hasura-default-domain.yaml

Description: 'This template will deploy complete Hasura Setup on to ECS along with connection to Aurora Serverless PostgreSQL Cluster.'

Parameters:
  DBMasterUsername:
    Description: 'The username that will be used for the root admin user in PostgreSQL'
    Type: String
  DBMasterUserPassword:
    Description: 'The password that will be used alongside the root admin username'
    Type: String
  DBName:
    Description: 'The name of the PostgreSQL database'
    Type: String
  DockerImage:
    Description: 'Name and tag of the Hasura Docker Image'
    Type: String
    Default: 'hasura/graphql-engine'
  APIName:
    Description: The name of the ECS Service.
    Type: String
    Default: 'HasuraGraphQLAPI'
  ContainerPort:
    Description: 'Hasura exposes stuff over 8080. We need to tell this to the container definition.'
    Type: Number
    Default: 8080
  LoadBalancerPort:
    Description: 'The load balancer accepts traffic on the port 80.'
    Type: Number
    Default: 80
  HealthCheckPath:
    Description: 'The Health check path. Hasura exposes /healthz as a health check path. Used on the LoadBalancing Target group.'
    Type: String
    Default: /healthz
  MinContainers:
    Description: 'for autoscaling'
    Type: Number
    Default: 1
  MaxContainers:
    Description: 'for autoscaling'
    Type: Number
    Default: 10
  AutoScalingTargetValue:
    Description: 'target CPU utilization (%)'
    Type: Number
    Default: 80
  HasuraAccessKey:
    Description: 'The console should have an access key for basic security.'
    Type: String

Resources:
  #Let's take care of the VPC
  #https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-vpc.html
  VPC:
    Type: 'AWS::EC2::VPC'
    Properties:
      CidrBlock: '10.0.0.0/16'
      EnableDnsSupport: true
      EnableDnsHostnames: true
      InstanceTenancy: default
      Tags:
        - Key: Name
          Value: !Sub '${APIName}-VPC'
  #https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-internetgateway.html
  InternetGateway:
    Type: 'AWS::EC2::InternetGateway'
    Properties:
      Tags:
        - Key: Name
          Value: !Sub '${APIName}-InternetGateway'
  #https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-vpc-gateway-attachment.html
  VPCGatewayAttachment:
    Type: 'AWS::EC2::VPCGatewayAttachment'
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway
  #https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-subnet.html
  SubnetAPublic:
    Type: 'AWS::EC2::Subnet'
    Properties:
      #https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-getavailabilityzones.html
      #https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-select.html
      AvailabilityZone: !Select [0, !GetAZs '']
      CidrBlock: '10.0.0.0/20'
      MapPublicIpOnLaunch: true
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub '${APIName}-Subnet-A-Public'
        - Key: Reach
          Value: public
  SubnetAPrivate:
    Type: 'AWS::EC2::Subnet'
    Properties:
      AvailabilityZone: !Select [0, !GetAZs '']
      CidrBlock: '10.0.16.0/20'
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub '${APIName}-Subnet-A-Private'
        - Key: Reach
          Value: private
  SubnetBPublic:
    Type: 'AWS::EC2::Subnet'
    Properties:
      AvailabilityZone: !Select [1, !GetAZs '']
      CidrBlock: '10.0.32.0/20'
      MapPublicIpOnLaunch: true
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub '${APIName}-Subnet-B-Public'
        - Key: Reach
          Value: public
  SubnetBPrivate:
    Type: 'AWS::EC2::Subnet'
    Properties:
      AvailabilityZone: !Select [1, !GetAZs '']
      CidrBlock: '10.0.48.0/20'
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub '${APIName}-Subnet-B-Private'
        - Key: Reach
          Value: private
  SubnetCPublic:
    Type: 'AWS::EC2::Subnet'
    Properties:
      AvailabilityZone: !Select [2, !GetAZs '']
