app.yml

AWSTemplateFormatVersion: "2010-09-09"

Description: "Application"

Parameters:
  AppName:
    Type: String
    Default: "app"
    Description: Name of the application
  KeyName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: AWS SSH Key. Create one in the AWS Console / EC2 / Network & Security / Key Pairs.
  GitHubOAuthToken:
    Type: String
    Description: GitHub token to allow CodePipeline access to the code repo. Create here https://github.com/settings/tokens
  AppRepo:
    Type: String
    Default: "cloudformation-django-sample"
    Description: Repository name on GitHub
  AppBranch:
    Type: String
    Default: "master"
    Description: Repository git branch
  AppRepoOwner:
    Type: String
    Description: Repository owner on Github
  AppHeartbeatUrl:
    Type: String
    Default: "/heartbeat"
    Description: A URL the loadbalancer can use to check application health. Let your application return a 200 HTTP status code for a healthy application at that URL.
  AppPortNumber:
    Type: Number
    Default: 8000
    Description: Application port number.

  InstanceType:
    Type: String
    Default: "t3.micro"
    Description: EC2 instance type.

  PublicSubnetCidrA:
    Type: String
    Default: "10.0.1.0/24"
    Description: Public accessible subnet for load balancer in availability zone A
  PublicSubnetCidrB:
    Type: String
    Default: "10.0.2.0/24"
    Description: Public accessible subnet for load balancer in availability zone B
  PublicSubnetCidrC:
    Type: String
    Default: "10.0.3.0/24"
    Description: Publicly accessible subnet for load balancer in availability zone C

  PrivateSubnetCidrA:
    Type: String
    Default: "10.0.11.0/24"
    Description: Private subnet for the application in availability zone A
  PrivateSubnetCidrB:
    Type: String
    Default: "10.0.12.0/24"
    Description: Private subnet for the application in availability zone B
  PrivateSubnetCidrC:
    Type: String
    Default: "10.0.13.0/24"
    Description: Private subnet for the application in availability zone C

Mappings:
  Ubuntu1804: # Ubuntu 18.04 20180912 - Oct 2018, has issues installing CodeDeploy agent due to Ruby 2.5.
    eu-central-1:
      "64": ami-0bdf93799014acdc4
    eu-west-1:
      "64": ami-00035f41c82244dab
    eu-west-2:
      "64": ami-0b0a60c0a2bd40612
    eu-west-3:
      "64": ami-08182c55a1c188dee
    us-east-1:
      "64": ami-0ac019f4fcb7cb7e6
    us-east-2:
      "64": ami-0f65671a86f061fcd
    us-west-1:
      "64": ami-063aa838bd7631e0b
    us-west-2:
      "64": ami-0bbe6b35405ecebdb
  Ubuntu1604: # Ubuntu 16.04 20180912
    eu-central-1:
      "64": ami-086a09d5b9fa35dc7
    eu-west-1:
      "64": ami-0773391ae604c49a4
    eu-west-2:
      "64": ami-061a2d878e5754b62
    eu-west-3:
      "64": ami-075b44448d2276521
    us-east-1:
      "64": ami-059eeca93cf09eebd
    us-east-2:
      "64": ami-0782e9ee97725263d
    us-west-1:
      "64": ami-0ad16744583f21877
    us-west-2:
      "64": ami-0e32ec5bc225539f5

Resources:
  # --- Public subnets ---
  PublicSubnetA:
    Type: "AWS::EC2::Subnet"
    Properties:
      AvailabilityZone: !Select
        - 0
        - !GetAZs ""
      CidrBlock: !Ref PublicSubnetCidrA
      MapPublicIpOnLaunch: False
      Tags:
        - Key: "Name"
          Value: !Sub ${AppName}-public-a
      VpcId: !ImportValue VpcId
  PublicSubnetARouteTable:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Properties:
      RouteTableId: !ImportValue PublicRouteTableID
      SubnetId: !Ref PublicSubnetA

  PublicSubnetB:
    Type: "AWS::EC2::Subnet"
    Properties:
      AvailabilityZone: !Select
        - 1
        - !GetAZs ""
      CidrBlock: !Ref PublicSubnetCidrB
      MapPublicIpOnLaunch: False
      Tags:
        - Key: "Name"
          Value: !Sub ${AppName}-public-b
      VpcId: !ImportValue VpcId
  PublicSubnetBRouteTable:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Properties:
      RouteTableId: !ImportValue PublicRouteTableID
      SubnetId: !Ref PublicSubnetB

