dependencies.template

{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Outputs": {
        "ALBTGNAME": {
            "Description": "Name of the ALB Target Group",
            "Export": {
                "Name": {
                    "Fn::Sub": "${AWS::StackName}-ALBTGNAME"
                }
            },
            "Value": {
                "Fn::GetAtt": [
                    "GhostTargetGroup",
                    "TargetGroupName"
                ]
            }
        },
        "ALBURL": {
            "Description": "URL of the ALB",
            "Export": {
                "Name": {
                    "Fn::Sub": "${AWS::StackName}-ALBURL"
                }
            },
            "Value": {
                "Fn::Join": [
                    "",
                    [
                        "http://",
                        {
                            "Fn::GetAtt": [
                                "GhostALB",
                                "DNSName"
                            ]
                        }
                    ]
                ]
            }
        },
        "GhostDBHost": {
            "Description": "FQDN of the Ghost DB.",
            "Export": {
                "Name": {
                    "Fn::Sub": "${AWS::StackName}-GhostDBHost"
                }
            },
            "Value": {
                "Fn::GetAtt": [
                    "GhostDB",
                    "Endpoint.Address"
                ]
            }
        },
        "GhostLogGroupName": {
            "Description": "Name of Ghost Log Group",
            "Export": {
                "Name": {
                    "Fn::Sub": "${AWS::StackName}-GhostLogGroupName"
                }
            },
            "Value": {
                "Ref": "GhostLogGroup"
            }
        },
        "GhostSG": {
            "Description": "ID of the Ghost Security Group",
            "Export": {
                "Name": {
                    "Fn::Sub": "${AWS::StackName}-GhostSG"
                }
            },
            "Value": {
                "Fn::GetAtt": [
                    "GhostHostSecurityGroup",
                    "GroupId"
                ]
            }
        },
        "GhostTG": {
            "Description": "ARN of the Ghost Target Group",
            "Export": {
                "Name": {
                    "Fn::Sub": "${AWS::StackName}-GhostTG"
                }
            },
            "Value": {
                "Ref": "GhostTargetGroup"
            }
        },
        "StackName": {
            "Description": "Name of this Stack",
            "Export": {
                "Name": {
                    "Fn::Sub": "${AWS::StackName}-StackName"
                }
            },
            "Value": {
                "Ref": "AWS::StackName"
            }
        },
        "Subnet1": {
            "Description": "ID of the first Subnet to use",
            "Export": {
                "Name": {
                    "Fn::Sub": "${AWS::StackName}-Subnet1"
                }
            },
            "Value": {
                "Ref": "DBSubnet"
            }
        },
        "Subnet2": {
            "Description": "ID of the first Subnet to use",
            "Export": {
                "Name": {
                    "Fn::Sub": "${AWS::StackName}-Subnet2"
                }
            },
            "Value": {
                "Ref": "DBSubnet2"
            }
        },
        "TaskExecutionRoleArn": {
            "Description": "Task Execution Role Arn",
            "Export": {
                "Name": {
                    "Fn::Sub": "${AWS::StackName}-TaskExecutionRoleArn"
                }
            },
            "Value": {
                "Fn::GetAtt": [
                    "TaskExecutionRole",
                    "Arn"
                ]
            }
        },
        "TaskRoleArn": {
            "Description": "Task Role Arn",
            "Export": {
                "Name": {
                    "Fn::Sub": "${AWS::StackName}-TaskRoleArn"
                }
            },
            "Value": {
                "Fn::GetAtt": [
                    "TaskRole",
                    "Arn"
                ]
            }
        }
    },
    "Parameters": {
        "ALBSubnet": {
            "Description": "A Public VPC subnet ID for the ALB.",
            "Type": "AWS::EC2::Subnet::Id"
        },
        "ALBSubnet2": {
            "Description": "A 2nd Public VPC subnet ID for the ALB.",
            "Type": "AWS::EC2::Subnet::Id"
        },
        "CRS3Bucket": {
            "Default": "ghost-ecs-fargate",
            "Description": "The S3 Bucket that the init_db_lambda.zip for the Custom Resource is located in",
            "Type": "String"
        },
        "DBAllocatedStorage": {
            "ConstraintDescription": "must be between 5 and 1024Gb.",
            "Default": "5",
            "Description": "The size of the database (Gb)",
            "MaxValue": "1024",
            "MinValue": "5",
            "Type": "Number"
        },
        "DBClass": {
            "AllowedValues": [
                "db.t2.small",
                "db.t2.large",
                "db.t2.xlarge",
                "db.m4.large",
                "db.m4.xlarge",
                "db.m2.2xlarge"
            ],
            "ConstraintDescription": "must select a valid database instance type.",
            "Default": "db.t2.small",
            "Description": "Database instance class",
            "Type": "String"
        },
        "DBMultiAZ": {
            "Default": "True",
            "Description": "Should the RDS be MultiAZ (True/False)",
            "Type": "String"
        },
        "DBPassword": {
            "AllowedPattern": "[a-zA-Z0-9]*",
            "ConstraintDescription": "must contain only alphanumeric characters.",
            "Description": "The database admin account password",
            "MaxLength": "41",
            "MinLength": "1",
            "NoEcho": true,
            "Type": "String"
        },
        "DBSubnet": {
            "Description": "A VPC subnet ID for the DB.",
            "Type": "AWS::EC2::Subnet::Id"