      CidrBlock: '10.0.64.0/20'
      MapPublicIpOnLaunch: true
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub '${APIName}-Subnet-C-Public'
        - Key: Reach
          Value: public
  SubnetCPrivate:
    Type: 'AWS::EC2::Subnet'
    Properties:
      AvailabilityZone: !Select [2, !GetAZs '']
      CidrBlock: '10.0.80.0/20'
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub '${APIName}-Subnet-C-Private'
        - Key: Reach
          Value: private
  #https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-route-table.html
  RouteTableAPublic:
    Type: 'AWS::EC2::RouteTable'
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub '${APIName}-Route-Table-Public-A'
  RouteTableAPrivate:
    Type: 'AWS::EC2::RouteTable'
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub '${APIName}-Route-Table-Private-A'
  RouteTableBPublic:
    Type: 'AWS::EC2::RouteTable'
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub '${APIName}-Route-Table-Public-B'
  RouteTableBPrivate:
    Type: 'AWS::EC2::RouteTable'
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub '${APIName}-Route-Table-Private-B'
  RouteTableCPublic:
    Type: 'AWS::EC2::RouteTable'
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub '${APIName}-Route-Table-Public-C'
  RouteTableCPrivate:
    Type: 'AWS::EC2::RouteTable'
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub '${APIName}-Route-Table-Private-C'
  #https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-subnet-route-table-assoc.html
  RouteTableAssociationAPublic:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      SubnetId: !Ref SubnetAPublic
      RouteTableId: !Ref RouteTableAPublic
  RouteTableAssociationAPrivate:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      SubnetId: !Ref SubnetAPrivate
      RouteTableId: !Ref RouteTableAPrivate
  RouteTableAssociationBPublic:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      SubnetId: !Ref SubnetBPublic
      RouteTableId: !Ref RouteTableBPublic
  RouteTableAssociationBPrivate:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      SubnetId: !Ref SubnetBPrivate
      RouteTableId: !Ref RouteTableBPrivate
  RouteTableAssociationCPublic:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      SubnetId: !Ref SubnetCPublic
      RouteTableId: !Ref RouteTableCPublic
  RouteTableAssociationCPrivate:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      SubnetId: !Ref SubnetCPrivate
      RouteTableId: !Ref RouteTableCPrivate
  #https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-route.html
  RouteTableAPublicInternetRoute:
    Type: 'AWS::EC2::Route'
    DependsOn: VPCGatewayAttachment
    Properties:
      RouteTableId: !Ref RouteTableAPublic
      DestinationCidrBlock: '0.0.0.0/0'
      GatewayId: !Ref InternetGateway
  RouteTablePublicBInternetRoute:
    Type: 'AWS::EC2::Route'
    DependsOn: VPCGatewayAttachment
    Properties:
      RouteTableId: !Ref RouteTableBPublic
      DestinationCidrBlock: '0.0.0.0/0'
      GatewayId: !Ref InternetGateway
  RouteTablePublicCInternetRoute:
    Type: 'AWS::EC2::Route'
    DependsOn: VPCGatewayAttachment
    Properties:
      RouteTableId: !Ref RouteTableCPublic
      DestinationCidrBlock: '0.0.0.0/0'
      GatewayId: !Ref InternetGateway
  #https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-network-acl.html
  NetworkAclPublic:
    Type: 'AWS::EC2::NetworkAcl'
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub '${APIName}-Public-Network-ACL'
  NetworkAclPrivate:
    Type: 'AWS::EC2::NetworkAcl'
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub '${APIName}-Private-Network-ACL'
  #https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-subnet-network-acl-assoc.html
  SubnetNetworkAclAssociationAPublic:
    Type: 'AWS::EC2::SubnetNetworkAclAssociation'
    Properties:
      SubnetId: !Ref SubnetAPublic
      NetworkAclId: !Ref NetworkAclPublic