  PublicSubnetC:
    Type: "AWS::EC2::Subnet"
    Properties:
      AvailabilityZone: !Select
        - 2
        - !GetAZs ""
      CidrBlock: !Ref PublicSubnetCidrC
      MapPublicIpOnLaunch: False
      Tags:
        - Key: "Name"
          Value: !Sub ${AppName}-public-c
      VpcId: !ImportValue VpcId
  PublicSubnetCRouteTable:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Properties:
      RouteTableId: !ImportValue PublicRouteTableID
      SubnetId: !Ref PublicSubnetC

  # --- Internet facing load balancer ---
  PublicLoadBalancer:
    Type: "AWS::ElasticLoadBalancingV2::LoadBalancer"
    Properties:
      Name: !Sub ${AppName}
      Scheme: internet-facing
      SecurityGroups:
        - !Ref PublicLoadBalancerSecurityGroup
      Subnets:
        - !Ref PublicSubnetA
        - !Ref PublicSubnetB
        - !Ref PublicSubnetC
      Tags:
        - Key: service
          Value: !Sub ${AppName}
      Type: application
      IpAddressType: ipv4

  PublicLoadBalancerSecurityGroup:
    Type: "AWS::EC2::SecurityGroup"
    Properties:
      GroupName: !Sub ${AppName}-public
      GroupDescription: !Sub ${AppName} public load balancer
      SecurityGroupEgress:
        - CidrIp: 0.0.0.0/0
          IpProtocol: tcp
          FromPort: 0
          ToPort: 65535
      SecurityGroupIngress:
        - CidrIp: 0.0.0.0/0
          IpProtocol: tcp # Web app HTTP public access
          FromPort: 80
          ToPort: 80
        - CidrIp: 0.0.0.0/0 # For HTTPS / SSL. Must create and install SSL certificate manually into load balancer.
          IpProtocol: tcp
          FromPort: 443
          ToPort: 443
      Tags:
        - Key: Name
          Value: !Sub ${AppName}-public
      VpcId: !ImportValue VpcId

  PublicLoadBalancerTargetGroup:
    Type: "AWS::ElasticLoadBalancingV2::TargetGroup"
    Properties:
      HealthCheckIntervalSeconds: 10
      HealthCheckPath: !Ref AppHeartbeatUrl
      HealthCheckPort: traffic-port
      HealthCheckProtocol: HTTP
      HealthCheckTimeoutSeconds: 5
      HealthyThresholdCount: 3
      UnhealthyThresholdCount: 3
      Matcher:
        HttpCode: 200
      Name: !GetAtt PublicLoadBalancer.LoadBalancerName
      Port: !Ref AppPortNumber
      Protocol: HTTP
      Tags:
        - Key: service
          Value: !Sub ${AppName}
      TargetGroupAttributes:
        - Key: deregistration_delay.timeout_seconds
          Value: "30"
      TargetType: instance
      VpcId: !ImportValue VpcId

  PublicLoadBalancerListener:
    Type: "AWS::ElasticLoadBalancingV2::Listener"
    Properties:
      DefaultActions:
        - TargetGroupArn: !Ref PublicLoadBalancerTargetGroup
          Type: forward
      LoadBalancerArn: !Ref PublicLoadBalancer
      Port: 80
      Protocol: HTTP

  # --- App's private subnets ---
  PrivateSubnetA:
    Type: "AWS::EC2::Subnet"
    Properties:
      AvailabilityZone: !Select
        - 0
        - !GetAZs ""
      CidrBlock: !Ref PrivateSubnetCidrA
      MapPublicIpOnLaunch: False
      Tags:
        - Key: "Name"
          Value: !Sub ${AppName}-private-a
      VpcId: !ImportValue VpcId
  SubnetARouteTable:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Properties:
      RouteTableId: !ImportValue PrivateRouteTableID
      SubnetId: !Ref PrivateSubnetA

  PrivateSubnetB:
    Type: "AWS::EC2::Subnet"
    Properties:
      AvailabilityZone: !Select
        - 1
        - !GetAZs ""
      CidrBlock: !Ref PrivateSubnetCidrB
      MapPublicIpOnLaunch: False
      Tags:
        - Key: "Name"
          Value: !Sub ${AppName}-private-b
      VpcId: !ImportValue VpcId
  SubnetBRouteTable:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Properties:
      RouteTableId: !ImportValue PrivateRouteTableID
      SubnetId: !Ref PrivateSubnetB

