Condition PrivateSubnetIsMultiAZ, !Condition CreateElasticIP1]
  CreateElasticIP2C: !And [!Condition PrivateSubnetIsMultiAZ, !Condition CreateElasticIP2]
  CreateElasticIP3C: !And [!Condition PrivateSubnetIsMultiAZ, !Condition CreateElasticIP3]
  CreateElasticIP4C: !And [!Condition PrivateSubnetIsMultiAZ, !Condition CreateElasticIP4]
  CreateElasticIP5C: !And [!Condition PrivateSubnetIsMultiAZ, !Condition CreateElasticIP5]
  CreateElasticIP6C: !And [!Condition PrivateSubnetIsMultiAZ, !Condition CreateElasticIP6]
  CreateElasticIP7C: !And [!Condition PrivateSubnetIsMultiAZ, !Condition CreateElasticIP7]
  CreateElasticIP8C: !And [!Condition PrivateSubnetIsMultiAZ, !Condition CreateElasticIP8]
  CreateInterfaceEndpointEc2: !Or [!Equals [!Ref VpcEndpoints, "EC2"], !Equals [!Ref VpcEndpoints, "EC2+ECR"]]
  CreateInterfaceEndpointEcrApi: !Or [!Equals [!Ref VpcEndpoints, "ECR"], !Equals [!Ref VpcEndpoints, "EC2+ECR"]]
  CreateInterfaceEndpointEcrDocker: !Or [!Equals [!Ref VpcEndpoints, "ECR"], !Equals [!Ref VpcEndpoints, "EC2+ECR"]]
  CreateSqsQueueOldestMessageAlarms: !Not [!Equals [!Ref SqsQueueOldestMessageThresholdSeconds, 0]]
  HasDefaultPermissionBoundaryArn: !Not [!Equals [!Ref DefaultPermissionBoundaryArn, ""]]
  HasVpcFlowLogEnabled: !Not [!Equals [!Ref VpcFlowLogFormat, ""]]
  HasVpcFlowLogFormat: !Not [!Equals [!Ref VpcFlowLogFormat, "default"]]
  HasVpcFlowLogS3BucketArn: !And [!Condition HasVpcFlowLogEnabled, !Not [!Equals [!Ref VpcFlowLogS3BucketArn, ""]]]
  HasIpv6Enabled: !Equals [!Ref Ipv6Enabled, "true"]
  HasSSHAllowed: !Equals [!Ref SSHAllowed, "true"]

Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCidrBlock
      EnableDnsSupport: true
      EnableDnsHostnames: true
      InstanceTenancy: default
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-VPC

  VPCIPv6CidrBlock:
    Type: AWS::EC2::VPCCidrBlock
    Properties:
      VpcId: !Ref VPC
      AmazonProvidedIpv6CidrBlock: true

  # EC2.6 - VPC flow logging should be enabled in all VPCs
  VPCFlowLog:
    Type: AWS::EC2::FlowLog
    Condition: HasVpcFlowLogEnabled
    Properties:
      ResourceType: VPC
      ResourceId: !Ref VPC
      TrafficType: ALL
      DeliverLogsPermissionArn: !GetAtt VPCFlowLogRole.Arn
      LogDestinationType: cloud-watch-logs
      LogGroupName: !Ref VPCFlowLogGroup
      LogFormat: !If [HasVpcFlowLogFormat, !Ref VpcFlowLogFormat, !Ref "AWS::NoValue"]

  VPCFlowLogGroup:
    Type: AWS::Logs::LogGroup
    Condition: HasVpcFlowLogEnabled
    Properties:
      RetentionInDays: !Ref VpcFlowLogRetentionInDays

  VPCFlowLogS3:
    Condition: HasVpcFlowLogS3BucketArn
    Type: AWS::EC2::FlowLog
    Properties:
      ResourceType: VPC
      ResourceId: !Ref VPC
      TrafficType: ALL
      LogDestinationType: s3
      LogDestination: !Ref VpcFlowLogS3BucketArn
      LogFormat: !If [HasVpcFlowLogFormat, !Ref VpcFlowLogFormat, !Ref "AWS::NoValue"]

  VPCFlowLogRole:
    Type: AWS::IAM::Role
    Condition: HasVpcFlowLogEnabled
    Properties:
      PermissionsBoundary: !If [HasDefaultPermissionBoundaryArn, !Ref DefaultPermissionBoundaryArn, !Ref "AWS::NoValue"]
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: vpc-flow-logs.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: allow-flow-logs
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                  - logs:DescribeLogGroups
                  - logs:DescribeLogStreams
                Resource: !GetAtt VPCFlowLogGroup.Arn

  PrivateSubnet1RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-PrivateSubnet1RouteTable

  PrivateSubnet2RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-PrivateSubnet2RouteTable

  PrivateSubnet3RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-PrivateSubnet3RouteTable

  PrivateSubnet1Route:
    Condition: HasPrivateSubnet
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateSubnet1RouteTable
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref PrivateSubnetGateway1

  PrivateSubnet1RouteIPv6:
    Condition: HasPrivateSubnet
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateSubnet1RouteTable
      DestinationIpv6CidrBlock: ::/0
      EgressOnlyInternetGatewayId: !Ref EgressOnlyInternetGateway

  PrivateSubnet2Route:
    Condition: HasPrivateSubnet
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateSubnet2RouteTable
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !If [PrivateSubnetIsMultiAZ, !Ref PrivateSubnetGateway2, !Ref PrivateSubnetGateway1]

  PrivateSubnet2RouteIPv6:
    Condition: HasPrivateSubnet
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateSubnet2RouteTable
      DestinationIpv6CidrBlock: ::/0
      EgressOnlyInternetGatewayId: !Ref EgressOnlyInternetGateway

  PrivateSubnet3Route:
    Condition: HasPrivateSubnet
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateSubnet3RouteTable
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !If [PrivateSubnetIsMultiAZ, !Ref PrivateSubnetGateway3, !Ref PrivateSubnetGateway1]

  PrivateSubnet3RouteIPv6:
    Condition: HasPrivateSubnet
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateSubnet3RouteTable
      DestinationIpv6CidrBlock: ::/0
      EgressOnlyInternetGatewayId: !Ref EgressOnlyInternetGateway

  EgressOnlyInternetGateway:
    Type: AWS::EC2::EgressOnlyInternetGateway
    Properties:
      VpcId: !Ref VPC

  PrivateSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateSubnet1
      RouteTableId: !Ref PrivateSubnet1RouteTable

  PrivateSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateSubnet2
      RouteTableId: !Ref PrivateSubnet2RouteTable

  PrivateSubnet3RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateSubnet3
      RouteTableId: !Ref PrivateSubnet3RouteTable

  PrivateSubnet1:
    Type: AWS::EC2::Subnet
    DependsOn: VPCIPv6CidrBlock
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [0, !GetAZs ""]
      CidrBlock: !Select [8, !Cidr [!GetAtt [VPC, CidrBlock], 16, !Ref VpcCidrSubnetBits]]
      MapPublicIpOnLaunch: false
      AssignIpv6AddressOnCreation: true
      Ipv6CidrBlock:
        Fn::Select:
          - 0
          - Fn::Cidr:
            - Fn::Select:
              - 0
              - Fn::GetAtt:
                - VPC
                - Ipv6CidrBlocks
            - 256
            - 64
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-PrivateSubnet1

  PrivateSubnet2:
    Type: AWS::EC2::Subnet
    DependsOn: VPCIPv6CidrBlock
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [1, !GetAZs ""]
      CidrBlock: !Select [9, !Cidr [!GetAtt [VPC, CidrBlock], 16, !Ref VpcCidrSubnetBits]]
      MapPublicIpOnLaunch: false
      AssignIpv6AddressOnCreation: true
      Ipv6CidrBlock:
        Fn::Select:
          - 1
          - Fn::Cidr:
            - Fn::Select:
              - 0
              - Fn::GetAtt:
                - VPC
                - Ipv6CidrBlocks
            - 256
            - 64
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-PrivateSubnet2

