bsm-instances.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: "BSM Cloud Formation"
Parameters:
  SourceCodeBucket:
    Type: String
    Default: repo.bsm.pub
  AZ:
    Type: String
    Default: eu-central-1a
  OperatorEMail:
    Description: EMail address to notify if there are any scaling operations
    Type: String
    AllowedPattern: "([a-zA-Z0-9_\\-\\.]+)@((\\[[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.)|(([a-zA-Z0-9\\-]+\\.)+))([a-zA-Z]{2,4}|[0-9]{1,3})(\\]?)"
  OpenApiHttpPort:
    Type: String
    Default: '5000'
  DictionaryHttpPort:
    Type: String
    Default: '5001'
  OpenApiVersion:
    Type: String
  DictionaryVersion:
    Type: String
    Default: 0.0.1

Resources:

  NotificationTopic:
      Type: AWS::SNS::Topic
      Properties:
        Subscription:
        - Endpoint:
            Ref: OperatorEMail
          Protocol: email

  bsmDNS:
      Type: AWS::Route53::RecordSetGroup
      Properties:
        HostedZoneName: bsm.pub.
        Comment: Zone apex alias targeted to BSM LoadBalancer.
        RecordSets:
        - Name: bsm.pub.
          Type: A
          AliasTarget:
            HostedZoneId: !GetAtt bsmELB.CanonicalHostedZoneNameID
            DNSName: !GetAtt bsmELB.DNSName
        - Name: dict.bsm.pub.
          Type: A
          TTL: '900'
          ResourceRecords:
          - !GetAtt DictionaryInstance.PrivateIp

  bsmELB:
    Type: AWS::ElasticLoadBalancing::LoadBalancer
    Properties:
      AvailabilityZones:
        Fn::GetAZs: ''
      CrossZone: 'true'
      Listeners:
      - LoadBalancerPort: '80'
        InstancePort:
          Ref: OpenApiHttpPort
        Protocol: HTTP
      HealthCheck:
        Target: 
          Fn::Join:
          - ''
          - - 'HTTP:'
            - Ref: OpenApiHttpPort
            - "/api/v2/api-docs"
        HealthyThreshold: '3'
        UnhealthyThreshold: '2'
        Interval: '30'
        Timeout: '5'

  OpenApiASG:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      AvailabilityZones:
        Fn::GetAZs: ''
      LaunchConfigurationName:
        Ref: OpenApiLaunchConfig
      MinSize: '1'
      MaxSize: '3'
      LoadBalancerNames:
      - Ref: bsmELB
      NotificationConfiguration:
        TopicARN:
          Ref: NotificationTopic
        NotificationTypes:
        - autoscaling:EC2_INSTANCE_LAUNCH
        - autoscaling:EC2_INSTANCE_LAUNCH_ERROR
        - autoscaling:EC2_INSTANCE_TERMINATE
        - autoscaling:EC2_INSTANCE_TERMINATE_ERROR
    CreationPolicy:
      ResourceSignal:
          Timeout: PT5M
          Count: '0'
    UpdatePolicy:
      AutoScalingRollingUpdate:
        MinInstancesInService: '1'
        MaxBatchSize: '1'
        PauseTime: PT10M
        WaitOnResourceSignals: 'true'

  OpenApiScaleUpPolicy:
      Type: AWS::AutoScaling::ScalingPolicy
      Properties:
        AdjustmentType: ChangeInCapacity
        AutoScalingGroupName:
          Ref: OpenApiASG
        Cooldown: '60'
        ScalingAdjustment: '1'

  OpenApiScaleDownPolicy:
    Type: AWS::AutoScaling::ScalingPolicy
    Properties:
      AdjustmentType: ChangeInCapacity
      AutoScalingGroupName:
        Ref: OpenApiASG
      Cooldown: '60'
      ScalingAdjustment: "-1"

  CPUAlarmHigh:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: Scale-up if CPU > 50% for 1 minute
      MetricName: CPUUtilization
      Namespace: AWS/EC2
      Statistic: Average
      Period: '60'
      EvaluationPeriods: '2'
      Threshold: '50'
      AlarmActions:
      - Ref: OpenApiScaleUpPolicy
      Dimensions:
      - Name: AutoScalingGroupName
        Value:
          Ref: OpenApiASG
      ComparisonOperator: GreaterThanThreshold

  CPUAlarmLow:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: Scale-down if CPU < 50% for 1 minute
      MetricName: CPUUtilization
      Namespace: AWS/EC2
      Statistic: Average
      Period: '60'
      EvaluationPeriods: '2'
      Threshold: '50'
      AlarmActions:
      - Ref: OpenApiScaleDownPolicy
      Dimensions:
      - Name: AutoScalingGroupName
        Value:
          Ref: OpenApiASG
      ComparisonOperator: LessThanThreshold

  OpenApiSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Enable SSH access and HTTP from the load balancer only
      SecurityGroupIngress:
      - CidrIp: 0.0.0.0/0
        FromPort: '22'
        IpProtocol: tcp
        ToPort: '22'
      - IpProtocol: tcp
        FromPort:
          Ref: OpenApiHttpPort
        ToPort:
          Ref: OpenApiHttpPort
        SourceSecurityGroupOwnerId:
          Fn::GetAtt:
          - bsmELB
          - SourceSecurityGroup.OwnerAlias
        SourceSecurityGroupName:
          Fn::GetAtt:
          - bsmELB
          - SourceSecurityGroup.GroupName

  DictionarySecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Enable SSH access and HTTP from the Open Api ASG only
      SecurityGroupIngress:
      - CidrIp: 0.0.0.0/0
        FromPort: '22'
        IpProtocol: tcp
        ToPort: '22'
      - IpProtocol: tcp
        FromPort:
          Ref: DictionaryHttpPort
        ToPort:
          Ref: DictionaryHttpPort
        SourceSecurityGroupId:
          Fn::GetAtt:
          - OpenApiSecurityGroup
          - GroupId

  #Application source code repository access
  RootRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Principal:
              Service:
              - ec2.amazonaws.com
            Action:
            - sts:AssumeRole
        Path: "/"
        Policies:
        - PolicyName: root
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action:
              - s3:Get*
              - s3:List*
              Resource:
                Fn::Join:
                - ''
                - - 'arn:aws:s3:::'
                  - Ref: SourceCodeBucket
                  - "/*"

  RootInstanceProfile:
      Type: AWS::IAM::InstanceProfile
      Properties:
        Path: "/"
        Roles:
        - Ref: RootRole

  OpenApiLaunchConfig:
      Type: AWS::AutoScaling::LaunchConfiguration
      Properties:
        KeyName: MasterKeyBSM
        ImageId: ami-07f1fbbff759e24dd
        SecurityGroups:
        - Ref: OpenApiSecurityGroup
        InstanceType: t2.micro
        IamInstanceProfile:
          Ref: RootInstanceProfile
        UserData:
          Fn::Base64:
            Fn::Join:
            - ''
            - - "#!/bin/bash\n"
              - "set -x"
              - "\n"
              - "exec > >(tee /var/log/user-data.log|logger -t user-data ) 2>&1"
              - "\n"
              - '/opt/aws/bin/cfn-init -v '
              - '         --stack '
              - Ref: AWS::StackName
              - '         --resource OpenApiASG '
              - '         --region '
              - Ref: AWS::Region
              - "\n"
              - "aws s3 cp s3://repo.bsm.pub/release/com/bsm/application/"
              - Ref: OpenApiVersion
              - "/application-"
              - Ref: OpenApiVersion
              - ".jar /opt/open-api/open-api.jar"
              - "\n"
              - "aws s3 cp s3://repo.bsm.pub/cloud-formation-init/open-api/open-api-init.sh /home/ec2-user/open-api-init.sh"
              - "\n"
              - "chmod +x /home/ec2-user/open-api-init.sh"
              - "\n"
              - "bash /home/ec2-user/open-api-init.sh"
              - "\n"
              # Signal the status from cfn-init
              - '/opt/aws/bin/cfn-signal -e $? '
              - '         --stack '
              - Ref: AWS::StackName
              - '         --resource OpenApiASG '
              - '         --region '
              - Ref: AWS::Region
              - "\n"

  DictionaryInstance:
    Type: AWS::EC2::Instance
    Properties:
      AvailabilityZone:
        Ref: AZ
      KeyName: MasterKeyBSM
      ImageId: ami-07f1fbbff759e24dd
      SecurityGroups:
      - Ref: DictionarySecurityGroup
      InstanceType: t2.micro
      IamInstanceProfile:
        Ref: RootInstanceProfile
      UserData:
        Fn::Base64:
          Fn::Join:
          - ''
          - - "#!/bin/bash\n"
            - "set -x"
            - "\n"
            - "exec > >(tee /var/log/user-data.log|logger -t user-data ) 2>&1"
            - "\n"
            - "aws s3 cp s3://repo.bsm.pub/release/com/bsm/dict/application/"
            - Ref: DictionaryVersion
            - "/application-"
            - Ref: DictionaryVersion
            - ".jar /opt/dictionary/dictionary.jar"
            - "\n"
            - "aws s3 cp s3://repo.bsm.pub/cloud-formation-init/dictionary/dictionary-init.sh /home/ec2-user/dictionary-init.sh"
            - "\n"
            - "chmod +x /home/ec2-user/dictionary-init.sh"
            - "\n"
            - "bash /home/ec2-user/dictionary-init.sh"
            - "\n"