  SubnetNetworkAclAssociationAPrivate:
    Type: 'AWS::EC2::SubnetNetworkAclAssociation'
    Properties:
      SubnetId: !Ref SubnetAPrivate
      NetworkAclId: !Ref NetworkAclPrivate
  SubnetNetworkAclAssociationBPublic:
    Type: 'AWS::EC2::SubnetNetworkAclAssociation'
    Properties:
      SubnetId: !Ref SubnetBPublic
      NetworkAclId: !Ref NetworkAclPublic
  SubnetNetworkAclAssociationBPrivate:
    Type: 'AWS::EC2::SubnetNetworkAclAssociation'
    Properties:
      SubnetId: !Ref SubnetBPrivate
      NetworkAclId: !Ref NetworkAclPrivate
  SubnetNetworkAclAssociationCPublic:
    Type: 'AWS::EC2::SubnetNetworkAclAssociation'
    Properties:
      SubnetId: !Ref SubnetCPublic
      NetworkAclId: !Ref NetworkAclPublic
  SubnetNetworkAclAssociationCPrivate:
    Type: 'AWS::EC2::SubnetNetworkAclAssociation'
    Properties:
      SubnetId: !Ref SubnetCPrivate
      NetworkAclId: !Ref NetworkAclPrivate
  #https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-network-acl-entry.html
  NetworkAclEntryInPublicAllowAll:
    Type: 'AWS::EC2::NetworkAclEntry'
    Properties:
      NetworkAclId: !Ref NetworkAclPublic
      RuleNumber: 99
      Protocol: -1
      RuleAction: allow
      Egress: false
      CidrBlock: '0.0.0.0/0'
  NetworkAclEntryOutPublicAllowAll:
    Type: 'AWS::EC2::NetworkAclEntry'
    Properties:
      NetworkAclId: !Ref NetworkAclPublic
      RuleNumber: 99
      Protocol: -1
      RuleAction: allow
      Egress: true
      CidrBlock: '0.0.0.0/0'
  NetworkAclEntryInPrivateAllowVPC:
    Type: 'AWS::EC2::NetworkAclEntry'
    Properties:
      NetworkAclId: !Ref NetworkAclPrivate
      RuleNumber: 99
      Protocol: -1
      RuleAction: allow
      Egress: false
      CidrBlock: '0.0.0.0/0'
  NetworkAclEntryOutPrivateAllowVPC:
    Type: 'AWS::EC2::NetworkAclEntry'
    Properties:
      NetworkAclId: !Ref NetworkAclPrivate
      RuleNumber: 99
      Protocol: -1
      RuleAction: allow
      Egress: true
      CidrBlock: '0.0.0.0/0'

  #Now it's time to make the Security groups that will let things communicate with each other
  DBSSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupName: !Sub '${APIName}-RDS-SecurityGroup'
      GroupDescription: !Sub 'Security group to control access to RDS PostgreSQL instance inside the ${APIName} API stack VPC'
      VpcId: !Ref 'VPC'
      SecurityGroupIngress:
        - IpProtocol: 'tcp'
          SourceSecurityGroupId: !Ref 'EC2SecurityGroup'
          FromPort: 5432
          ToPort: 5432

      Tags:
        - Key: 'Name'
          Value: !Sub '${APIName}-RDS-SecurityGroup'
  #I'm listing security groups in the order that traffic would flow from the outside internet. It would first come through the SSL port 443 on the load balancer.
  #This first security group should be assigned to any load balancer that is sitting in front of an EC2 instance in the VPC
  #https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group.html
  LoadBalancerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Sub '${APIName}-ELB-SecurityGroup'
      GroupDescription: !Sub 'Security group to control external access to the load balancer. ${APIName}'
      VpcId: !Ref 'VPC'
      SecurityGroupIngress:
        - IpProtocol: 'tcp'
          FromPort: 443
          ToPort: 443
          CidrIp: '0.0.0.0/0'
        - IpProtocol: 'tcp'
          FromPort: 80
          ToPort: 80
          CidrIp: '0.0.0.0/0'
        - IpProtocol: 'tcp'
          FromPort: 443
          ToPort: 443
          CidrIpv6: '::/0'
        - IpProtocol: 'tcp'
          FromPort: 80
          ToPort: 80
          CidrIpv6: '::/0'
      Tags:
        - Key: 'Name'
          Value: !Sub '${APIName}-ELB-SecurityGroup'
  #After traffic comes in through a load balancer it goes to an EC2 instance. The EC2 instance should allow traffic from the load balancer over both port 80 and 8080 which are two common ports.