        },
        "DBSubnet2": {
            "Description": "A 2nd VPC subnet ID for the DB.",
            "Type": "AWS::EC2::Subnet::Id"
        },
        "DBVPC": {
            "Description": "A VPC subnet ID for the DB.",
            "Type": "AWS::EC2::VPC::Id"
        },
        "KeyAdminARN": {
            "Description": "The ARN for the User/Role that can manage the RDS KMS key (e.g. arn:aws:iam::111122223333:root)",
            "Type": "String"
        }
    },
    "Resources": {
        "ALBSecurityGroup": {
            "Properties": {
                "GroupDescription": "Ghost ALB Security Group",
                "SecurityGroupIngress": [
                    {
                        "CidrIp": "0.0.0.0/0",
                        "FromPort": "80",
                        "IpProtocol": "tcp",
                        "ToPort": "80"
                    },
                    {
                        "CidrIp": "0.0.0.0/0",
                        "FromPort": "443",
                        "IpProtocol": "tcp",
                        "ToPort": "443"
                    }
                ],
                "VpcId": {
                    "Ref": "DBVPC"
                }
            },
            "Type": "AWS::EC2::SecurityGroup"
        },
        "DBAccessPolicy": {
            "Properties": {
                "PolicyDocument": {
                    "Statement": [
                        {
                            "Action": [
                                "rds-db:connect"
                            ],
                            "Effect": "Allow",
                            "Resource": [
                                {
                                    "Fn::Join": [
                                        "",
                                        [
                                            "arn:aws:rds-db:",
                                            {
                                                "Ref": "AWS::Region"
                                            },
                                            ":",
                                            {
                                                "Ref": "AWS::AccountId"
                                            },
                                            ":dbuser:",
                                            {
                                                "Fn::GetAtt": [
                                                    "DBInit",
                                                    "db_resource_id"
                                                ]
                                            },
                                            "/ghost"
                                        ]
                                    ]
                                }
                            ]
                        }
                    ],
                    "Version": "2012-10-17"
                },
                "PolicyName": "DBAccessPolicy",
                "Roles": [
                    {
                        "Ref": "TaskRole"
                    }
                ]
            },
            "Type": "AWS::IAM::Policy"
        },
        "DBInit": {
            "DependsOn": "GhostDB",
            "Properties": {
                "DBHost": {
                    "Fn::GetAtt": [
                        "GhostDB",
                        "Endpoint.Address"
                    ]
                },
                "Password": {
                    "Ref": "DBPassword"
                },
                "ServiceToken": {
                    "Fn::GetAtt": [
                        "InitDBFunction",
                        "Arn"
                    ]
                }
            },
            "Type": "Custom::DBInit"
        },
        "DBSecurityGroup": {
            "Properties": {
                "GroupDescription": "Security group for RDS DB Instance.",
                "SecurityGroupIngress": [
                    {
                        "FromPort": "3306",
                        "IpProtocol": "tcp",
                        "SourceSecurityGroupId": {
                            "Fn::GetAtt": [
                                "GhostHostSecurityGroup",
                                "GroupId"
                            ]
                        },
                        "ToPort": "3306"
                    }
                ],
                "VpcId": {
                    "Ref": "DBVPC"
                }
            },
            "Type": "AWS::EC2::SecurityGroup"
        },
        "DBSubnetGroup": {
            "Properties": {
                "DBSubnetGroupDescription": "Subnets available for the RDS DB Instance",
                "SubnetIds": [
                    {
                        "Ref": "DBSubnet"
                    },
                    {
                        "Ref": "DBSubnet2"
                    }
                ]
            },
            "Type": "AWS::RDS::DBSubnetGroup"
        },
        "FargateExecutionPolicy": {
            "Properties": {
                "PolicyDocument": {
                    "Statement": [
                        {
                            "Action": [
                                "ecr:GetAuthorizationToken",
                                "ecr:BatchCheckLayerAvailability",
                                "ecr:GetDownloadUrlForLayer",
                                "ecr:BatchGetImage",
                                "logs:CreateLogStream",
                                "logs:PutLogEvents"
                            ],
                            "Effect": "Allow",
                            "Resource": [
                                "*"
                            ]
                        }
                    ],
                    "Version": "2012-10-17"
                },
                "PolicyName": "fargate-execution",
                "Roles": [
                    {
                        "Ref": "TaskExecutionRole"
                    }
                ]
            },
            "Type": "AWS::IAM::Policy"
        },
        "GhostALB": {
            "Properties": {
