07_ec2_codedeploy.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: Part 3 - Setup a CodePipeline with CloudFormation

Parameters:
  AvailabilityZone:
    Type: AWS::EC2::AvailabilityZone::Name
  EnvironmentType:
    Description: 'Specify the Environment type of the stack.'
    Type: String
    Default: dev
    AllowedValues:
      - dev
      - test
      - prod
  AmiID:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Description: 'The ID of the AMI.'
    Default: /aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2
  KeyPairName:
    Type: String
    Description: The name of an existing Amazon EC2 key pair in this region to use to SSH into the Amazon EC2 instances.

  DBInstanceIdentifier:
    Type: String
    Default: 'webapp-db'
  DBUsername:
    NoEcho: 'true'
    Description: Username for Postgresql database access
    Type: String
    MinLength: '1'
    MaxLength: '16'
    AllowedPattern: '[a-zA-Z][a-zA-Z0-9]*'
    ConstraintDescription: Must begin with a letter and contain only alphanumeric characters.
    Default: 'postgres'
  DBPassword:
    NoEcho: 'true'
    Description: Password for Postgresql database access
    Type: String
    MinLength: '8'
    MaxLength: '41'
    AllowedPattern: '[a-zA-Z0-9]*'
    ConstraintDescription: Must contain only alphanumeric characters.

  TagKey:
    Description: The EC2 tag key that identifies this as a target for deployments.
    Type: String
    Default: CodeDeployTag
    AllowedPattern: '[\x20-\x7E]*'
    ConstraintDescription: Can contain only ASCII characters.
  TagValue:
    Description: The EC2 tag value that identifies this as a target for deployments.
    Type: String
    Default: CodeDeployDemo
    AllowedPattern: '[\x20-\x7E]*'
    ConstraintDescription: Can contain only ASCII characters.

Mappings:
  EnvironmentToInstanceType:
    dev:
      InstanceType: t2.nano
    test:
      InstanceType: t2.micro
    prod:
      InstanceType: t2.small

Resources:
  WebAppInstance:
    Type: AWS::EC2::Instance
    Metadata:
      AWS::CloudFormation::Init:
        services:
          sysvint:
            codedeploy-agent:
              enabled: 'true'
              ensureRunning: 'true'
    Properties:
      AvailabilityZone: !Ref AvailabilityZone
      ImageId: !Ref AmiID
      InstanceType: !FindInMap [EnvironmentToInstanceType, !Ref EnvironmentType, InstanceType]
      KeyName: !Ref KeyPairName
      SecurityGroupIds:
        - !Ref WebAppSecurityGroup
      UserData: !Base64
        Fn::Join:
          - ''
          - - "#!/bin/bash -ex\n"
            - "yum update -y aws-cfn-bootstrap\n"
            - "yum install -y aws-cli\n"
            - "yum install -y ruby\n"
            - "iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3000\n"
            - "echo 'iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3000' >> /etc/rc.local\n"
            - "# Helper function.\n"
            - "function error_exit\n"
            - "{\n"
            - '  /opt/aws/bin/cfn-signal -e 1 -r "$1" '''
            - !Ref 'WaitHandle'
            - "'\n"
            - "  exit 1\n"
            - "}\n"
            - "# Install the AWS CodeDeploy Agent.\n"
            - "cd /home/ec2-user/\n"
            - "aws s3 cp 's3://aws-codedeploy-us-east-1/latest/codedeploy-agent.noarch.rpm'\
              \ . || error_exit 'Failed to download AWS CodeDeploy Agent.'\n"
            - "yum -y install codedeploy-agent.noarch.rpm || error_exit 'Failed to\
              \ install AWS CodeDeploy Agent.' \n"
            - '/opt/aws/bin/cfn-init -s '
            - !Ref 'AWS::StackId'
            - ' -r WebAppInstance --region '
            - !Ref 'AWS::Region'
            - " || error_exit 'Failed to run cfn-init.'\n"
            - "# All is well, so signal success.\n"
            - /opt/aws/bin/cfn-signal -e 0 -r "AWS CodeDeploy Agent setup complete."
              '
            - !Ref 'WaitHandle'
            - "'\n"
      Tags:
        - Key: !Ref 'TagKey'
          Value: !Ref 'TagValue'
      IamInstanceProfile: !Ref 'InstanceRoleInstanceProfile'