  PrivateSubnet3:
    Type: AWS::EC2::Subnet
    DependsOn: VPCIPv6CidrBlock
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [2, !GetAZs ""]
      CidrBlock: !Select [10, !Cidr [!GetAtt [VPC, CidrBlock], 16, !Ref VpcCidrSubnetBits]]
      MapPublicIpOnLaunch: false
      AssignIpv6AddressOnCreation: true
      Ipv6CidrBlock:
        Fn::Select:
          - 2
          - Fn::Cidr:
            - Fn::Select:
              - 0
              - Fn::GetAtt:
                - VPC
                - Ipv6CidrBlocks
            - 256
            - 64
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-PrivateSubnet3

  PrivateSubnetGateway1:
    Condition: HasPrivateSubnet
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !If
        - CreateElasticIP1
        - !GetAtt ElasticIP1.AllocationId
        - !Ref AWS::NoValue
      SecondaryAllocationIds:
        - !If [CreateElasticIP2, !GetAtt ElasticIP2.AllocationId, !Ref "AWS::NoValue"]
        - !If [CreateElasticIP3, !GetAtt ElasticIP3.AllocationId, !Ref "AWS::NoValue"]
        - !If [CreateElasticIP4, !GetAtt ElasticIP4.AllocationId, !Ref "AWS::NoValue"]
        - !If [CreateElasticIP5, !GetAtt ElasticIP5.AllocationId, !Ref "AWS::NoValue"]
        - !If [CreateElasticIP6, !GetAtt ElasticIP6.AllocationId, !Ref "AWS::NoValue"]
        - !If [CreateElasticIP7, !GetAtt ElasticIP7.AllocationId, !Ref "AWS::NoValue"]
        - !If [CreateElasticIP8, !GetAtt ElasticIP8.AllocationId, !Ref "AWS::NoValue"]
      SubnetId: !Ref PublicSubnet1
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-PrivateSubnetGateway1

  PrivateSubnetGateway2:
    Condition: PrivateSubnetIsMultiAZ
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !If
        - CreateElasticIP1B
        - !GetAtt ElasticIP1B.AllocationId
        - !Ref AWS::NoValue
      SecondaryAllocationIds:
        - !If [CreateElasticIP2B, !GetAtt ElasticIP2B.AllocationId, !Ref "AWS::NoValue"]
        - !If [CreateElasticIP3B, !GetAtt ElasticIP3B.AllocationId, !Ref "AWS::NoValue"]
        - !If [CreateElasticIP4B, !GetAtt ElasticIP4B.AllocationId, !Ref "AWS::NoValue"]
        - !If [CreateElasticIP5B, !GetAtt ElasticIP5B.AllocationId, !Ref "AWS::NoValue"]
        - !If [CreateElasticIP6B, !GetAtt ElasticIP6B.AllocationId, !Ref "AWS::NoValue"]
        - !If [CreateElasticIP7B, !GetAtt ElasticIP7B.AllocationId, !Ref "AWS::NoValue"]
        - !If [CreateElasticIP8B, !GetAtt ElasticIP8B.AllocationId, !Ref "AWS::NoValue"]
      SubnetId: !Ref PublicSubnet2
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-PrivateSubnetGateway2

  PrivateSubnetGateway3:
    Condition: PrivateSubnetIsMultiAZ
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !If
        - CreateElasticIP1C
        - !GetAtt ElasticIP1C.AllocationId
        - !Ref AWS::NoValue
      SecondaryAllocationIds:
        - !If [CreateElasticIP2C, !GetAtt ElasticIP2C.AllocationId, !Ref "AWS::NoValue"]
        - !If [CreateElasticIP3C, !GetAtt ElasticIP3C.AllocationId, !Ref "AWS::NoValue"]
        - !If [CreateElasticIP4C, !GetAtt ElasticIP4C.AllocationId, !Ref "AWS::NoValue"]
        - !If [CreateElasticIP5C, !GetAtt ElasticIP5C.AllocationId, !Ref "AWS::NoValue"]
        - !If [CreateElasticIP6C, !GetAtt ElasticIP6C.AllocationId, !Ref "AWS::NoValue"]
        - !If [CreateElasticIP7C, !GetAtt ElasticIP7C.AllocationId, !Ref "AWS::NoValue"]
        - !If [CreateElasticIP8C, !GetAtt ElasticIP8C.AllocationId, !Ref "AWS::NoValue"]
      SubnetId: !Ref PublicSubnet3
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-PrivateSubnetGateway3

  ElasticIP1:
    Condition: CreateElasticIP1
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-ElasticIP1

  ElasticIP2:
    Condition: CreateElasticIP2
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-ElasticIP2

  ElasticIP3:
    Condition: CreateElasticIP3
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-ElasticIP3

  ElasticIP4:
    Condition: CreateElasticIP4
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-ElasticIP4

  ElasticIP5:
    Condition: CreateElasticIP5
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-ElasticIP5

  ElasticIP6:
    Condition: CreateElasticIP6
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-ElasticIP6

  ElasticIP7:
    Condition: CreateElasticIP7
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-ElasticIP7

  ElasticIP8:
    Condition: CreateElasticIP8
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-ElasticIP8

  ElasticIP1B:
    Condition: CreateElasticIP1B
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-ElasticIP1B

  ElasticIP2B:
    Condition: CreateElasticIP2B
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-ElasticIP2B

  ElasticIP3B:
    Condition: CreateElasticIP3B
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-ElasticIP3B

  ElasticIP4B:
    Condition: CreateElasticIP4B
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-ElasticIP4B

  ElasticIP5B:
    Condition: CreateElasticIP5B
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-ElasticIP5B

  ElasticIP6B:
    Condition: CreateElasticIP6B
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-ElasticIP6B

  ElasticIP7B:
    Condition: CreateElasticIP7B
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-ElasticIP7B

  ElasticIP8B:
    Condition: CreateElasticIP8B
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-ElasticIP8B

  ElasticIP1C:
    Condition: CreateElasticIP1C
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-ElasticIP1C

  ElasticIP2C:
    Condition: CreateElasticIP2C
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-ElasticIP2C

  ElasticIP3C:
    Condition: CreateElasticIP3C
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-ElasticIP3C

  ElasticIP4C:
    Condition: CreateElasticIP4C
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-ElasticIP4C

  ElasticIP5C:
    Condition: CreateElasticIP5C
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-ElasticIP5C

  ElasticIP6C:
    Condition: CreateElasticIP6C
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-ElasticIP6C

  ElasticIP7C:
    Condition: CreateElasticIP7C
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-ElasticIP7C

  ElasticIP8C:
    Condition: CreateElasticIP8C
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-ElasticIP8C

  PublicSubnet1:
    Type: AWS::EC2::Subnet
    DependsOn: VPCIPv6CidrBlock
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [0, !GetAZs ""]
      CidrBlock: !Select [0, !Cidr [!GetAtt [VPC, CidrBlock], 16, !Ref VpcCidrSubnetBits]]
      MapPublicIpOnLaunch: !If [IsPrivateOnly, false, true]
      AssignIpv6AddressOnCreation: true
      Ipv6CidrBlock:
        Fn::Select:
          - 3
          - Fn::Cidr:
            - Fn::Select:
              - 0
              - Fn::GetAtt:
                - VPC
                - Ipv6CidrBlocks
            - 256
            - 64
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-PublicSubnet1

  PublicSubnet2:
    Type: AWS::EC2::Subnet
    DependsOn: VPCIPv6CidrBlock
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [1, !GetAZs ""]
      CidrBlock: !Select [1, !Cidr [!GetAtt [VPC, CidrBlock], 16, !Ref VpcCidrSubnetBits]]
      MapPublicIpOnLaunch: !If [IsPrivateOnly, false, true]
      AssignIpv6AddressOnCreation: true
      Ipv6CidrBlock:
        Fn::Select:
          - 4
          - Fn::Cidr:
            - Fn::Select:
              - 0
              - Fn::GetAtt:
                - VPC
                - Ipv6CidrBlocks
            - 256
            - 64
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-PublicSubnet2

