ecs-cluster.yaml

Description: >
    This template deploys an ECS cluster to the provided VPC and subnets
    using an Auto Scaling Group

Parameters:

    EnvironmentName:
        Description: An environment name that will be prefixed to resource names
        Type: String

    InstanceType:
        Description: Which instance type should we use to build the ECS cluster?
        Type: String
        Default: t2.large

    ClusterSize:
        Description: How many ECS hosts do you want to initially deploy?
        Type: Number
        Default: 2

    VPC:
        Description: Choose which VPC this ECS cluster should be deployed to
        Type: AWS::EC2::VPC::Id

    Subnets:
        Description: Choose which subnets this ECS cluster should be deployed to
        Type: List<AWS::EC2::Subnet::Id>

    SecurityGroup:
        Description: Select the Security Group to use for the ECS cluster hosts
        Type: AWS::EC2::SecurityGroup::Id

    KeyPairName:
        Description: Key Pair for access the ecs host instances
        Type: String

    ECSAMI:
        Description: ECS-Optimized AMI ID
        #### Temporary - civic-devops-282 ###
        # Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
        Type: String
        # Default: /aws/service/ecs/optimized-ami/amazon-linux/recommended/image_id

Resources:

    ECSCluster:
        Type: AWS::ECS::Cluster
        Properties:
            ClusterName: !Ref EnvironmentName

    ECSAutoScalingGroup:
        Type: AWS::AutoScaling::AutoScalingGroup
        Properties:
            VPCZoneIdentifier: !Ref Subnets
            LaunchConfigurationName: !Ref ECSLaunchConfiguration
            MinSize: !Ref ClusterSize
            MaxSize: !Ref ClusterSize
            DesiredCapacity: !Ref ClusterSize
            Tags:
                - Key: Name
                  Value: !Sub ${EnvironmentName} ECS host
                  PropagateAtLaunch: true
                - Key: Account
                  Value: HackOregon
                  PropagateAtLaunch: true
                - Key: Project
                  Value: Admin
                  PropagateAtLaunch: true
        CreationPolicy:
            ResourceSignal:
                Timeout: PT15M
        UpdatePolicy:
            AutoScalingRollingUpdate:
                MinInstancesInService: 1
                MaxBatchSize: 1
                PauseTime: PT15M
                WaitOnResourceSignals: true

    ECSLaunchConfiguration:
        Type: AWS::AutoScaling::LaunchConfiguration
        Properties:
            ImageId:  !Ref ECSAMI
            InstanceType: !Ref InstanceType
            KeyName: !Ref KeyPairName
            SecurityGroups:
                - !Ref SecurityGroup
            BlockDeviceMappings:
            - DeviceName: /dev/xvdcz
              Ebs:
                VolumeSize: 22
                VolumeType: gp2
            IamInstanceProfile: !Ref ECSInstanceProfile
            UserData:
                "Fn::Base64": !Sub |
                    #!/bin/bash
                    yum install -y aws-cfn-bootstrap
                    echo "ECS_IMAGE_CLEANUP_INTERVAL=10m" >> /etc/ecs/ecs.config
                    echo "ECS_IMAGE_MINIMUM_CLEANUP_AGE=15m" >> /etc/ecs/ecs.config
                    echo "ECS_NUM_IMAGES_DELETE_PER_CYCLE=10" >> /etc/ecs/ecs.config
                    echo "ECS_ENGINE_TASK_CLEANUP_WAIT_DURATION=5m" >> /etc/ecs/ecs.config
                    /opt/aws/bin/cfn-init -v --region ${AWS::Region} --stack ${AWS::StackName} --resource ECSLaunchConfiguration
                    /opt/aws/bin/cfn-signal -e $? --region ${AWS::Region} --stack ${AWS::StackName} --resource ECSAutoScalingGroup

        Metadata:
            AWS::CloudFormation::Init:
                config:
                    commands:
                        01_add_instance_to_cluster:
                            command: !Sub echo ECS_CLUSTER=${ECSCluster} >> /etc/ecs/ecs.config
                    files:
                        "/etc/cfn/cfn-hup.conf":
                            mode: 000400
                            owner: root
                            group: root
                            content: !Sub |
                                [main]
                                stack=${AWS::StackId}
                                region=${AWS::Region}

                        "/etc/cfn/hooks.d/cfn-auto-reloader.conf":
                            content: !Sub |
                                [cfn-auto-reloader-hook]
                                triggers=post.update
                                path=Resources.ContainerInstances.Metadata.AWS::CloudFormation::Init
                                action=/opt/aws/bin/cfn-init -v --region ${AWS::Region} --stack ${AWS::StackName} --resource ECSLaunchConfiguration

                    services:
                        sysvinit:
                            cfn-hup:
                                enabled: true
                                ensureRunning: true
                                files:
                                    - /etc/cfn/cfn-hup.conf
                                    - /etc/cfn/hooks.d/cfn-auto-reloader.conf

    # This IAM Role is attached to all of the ECS hosts. It is based on the default role
    # published here:
    # http://docs.aws.amazon.com/AmazonECS/latest/developerguide/instance_IAM_role.html
    #
    # You can add other IAM policy statements here to allow access from your ECS hosts
    # to other AWS services. Please note that this role will be used by ALL containers
    # running on the ECS host.