  WaitHandle:
    Type: AWS::CloudFormation::WaitConditionHandle
  WaitCondition:
    Type: AWS::CloudFormation::WaitCondition
    Properties:
      Handle: !Ref 'WaitHandle'
      Timeout: '900'

  WebAppSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Join [ '-', [ webapp-security-group, !Ref EnvironmentType ] ]
      GroupDescription: 'Allow HTTP/HTTPS and SSH inbound and outbound traffic'
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0

  WebAppEIP:
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      InstanceId: !Ref WebAppInstance
      Tags:
        - Key: Name
          Value: !Join [ '-', [ webapp-eip, !Ref EnvironmentType ] ]

  CodeDeployTrustRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Sid: '1'
            Effect: Allow
            Principal:
              Service:
                - codedeploy.us-east-1.amazonaws.com
                - codedeploy.us-west-2.amazonaws.com
            Action: sts:AssumeRole
      Path: /
  CodeDeployRolePolicies:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: CodeDeployPolicy
      PolicyDocument:
        Statement:
          - Effect: Allow
            Resource:
              - '*'
            Action:
              - ec2:Describe*
          - Effect: Allow
            Resource:
              - '*'
            Action:
              - autoscaling:CompleteLifecycleAction
              - autoscaling:DeleteLifecycleHook
              - autoscaling:DescribeLifecycleHooks
              - autoscaling:DescribeAutoScalingGroups
              - autoscaling:PutLifecycleHook
              - autoscaling:RecordLifecycleActionHeartbeat
      Roles:
        - !Ref 'CodeDeployTrustRole'

  InstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /

  InstanceRolePolicies:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: InstanceRole
      PolicyDocument:
        Statement:
          - Effect: Allow
            Action:
              - autoscaling:Describe*
              - cloudformation:Describe*
              - cloudformation:GetTemplate
              - s3:Get*
            Resource: '*'
      Roles:
        - !Ref 'InstanceRole'

  InstanceRoleInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - !Ref 'InstanceRole'

  WebAppDatabase:
    Type: AWS::RDS::DBInstance
    Properties:
      DBInstanceIdentifier: !Ref DBInstanceIdentifier
      VPCSecurityGroups:
      - !GetAtt DBEC2SecurityGroup.GroupId
      AllocatedStorage: '5'
      DBInstanceClass: db.t3.micro
      Engine: postgres
      MasterUsername: !Ref DBUsername
      MasterUserPassword: !Ref DBPassword
      Tags:
        - Key: Name
          Value: !Join [ '-', [ webapp-rds, !Ref EnvironmentType ] ]
    DeletionPolicy: Snapshot
    UpdateReplacePolicy: Snapshot

  DBEC2SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Join [ '-', [ webapp-db-security-group, !Ref EnvironmentType ] ]
      GroupDescription: Allow postgres inbound traffic
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 5432
        ToPort: 5432
        SourceSecurityGroupName:
          Ref: WebAppSecurityGroup
      Tags:
        - Key: Name
          Value: !Join [ '-', [ webapp-db-security-group, !Ref EnvironmentType ] ]

Outputs:
  WebsiteURL:
    Value: !Sub http://${WebAppEIP}
    Description: WebApp URL

  WebServerPublicDNS:
    Description: 'Public DNS of EC2 instance'
    Value: !GetAtt WebAppInstance.PublicDnsName

  WebAppDatabaseEndpoint:
    Description: 'Connection endpoint for the database'
    Value: !GetAtt WebAppDatabase.Endpoint.Address

  CodeDeployTrustRoleARN:
    Value: !GetAtt 'CodeDeployTrustRole.Arn'