resources.yml

AWSTemplateFormatVersion: '2010-09-09'
Description: Redis, and any other resources that the chat app needs.
Parameters:
  EnvironmentName:
    Type: String
    Default: production
    Description: The environment name, used for locating outputs from the
                 prerequisite stacks
Resources:
  # Subnet group to control where the Redis gets placed
  RedisSubnetGroup:
    Type: AWS::ElastiCache::SubnetGroup
    Properties:
      Description: Group of subnets to place Redis into
      SubnetIds:
        - Fn::ImportValue:
            !Join [':', [!Ref 'EnvironmentName', 'PublicSubnetOne']]
        - Fn::ImportValue:
            !Join [':', [!Ref 'EnvironmentName', 'PublicSubnetTwo']]

  # Security group to add the Redis cluster to the VPC,
  # and to allow the Fargate containers to talk to Redis on port 6379
  RedisSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: "Redis Security Group"
      VpcId:
        Fn::ImportValue:
          !Join [':', [!Ref 'EnvironmentName', 'VPCId']]
  RedisIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      Description: Ingress from Fargate containers
      GroupId: !Ref 'RedisSecurityGroup'
      IpProtocol: tcp
      FromPort: 6379
      ToPort: 6379
      SourceSecurityGroupId:
        Fn::ImportValue:
          !Join [':', [!Ref 'EnvironmentName', 'FargateContainerSecurityGroup']]

  # The cluster itself.
  Redis:
    Type: AWS::ElastiCache::CacheCluster
    Properties:
      Engine: redis
      CacheNodeType: cache.m4.large
      NumCacheNodes: 1
      CacheSubnetGroupName: !Ref 'RedisSubnetGroup'
      VpcSecurityGroupIds:
        - !GetAtt 'RedisSecurityGroup.GroupId'

  # Table for storing user info
  UsersTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: !Join ['_', [!Ref 'EnvironmentName', 'Users']]
      AttributeDefinitions:
        - AttributeName: username
          AttributeType: S
      KeySchema:
        - AttributeName: username
          KeyType: HASH
      ProvisionedThroughput:
        ReadCapacityUnits: 10
        WriteCapacityUnits: 10

  # Table for storing the messages
  MessagesTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: !Join ['_', [!Ref 'EnvironmentName', 'Messages']]
      AttributeDefinitions:
        - AttributeName: room
          AttributeType: S
        - AttributeName: message
          AttributeType: S
      KeySchema:
        - AttributeName: room
          KeyType: HASH
        - AttributeName: message
          KeyType: RANGE
      ProvisionedThroughput:
        ReadCapacityUnits: 10
        WriteCapacityUnits: 10

  # A role for the service so it can access the tables
  ChatServiceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service: "ecs-tasks.amazonaws.com"
          Action: ['sts:AssumeRole']
      Path: /
      Policies:
      - PolicyName: users-dynamodb-table
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
              - "dynamodb:PutItem"
              - "dynamodb:GetItem"
              - "dynamodb:Query"
              - "dynamodb:Scan"
              - "dynamodb:UpdateItem"
              - "dynamodb:DeleteItem"
            Resource:
              - !Join ['', ['arn:aws:dynamodb:*:*:table/', !Ref 'UsersTable']]
              - !Join ['', ['arn:aws:dynamodb:*:*:table/', !Ref 'MessagesTable']]

Outputs:
  RedisEndpoint:
    Description: The endpoint of the redis cluster
    Value: !GetAtt 'Redis.RedisEndpoint.Address'
    Export:
      Name: !Join [ ':', [ !Ref 'EnvironmentName', 'RedisEndpoint' ] ]
  ChatServiceRole:
    Description: The role of the chat service
    Value: !GetAtt 'ChatServiceRole.Arn'
    Export:
      Name: !Join [ ':', [ !Ref 'EnvironmentName', 'ChatServiceRole' ] ]