  PrivateSubnetC:
    Type: "AWS::EC2::Subnet"
    Properties:
      AvailabilityZone: !Select
        - 2
        - !GetAZs ""
      CidrBlock: !Ref PrivateSubnetCidrC
      MapPublicIpOnLaunch: False
      Tags:
        - Key: "Name"
          Value: !Sub ${AppName}-private-c
      VpcId: !ImportValue VpcId
  SubnetCRouteTable:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Properties:
      RouteTableId: !ImportValue PrivateRouteTableID
      SubnetId: !Ref PrivateSubnetC

  # --- App ---
  AppLaunchTemplate:
    Type: "AWS::EC2::LaunchTemplate"
    Properties:
      LaunchTemplateName: !Sub ${AppName}
      LaunchTemplateData:
        TagSpecifications:
          - ResourceType: instance
            Tags:
              - Key: Name
                Value: !Sub ${AppName}
        IamInstanceProfile:
          Name: !Ref InstanceProfile
        SecurityGroupIds:
          - !Ref AppAutoScalingSecurityGroup
        KeyName: !Ref KeyName
        ImageId: !FindInMap [Ubuntu1604, !Ref "AWS::Region", 64]
        InstanceType: !Ref InstanceType
        UserData:
          Fn::Base64: !Sub |
            #!/bin/bash
            apt-get update
            DEBIAN_FRONTEND=noninteractive apt-get -y upgrade
            apt-get install python-pip ruby wget -y
            cd /home/ubuntu
            wget https://aws-codedeploy-${AWS::Region}.s3.amazonaws.com/latest/install
            chmod +x ./install
            ./install auto
            rm install
            systemctl start codedeploy-agent.service

  AppAutoScalingSecurityGroup:
    Type: "AWS::EC2::SecurityGroup"
    Properties:
      GroupName: !Sub ${AppName}-private
      GroupDescription: !Sub ${AppName} autoscaling
      SecurityGroupEgress:
        - CidrIp: 0.0.0.0/0
          IpProtocol: tcp
          FromPort: 0
          ToPort: 65535
      SecurityGroupIngress:
        - IpProtocol: tcp
          SourceSecurityGroupId: !Ref PublicLoadBalancerSecurityGroup
          FromPort: !Ref AppPortNumber
          ToPort: !Ref AppPortNumber
        - IpProtocol: tcp
          SourceSecurityGroupId: !ImportValue BastionHostSecurityGroupID
          FromPort: 22
          ToPort: 22
      Tags:
        - Key: Name
          Value: !Sub ${AppName}-private
      VpcId: !ImportValue VpcId

  AppAutoScalingGroup:
    Type: "AWS::AutoScaling::AutoScalingGroup"
    Properties:
      Tags:
        - Key: Name
          Value: !Sub ${AppName}
          PropagateAtLaunch: True
      Cooldown: 70
      DesiredCapacity: 2
      HealthCheckGracePeriod: 300
      HealthCheckType: ELB
      LaunchTemplate:
        LaunchTemplateId: !Ref AppLaunchTemplate
        Version: !GetAtt AppLaunchTemplate.LatestVersionNumber
      MaxSize: 3
      MetricsCollection:
        - Granularity: 1Minute
      MinSize: 2
      TargetGroupARNs:
        - !Ref PublicLoadBalancerTargetGroup
      VPCZoneIdentifier:
        - !Ref PrivateSubnetA
        - !Ref PrivateSubnetB
        - !Ref PrivateSubnetC
    UpdatePolicy:
      AutoScalingReplacingUpdate:
        WillReplace: False
      AutoScalingScheduledAction:
        IgnoreUnmodifiedGroupSizeProperties: True
      AutoScalingRollingUpdate:
        MaxBatchSize: 1
        MinInstancesInService: 2
        PauseTime: PT1M
        SuspendProcesses:
          - HealthCheck
          - ReplaceUnhealthy
          - AZRebalance
          - AlarmNotification
          - ScheduledActions
        WaitOnResourceSignals: False

  TargetScalingPolicy:
    Type: "AWS::AutoScaling::ScalingPolicy"
    Properties:
      AutoScalingGroupName: !Ref AppAutoScalingGroup
      Cooldown: "90"
      PolicyType: "TargetTrackingScaling"
      TargetTrackingConfiguration:
        DisableScaleIn: False
        TargetValue: 300
        PredefinedMetricSpecification:
          PredefinedMetricType: ALBRequestCountPerTarget
          ResourceLabel: !Join
            - "/"
            - - !Select [1, !Split ["loadbalancer/", !Ref PublicLoadBalancer]]
              - "targetgroup"
              - !Select [
                  1,
                  !Split ["targetgroup/", !Ref PublicLoadBalancerTargetGroup],
                ]

