fargate-endpoints-catalog.yaml

### This template is based on the reference architecture developed or documented by Paul Lewis of AWS
### https://github.com/pjlewisuk/fargate-refarch-cloudformation

Description: >
    ECS Service definition for HackOregon's endpoints catalog

Parameters:

## Miscellaneous configuration parameters

    ProjectName:
        Description: The canonical name of the project, used in many places in this script
        Type: String

    DeploymentSsmNamespace:
        Description: The namespace prefix in which the service's SSM parameters are found
        Type: String

## ALB configuration parameters

    Listener:
        Description: The Application Load Balancer listener to register with
        Type: String

    ListenerTls:
        Description: The 443 Application Load Balancer listener to register with
        Type: String

    ListenerRulePriority:
        Description: Load Balancer priority for the base listener
        Type: Number

    ListenerRuleTlsPriority:
        Description: Load Balancer priority for the TLS listener
        Type: Number

    ListenerRuleSecondaryPriority:
        Description: Load Balancer priority for the base listener for secondary path
        Type: Number

    ListenerRuleSecondaryTlsPriority:
        Description: Load Balancer priority for the TLS listener for secondary path
        Type: Number

    Host:
        Description: The host path to register with the Application Load Balancer
        Type: String

    Path:
        Description: The path to register with the Application Load Balancer
        Type: String

    PathSecondary:
        Description: The secondary path to register with the Application Load Balancer
        Type: String

    HealthCheckPathName:
        Description: The path for ALB to check the health of the container
        Type: String

## ECS configuration parameters

    VPC:
        Description: The VPC that the ECS cluster is deployed to
        Type: AWS::EC2::VPC::Id

    Cluster:
        Description: Please provide the ECS Cluster ID that this service should run on
        Type: String

    DesiredCount:
        Default: 0 # Allows us to deploy the service even if there's no container image to launch
        Description: How many instances of this task should we run across our cluster?
        Type: Number

    ECSTaskExecutionRole:
        Description: The ECS Task Execution Role
        Type: String

    TaskCpu:
        Default: 256
        Description: How much CPU to give the ECS task, in CPU units (where 1,024 units is 1 CPU) or vCPUs
        Type: Number

    TaskMemory:
        Default: 512
        Description: How much memory to give the ECS task in megabytes
        Type: Number

    ContainerPort:
        Description: The TCP port on which the container app is listening
        Type: Number

    SecurityGroup:
        Description: Select the Security Group to use for the ECS cluster hosts
        Type: AWS::EC2::SecurityGroup::Id

    Subnets:
        Description: Choose which subnets this ECS cluster should be deployed to
        Type: List<AWS::EC2::Subnet::Id>
    # Use !Select to choose 0 and 1 from subnet array, e.g. !Select [ 0, !Ref Subnets ]

    EcrImage:
        Description: the container image to be deployed from ECR (Elastic Container Registry)
        ## EXPERIMENTAL - based on https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecr-repository.html
        ## Might want to just pass in a String instead of strongly-typing this parameter
        # Type: AWS::ECR::Repository
        Type: String

Resources:

## This service definition introduces NetworkConfiguration and lacks PlacementStrategies and Role
    Service:
        Type: AWS::ECS::Service
        DependsOn: ListenerRule
        Properties:
            Cluster: !Ref Cluster
            DeploymentConfiguration:
                MaximumPercent: 200
                MinimumHealthyPercent: 100
            DesiredCount: !Ref DesiredCount
            LaunchType: FARGATE
            NetworkConfiguration:
                AwsvpcConfiguration:
                    AssignPublicIp: ENABLED
                    SecurityGroups:
                      - !Ref SecurityGroup
                    Subnets:
                      - !Select [ 0, !Ref Subnets ]
                      - !Select [ 1, !Ref Subnets ]
            TaskDefinition: !Ref TaskDefinition
            LoadBalancers:
                - ContainerName: !Ref ProjectName
                  ContainerPort: !Ref ContainerPort
                  TargetGroupArn: !Ref TargetGroup
            Tags:
                - Key: Account
                  Value: HackOregon
                - Key: Project
                  Value: Admin

    TaskDefinition:
        Type: AWS::ECS::TaskDefinition
        Properties:
            Family: !Ref ProjectName
            Cpu: !Ref TaskCpu
            Memory: !Ref TaskMemory
            NetworkMode: awsvpc
            RequiresCompatibilities:
              - FARGATE
            ExecutionRoleArn: !Ref ECSTaskExecutionRole
            TaskRoleArn: !Ref TaskRole
            Tags:
                - Key: Account
                  Value: HackOregon
                - Key: Project
                  Value: Admin
            ContainerDefinitions:
                - Name: !Ref ProjectName
                  Essential: true
                  Image: !Ref EcrImage
                  ## NOTE: these Container resource values can be smaller than Task if there are multiple Containers per Task
                  ## Since we deploy one Container per Task, there's no reason to use different values
                  Cpu: !Ref TaskCpu
                  Memory: !Ref TaskMemory # This is the minimum memory
                  MemoryReservation: !Ref TaskMemory # This is the upper burstable limit
                  PortMappings:
                    - ContainerPort: !Ref ContainerPort
                  LogConfiguration:
                    LogDriver: awslogs
                    Options:
                        awslogs-group: !Ref AWS::StackName
                        awslogs-region: !Ref AWS::Region
                        awslogs-stream-prefix: !Ref AWS::StackName

    CloudWatchLogsGroup:
        Type: AWS::Logs::LogGroup
        Properties:
            LogGroupName: !Ref AWS::StackName
            RetentionInDays: 365