  PublicSubnet3:
    Type: AWS::EC2::Subnet
    DependsOn: VPCIPv6CidrBlock
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [2, !GetAZs ""]
      CidrBlock: !Select [2, !Cidr [!GetAtt [VPC, CidrBlock], 16, !Ref VpcCidrSubnetBits]]
      MapPublicIpOnLaunch: !If [IsPrivateOnly, false, true]
      AssignIpv6AddressOnCreation: true
      Ipv6CidrBlock:
        Fn::Select:
          - 5
          - Fn::Cidr:
            - Fn::Select:
              - 0
              - Fn::GetAtt:
                - VPC
                - Ipv6CidrBlocks
            - 256
            - 64
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-PublicSubnet3

  S3VpcEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref VPC
      ServiceName:
        Fn::Sub: "com.amazonaws.${AWS::Region}.s3"
      VpcEndpointType: Gateway
      RouteTableIds:
        - !Ref PublicRouteTable
        - !Ref PrivateSubnet1RouteTable
        - !Ref PrivateSubnet2RouteTable
        - !Ref PrivateSubnet3RouteTable

  VPCEndpointSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for VPC Endpoints (EC2 and ECR)
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: !Ref VpcCidrBlock
          Description: "Allow HTTPS from VPC CIDR for EC2 and ECR endpoints"
      SecurityGroupEgress:
        - IpProtocol: "-1"
          CidrIp: "0.0.0.0/0"
          Description: "Allow all outbound traffic"
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName

  # EC2.10 - Amazon EC2 should be configured to use VPC endpoints that are created for the Amazon EC2 service
  # Incurs additional cost
  EC2VpcEndpoint:
    Condition: CreateInterfaceEndpointEc2
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref VPC
      ServiceName: !Sub "com.amazonaws.${AWS::Region}.ec2"
      VpcEndpointType: Interface
      PrivateDnsEnabled: true
      SubnetIds:
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2
        - !Ref PrivateSubnet3
      SecurityGroupIds:
        - !Ref VPCEndpointSecurityGroup

  ECRApiVpcEndpoint:
    Condition: CreateInterfaceEndpointEcrApi
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref VPC
      ServiceName: !Sub "com.amazonaws.${AWS::Region}.ecr.api"
      VpcEndpointType: Interface
      PrivateDnsEnabled: true
      SubnetIds:
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2
        - !Ref PrivateSubnet3
      SecurityGroupIds:
        - !Ref VPCEndpointSecurityGroup

  ECRDockerVpcEndpoint:
    Condition: CreateInterfaceEndpointEcrDocker
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref VPC
      ServiceName: !Sub "com.amazonaws.${AWS::Region}.ecr.dkr"
      VpcEndpointType: Interface
      PrivateDnsEnabled: true
      SubnetIds:
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2
        - !Ref PrivateSubnet3
      SecurityGroupIds:
        - !Ref VPCEndpointSecurityGroup

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-InternetGateway

  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: Name
          Value: !Sub ${AWS::StackName}-PublicRouteTable

  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: AttachGateway
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  PublicRouteIPv6:
    Type: AWS::EC2::Route
    DependsOn: AttachGateway
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationIpv6CidrBlock: ::/0
      GatewayId: !Ref InternetGateway

  SubnetRouteTableAssociation1:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet1
      RouteTableId: !Ref PublicRouteTable

  SubnetRouteTableAssociation2:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet2
      RouteTableId: !Ref PublicRouteTable

  SubnetRouteTableAssociation3:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet3
      RouteTableId: !Ref PublicRouteTable

  EC2FleetLaunchTemplateLinuxDefault:
    Type: AWS::EC2::LaunchTemplate
    Properties:
      TagSpecifications:
        - ResourceType: launch-template
          Tags:
            - Key: !Ref CostAllocationTag
              Value: !Ref AWS::StackName
      LaunchTemplateData:
        TagSpecifications:
          - ResourceType: instance
            Tags:
              - Key: !Ref CostAllocationTag
                Value: !Ref AWS::StackName
          - ResourceType: volume
            Tags:
              - Key: !Ref CostAllocationTag
                Value: !Ref AWS::StackName
          - ResourceType: network-interface
            Tags:
              - Key: !Ref CostAllocationTag
                Value: !Ref AWS::StackName
        IamInstanceProfile:
          Arn: !GetAtt EC2InstanceProfile.Arn
        EbsOptimized: "true"
        MetadataOptions:
          HttpTokens: required
          HttpPutResponseHopLimit: 2
        BlockDeviceMappings:
          - DeviceName: !Ref RunnerDefaultDiskDeviceName
            Ebs:
              VolumeSize: !Ref RunnerDefaultDiskSize
              VolumeType: gp3
              Throughput: !Ref RunnerDefaultVolumeThroughput
              Iops: 3000
              DeleteOnTermination: true
              Encrypted: !If [HasEncryptEbs, true, false]
              KmsKeyId: !If [HasEncryptEbs, alias/aws/ebs, Ref: AWS::NoValue]
        InstanceInitiatedShutdownBehavior: "terminate"
        Monitoring:
          !If
            - ECInstanceDetailedMonitoringEnabled
            - Enabled: true
            - Ref: AWS::NoValue
        NetworkInterfaces:
          - DeleteOnTermination: true
            DeviceIndex: "0"
            Groups:
              - !Ref SecurityGroup
            Ipv6AddressCount: !If [HasIpv6Enabled, 1, 0]
        UserData:
          Fn::Base64: !Sub
            - |
              #!/bin/bash -e
              _the_end() {
                echo "user-data: Going to shut down in a few seconds..." && sleep 45s && shutdown -h now
              } ; trap _the_end EXIT INT TERM
              export RUNS_ON_BOOSTRAP_PATH="${S3Bucket}.s3.${AWS::Region}.amazonaws.com/agents/${AppVersion}"
              export RUNS_ON_LOG_GROUP_NAME="${EC2InstanceLogGroup}"
              b=$(mktemp) ; time curl --connect-time 3 --max-time 10 --retry 5 -s "https://$RUNS_ON_BOOSTRAP_PATH/bootstrap.sh" -o $b ; bash -ex $b
            - AppVersion: !FindInMap [App, Image, Tag]

  EC2FleetLaunchTemplateLinuxLarge:
    Type: AWS::EC2::LaunchTemplate
    Properties:
      TagSpecifications:
        - ResourceType: launch-template
          Tags:
            - Key: !Ref CostAllocationTag
              Value: !Ref AWS::StackName
      LaunchTemplateData:
        TagSpecifications:
          - ResourceType: instance
            Tags:
              - Key: !Ref CostAllocationTag
                Value: !Ref AWS::StackName
          - ResourceType: volume
            Tags:
              - Key: !Ref CostAllocationTag
                Value: !Ref AWS::StackName
          - ResourceType: network-interface
            Tags:
              - Key: !Ref CostAllocationTag
                Value: !Ref AWS::StackName
        IamInstanceProfile:
          Arn: !GetAtt EC2InstanceProfile.Arn
        EbsOptimized: "true"
        MetadataOptions:
          HttpTokens: required
          HttpPutResponseHopLimit: 2
        BlockDeviceMappings:
          - DeviceName: !Ref RunnerLargeDiskDeviceName
            Ebs:
              VolumeSize: !Ref RunnerLargeDiskSize
              VolumeType: gp3
              Throughput: !Ref RunnerLargeVolumeThroughput
              Iops: 4000
              DeleteOnTermination: true
              Encrypted: !If [HasEncryptEbs, true, false]
              KmsKeyId: !If [HasEncryptEbs, alias/aws/ebs, Ref: AWS::NoValue]
        InstanceInitiatedShutdownBehavior: "terminate"
        Monitoring:
          !If
            - ECInstanceDetailedMonitoringEnabled
            - Enabled: true
            - Ref: AWS::NoValue
        NetworkInterfaces:
          - DeleteOnTermination: true
            DeviceIndex: "0"
            Groups:
              - !Ref SecurityGroup
            Ipv6AddressCount: !If [HasIpv6Enabled, 1, 0]
        UserData:
          Fn::Base64: !Sub
            - |
              #!/bin/bash -e
              _the_end() {
                echo "user-data: Going to shut down in a few seconds..." && sleep 45s && shutdown -h now
              } ; trap _the_end EXIT INT TERM
              export RUNS_ON_BOOSTRAP_PATH="${S3Bucket}.s3.${AWS::Region}.amazonaws.com/agents/${AppVersion}"
              export RUNS_ON_LOG_GROUP_NAME="${EC2InstanceLogGroup}"
              b=$(mktemp) ; time curl --connect-time 3 --max-time 10 --retry 5 -s "https://$RUNS_ON_BOOSTRAP_PATH/bootstrap.sh" -o $b ; bash -ex $b
            - AppVersion: !FindInMap [App, Image, Tag]

