aws-ecs-deployment.yml

AWSTemplateFormatVersion: '2010-09-09'

Description: IVerify Deployment ECS - Default VPC
# Make sure to create Kinesis data firehose service that listening to Kinesis stream created in 'loginStream' and put data to ES domain
Parameters:
  CountryCode:
    Description: An environment name that is prefixed to resource names
    Type: String

  ConfigFile:
    Type: String
    Description: System config file
    Default: arn:aws:s3:::iverify-prod-configs/sl.env

  APIImage:
    Type: String
    Description: ECR name of the API docker image
    Default: 427524370246.dkr.ecr.us-east-1.amazonaws.com/iverify-api:latest

  PublisherImage:
    Type: String
    Description: ECR name of the API docker image
    Default: 427524370246.dkr.ecr.us-east-1.amazonaws.com/iverify-publisher

  TriageImage:
    Type: String
    Description: ECR name of the API docker image
    Default: 427524370246.dkr.ecr.us-east-1.amazonaws.com/iverify-triage

  TaskRole:
    Type: String
    Description: Task definition task role arn
    Default: arn:aws:iam::427524370246:role/iverify-sl-task-role

  DBEngine:
    Type: String
    Default: "MySQL"

  DBEngineVersion:
    Type: String
    Default: "8.0.28"

  DBSourceRegion:
    Type: String
    Default: "us-east-1"

  DBInstanceClass:
    Type: String
    Default: "db.t3.micro"

  DBStorageType:
    Type: String
    Default: "gp2"

  DBAllocatedStorage:
    Type: Number
    Default: 10

  DBName:
    Type: String
    Default: "iverify"

  DBUser:
    Type: String
    Default: "root"

  DBPassword:
    Type: String
    NoEcho: True

Resources:
  Vpc:
    Type: AWS::EC2::VPC
    Properties: 
      CidrBlock: "10.0.0.0/16"
      InstanceTenancy: "default"
      Tags: 
        - Key: Name
          Value: !Join ['-', [!Ref 'AWS::StackName', vpc]]

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: !Join ['-', [!Ref 'AWS::StackName', igw]]

  InternetGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref Vpc

  SubnetPublic1:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: "us-east-1a"
      CidrBlock: "10.0.1.0/24"
      Tags: 
        - Key: Name
          Value: !Join ['-', [!Ref 'AWS::StackName', public-subnet-1]]
      VpcId: !Ref Vpc

  SubnetPublic2:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: "us-east-1b"
      CidrBlock: "10.0.2.0/24"
      Tags: 
        - Key: Name
          Value: !Join ['-', [!Ref 'AWS::StackName', public-subnet-2]]
      VpcId: !Ref Vpc

  SubnetPrivate1:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: "us-east-1a"
      CidrBlock: "10.0.3.0/24"
      Tags: 
        - Key: Name
          Value: !Join ['-', [!Ref 'AWS::StackName', private-subnet-1]]
      VpcId: !Ref Vpc

  SubnetPrivate2:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: "us-east-1b"
      CidrBlock: "10.0.4.0/24"
      Tags: 
        - Key: Name
          Value: !Join ['-', [!Ref 'AWS::StackName', private-subnet-2]]
      VpcId: !Ref Vpc

  NatIP:
    Type: AWS::EC2::EIP
    DependsOn: InternetGatewayAttachment
    Properties:
      Domain: vpc
      Tags:
        - Key: Name
          Value: !Join ['-', [!Ref 'AWS::StackName', nat-eip]]

  NatGateway:
    Type: AWS::EC2::NatGateway
    DependsOn: NatIP
    Properties:
      AllocationId: !GetAtt NatIP.AllocationId
      SubnetId: !Ref SubnetPublic1
      Tags:
        - Key: Name
          Value: !Join ['-', [!Ref 'AWS::StackName', ngw]]

  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref Vpc
      Tags:
        - Key: Name
          Value: !Join ['-', [!Ref 'AWS::StackName', public-rt]]

  DefaultPublicRoute:
    Type: AWS::EC2::Route
    DependsOn: InternetGatewayAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  PublicSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref SubnetPublic1

  PublicSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref SubnetPublic2

  PrivateRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref Vpc
      Tags:
        - Key: Name
          Value: !Join ['-', [!Ref 'AWS::StackName', private-rt]]

  DefaultPrivateRoute:
    Type: AWS::EC2::Route
    DependsOn: NatGateway
    Properties:
      RouteTableId: !Ref PrivateRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway

  PrivateSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateRouteTable
      SubnetId: !Ref SubnetPrivate1

  AlbSg:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Application loadbalancer security group 
      GroupName: !Join ['-', [!Ref 'AWS::StackName', iverify-alb-sg]]
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 8000
          ToPort: 8000
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 3334
          ToPort: 3334
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 3335
          ToPort: 3335
          CidrIp: 0.0.0.0/0
      VpcId: !Ref Vpc

  ApiServiceSg:
    Type: AWS::EC2::SecurityGroup
    DependsOn: AlbSg
    Properties:
      GroupDescription: Api service security group 
      GroupName: !Join ['-', [!Ref 'AWS::StackName', api-service-sg]]
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 0
          ToPort: 65535
          SourceSecurityGroupId: !GetAtt AlbSg.GroupId
      VpcId: !Ref Vpc

  NoIngressSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: "no-ingress-sg"
      GroupDescription: "Security group with no ingress rule"
      VpcId: !Ref Vpc
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 3306
          ToPort: 3306
          SourceSecurityGroupId: !GetAtt ApiServiceSg.GroupId

  DBSubnetGroup:
    Type: AWS::RDS::DBSubnetGroup
    Properties:
      DBSubnetGroupDescription: DBSubnetGroup for RDS instances
      SubnetIds:
        - Ref: SubnetPrivate1
        - Ref: SubnetPrivate2

  DBInstance:
    Type: AWS::RDS::DBInstance
    Properties:
      DBInstanceIdentifier: !Sub iverify-${CountryCode}
      DBName: !Sub iverify${CountryCode}
      AllocatedStorage:
        Ref: DBAllocatedStorage
      DBInstanceClass:
        Ref: DBInstanceClass
      StorageType:
        Ref: DBStorageType
      Engine:
        Ref: DBEngine
      EngineVersion:
        Ref: DBEngineVersion
      MasterUsername:
        Ref: DBUser
      MasterUserPassword:
        Ref: DBPassword
      Tags:
        - Key: Programme
          Value: "RDS PostgreSQL"
      VPCSecurityGroups:
        - !Ref NoIngressSecurityGroup
      DBSubnetGroupName:
        Ref: DBSubnetGroup

  PrivateSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateRouteTable
      SubnetId: !Ref SubnetPrivate2

  Cluster:
    Type: AWS::ECS::Cluster
    Properties:
      CapacityProviders:
        - FARGATE
      ClusterName: !Join ['-', [!Ref 'AWS::StackName', cluster]]

  ApiTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    DependsOn: [LogGroupApi, ExecutionRole]
    Properties:
      Family: !Join ['-', [!Ref 'AWS::StackName', api-def]]
      ContainerDefinitions:
        - Name: api-container
          Image: !Ref APIImage
          PortMappings:
            - ContainerPort: 8000
          Memory: 512
          MemoryReservation: 256
          Environment:
            - Name: DB_HOST
              Value: !GetAtt 'DBInstance.Endpoint.Address'
          EnvironmentFiles:
            - Value: !Ref ConfigFile
              Type: s3
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region: !Ref AWS::Region
              awslogs-group: !Ref LogGroupApi
              awslogs-stream-prefix: ecs
      Cpu: 256
      Memory: 0.5GB
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      TaskRoleArn: !Ref TaskRole
      ExecutionRoleArn: !Ref ExecutionRole
      Tags:
        - Key: group
          Value: iVerify
        - Key: Name
          Value: !Sub iVerify-${CountryCode}
        - Key: stack
          Value: !Sub iVerify-${CountryCode}

  PublisherTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    DependsOn: [LogGroupPublisher, ExecutionRole]
    Properties:
      Family: !Join ['-', [!Ref 'AWS::StackName', publisher-def]]
      ContainerDefinitions:
        - Name: publisher-container
          Image: !Ref PublisherImage
          PortMappings:
            - ContainerPort: 3334
          Memory: 512
          MemoryReservation: 256
          EnvironmentFiles:
            - Value: !Ref ConfigFile
              Type: s3
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region: !Ref AWS::Region
              awslogs-group: !Ref LogGroupPublisher
              awslogs-stream-prefix: ecs
      Cpu: 256
      Memory: 0.5GB
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      TaskRoleArn: !Ref TaskRole
      ExecutionRoleArn: !Ref ExecutionRole
      Tags:
        - Key: group
          Value: iVerify
        - Key: Name
          Value: !Sub iVerify-${CountryCode}
        - Key: stack
          Value: !Sub iVerify-${CountryCode}

  TriageTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    DependsOn: [LogGroupTriage, ExecutionRole]
    Properties:
      Family: !Join ['-', [!Ref 'AWS::StackName', triage-def]]
      ContainerDefinitions:
        - Name: triage-container
          Image: !Ref TriageImage
          PortMappings:
            - ContainerPort: 3335
          Memory: 512
          MemoryReservation: 256
          EnvironmentFiles:
            - Value: !Ref ConfigFile
              Type: s3
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region: !Ref AWS::Region
              awslogs-group: !Ref LogGroupTriage
              awslogs-stream-prefix: ecs
      Cpu: 256
      Memory: 0.5GB
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      TaskRoleArn: !Ref TaskRole
      ExecutionRoleArn: !Ref ExecutionRole
      Tags:
        - Key: group
          Value: iVerify
        - Key: Name
          Value: !Sub iVerify-${CountryCode}
        - Key: stack
          Value: !Sub iVerify-${CountryCode}

  LogGroupApi:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Join ['/', [/ecs, !Ref 'AWS::StackName', api-def]]

  LogGroupPublisher:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Join ['/', [/ecs, !Ref 'AWS::StackName', publisher-def]]

  LogGroupTriage:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Join ['/', [/ecs, !Ref 'AWS::StackName', triage-def]]

  ExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Join ['-', [!Ref 'AWS::StackName', ExecutionRole]]
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action: 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy'
        - 'arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess'

  Alb:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    DependsOn: AlbSg
    Properties:
      IpAddressType: ipv4
      Name: !Join ['-', [!Ref 'AWS::StackName', api-alb]]
      Scheme: internet-facing
      SecurityGroups:
        - !Ref AlbSg
      Subnets: [!Ref SubnetPublic1, !Ref SubnetPublic2]
      Type: application

  ApiAlbListner:
    Type: AWS::ElasticLoadBalancingV2::Listener
    DependsOn: [ApiTg, Alb]
    Properties:
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref ApiTg
      LoadBalancerArn: !Ref Alb
      Port: 8000
      Protocol: HTTP

  PublisherAlbListner:
    Type: AWS::ElasticLoadBalancingV2::Listener
    DependsOn: [PublisherTg, Alb]
    Properties:
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref PublisherTg
      LoadBalancerArn: !Ref Alb
      Port: 3334
      Protocol: HTTP

  TriageAlbListner:
    Type: AWS::ElasticLoadBalancingV2::Listener
    DependsOn: [TriageTg, Alb]
    Properties:
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref TriageTg
      LoadBalancerArn: !Ref Alb
      Port: 3335
      Protocol: HTTP

  ApiAlbListnerRule:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    DependsOn: [ApiAlbListner, ApiTg]
    Properties:
      Actions:
        - Type: forward
          TargetGroupArn: !Ref ApiTg
      Conditions:
        - Field: path-pattern
          Values: [/]
      ListenerArn: !Ref ApiAlbListner
      Priority: 1

  PublisherAlbListnerRule:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    DependsOn: [PublisherAlbListner, PublisherTg]
    Properties:
      Actions:
        - Type: forward
          TargetGroupArn: !Ref ApiTg
      Conditions:
        - Field: path-pattern
          Values: [/]
      ListenerArn: !Ref PublisherAlbListner
      Priority: 1

  TriageAlbListnerRule:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    DependsOn: [TriageAlbListner, TriageTg]
    Properties:
      Actions:
        - Type: forward
          TargetGroupArn: !Ref TriageTg
      Conditions:
        - Field: path-pattern
          Values: [/]
      ListenerArn: !Ref TriageAlbListner
      Priority: 1

  ApiTg:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    DependsOn: Alb 
    Properties:
      HealthCheckIntervalSeconds: 30
      HealthCheckPath: /hello
      HealthCheckPort: 8000
      HealthCheckProtocol: HTTP
      Name: !Join ['-', [!Ref 'AWS::StackName', api-tg]]
      Port: 8000
      Protocol: HTTP
      TargetType: ip
      VpcId: !Ref Vpc

  PublisherTg:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    DependsOn: Alb 
    Properties:
      HealthCheckIntervalSeconds: 30
      HealthCheckPath: /api/
      HealthCheckPort: 3334
      HealthCheckProtocol: HTTP
      Name: !Join ['-', [!Ref 'AWS::StackName', publisher-tg]]
      Port: 3334
      Protocol: HTTP
      TargetType: ip
      VpcId: !Ref Vpc