  EC2SecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupName: !Sub '${APIName}-EC2-SecurityGroup'
      GroupDescription: !Sub 'Security group to control access to an EC2 instance inside the ${APIName} stack VPC'
      VpcId: !Ref 'VPC'
      SecurityGroupIngress:
        - IpProtocol: 'tcp'
          SourceSecurityGroupId: !Ref 'LoadBalancerSecurityGroup'
          FromPort: 8080
          ToPort: 8080
        - IpProtocol: 'tcp'
          SourceSecurityGroupId: !Ref 'LoadBalancerSecurityGroup'
          FromPort: 80
          ToPort: 80
      Tags:
        - Key: 'Name'
          Value: !Sub '${APIName}-EC2-SecurityGroup'
  #Now It's time to make the PostgreSQL DB.
  RDSSubnetGroup:
    Type: 'AWS::RDS::DBSubnetGroup'
    Properties:
      DBSubnetGroupDescription: 'Subnet RDS Subnet group.'
      DBSubnetGroupName: 'rds-subnetgroup'
      SubnetIds:
        - !Ref 'SubnetAPublic'
        - !Ref 'SubnetBPublic'
        - !Ref 'SubnetCPublic'
  #https://dev.classmethod.jp/cloud/aws/cloudformation-aurora-postgresql/
  AuroraClusterParameterGroup:
    Type: 'AWS::RDS::DBClusterParameterGroup'
    Properties:
      Description: 'Parameter group for DB Cluster'
      Family: 'aurora-postgresql10'
      Parameters:
        client_encoding: UTF8
  #https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-rds-dbcluster.html
  AuroraCluster:
    DependsOn: RDSSubnetGroup
    Type: 'AWS::RDS::DBCluster'
    Properties:
      Engine: 'aurora-postgresql'
      EngineVersion: '10.7'
      EngineMode: 'serverless'
      DBClusterIdentifier: !Sub '${APIName}-Database-Cluster'
      DatabaseName: !Ref 'DBName'
      DBClusterParameterGroupName: !Ref 'AuroraClusterParameterGroup'
      DBSubnetGroupName: !Ref 'RDSSubnetGroup'
      MasterUsername: !Ref 'DBMasterUsername'
      MasterUserPassword: !Ref 'DBMasterUserPassword'
      Port: 5432
      #https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rds-dbcluster-scalingconfiguration.html
      ScalingConfiguration:
        AutoPause: false
        MaxCapacity: 32
        MinCapacity: 2
      VpcSecurityGroupIds:
        - !Ref 'DBSSecurityGroup'

  Cluster:
    Type: AWS::ECS::Cluster
    Properties:
      ClusterName: !Join ['-', [!Ref APIName, Cluster]]
  #https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecs-taskdefinition.html
  TaskDefinition:
    Type: AWS::ECS::TaskDefinition
    # Makes sure the log group is created before it is used.
    DependsOn: LogGroup
    Properties:
      # Name of the task definition. Subsequent versions of the task definition are grouped together under this name.
      Family: !Join ['-', [!Ref APIName, TaskDefinition]]
      # awsvpc is required for Fargate
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      # 256 (.25 vCPU) - Available memory values: 0.5GB, 1GB, 2GB
      # 512 (.5 vCPU) - Available memory values: 1GB, 2GB, 3GB, 4GB
      # 1024 (1 vCPU) - Available memory values: 2GB, 3GB, 4GB, 5GB, 6GB, 7GB, 8GB
      # 2048 (2 vCPU) - Available memory values: Between 4GB and 16GB in 1GB increments
      # 4096 (4 vCPU) - Available memory values: Between 8GB and 30GB in 1GB increments
      Cpu: 4096
      # 0.5GB, 1GB, 2GB - Available cpu values: 256 (.25 vCPU)
      # 1GB, 2GB, 3GB, 4GB - Available cpu values: 512 (.5 vCPU)
      # 2GB, 3GB, 4GB, 5GB, 6GB, 7GB, 8GB - Available cpu values: 1024 (1 vCPU)
      # Between 4GB and 16GB in 1GB increments - Available cpu values: 2048 (2 vCPU)
      # Between 8GB and 30GB in 1GB increments - Available cpu values: 4096 (4 vCPU)
      Memory: 8GB
      # A role needed by ECS.
      # "The ARN of the task execution role that containers in this task can assume. All containers in this task are granted the permissions that are specified in this role."
      # "There is an optional task execution IAM role that you can specify with Fargate to allow your Fargate tasks to make API calls to Amazon ECR."
      ExecutionRoleArn: !Ref ExecutionRole
      # "The Amazon Resource Name (ARN) of an AWS Identity and Access Management (IAM) role that grants containers in the task permission to call AWS APIs on your behalf."
      TaskRoleArn: !Ref TaskRole
      ContainerDefinitions:
        - Name: !Ref APIName
          Image: !Ref DockerImage
          PortMappings:
            - ContainerPort: !Ref ContainerPort
          # Send logs to CloudWatch Logs
          Command:
            - 'graphql-engine'
            - 'serve'
            - '--enable-console'
          Environment:
            - Name: 'HASURA_GRAPHQL_DATABASE_URL'
              #Make the PostgreSQL connection string from the parameters we have.
              Value:
                !Join [
                  '',
                  [
                    'postgres://',
                    !Ref 'DBMasterUsername',
                    ':',
                    !Ref 'DBMasterUserPassword',
                    '@',
                    !GetAtt 'AuroraCluster.Endpoint.Address',
                    ':5432/',
                    !Ref 'DBName',
                  ],
                ]
            - Name: 'HASURA_GRAPHQL_PG_TIMEOUT'
              Value: '30'
            - Name: 'HASURA_GRAPHQL_ENABLED_APIS'
              Value: 'metadata,graphql,pgdump,developer'
            - Name: 'HASURA_GRAPHQL_ACCESS_KEY'
              Value: !Ref 'HasuraAccessKey'
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region: !Ref AWS::Region
              awslogs-group: !Ref LogGroup
              awslogs-stream-prefix: ecs
  # A role needed by ECS
  ExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Join ['-', [!Ref APIName, ExecutionRole]]
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action: 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy'
  # A role for the containers
  TaskRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Join ['-', [!Ref APIName, TaskRole]]
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action: 'sts:AssumeRole'
  # A role needed for auto scaling
  AutoScalingRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Join ['-', [!Ref APIName, AutoScalingRole]]
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action: 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceAutoscaleRole'
  Service:
    Type: AWS::ECS::Service
    # This dependency is needed so that the load balancer is setup correctly in time
    DependsOn:
      - ListenerHTTP
    Properties:
      ServiceName: !Ref APIName
      Cluster: !Ref Cluster
      TaskDefinition: !Ref TaskDefinition