  InstanceProfile:
    Type: "AWS::IAM::InstanceProfile"
    Properties:
      Path: "/"
      Roles:
        - !Ref "InstanceRole"
      InstanceProfileName: !Sub ${AppName}-ec2

  InstanceRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: !Sub ${AppName}-ec2
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "ec2.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"
      Policies:
        - PolicyName: "S3Bucket"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - s3:Get*
                  - s3:List*
                Resource:
                  - !Join ["", [!GetAtt DeploymentBucket.Arn, "*"]]
        # *** Add access to more S3 buckets here or other AWS resources for your app EC2 instances. ***

  # --- App's deployment ---
  DeploymentBucket:
    Type: AWS::S3::Bucket

  CodePipelineRole:
      Type: "AWS::IAM::Role"
      Properties:
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: "Allow"
              Principal:
                Service:
                  - "codepipeline.amazonaws.com"
              Action:
                - "sts:AssumeRole"
        Policies:
          - PolicyName: "DeploymentBucket"
            PolicyDocument:
              Version: "2012-10-17"
              Statement:
                - Effect: "Allow"
                  Action: "s3:*"
                  Resource:
                    - !Join ["", [!GetAtt DeploymentBucket.Arn, "*"]]
          - PolicyName: "CodeDeploy"
            PolicyDocument:
              Version: "2012-10-17"
              Statement:
                - Effect: "Allow"
                  Action: "codedeploy:*"
                  Resource: "*"
          - 
            PolicyName: "DeploymentNotification"
            PolicyDocument: 
              Version: "2012-10-17"
              Statement:
                - 
                  Effect: "Allow"
                  Action: "sns:Publish"
                  Resource: !Ref CodeDeployNotificationTopic

        Path: "/"
        RoleName: !Sub ${AppName}-codepipeline
        ManagedPolicyArns:
          - "arn:aws:iam::aws:policy/AWSCodePipelineFullAccess"

  AppPipeline:
    Type: "AWS::CodePipeline::Pipeline"
    Properties:
      Name: !Ref AppName
      RoleArn: !GetAtt CodePipelineRole.Arn
      Stages:
        - Name: Source
          Actions:
            - Name: App
              ActionTypeId:
                Category: Source
                Owner: ThirdParty
                Version: 1
                Provider: GitHub
              OutputArtifacts:
                - Name: App
              Configuration:
                Owner: !Ref AppRepoOwner
                Repo: !Ref AppRepo
                PollForSourceChanges: True
                Branch: !Ref AppBranch
                OAuthToken: !Ref GitHubOAuthToken
              RunOrder: 1
        - Name: Deploy
          Actions:
            - Name: DeployAction
              InputArtifacts:
                - Name: App
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Version: 1
                Provider: CodeDeploy
              Configuration:
                ApplicationName: !Ref CodeDeployApplication
                DeploymentGroupName: !Ref CodeDeploy
              RunOrder: 1

      ArtifactStore:
        Type: S3
        Location: !Ref DeploymentBucket

  CodeDeployApplication:
    Type: "AWS::CodeDeploy::Application"
    Properties:
      ApplicationName: !Ref AppName

  CodeDeploy:
    Type: "AWS::CodeDeploy::DeploymentGroup"
    Properties:
      ApplicationName: !Ref CodeDeployApplication
      AutoScalingGroups:
        - !Ref AppAutoScalingGroup
      DeploymentGroupName: !Ref AppName
      DeploymentStyle:
        DeploymentOption: WITH_TRAFFIC_CONTROL
      LoadBalancerInfo:
        TargetGroupInfoList:
          - Name: !Select [1,!Split ['/',!GetAtt PublicLoadBalancerTargetGroup.TargetGroupFullName]]
      ServiceRoleArn: !GetAtt CodeDeployRole.Arn
      TriggerConfigurations:
        - TriggerEvents:
            - DeploymentStart
            - DeploymentSuccess
            - DeploymentFailure
            - InstanceFailure
            - DeploymentStop
            - DeploymentRollback
            - DeploymentReady
          TriggerName: !Sub ${AppName}-deployment-notifications
          TriggerTargetArn: !Ref CodeDeployNotificationTopic

  CodeDeployRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "codedeploy.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"
      RoleName: !Sub ${AppName}-codedeploy
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRole"

  # Subscribe to this SNS topic to get deployment notifications. Subscribe your e-mail address for example.
  CodeDeployNotificationTopic:
    Type: AWS::SNS::Topic
    Properties: 
      DisplayName: !Sub ${AppName}
      TopicName: !Sub ${AppName}-deployment