devopsgirls-wordpress.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: DevOps Represent Cloudformation Stack

Parameters:
  InstanceType:
    Description: WebServer EC2 instance type
    Type: String
    Default: t2.small
    AllowedValues:
      - t2.micro
      - t2.small
      - t2.medium
    ConstraintDescription: must be a valid EC2 instance type.
  SSHLocation:
    Description: The IP address range that can be used to SSH to the EC2 instances
    Type: String
    MinLength: '9'
    MaxLength: '18'
    Default: 0.0.0.0/0
    AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})
    ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x.
  DevopsRepresentUser:
    Default: banana.smith
    Description: Your firstname and lastname
    Type: String
    MinLength: '1'
    MaxLength: '64'
    ConstraintDescription: must begin with a letter and contain only alphanumeric
      characters.
  WordpressS3Bucket:
    Default: devopsrep-training
    NoEcho: 'true'
    Description: Bucket to get Wordpress from
    Type: String

Mappings:
  AWSInstanceType2Arch:
    t2.micro:
      Arch: HVM64
    t2.small:
      Arch: HVM64
    t2.medium:
      Arch: HVM64
  AWSRegionArch2AMI:
    ap-southeast-2:
      HVM64: ami-48d38c2b

Resources:
  ElasticLoadBalancer:
    Type: AWS::ElasticLoadBalancing::LoadBalancer
    Properties:
      AvailabilityZones: !GetAZs ''
      SecurityGroups:
        - !GetAtt 'ElasticLoadBalancerSecurityGroup.GroupId'
      CrossZone: 'true'
      LBCookieStickinessPolicy:
        - PolicyName: CookieBasedPolicy
          CookieExpirationPeriod: '30'
      Listeners:
        - LoadBalancerPort: '80'
          InstancePort: '80'
          Protocol: HTTP
          PolicyNames:
            - CookieBasedPolicy
      HealthCheck:
        Target: TCP:80
        HealthyThreshold: '2'
        UnhealthyThreshold: '5'
        Interval: '10'
        Timeout: '5'

  WebServerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Enable HTTP access via port 80 locked down to the load balancer
        + SSH access
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: '80'
          ToPort: '80'
          SourceSecurityGroupOwnerId: !GetAtt 'ElasticLoadBalancer.SourceSecurityGroup.OwnerAlias'
          SourceSecurityGroupId: !GetAtt 'ElasticLoadBalancerSecurityGroup.GroupId'
        - IpProtocol: tcp
          FromPort: '22'
          ToPort: '22'
          CidrIp: !Ref 'SSHLocation'

  ElasticLoadBalancerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Enable HTTP access via port 80 locked down to the load balancer
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: '80'
          ToPort: '80'
          CidrIp: 0.0.0.0/0

  WebServerGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      AvailabilityZones: !GetAZs ''
      LaunchConfigurationName: !Ref 'LaunchConfig'
      MinSize: '1'
      MaxSize: '5'
      DesiredCapacity: '2'
      LoadBalancerNames:
        - !Ref 'ElasticLoadBalancer'
    CreationPolicy:
      ResourceSignal:
        Timeout: PT30M
    UpdatePolicy:
      AutoScalingRollingUpdate:
        MinInstancesInService: '1'
        MaxBatchSize: '1'
        PauseTime: PT30M
        WaitOnResourceSignals: 'true'

  WebServerRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: permit-s3-wordpress
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action: s3:GetObject
                Resource: !Join ['', ['arn:aws:s3:::', !Ref 'WordpressS3Bucket', /*]]
              - Effect: Allow
                Action: s3:ListBucket
                Resource: !Join ['', ['arn:aws:s3:::', !Ref 'WordpressS3Bucket']]

  WebServerProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - !Ref 'WebServerRole'

  LaunchConfig:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      ImageId: !FindInMap [AWSRegionArch2AMI, !Ref 'AWS::Region', !FindInMap [AWSInstanceType2Arch,
          !Ref 'InstanceType', Arch]]
      InstanceType: !Ref 'InstanceType'
      IamInstanceProfile: !Ref 'WebServerProfile'
      SecurityGroups:
        - !Ref 'WebServerSecurityGroup'
      UserData: !Base64
        Fn::Join:
          - ''
          - - "#!/bin/bash -xe \n"
            - "yum update -y aws-cfn-bootstrap \n"
            - "aws configure set default.s3.multipart_threshold 64MB \n"
            - aws s3 cp s3://devopsrep-training/
            - !Ref 'DevopsRepresentUser'
            - "-wordpress.tgz /var/www/wordpress.tgz --no-sign-request \n"
            - "yum install httpd php php-mysql -y \n"
            - "mkdir -p /var/www/html \n"
            - "tar xvfz /var/www/wordpress.tgz -C /var/www/html/ \n"
            - "chown -R apache /var/www/html/ \n"
            - "service httpd start \n"
            - '/opt/aws/bin/cfn-signal -e $? '
            - '         --stack '
            - !Ref 'AWS::StackName'
            - '         --resource WebServerGroup '
            - '         --region '
            - !Ref 'AWS::Region'
            - '

              '
Outputs:
  WebsiteURL:
    Value: !Join ['', ['http://', !GetAtt 'ElasticLoadBalancer.DNSName', /]]
    Description: WordPress Website