      DeploymentConfiguration:
        MinimumHealthyPercent: 100
        MaximumPercent: 200
      DesiredCount: 2
      # This may need to be adjusted if the container takes a while to start up
      HealthCheckGracePeriodSeconds: 120
      LaunchType: FARGATE
      NetworkConfiguration:
        AwsvpcConfiguration:
          # change to DISABLED if you're using private subnets that have access to a NAT gateway
          AssignPublicIp: ENABLED
          Subnets:
            - !Ref 'SubnetAPublic'
            - !Ref 'SubnetBPublic'
            - !Ref 'SubnetCPublic'
          SecurityGroups:
            - !Ref 'EC2SecurityGroup'
      LoadBalancers:
        - ContainerName: !Ref APIName
          ContainerPort: !Ref ContainerPort
          TargetGroupArn: !Ref TargetGroup
  TargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckIntervalSeconds: 10
      # will look for a 200 status code by default unless specified otherwise
      HealthCheckPath: !Ref HealthCheckPath
      HealthCheckTimeoutSeconds: 5
      UnhealthyThresholdCount: 2
      HealthyThresholdCount: 2
      Name: !Join ['-', [!Ref APIName, TargetGroup]]
      Port: !Ref ContainerPort
      Protocol: HTTP
      TargetGroupAttributes:
        - Key: deregistration_delay.timeout_seconds
          Value: 60 # default is 300
      TargetType: ip
      VpcId: !Ref VPC
  ListenerHTTP:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - TargetGroupArn: !Ref TargetGroup
          Type: forward
      LoadBalancerArn: !Ref LoadBalancer
      Port: !Ref LoadBalancerPort
      Protocol: HTTP
  LoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      LoadBalancerAttributes:
        # this is the default, but is specified here in case it needs to be changed
        - Key: idle_timeout.timeout_seconds
          Value: 360
      Name: !Join ['-', [!Ref APIName, LoadBalancer]]
      # "internal" is also an option
      Scheme: internet-facing
      SecurityGroups:
        - !Ref 'LoadBalancerSecurityGroup'
      Subnets:
        - !Ref 'SubnetBPublic'
        - !Ref 'SubnetCPublic'
  LogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Join ['', [/ecs/, !Ref APIName, TaskDefinition]]
  AutoScalingTarget:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    Properties:
      MinCapacity: !Ref MinContainers
      MaxCapacity: !Ref MaxContainers
      ResourceId: !Join ['/', [service, !Ref Cluster, !GetAtt Service.Name]]
      ScalableDimension: ecs:service:DesiredCount
      ServiceNamespace: ecs
      # "The Amazon Resource Name (ARN) of an AWS Identity and Access Management (IAM) role that allows Application Auto Scaling to modify your scalable target."
      RoleARN: !GetAtt AutoScalingRole.Arn
  AutoScalingPolicy:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName: !Join ['-', [!Ref APIName, AutoScalingPolicy]]
      PolicyType: TargetTrackingScaling
      ScalingTargetId: !Ref AutoScalingTarget
      TargetTrackingScalingPolicyConfiguration:
        PredefinedMetricSpecification:
          PredefinedMetricType: ECSServiceAverageCPUUtilization
        ScaleInCooldown: 10
        ScaleOutCooldown: 10
        # Keep things at or lower than 50% CPU utilization, for example
        TargetValue: !Ref AutoScalingTargetValue

Outputs:
  AZA:
    Description: 'AZ of A'
    Value: !Select [0, !GetAZs '']
    Export:
      Name: !Sub '${AWS::StackName}-AZA'
  SubnetAPublic:
    Description: 'Subnet A public.'
    Value: !Ref SubnetAPublic
    Export:
      Name: !Sub '${AWS::StackName}-SubnetAPublic'
  SubnetBPublic:
    Description: 'Subnet B public.'
    Value: !Ref SubnetBPublic
    Export:
      Name: !Sub '${AWS::StackName}-SubnetBPublic'
  SubnetCPublic:
    Description: 'Subnet C public.'
    Value: !Ref SubnetCPublic
    Export:
      Name: !Sub '${AWS::StackName}-SubnetCPublic'
  EC2SecurityGroupID:
    Description: 'The ID of the EC2 Security group'
    Value: !GetAtt EC2SecurityGroup.GroupId
    Export:
      Name: !Sub '${AWS::StackName}-EC2-ID'