  TriageTg:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    DependsOn: Alb 
    Properties:
      HealthCheckIntervalSeconds: 30
      HealthCheckPath: /api/
      HealthCheckPort: 3335
      HealthCheckProtocol: HTTP
      Name: !Join ['-', [!Ref 'AWS::StackName', triage-tg]]
      Port: 3335
      Protocol: HTTP
      TargetType: ip
      VpcId: !Ref Vpc

  ApiService:
    Type: AWS::ECS::Service
    DependsOn: ApiAlbListner
    Properties:
      Cluster: !Ref Cluster
      DeploymentController:
        Type: ECS
      DesiredCount: 0
      HealthCheckGracePeriodSeconds: 30
      LaunchType: FARGATE
      LoadBalancers:
        - ContainerName: api-container
          ContainerPort: 8000
          TargetGroupArn: !Ref ApiTg
      NetworkConfiguration:
        AwsvpcConfiguration:
          SecurityGroups: 
            - !Ref ApiServiceSg
          Subnets: 
            - !Ref SubnetPrivate1
            # - !Ref SubnetPrivate2
      ServiceName: !Join ['-', [!Ref 'AWS::StackName', api-service]]
      TaskDefinition: !Ref ApiTaskDefinition
      EnableECSManagedTags: true
      PropagateTags: TASK_DEFINITION

  PublisherService:
    Type: AWS::ECS::Service
    DependsOn: PublisherAlbListner
    Properties:
      Cluster: !Ref Cluster
      DeploymentController:
        Type: ECS
      DesiredCount: 1
      HealthCheckGracePeriodSeconds: 30
      LaunchType: FARGATE
      LoadBalancers:
        - ContainerName: publisher-container
          ContainerPort: 3334
          TargetGroupArn: !Ref PublisherTg
      NetworkConfiguration:
        AwsvpcConfiguration:
          SecurityGroups: 
            - !Ref ApiServiceSg
          Subnets: 
            - !Ref SubnetPrivate1
            # - !Ref SubnetPrivate2
      ServiceName: !Join ['-', [!Ref 'AWS::StackName', publisher-service]]
      TaskDefinition: !Ref PublisherTaskDefinition
      EnableECSManagedTags: true
      PropagateTags: TASK_DEFINITION

  TriageService:
    Type: AWS::ECS::Service
    DependsOn: TriageAlbListner
    Properties:
      Cluster: !Ref Cluster
      DeploymentController:
        Type: ECS
      DesiredCount: 1
      HealthCheckGracePeriodSeconds: 30
      LaunchType: FARGATE
      LoadBalancers:
        - ContainerName: triage-container
          ContainerPort: 3335
          TargetGroupArn: !Ref TriageTg
      NetworkConfiguration:
        AwsvpcConfiguration:
          SecurityGroups: 
            - !Ref ApiServiceSg
          Subnets: 
            - !Ref SubnetPrivate1
            # - !Ref SubnetPrivate2
      ServiceName: !Join ['-', [!Ref 'AWS::StackName', triage-service]]
      TaskDefinition: !Ref TriageTaskDefinition
      EnableECSManagedTags: true
      PropagateTags: TASK_DEFINITION

  S3BucketWeb:
    Type: AWS::S3::Bucket
    DeletionPolicy: Delete
    Properties:
      PublicAccessBlockConfiguration:
        BlockPublicAcls: false
      OwnershipControls:
        Rules:
          - ObjectOwnership: ObjectWriter
      BucketName: !Join ['-', [!Ref 'AWS::StackName', web]]
      WebsiteConfiguration:
        ErrorDocument: 'index.html'
        IndexDocument: 'index.html'

  S3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref S3BucketWeb
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: 'Allow'
            Action: 's3:GetObject'
            Principal: '*'
            Resource: !Sub '${S3BucketWeb.Arn}/*'

Outputs:
  # vpc: 
  #   Value: !Ref Vpc

  # ecscluster:
  #   Value: !Ref Cluster

  taskexecutionrole:
    Value: !Ref ExecutionRole

  apiservice:
    Value: !Ref ApiService

  publisherservice:
    Value: !Ref PublisherService

  triageservice:
    Value: !Ref TriageService

  apitaskdef:
    Value: !Ref ApiTaskDefinition

  apiloggroup:
    Value: !Ref LogGroupApi

  BucketUrl:
    Description: 'S3 Web Bucket Url'
    Value: !GetAtt 'S3BucketWeb.WebsiteURL'