                "Scheme": "internet-facing",
                "SecurityGroups": [
                    {
                        "Ref": "ALBSecurityGroup"
                    }
                ],
                "Subnets": [
                    {
                        "Ref": "ALBSubnet"
                    },
                    {
                        "Ref": "ALBSubnet2"
                    }
                ]
            },
            "Type": "AWS::ElasticLoadBalancingV2::LoadBalancer"
        },
        "GhostDB": {
            "Properties": {
                "AllocatedStorage": {
                    "Ref": "DBAllocatedStorage"
                },
                "DBInstanceClass": {
                    "Ref": "DBClass"
                },
                "DBName": "ghost",
                "DBSubnetGroupName": {
                    "Ref": "DBSubnetGroup"
                },
                "Engine": "MySQL",
                "EngineVersion": "5.7.21",
                "KmsKeyId": {
                    "Ref": "rdskmskey"
                },
                "MasterUserPassword": {
                    "Ref": "DBPassword"
                },
                "MasterUsername": "root",
                "MultiAZ": {
                    "Ref": "DBMultiAZ"
                },
                "StorageEncrypted": "true",
                "StorageType": "gp2",
                "VPCSecurityGroups": [
                    {
                        "Ref": "DBSecurityGroup"
                    }
                ]
            },
            "Type": "AWS::RDS::DBInstance"
        },
        "GhostHostSecurityGroup": {
            "Properties": {
                "GroupDescription": "Ghost ECS Security Group.",
                "SecurityGroupIngress": [
                    {
                        "FromPort": "2368",
                        "IpProtocol": "tcp",
                        "SourceSecurityGroupId": {
                            "Fn::GetAtt": [
                                "ALBSecurityGroup",
                                "GroupId"
                            ]
                        },
                        "ToPort": "2368"
                    }
                ],
                "VpcId": {
                    "Ref": "DBVPC"
                }
            },
            "Type": "AWS::EC2::SecurityGroup"
        },
        "GhostLogGroup": {
            "Type": "AWS::Logs::LogGroup"
        },
        "GhostTargetGroup": {
            "Properties": {
                "HealthCheckIntervalSeconds": "30",
                "HealthCheckProtocol": "HTTP",
                "HealthCheckTimeoutSeconds": "10",
                "HealthyThresholdCount": "4",
                "Matcher": {
                    "HttpCode": "200,301"
                },
                "Port": 2368,
                "Protocol": "HTTP",
                "TargetType": "ip",
                "UnhealthyThresholdCount": "3",
                "VpcId": {
                    "Ref": "DBVPC"
                }
            },
            "Type": "AWS::ElasticLoadBalancingV2::TargetGroup"
        },
        "InitDBFunction": {
            "DependsOn": "LambdaExecutionPolicy",
            "Properties": {
                "Code": {
                    "S3Bucket": {
                        "Ref": "CRS3Bucket"
                    },
                    "S3Key": "init-db-lambda.zip"
                },
                "Environment": {
                    "Variables": {
                        "awsregion": {
                            "Ref": "AWS::Region"
                        },
                        "dbhost": {
                            "Fn::GetAtt": [
                                "GhostDB",
                                "Endpoint.Address"
                            ]
                        },
                        "dbid": {
                            "Ref": "GhostDB"
                        },
                        "dbname": "ghost",
                        "dbuser": "root"
                    }
                },
                "Handler": "init-db-lambda.handler",
                "MemorySize": 128,
                "Role": {
                    "Fn::GetAtt": [
                        "LambdaExecutionRole",
                        "Arn"
                    ]
                },
                "Runtime": "python2.7",
                "Timeout": "180",
                "VpcConfig": {
                    "SecurityGroupIds": [
                        {
                            "Ref": "GhostHostSecurityGroup"
                        }
                    ],
                    "SubnetIds": [
                        {
                            "Ref": "DBSubnet"
                        },
                        {
                            "Ref": "DBSubnet2"
                        }
                    ]
                }
            },
            "Type": "AWS::Lambda::Function"
        },
        "LambdaExecutionPolicy": {
            "Properties": {
                "PolicyDocument": {
                    "Statement": [
                        {
                            "Action": [
                                "logs:CreateLogGroup",
                                "logs:CreateLogStream",
                                "logs:PutLogEvents",
                                "ec2:CreateNetworkInterface",
                                "ec2:DescribeNetworkInterfaces",
                                "ec2:DeleteNetworkInterface"
                            ],
                            "Effect": "Allow",
                            "Resource": [
                                "*"
                            ]
                        },
                        {
                            "Action": [
                                "rds:ModifyDBInstance"
                            ],
                            "Effect": "Allow",
                            "Resource": {
                                "Fn::Join": [
                                    "",
                                    [
                                        "arn:aws:rds:",
                                        {