    ECSRole:
        Type: AWS::IAM::Role
        Properties:
            Path: /
            RoleName: !Sub ${EnvironmentName}-ECSRole-${AWS::Region}
            AssumeRolePolicyDocument: |
                {
                    "Statement": [{
                        "Action": "sts:AssumeRole",
                        "Effect": "Allow",
                        "Principal": {
                            "Service": "ec2.amazonaws.com"
                        }
                    }]
                }
            Policies:
                - PolicyName: ecs-service
                  PolicyDocument: |
                    {
                        "Statement": [{
                            "Effect": "Allow",
                            "Action": [
                                "ecs:CreateCluster",
                                "ecs:DeregisterContainerInstance",
                                "ecs:DiscoverPollEndpoint",
                                "ecs:Poll",
                                "ecs:RegisterContainerInstance",
                                "ecs:StartTelemetrySession",
                                "ecs:Submit*",
                                "logs:CreateLogStream",
                                "logs:PutLogEvents",
                                "ecr:BatchCheckLayerAvailability",
                                "ecr:BatchGetImage",
                                "ecr:GetDownloadUrlForLayer",
                                "ecr:GetAuthorizationToken",
                                "s3:GetObject"
                            ],
                            "Resource": "*"
                        }]
                    }
                - PolicyName: ssm-access
                  PolicyDocument:
                    {
                        "Version": "2012-10-17",
                        "Statement": [
                            {
                                "Effect": "Allow",
                                "Action": [
                                    "ssm:DescribeParameters"
                                ],
                                "Resource": "*"
                            },
                            {
                                "Sid": "Stmt1482841904000",
                                "Effect": "Allow",
                                "Action": [
                                    "ssm:GetParameters"
                                ],
                                "Resource": [
                                    "arn:aws:ssm:us-west-2:845828040396:parameter/production/2017/*",
                                    "arn:aws:ssm:us-west-2:845828040396:parameter/staging/2018/*",
                                    "arn:aws:ssm:us-west-2:845828040396:parameter/production/2018/*",
                                    "arn:aws:ssm:us-west-2:845828040396:parameter/staging/2019*",
                                    "arn:aws:ssm:us-west-2:845828040396:parameter/production/2019/*"
                                ]
                            },
                            {
                                "Sid": "Stmt1482841948000",
                                "Effect": "Allow",
                                "Action": [
                                    "kms:Decrypt"
                                ],
                                "Resource": [
                                    "arn:aws:kms:us-west-2:845828040396:key/0280a59b-d8f5-44e0-8b51-80aec2f27275"
                                ]
                            }
                        ]
                    }

    ECSInstanceProfile:
        Type: AWS::IAM::InstanceProfile
        Properties:
            Path: /
            Roles:
                - !Ref ECSRole

    # This is a role which is used by the ECS service to perform ECS API actions on your
    # behalf, such pulling container images from ECR, or storing container application
    # logs in CloudWatch.
    ECSTaskExecutionRole:
        Type: AWS::IAM::Role
        Properties:
            AssumeRolePolicyDocument:
                Statement:
                - Effect: Allow
                  Principal:
                    Service: [ecs-tasks.amazonaws.com]
                  Action: ['sts:AssumeRole']
            Path: /
            Policies:
                - PolicyName: AmazonECSTaskExecutionRolePolicy
                  PolicyDocument:
                    Statement:
                    - Effect: Allow
                      Action:
                        # Allow the ECS Tasks to download images from ECR
                        - 'ecr:GetAuthorizationToken'
                        - 'ecr:BatchCheckLayerAvailability'
                        - 'ecr:GetDownloadUrlForLayer'
                        - 'ecr:BatchGetImage'

                        # Allow the ECS tasks to upload logs to CloudWatch
                        - 'logs:CreateLogStream'
                        - 'logs:PutLogEvents'
                      Resource: '*'

    ECSInstanceProfile:
        Type: AWS::IAM::InstanceProfile
        Properties:
            Path: /
            Roles:
                - !Ref ECSRole

Outputs:

    Cluster:
        Description: A reference to the ECS cluster
        Value: !Ref ECSCluster

    ECSTaskExecutionRole:
        Description: A reference to the ECS Task Execution Role
        Value: !GetAtt ECSTaskExecutionRole.Arn