  EC2FleetLaunchTemplateWindowsDefault:
    Type: AWS::EC2::LaunchTemplate
    Properties:
      TagSpecifications:
        - ResourceType: launch-template
          Tags:
            - Key: !Ref CostAllocationTag
              Value: !Ref AWS::StackName
      LaunchTemplateData:
        TagSpecifications:
          - ResourceType: instance
            Tags:
              - Key: !Ref CostAllocationTag
                Value: !Ref AWS::StackName
          - ResourceType: volume
            Tags:
              - Key: !Ref CostAllocationTag
                Value: !Ref AWS::StackName
          - ResourceType: network-interface
            Tags:
              - Key: !Ref CostAllocationTag
                Value: !Ref AWS::StackName
        IamInstanceProfile:
          Arn: !GetAtt EC2InstanceProfile.Arn
        EbsOptimized: "true"
        MetadataOptions:
          HttpTokens: required
          HttpPutResponseHopLimit: 2
        BlockDeviceMappings:
          # Windows is always /dev/sda1 - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/device_naming.html
          - DeviceName: /dev/sda1
            Ebs:
              VolumeSize: !Ref RunnerDefaultDiskSize
              VolumeType: gp3
              Throughput: !Ref RunnerDefaultVolumeThroughput
              Iops: 3000
              DeleteOnTermination: true
              Encrypted: !If [HasEncryptEbs, true, false]
              KmsKeyId: !If [HasEncryptEbs, alias/aws/ebs, Ref: AWS::NoValue]
        InstanceInitiatedShutdownBehavior: "terminate"
        Monitoring:
          !If
            - ECInstanceDetailedMonitoringEnabled
            - Enabled: true
            - Ref: AWS::NoValue
        NetworkInterfaces:
          - DeleteOnTermination: true
            DeviceIndex: "0"
            Groups:
              - !Ref SecurityGroup
            Ipv6AddressCount: !If [HasIpv6Enabled, 1, 0]
        UserData:
          Fn::Base64: !Sub
            - |
              <powershell>
              try {
                $env:RUNS_ON_BOOSTRAP_PATH = "${S3Bucket}.s3.${AWS::Region}.amazonaws.com/agents/${AppVersion}"
                $env:RUNS_ON_LOG_GROUP_NAME = "${EC2InstanceLogGroup}"
                $b = [System.IO.Path]::ChangeExtension((New-TemporaryFile).FullName, ".ps1")
                Write-Host "Downloading bootstrap.ps1 to $b"
                Invoke-WebRequest -Uri "https://$env:RUNS_ON_BOOSTRAP_PATH/bootstrap.ps1" -OutFile $b -UseBasicParsing
                Write-Host "Running $b"
                powershell -File $b
              } finally {
                Write-Output "user-data: Going to shut down in a few seconds..."
                Start-Sleep -Seconds 45
                Stop-Computer -Force
              }
              </powershell>
            - AppVersion: !FindInMap [App, Image, Tag]

  EC2FleetLaunchTemplateWindowsLarge:
    Type: AWS::EC2::LaunchTemplate
    Properties:
      TagSpecifications:
        - ResourceType: launch-template
          Tags:
            - Key: !Ref CostAllocationTag
              Value: !Ref AWS::StackName
      LaunchTemplateData:
        TagSpecifications:
          - ResourceType: instance
            Tags:
              - Key: !Ref CostAllocationTag
                Value: !Ref AWS::StackName
          - ResourceType: volume
            Tags:
              - Key: !Ref CostAllocationTag
                Value: !Ref AWS::StackName
          - ResourceType: network-interface
            Tags:
              - Key: !Ref CostAllocationTag
                Value: !Ref AWS::StackName
        IamInstanceProfile:
          Arn: !GetAtt EC2InstanceProfile.Arn
        EbsOptimized: "true"
        MetadataOptions:
          HttpTokens: required
          HttpPutResponseHopLimit: 2
        BlockDeviceMappings:
          - DeviceName: /dev/sda1
            Ebs:
              VolumeSize: !Ref RunnerLargeDiskSize
              VolumeType: gp3
              Throughput: !Ref RunnerLargeVolumeThroughput
              Iops: 4000
              DeleteOnTermination: true
              Encrypted: !If [HasEncryptEbs, true, false]
              KmsKeyId: !If [HasEncryptEbs, alias/aws/ebs, Ref: AWS::NoValue]
        InstanceInitiatedShutdownBehavior: "terminate"
        Monitoring:
          !If
            - ECInstanceDetailedMonitoringEnabled
            - Enabled: true
            - Ref: AWS::NoValue
        NetworkInterfaces:
          - DeleteOnTermination: true
            DeviceIndex: "0"
            Groups:
              - !Ref SecurityGroup
            Ipv6AddressCount: !If [HasIpv6Enabled, 1, 0]
        UserData:
          Fn::Base64: !Sub
            - |
              <powershell>
              try {
                $env:RUNS_ON_BOOSTRAP_PATH = "${S3Bucket}.s3.${AWS::Region}.amazonaws.com/agents/${AppVersion}"
                $env:RUNS_ON_LOG_GROUP_NAME = "${EC2InstanceLogGroup}"
                $b = [System.IO.Path]::ChangeExtension((New-TemporaryFile).FullName, ".ps1")
                Write-Host "Downloading bootstrap.ps1 to $b"
                Invoke-WebRequest -Uri "https://$env:RUNS_ON_BOOSTRAP_PATH/bootstrap.ps1" -OutFile $b -UseBasicParsing
                Write-Host "Running $b"
                powershell -File $b
              } finally {
                Write-Output "user-data: Going to shut down in a few seconds..."
                Start-Sleep -Seconds 45
                Stop-Computer -Force
              }
              </powershell>
            - AppVersion: !FindInMap [App, Image, Tag]

  SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for SSH access
      VpcId:
        Ref: VPC
      SecurityGroupIngress:
        - !If
          - HasSSHAllowed
          - CidrIp:
              Fn::Sub: "${SSHCidrRange}"
            FromPort: 22
            ToPort: 22
            IpProtocol: tcp
          - !Ref AWS::NoValue
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName

  S3Bucket:
    Type: AWS::S3::Bucket
    UpdateReplacePolicy: Retain
    DeletionPolicy: RetainExceptOnCreate
    Properties:
      VersioningConfiguration:
        Status: Enabled
      LifecycleConfiguration:
        Rules:
          - Id: ExpireAgentBinaries
            Prefix: agents/v1*
            Status: Enabled
            ExpirationInDays: 30
            NoncurrentVersionExpiration:
              NoncurrentDays: 30
          - Id: ExpireDbEntries
            Prefix: runs-on/db/
            Status: Enabled
            ExpirationInDays: 30
            NoncurrentVersionExpiration:
              NoncurrentDays: 30
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        IgnorePublicAcls: true
        BlockPublicPolicy: true
        RestrictPublicBuckets: true
      LoggingConfiguration:
        DestinationBucketName: !Ref S3BucketLogging
        LogFilePrefix: s3-config-access-logs/
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: "runs-on/purpose"
          Value: "config"