                                            "Ref": "AWS::Region"
                                        },
                                        ":",
                                        {
                                            "Ref": "AWS::AccountId"
                                        },
                                        ":db:",
                                        {
                                            "Ref": "GhostDB"
                                        }
                                    ]
                                ]
                            }
                        }
                    ],
                    "Version": "2012-10-17"
                },
                "PolicyName": "lambda-execution",
                "Roles": [
                    {
                        "Ref": "LambdaExecutionRole"
                    }
                ]
            },
            "Type": "AWS::IAM::Policy"
        },
        "LambdaExecutionRole": {
            "Properties": {
                "AssumeRolePolicyDocument": {
                    "Statement": [
                        {
                            "Action": [
                                "sts:AssumeRole"
                            ],
                            "Effect": "Allow",
                            "Principal": {
                                "Service": [
                                    "lambda.amazonaws.com"
                                ]
                            }
                        }
                    ]
                }
            },
            "Type": "AWS::IAM::Role"
        },
        "Listener": {
            "Properties": {
                "DefaultActions": [
                    {
                        "TargetGroupArn": {
                            "Ref": "GhostTargetGroup"
                        },
                        "Type": "forward"
                    }
                ],
                "LoadBalancerArn": {
                    "Ref": "GhostALB"
                },
                "Port": "80",
                "Protocol": "HTTP"
            },
            "Type": "AWS::ElasticLoadBalancingV2::Listener"
        },
        "TaskExecutionRole": {
            "Properties": {
                "AssumeRolePolicyDocument": {
                    "Statement": [
                        {
                            "Action": [
                                "sts:AssumeRole"
                            ],
                            "Effect": "Allow",
                            "Principal": {
                                "Service": [
                                    "ecs-tasks.amazonaws.com"
                                ]
                            }
                        }
                    ]
                }
            },
            "Type": "AWS::IAM::Role"
        },
        "TaskRole": {
            "Properties": {
                "AssumeRolePolicyDocument": {
                    "Statement": [
                        {
                            "Action": [
                                "sts:AssumeRole"
                            ],
                            "Effect": "Allow",
                            "Principal": {
                                "Service": [
                                    "ecs-tasks.amazonaws.com"
                                ]
                            }
                        }
                    ]
                }
            },
            "Type": "AWS::IAM::Role"
        },
        "rdskmskey": {
            "Properties": {
                "Description": "Key for encrypting the RDS",
                "KeyPolicy": {
                    "Statement": [
                        {
                            "Action": [
                                "kms:*"
                            ],
                            "Effect": "Allow",
                            "Principal": {
                                "AWS": {
                                    "Ref": "KeyAdminARN"
                                }
                            },
                            "Resource": "*",
                            "Sid": "Allow full administration of the key by the root account"
                        },
                        {
                            "Action": [
                                "kms:Encrypt",
                                "kms:Decrypt",
                                "kms:ReEncrypt*",
                                "kms:GenerateDataKey*",
                                "kms:CreateGrant",
                                "kms:DescribeKey"
                            ],
                            "Condition": {
                                "StringEquals": {
                                    "kms:CallerAccount": {
                                        "Ref": "AWS::AccountId"
                                    },
                                    "kms:ViaService": {
                                        "Fn::Join": [
                                            "",
                                            [
                                                "rds.",
                                                {
                                                    "Ref": "AWS::Region"
                                                },
                                                ".amazonaws.com"
                                            ]
                                        ]
                                    }
                                }
                            },
                            "Effect": "Allow",
                            "Principal": {
                                "AWS": "*"
                            },
                            "Resource": "*",
                            "Sid": "Allow access through RDS for all principals in the account that are authorized to use RDS"
                        }
                    ],
                    "Version": "2012-10-17"
                }
            },
            "Type": "AWS::KMS::Key"
        }
    }
}