    TargetGroup:
        Type: AWS::ElasticLoadBalancingV2::TargetGroup
        Properties:
            VpcId: !Ref VPC
            Port: 80
            Protocol: HTTP
            TargetType: ip
            Matcher:
                # HttpCode: 200-299
                HttpCode: 200-299,404 # Civic Devops issue #254
            HealthCheckIntervalSeconds: 10
            HealthCheckPath: !Ref HealthCheckPathName
            HealthCheckProtocol: HTTP
            HealthCheckTimeoutSeconds: 5
            HealthyThresholdCount: 2

    ListenerRule:
        Type: AWS::ElasticLoadBalancingV2::ListenerRule
        Properties:
            ListenerArn: !Ref Listener
            Priority: !Ref ListenerRulePriority
            Conditions:
                - Field: host-header
                  Values:
                    - !Ref Host
                - Field: path-pattern
                  Values:
                    - !Ref Path
            Actions:
                - TargetGroupArn: !Ref TargetGroup
                  Type: forward

    ListenerRuleTls:
        Type: AWS::ElasticLoadBalancingV2::ListenerRule
        Properties:
            ListenerArn: !Ref ListenerTls
            Priority: !Ref ListenerRuleTlsPriority
            Conditions:
                - Field: host-header
                  Values:
                    - !Ref Host
                - Field: path-pattern
                  Values:
                    - !Ref Path
            Actions:
                - TargetGroupArn: !Ref TargetGroup
                  Type: forward

    # Since the listener rule only applies strictly to / and the project has static assets,
    # /__assets also needs to be routed into this container
    ListenerRuleSecondary:
        Type: AWS::ElasticLoadBalancingV2::ListenerRule
        Properties:
            ListenerArn: !Ref Listener
            Priority: !Ref ListenerRuleSecondaryPriority
            Conditions:
                - Field: host-header
                  Values:
                    - !Ref Host
                - Field: path-pattern
                  Values:
                    - !Ref PathSecondary
            Actions:
                - TargetGroupArn: !Ref TargetGroup
                  Type: forward

    # Since the listener rule only applies strictly to / and the project has static assets,
    # /__assets also needs to be routed into this container
    ListenerRuleSecondaryTls:
        Type: AWS::ElasticLoadBalancingV2::ListenerRule
        Properties:
            ListenerArn: !Ref ListenerTls
            Priority: !Ref ListenerRuleSecondaryTlsPriority
            Conditions:
                - Field: host-header
                  Values:
                    - !Ref Host
                - Field: path-pattern
                  Values:
                    - !Ref PathSecondary
            Actions:
                - TargetGroupArn: !Ref TargetGroup
                  Type: forward

    ## TODO: extract this role to a global role for all Fargate tasks

    # This IAM Role grants the Fargate-based service access to register/unregister with the
    # Application Load Balancer (ALB). It is based on the default documented here:
    # http://docs.aws.amazon.com/AmazonECS/latest/developerguide/service_IAM_role.html
    #
    # It also has the side-effect of allowing other parts of the stack to attach other IAM policies
    # such as allowing SSM access.
    TaskRole:
        Type: AWS::IAM::Role
        Properties:
            RoleName: !Sub ecs-service-${AWS::StackName}
            Path: /
            AssumeRolePolicyDocument: |
                {
                    "Statement": [{
                        "Effect": "Allow",
                        "Principal": { "Service": [ "ecs-tasks.amazonaws.com" ]},
                        "Action": [ "sts:AssumeRole" ]
                    }]
                }
            Policies:
                - PolicyName: !Sub ecs-service-${AWS::StackName}
                  PolicyDocument:
                    {
                        "Version": "2012-10-17",
                        "Statement": [{
                                "Effect": "Allow",
                                "Action": [
                                    "ec2:AuthorizeSecurityGroupIngress",
                                    "ec2:Describe*",
                                    "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
                                    "elasticloadbalancing:Describe*",
                                    "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
                                    "elasticloadbalancing:DeregisterTargets",
                                    "elasticloadbalancing:DescribeTargetGroups",
                                    "elasticloadbalancing:DescribeTargetHealth",
                                    "elasticloadbalancing:RegisterTargets"
                                ],
                                "Resource": "*"
                        }]
                    }
                - PolicyName: ssm-access
                  PolicyDocument:
                    {
                        "Version": "2012-10-17",
                        "Statement": [
                            {
                                "Effect": "Allow",
                                "Action": [
                                    "ssm:DescribeParameters"
                                ],
                                "Resource": "*"
                            },
                            {
                                "Sid": "Stmt1482841904000",
                                "Effect": "Allow",
                                "Action": [
                                    "ssm:GetParameters"
                                ],
                                "Resource": [
                                    "arn:aws:ssm:us-west-2:845828040396:parameter/staging/2018/*",
                                    "arn:aws:ssm:us-west-2:845828040396:parameter/production/2018/*",
                                    "arn:aws:ssm:us-west-2:845828040396:parameter/staging/2019*",
                                    "arn:aws:ssm:us-west-2:845828040396:parameter/production/2019/*"
                                ]
                            },
                            {
                                "Sid": "Stmt1482841948000",
                                "Effect": "Allow",
                                "Action": [
                                    "kms:Decrypt"
                                ],
                                "Resource": [
                                    "arn:aws:kms:us-west-2:845828040396:key/0280a59b-d8f5-44e0-8b51-80aec2f27275"
                                ]
                            }
                        ]
                    }