  S3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref S3Bucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: AllowReadForAgentBinariesFromVpcEndpoint
            Effect: Allow
            Principal: "*"
            Action: "s3:GetObject"
            Resource: !Sub "arn:aws:s3:::${S3Bucket}/agents/*"
            Condition:
              StringEquals:
                aws:SourceVpce: !Ref S3VpcEndpoint
          - Sid: DenyUnencryptedConnections
            Effect: Deny
            Principal: "*"
            Action: "s3:*"
            Resource:
              - !Sub "arn:aws:s3:::${S3Bucket}"
              - !Sub "arn:aws:s3:::${S3Bucket}/*"
            Condition:
              Bool:
                aws:SecureTransport: false

  S3BucketCache:
    Type: AWS::S3::Bucket
    UpdateReplacePolicy: Retain
    DeletionPolicy: RetainExceptOnCreate
    Properties:
      VersioningConfiguration:
        Status: Suspended
      LifecycleConfiguration:
        Rules:
          - Id: ExpireRunnerConfig
            Prefix: runners/
            Status: Enabled
            ExpirationInDays: 1
            NoncurrentVersionExpiration:
              NoncurrentDays: 1
          - Id: ExpireCache
            Prefix: cache/
            Status: Enabled
            ExpirationInDays: !Ref S3CacheExpirationInDays
            NoncurrentVersionExpiration:
              NoncurrentDays: 10
      LoggingConfiguration:
        DestinationBucketName: !Ref S3BucketLogging
        LogFilePrefix: s3-cache-access-logs/
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: "runs-on/purpose"
          Value: "cache"

  S3BucketCachePolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref S3BucketCache
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: DenyUnencryptedConnections
            Effect: Deny
            Principal: "*"
            Action: "s3:*"
            Resource:
              - !Sub "arn:aws:s3:::${S3BucketCache}"
              - !Sub "arn:aws:s3:::${S3BucketCache}/*"
            Condition:
              Bool:
                aws:SecureTransport: false

  S3BucketLogging:
    Type: AWS::S3::Bucket
    UpdateReplacePolicy: Retain
    DeletionPolicy: RetainExceptOnCreate
    Properties:
      VersioningConfiguration:
        Status: Enabled
      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerPreferred
      LifecycleConfiguration:
        Rules:
          - Id: DeleteOldLogs
            Status: Enabled
            ExpirationInDays: 30
            NoncurrentVersionExpiration:
              NoncurrentDays: 30
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
        - Key: "runs-on/purpose"
          Value: "s3-access-logs"

  S3BucketLoggingPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref S3BucketLogging
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: DenyUnencryptedConnections
            Effect: Deny
            Principal: "*"
            Action: "s3:*"
            Resource:
              - !Sub "arn:aws:s3:::${S3BucketLogging}"
              - !Sub "arn:aws:s3:::${S3BucketLogging}/*"
            Condition:
              Bool:
                aws:SecureTransport: false
          - Sid: S3ServerAccessLogsPolicy
            Effect: Allow
            Principal:
              Service: logging.s3.amazonaws.com
            Action: "s3:PutObject"
            Resource:
              - !Sub "arn:aws:s3:::${S3BucketLogging}/s3-cache-access-logs/*"
              - !Sub "arn:aws:s3:::${S3BucketLogging}/s3-config-access-logs/*"
            Condition:
              StringEquals:
                aws:SourceAccount: !Sub ${AWS::AccountId}
              ArnLike:
                aws:Sourcearn:
                  - !Sub "arn:aws:s3:::${S3BucketCache}"
                  - !Sub "arn:aws:s3:::${S3Bucket}"

  EC2InstanceLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      RetentionInDays: !Ref Ec2LogRetentionInDays
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName

  EC2InstanceRole:
    Type: AWS::IAM::Role
    Properties:
      PermissionsBoundary: !If [HasDefaultPermissionBoundaryArn, !Ref DefaultPermissionBoundaryArn, !Ref "AWS::NoValue"]
      ManagedPolicyArns:
        !If [CustomPolicyProvided, [!Ref EC2InstanceCustomPolicy, "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"], ["arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"]]
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: DescribeTags
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - ec2:DescribeTags
                # No way (that I know of) to limit this to the instance itself.
                Resource: "*"
        - PolicyName: CreateTags
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - ec2:CreateTags
                Resource: "*"
                Condition:
                  StringEquals:
                    "aws:ARN": "${ec2:SourceInstanceARN}"
        - PolicyName: SendLogs
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "logs:PutLogEvents"
                  - "logs:PutRetentionPolicy"
                  - "logs:DescribeLogStreams"
                  - "logs:DescribeLogGroups"
                  - "logs:CreateLogStream"
                  - "logs:CreateLogGroup"
                Resource:
                - !Sub "${EC2InstanceLogGroup.Arn}"
                - !Sub "${EC2InstanceLogGroup.Arn}:*"
        - PolicyName: SendMetrics
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - cloudwatch:PutMetricData
                Resource: "*"
                Condition:
                  StringEquals:
                    cloudwatch:namespace: "RunsOn/Runners"
        - PolicyName: EC2AccessS3BucketPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:PutObject
                  - s3:DeleteObject
                  - s3:ListBucket
                  - s3:GetBucketLocation
                  - s3:ListBucketMultipartUploads
                  - s3:ListMultipartUploadParts
                Resource:
                  - !Sub "arn:aws:s3:::${S3BucketCache}"
                  - !Sub "arn:aws:s3:::${S3BucketCache}/cache/*"
              - Effect: Allow
                Action:
                  - s3:GetObject
                Resource:
                  - !Join
                    - ""
                    - [
                        !Sub "arn:aws:s3:::${S3BucketCache}/runners/",
                        "${aws:userid}/*",
                      ]
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName

  EC2InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - !Ref EC2InstanceRole

  SchedulerCostReport:
    Condition: CostReportsEnabled
    Type: AWS::Scheduler::Schedule
    Properties:
      ScheduleExpression: "cron(5 0 * * ? *)"
      ScheduleExpressionTimezone: "UTC"
      FlexibleTimeWindow:
        Mode: "OFF"
      Target:
        Arn: !GetAtt RunsOnQueueEvents.Arn
        RoleArn: !GetAtt SchedulerInvokeRole.Arn
        RetryPolicy:
          MaximumRetryAttempts: 0
        Input: '{"detail-type":"RunsOn Cost Report"}'

  SchedulerCostAllocationTag:
    Condition: CostReportsEnabled
    Type: AWS::Scheduler::Schedule
    Properties:
      ScheduleExpression: "cron(10 0 * * ? *)"
      ScheduleExpressionTimezone: "UTC"
      FlexibleTimeWindow:
        Mode: "OFF"
      Target:
        Arn: !GetAtt RunsOnQueueEvents.Arn
        RoleArn: !GetAtt SchedulerInvokeRole.Arn
        RetryPolicy:
          MaximumRetryAttempts: 0
        Input: '{"detail-type":"RunsOn Cost Allocation Tag"}'

  SchedulerInvokeRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: scheduler.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: "AllowSQSSendMessage"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: sqs:SendMessage
                Resource: !GetAtt RunsOnQueueEvents.Arn

  RunsOnServiceAutoScalingConfiguration:
    Type: AWS::AppRunner::AutoScalingConfiguration
    Properties:
      MaxConcurrency: 100
      MaxSize: 25
      MinSize: 1
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName

  RunsOnService:
    Type: AWS::AppRunner::Service
    Properties:
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
      InstanceConfiguration:
        Cpu: !Ref AppCPU
        Memory: !Ref AppMemory
        InstanceRoleArn: !GetAtt RunsOnServiceRole.Arn
      NetworkConfiguration:
        EgressConfiguration:
          EgressType: DEFAULT
        IngressConfiguration:
          IsPubliclyAccessible: true
        IpAddressType: IPV4
      HealthCheckConfiguration:
        Path: /ping
        Protocol: HTTP
        HealthyThreshold: 1
        UnhealthyThreshold: 10
        Interval: 3
      AutoScalingConfigurationArn: !Ref RunsOnServiceAutoScalingConfiguration
      SourceConfiguration:
        ImageRepository:
          ImageConfiguration:
            Port: 8080
            RuntimeEnvironmentVariables:
              - Name: RUNS_ON_ENV
                Value: !Ref Environment
              - Name: RUNS_ON_COST_ALLOCATION_TAG
                Value: !Ref CostAllocationTag
              - Name: RUNS_ON_STACK_NAME
                Value: !Ref AWS::StackName
              - Name: RUNS_ON_ORG
                Value: !Ref GithubOrganization
              - Name: RUNS_ON_APP_VERSION
                Value: !FindInMap [App, Image, Tag]
              - Name: RUNS_ON_LICENSE_KEY
                Value: !Ref LicenseKey
              - Name: RUNS_ON_RUNNER_CUSTOM_TAGS
                Value: !Join [",", !Ref RunnerCustomTags]
              - Name: RUNS_ON_BUCKET_CONFIG
                Value: !Ref S3Bucket
              - Name: RUNS_ON_BUCKET_CACHE
                Value: !Ref S3BucketCache
              - Name: RUNS_ON_SECURITY_GROUP_ID
                Value: !Ref SecurityGroup
              - Name: RUNS_ON_INSTANCE_PROFILE_ARN
                Value: !GetAtt EC2InstanceProfile.Arn
              - Name: RUNS_ON_INSTANCE_ROLE_NAME
                Value: !Ref EC2InstanceRole
              - Name: RUNS_ON_TOPIC_ARN
                Value: !Ref AlertTopic
              - Name: RUNS_ON_REGION
                Value: !Ref AWS::Region
              - Name: RUNS_ON_APP_EC2_QUEUE_SIZE
                Value: !Ref AppEc2QueueSize
              - Name: RUNS_ON_PUBLIC_SUBNET1
                Value: !Ref PublicSubnet1
              - Name: RUNS_ON_PUBLIC_SUBNET2
                Value: !Ref PublicSubnet2
              - Name: RUNS_ON_PUBLIC_SUBNET3
                Value: !Ref PublicSubnet3
              - Name: RUNS_ON_PRIVATE_SUBNET1
                Value: !Ref PrivateSubnet1
              - Name: RUNS_ON_PRIVATE_SUBNET2
                Value: !Ref PrivateSubnet2
              - Name: RUNS_ON_PRIVATE_SUBNET3
                Value: !Ref PrivateSubnet3
              - Name: RUNS_ON_PRIVATE
                Value: !Ref Private
              - Name: RUNS_ON_DEFAULT_ADMINS
                Value: !Ref DefaultAdmins
              - Name: RUNS_ON_LAUNCH_TEMPLATE_LINUX_DEFAULT
                Value: !Join [":", [!Ref EC2FleetLaunchTemplateLinuxDefault, !GetAtt EC2FleetLaunchTemplateLinuxDefault.LatestVersionNumber]]
              - Name: RUNS_ON_LAUNCH_TEMPLATE_LINUX_LARGE
                Value: !Join [":", [!Ref EC2FleetLaunchTemplateLinuxLarge, !GetAtt EC2FleetLaunchTemplateLinuxLarge.LatestVersionNumber]]
              - Name: RUNS_ON_LAUNCH_TEMPLATE_WINDOWS_DEFAULT
                Value: !Join [":", [!Ref EC2FleetLaunchTemplateWindowsDefault, !GetAtt EC2FleetLaunchTemplateWindowsDefault.LatestVersionNumber]]
              - Name: RUNS_ON_LAUNCH_TEMPLATE_WINDOWS_LARGE
                Value: !Join [":", [!Ref EC2FleetLaunchTemplateWindowsLarge, !GetAtt EC2FleetLaunchTemplateWindowsLarge.LatestVersionNumber]]
              - Name: RUNS_ON_RUNNER_DEFAULT_DISK_SIZE
                Value: !Ref RunnerDefaultDiskSize
              - Name: RUNS_ON_RUNNER_LARGE_DISK_SIZE
                Value: !Ref RunnerLargeDiskSize
              - Name: RUNS_ON_QUEUE
                Value: !Ref RunsOnQueue
              - Name: RUNS_ON_QUEUE_HOUSEKEEPING
                Value: !Ref RunsOnQueueHousekeeping
              - Name: RUNS_ON_QUEUE_TERMINATION
                Value: !Ref RunsOnQueueTermination
              - Name: RUNS_ON_QUEUE_EVENTS
                Value: !Ref RunsOnQueueEvents
              - Name: RUNS_ON_COST_REPORTS_ENABLED
                Value: !Ref CostReportsEnabled
              - Name: RUNS_ON_SERVER_PASSWORD
                Value: !Ref ServerPassword
              - Name: RUNS_ON_SPOT_CIRCUIT_BREAKER
                Value: !Ref SpotCircuitBreaker
              - Name: RUNS_ON_INTEGRATION_STEP_SECURITY_API_KEY
                Value: !Ref IntegrationStepSecurityApiKey
              - Name: RUNS_ON_GITHUB_ENTERPRISE_URL
                Value: !Ref GithubEnterpriseUrl
          ImageIdentifier: !Sub
            - "${AppRegistry}:${AppVersion}"
            - AppVersion: !FindInMap [App, Image, Tag]
          ImageRepositoryType: ECR_PUBLIC

  RunsOnServiceRole:
    Type: AWS::IAM::Role
    Properties:
      PermissionsBoundary: !If [HasDefaultPermissionBoundaryArn, !Ref DefaultPermissionBoundaryArn, !Ref "AWS::NoValue"]
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - tasks.apprunner.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: AppRunnerEC2Permissions
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - ec2:DescribeImages
                  - ec2:DescribeInstances
                  - ce:GetCostAndUsage
                  - ce:UpdateCostAllocationTagsStatus
                  - cloudwatch:PutMetricData
                  - cloudwatch:GetMetricData
                  - cloudwatch:DescribeAlarms
                  - cloudtrail:LookupEvents
                Resource: "*"
              - Effect: Allow
                Action:
                  - cloudformation:DescribeStacks
                Resource: !Ref AWS::StackId
              - Effect: Allow
                Action:
                  - ec2:CreateFleet
                  - ec2:DeleteFleets
                Resource: "*"
              - Effect: Allow
                Action:
                  - ec2:CreateTags
                  - ec2:RunInstances
                Resource:
                  - !Sub "arn:aws:ec2:${AWS::Region}::image/*"
                  - !Sub "arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:*"
              - Effect: Allow
                Action:
                  - iam:PassRole
                  - iam:GetRole
                Resource: !GetAtt EC2InstanceRole.Arn
              - Effect: Allow
                Action:
                  - ssm:PutParameter
                  - ssm:GetParameter
                  - ssm:GetParameters
                  - ssm:DeleteParameter
                  - ssm:DeleteParameters
                Resource:
                  - !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${AWS::StackName}/*"
              - Effect: Allow
                Action:
                  - ec2:TerminateInstances
                Resource: !Sub "arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:instance/*"
                Condition:
                  StringEquals:
                    "aws:ResourceTag/provider": "runs-on.com"
              - Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:PutObject
                Resource:
                  - Fn::Sub: arn:aws:s3:::${S3Bucket}
                  - Fn::Sub: arn:aws:s3:::${S3Bucket}/*
              - Effect: Allow
                Action:
                  - s3:PutObject
                Resource:
                  - Fn::Sub: arn:aws:s3:::${S3BucketCache}
                  - Fn::Sub: arn:aws:s3:::${S3BucketCache}/runners/*
                  - Fn::Sub: arn:aws:s3:::${S3BucketCache}/agents/*
              - Effect: Allow
                Action:
                  - sns:Publish
                Resource: !Ref AlertTopic
              - Effect: Allow
                Action:
                  - sqs:SendMessage
                  - sqs:ReceiveMessage
                  - sqs:DeleteMessage
                  - sqs:GetQueueAttributes
                Resource:
                  - !GetAtt RunsOnQueue.Arn
                  - !GetAtt RunsOnQueueHousekeeping.Arn
                  - !GetAtt RunsOnQueueTermination.Arn
                  - !GetAtt RunsOnQueueEvents.Arn

  MinutesPerDayAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: !Sub "RunsOn daily usage exceeds ${AppAlarmDailyMinutes} minutes"
      Namespace: RunsOn
      MetricName: minutesNoDimension
      Dimensions:
        - Name: StackName
          Value: !Ref AWS::StackName
      Statistic: Sum
      Period: 86400 # 24h
      EvaluationPeriods: 1
      Threshold: !Ref AppAlarmDailyMinutes
      ComparisonOperator: GreaterThanThreshold
      TreatMissingData: "notBreaching"
      AlarmActions:
        - !Ref AlertTopic
      OKActions:
        - !Ref AlertTopic

  RunsOnQueueDeadLetter:
    Type: AWS::SQS::Queue
    Properties:
      FifoQueue: true
      MessageRetentionPeriod: 259200 # 3 days

  RunsOnQueueDeadLetterPolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      Queues:
        - !Ref RunsOnQueueDeadLetter
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal: "*"
            Action: "sqs:SendMessage"
            Resource: !GetAtt RunsOnQueueDeadLetter.Arn
            Condition:
              ArnEquals:
                aws:SourceArn: !Ref RunsOnQueue

  RunsOnQueue:
    Type: AWS::SQS::Queue
    Properties:
      FifoQueue: true
      ContentBasedDeduplication: true
      MessageRetentionPeriod: 86400 # 24h
      ReceiveMessageWaitTimeSeconds: 10
      VisibilityTimeout: 120 # AWS recommends 6 times the max processing time
      RedrivePolicy:
        deadLetterTargetArn: !GetAtt RunsOnQueueDeadLetter.Arn
        maxReceiveCount: 5
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName

  RunsOnQueueHousekeeping:
    Type: AWS::SQS::Queue
    Properties:
      MessageRetentionPeriod: 86400 # 24h
      ReceiveMessageWaitTimeSeconds: 20
      VisibilityTimeout: 120
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName

  RunsOnQueueTermination:
    Type: AWS::SQS::Queue
    Properties:
      MessageRetentionPeriod: 86400 # 24h
      ReceiveMessageWaitTimeSeconds: 20
      VisibilityTimeout: 120
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName

  RunsOnQueueEvents:
    Type: AWS::SQS::Queue
    Properties:
      MessageRetentionPeriod: 7200
      ReceiveMessageWaitTimeSeconds: 20
      VisibilityTimeout: 120
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName

  RunsOnQueueDeadLetterOldestMessageAlarm:
    Condition: CreateSqsQueueOldestMessageAlarms
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: !Sub "SQS queue RunsOnQueueDeadLetter oldest message age excedes ${SqsQueueOldestMessageThresholdSeconds} seconds."
      Namespace: AWS/SQS
      MetricName: ApproximateAgeOfOldestMessage
      Dimensions:
      - Name: QueueName
        Value: !GetAtt RunsOnQueueDeadLetter.QueueName
      Statistic: Maximum
      Period: 60
      EvaluationPeriods: 1
      Threshold: !Ref SqsQueueOldestMessageThresholdSeconds
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: "notBreaching"
      AlarmActions:
        - !Ref AlertTopic
      OKActions:
        - !Ref AlertTopic

  RunsOnQueueOldestMessageAlarm:
    Condition: CreateSqsQueueOldestMessageAlarms
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: !Sub "SQS queue RunsOnQueue oldest message age excedes ${SqsQueueOldestMessageThresholdSeconds} seconds."
      Namespace: AWS/SQS
      MetricName: ApproximateAgeOfOldestMessage
      Dimensions:
      - Name: QueueName
        Value: !GetAtt RunsOnQueue.QueueName
      Statistic: Maximum
      Period: 60
      EvaluationPeriods: 1
      Threshold: !Ref SqsQueueOldestMessageThresholdSeconds
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: "notBreaching"
      AlarmActions:
        - !Ref AlertTopic
      OKActions:
        - !Ref AlertTopic

  RunsOnQueueHousekeepingOldestMessageAlarm:
    Condition: CreateSqsQueueOldestMessageAlarms
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: !Sub "SQS queue RunsOnQueueHousekeeping oldest message age excedes ${SqsQueueOldestMessageThresholdSeconds} seconds."
      Namespace: AWS/SQS
      MetricName: ApproximateAgeOfOldestMessage
      Dimensions:
      - Name: QueueName
        Value: !GetAtt RunsOnQueueHousekeeping.QueueName
      Statistic: Maximum
      Period: 60
      EvaluationPeriods: 1
      Threshold: !Ref SqsQueueOldestMessageThresholdSeconds
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: "notBreaching"
      AlarmActions:
        - !Ref AlertTopic
      OKActions:
        - !Ref AlertTopic

  RunsOnQueueTerminationOldestMessageAlarm:
    Condition: CreateSqsQueueOldestMessageAlarms
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: !Sub "SQS queue RunsOnQueueTermination oldest message age excedes ${SqsQueueOldestMessageThresholdSeconds} seconds."
      Namespace: AWS/SQS
      MetricName: ApproximateAgeOfOldestMessage
      Dimensions:
      - Name: QueueName
        Value: !GetAtt RunsOnQueueTermination.QueueName
      Statistic: Maximum
      Period: 60
      EvaluationPeriods: 1
      Threshold: !Ref SqsQueueOldestMessageThresholdSeconds
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: "notBreaching"
      AlarmActions:
        - !Ref AlertTopic
      OKActions:
        - !Ref AlertTopic

  RunsOnQueueEventsOldestMessageAlarm:
    Condition: CreateSqsQueueOldestMessageAlarms
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: !Sub "SQS queue RunsOnQueueEvents oldest message age excedes ${SqsQueueOldestMessageThresholdSeconds} seconds."
      Namespace: AWS/SQS
      MetricName: ApproximateAgeOfOldestMessage
      Dimensions:
      - Name: QueueName
        Value: !GetAtt RunsOnQueueEvents.QueueName
      Statistic: Maximum
      Period: 60
      EvaluationPeriods: 1
      Threshold: !Ref SqsQueueOldestMessageThresholdSeconds
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: "notBreaching"
      AlarmActions:
        - !Ref AlertTopic
      OKActions:
        - !Ref AlertTopic

  SpotInstanceEventRule:
    Type: AWS::Events::Rule
    Properties:
      Description: "Rule to capture EC2 Spot Instance interruption notices"
      EventPattern:
        source:
          - aws.ec2
        detail-type:
          - EC2 Spot Instance Interruption Warning
          - EC2 Instance State-change Notification
      State: ENABLED
      Targets:
        - Arn: !GetAtt RunsOnQueueEvents.Arn
          Id: InstanceEvents
          
  SpotInstanceEventRulePermission:
    Type: AWS::SQS::QueuePolicy
    Properties:
      Queues:
        - !Ref RunsOnQueueEvents
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Action: sqs:SendMessage
            Resource: !GetAtt RunsOnQueueEvents.Arn
            Condition:
              ArnEquals:
                aws:SourceArn: !GetAtt SpotInstanceEventRule.Arn

  AlertTopic:
    Type: AWS::SNS::Topic
    Properties:
      Tags:
        - Key: !Ref CostAllocationTag
          Value: !Ref AWS::StackName
      DisplayName: RunsOn Alerts

  AlertTopicSubscription:
    Type: AWS::SNS::Subscription
    Properties:
      Protocol: email
      TopicArn: !Ref AlertTopic
      Endpoint: !If [EmailProvided, !Ref EmailAddress, ""]

  AlertTopicSubscriptionHttps:
    Condition: AlertTopicSubscriptionHttpsProvided
    Type: AWS::SNS::Subscription
    Properties:
      Protocol: https
      TopicArn: !Ref AlertTopic
      Endpoint: !Ref AlertTopicSubscriptionHttpsEndpoint

Outputs:
  RunsOnEntryPoint:
    Description: Entrypoint for the RunsOn service
    Value: !GetAtt RunsOnService.ServiceUrl
  RunsOnService:
    Description: Link to the AppRunner service in AWS console
    Value: !Sub "https://${AWS::Region}.console.aws.amazon.com/apprunner/home?region=${AWS::Region}#/services/dashboard?service_arn=${RunsOnService}"
  RunsOnOrg:
    Description: GitHub organization or personal account
    Value: !Ref GithubOrganization
  RunsOnLicenseKey:
    Description: License key
    Value: !Ref LicenseKey
  RunsOnRegion:
    Description: AWS region
    Value: !Ref AWS::Region
  RunsOnVPCId:
    Description: VPC ID
    Value: !Ref VPC
    Export:
      Name: !Sub "${AWS::StackName}-VPCId"
  RunsOnVpcCidrBlock:
    Description: VPC CIDR block
    Value: !Ref VpcCidrBlock
    Export:
      Name: !Sub "${AWS::StackName}-VpcCidrBlock"
  RunsOnPublicRouteTableId:
    Description: Public Route Table ID
    Value: !Ref PublicRouteTable
    Export:
      Name: !Sub "${AWS::StackName}-PublicRouteTableId"
  RunsOnPrivateRouteTable1Id:
    Description: Private Route Table 1 ID
    Value: !Ref PrivateSubnet1RouteTable
    Export:
      Name: !Sub "${AWS::StackName}-PrivateRouteTable1Id"
  RunsOnPrivateRouteTable2Id:
    Description: Private Route Table 2 ID
    Value: !Ref PrivateSubnet2RouteTable
    Export:
      Name: !Sub "${AWS::StackName}-PrivateRouteTable2Id"
  RunsOnPrivateRouteTable3Id:
    Description: Private Route Table 3 ID
    Value: !Ref PrivateSubnet3RouteTable
    Export:
      Name: !Sub "${AWS::StackName}-PrivateRouteTable3Id"
  RunsOnEgressStaticIps:
    Description: Static IPs for egress traffic (if configured)
    Value: !If
      - HasPrivateSubnet
      - !Join
        - ","
        - !Split
          - ","
          - !Join
            - ","
            - - !If [CreateElasticIP1, !Ref ElasticIP1, !Ref "AWS::NoValue"]
              - !If [CreateElasticIP2, !Ref ElasticIP2, !Ref "AWS::NoValue"]
              - !If [CreateElasticIP3, !Ref ElasticIP3, !Ref "AWS::NoValue"]
              - !If [CreateElasticIP4, !Ref ElasticIP4, !Ref "AWS::NoValue"]
              - !If [CreateElasticIP5, !Ref ElasticIP5, !Ref "AWS::NoValue"]
              - !If [CreateElasticIP6, !Ref ElasticIP6, !Ref "AWS::NoValue"]
              - !If [CreateElasticIP7, !Ref ElasticIP7, !Ref "AWS::NoValue"]
              - !If [CreateElasticIP8, !Ref ElasticIP8, !Ref "AWS::NoValue"]
      - ""
  RunsOnPublicSubnet1:
    Description: Public subnet 1
    Value: !Ref PublicSubnet1
  RunsOnPublicSubnet2:
    Description: Public subnet 2
    Value: !Ref PublicSubnet2
  RunsOnPublicSubnet3:
    Description: Public subnet 3
    Value: !Ref PublicSubnet3
  RunsOnPrivateSubnet1:
    Description: Private subnet 1
    Value: !Ref PrivateSubnet1
  RunsOnPrivateSubnet2:
    Description: Private subnet 2
    Value: !Ref PrivateSubnet2
  RunsOnPrivateSubnet3:
    Description: Private subnet 3
    Value: !Ref PrivateSubnet3
  RunsOnPrivate:
    Description: Private subnets enabled
    Value: !Ref Private
  RunsOnRunnerDefaultDiskSize:
    Description: Default disk size for runners
    Value: !Ref RunnerDefaultDiskSize
  RunsOnRunnerLargeDiskSize:
    Description: Large disk size for runners
    Value: !Ref RunnerLargeDiskSize
  RunsOnRunnerCustomTags:
    Description: Custom tags for runners
    Value: !Join [",", !Ref RunnerCustomTags]
  RunsOnInstanceProfileArn:
    Description: Runner instance profile ARN
    Value: !GetAtt EC2InstanceProfile.Arn
  RunsOnInstanceProfileName:
    Description: Runner instance profile Name
    Value: !Ref EC2InstanceProfile
  RunsOnInstanceRoleName:
    Description: Runner instance role Name
    Value: !Ref EC2InstanceRole
  RunsOnSecurityGroupId:
    Description: Security group for runners
    Value: !Ref SecurityGroup
  RunsOnBucketConfig:
    Description: S3 bucket for storing configuration
    Value: !Ref S3Bucket
  RunsOnBucketCache:
    Description: S3 bucket for storing cache artifacts
    Value: !Ref S3BucketCache
  RunsOnTopicArn:
    Description: SNS Topic where email alerts and reports are sent
    Value: !Ref AlertTopic
  RunsOnDefaultAdmins:
    Description: Default GitHub usernames with SSH access to the runners
    Value: !Ref DefaultAdmins
  RunsOnLaunchTemplateLinuxDefault:
    Description: Default Linux launch template for the RunsOn service
    Value: !Join [":", [!Ref EC2FleetLaunchTemplateLinuxDefault, !GetAtt EC2FleetLaunchTemplateLinuxDefault.LatestVersionNumber]]
  RunsOnLaunchTemplateLinuxLarge:
    Description: Large Linux launch template for the RunsOn service
    Value: !Join [":", [!Ref EC2FleetLaunchTemplateLinuxLarge, !GetAtt EC2FleetLaunchTemplateLinuxLarge.LatestVersionNumber]]
  RunsOnLaunchTemplateWindowsDefault:
    Description: Default Windows launch template for the RunsOn service
    Value: !Join [":", [!Ref EC2FleetLaunchTemplateWindowsDefault, !GetAtt EC2FleetLaunchTemplateWindowsDefault.LatestVersionNumber]]
  RunsOnLaunchTemplateWindowsLarge:
    Description: Large Windows launch template for the RunsOn service
    Value: !Join [":", [!Ref EC2FleetLaunchTemplateWindowsLarge, !GetAtt EC2FleetLaunchTemplateWindowsLarge.LatestVersionNumber]]
  RunsOnAppVersion:
    Description: Version of the RunsOn service
    Value: !FindInMap [App, Image, Tag]
  RunsOnStackName:
    Description: Name of the stack
    Value: !Ref AWS::StackName
  RunsOnAppEc2QueueSize:
    Description: Size of the EC2 queue
    Value: !Ref AppEc2QueueSize
  RunsOnQueue:
    Description: SQS queue for the RunsOn service
    Value: !Ref RunsOnQueue
  RunsOnQueueHousekeeping:
    Description: SQS queue for the RunsOn service, used for non-critical housekeeping tasks
    Value: !Ref RunsOnQueueHousekeeping
  RunsOnQueueTermination:
    Description: SQS queue for the RunsOn service, used for runner termination tasks
    Value: !Ref RunsOnQueueTermination
  RunsOnQueueEvents:
    Description: SQS queue for the RunsOn service, used for events from other AWS services
    Value: !Ref RunsOnQueueEvents
  RunsOnCostReportsEnabled:
    Description: Enable or disable cost reports sent by email
    Value: !Ref CostReportsEnabled
  RunsOnServerPassword:
    Description: Password for the RunsOn server
    Value: !Ref ServerPassword
  RunsOnCostAllocationTag:
    Description: Cost allocation tag for the RunsOn service
    Value: !Ref CostAllocationTag
  RunsOnServiceArn:
    Description: ARN of the App Runner service
    Value: !Ref RunsOnService
  RunsOnEC2InstanceLogGroupArn:
    Description: Log group ARN for the EC2 instances
    Value: !Ref EC2InstanceLogGroup