template.yaml

---
Description: Autoscaling Lambda for elastic-ci stack Buildkite Agents
Transform: AWS::Serverless-2016-10-31

Parameters:
  BuildkiteAgentTokenParameter:
    Description: Buildkite agent token Systems Manager Parameter Store path
    Type: String

  BuildkiteAgentTokenParameterStoreKMSKey:
    Description: (Optional) AWS KMS Key ID used to encrypt the BuildkiteAgentTokenParameter Systems Manager Parameter, if encrypted
    Type: String
    Default: ""

  BuildkiteQueue:
    Description: Queue name that agents will use, targeted in pipeline steps using "queue={value}"
    Type: String
    Default: default
    MinLength: "1"

  RootStackName:
    Description: Name of parent CloudFormation stack (if exists)
    Type: String
    Default: "Elastic CI Stack"

  AgentAutoScaleGroup:
    Description: The name of the Auto Scaling group to set desired count on.
    Type: String
    Default: default

  AutoscalingLambdaExecutionRole:
    Description: IAM Role ARN
    Type: String
    Default: ''

  EventSchedulePeriod:
    Description: How often the Event Schedule is triggered. Should be an expression with units, e.g. "30 seconds", "1 minute", "5 minutes".
    Type: String
    Default: "1 minute"

  AgentsPerInstance:
    Description: ""
    Type: Number

  MinSize:
    Description: ""
    Type: String

  MaxSize:
    Description: ""
    Type: String

  ScaleOutFactor:
    Description: ""
    Type: Number

  InstanceBuffer:
    Description: How many free instances to maintain
    Type: Number
    Default: "0"

  ScaleOutForWaitingJobs:
    Description: ""
    Type: String
    AllowedValues:
      - "true"
      - "false"
    Default: "false"

  DisableScaleIn:
    Description: Whether the desired count should ever be decreased on the given Auto Scaling group. Defaults to true, instances are expected to self terminate when they are idle.
    Type: String
    AllowedValues:
      - "true"
      - "false"
    Default: "true"

  RolePermissionsBoundaryARN:
    Type: String
    Description: The ARN of the policy used to set the permissions boundary for the role.
    Default: ""

  LogRetentionDays:
    Type: Number
    Description: The number of days to retain the Cloudwatch Logs of the lambda.
    Default: "1"

  MaxDescribeScalingActivitiesPages:
    Type: Number
    Description: The number of pages to retrive for DescribeScalingActivity. Negative numbers mean unlimited.
    Default: "-1"

  MinPollInterval:
    Type: String
    Description: Minimum time interval between polls. If a larger interval is provided by Buildkite, that is used instead.
    Default: "10s"
  
  SecurityGroupIds:
    Description: "Comma separated list of security group IDs to run the lambda in. Defaults to not configuring security groups."
    Type: CommaDelimitedList
    Default: ""
    
  SubnetIds:
    Description: "Comma separated list of subnet IDs to run the lambda in. Defaults to not configuring subnets."
    Type: CommaDelimitedList
    Default: ""

Conditions:
  CreateRole:
    !Equals [ !Ref AutoscalingLambdaExecutionRole, '' ]
  UseKmsKeyForParameterStore:
    !Not [ !Equals [ !Ref BuildkiteAgentTokenParameterStoreKMSKey, "" ] ]
  SetRolePermissionsBoundaryARN:
    !Not [ !Equals [ !Ref RolePermissionsBoundaryARN, "" ] ]
  SetSecurityGroups:
    Fn::Not:
      - Fn::Equals:
        - Fn::Join:
           - ""
           - Ref: SecurityGroupIds
        - ""
  SetSubnets:
    Fn::Not:
      - Fn::Equals:
        - Fn::Join:
           - ""
           - Ref: SubnetIds
        - ""

Mappings:
  LambdaBucket:
    us-east-1: { Bucket: "buildkite-lambdas" }
    us-east-2: { Bucket: "buildkite-lambdas-us-east-2" }
    us-west-1: { Bucket: "buildkite-lambdas-us-west-1" }
    us-west-2: { Bucket: "buildkite-lambdas-us-west-2" }
    af-south-1: { Bucket: "buildkite-lambdas-af-south-1" }
    ap-east-1: { Bucket: "buildkite-lambdas-ap-east-1" }
    ap-south-1: { Bucket: "buildkite-lambdas-ap-south-1" }
    ap-northeast-2: { Bucket: "buildkite-lambdas-ap-northeast-2" }
    ap-northeast-1: { Bucket: "buildkite-lambdas-ap-northeast-1" }
    ap-southeast-2: { Bucket: "buildkite-lambdas-ap-southeast-2" }
    ap-southeast-1: { Bucket: "buildkite-lambdas-ap-southeast-1" }
    ca-central-1: { Bucket: "buildkite-lambdas-ca-central-1" }
    eu-central-1: { Bucket: "buildkite-lambdas-eu-central-1" }
    eu-west-1: { Bucket: "buildkite-lambdas-eu-west-1" }
    eu-west-2: { Bucket: "buildkite-lambdas-eu-west-2" }
    eu-south-1: { Bucket: "buildkite-lambdas-eu-south-1" }
    eu-west-3: { Bucket: "buildkite-lambdas-eu-west-3" }
    eu-north-1: { Bucket: "buildkite-lambdas-eu-north-1" }
    me-south-1: { Bucket: "buildkite-lambdas-me-south-1" }
    sa-east-1: { Bucket: "buildkite-lambdas-sa-east-1" }

Resources:
  ExecutionRole:
    Type: AWS::IAM::Role
    Condition: CreateRole
    Properties:
      Path: "/"
      PermissionsBoundary: !If [ SetRolePermissionsBoundaryARN, !Ref RolePermissionsBoundaryARN, !Ref "AWS::NoValue" ]
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
          Action:
          - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: AutoScalingGroups
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - autoscaling:DescribeAutoScalingGroups
                  # *
                  - autoscaling:SetDesiredCapacity
                  - autoscaling:DescribeScalingActivities
                  # # arn:aws:autoscaling:$region:$account:autoScalingGroup:$uuid:autoScalingGroupName/$name
                Resource: '*'
        - PolicyName: WriteCloudwatchMetrics
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: cloudwatch:PutMetricData
                Resource: '*'
        - PolicyName: ReadAgentToken
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: ssm:GetParameter
                Resource: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter${BuildkiteAgentTokenParameter}
        - !If
          - UseKmsKeyForParameterStore
          - PolicyName: DecryptAgentToken
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action: kms:Decrypt
                  Resource: !Sub arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/${BuildkiteAgentTokenParameterStoreKMSKey}
          - !Ref 'AWS::NoValue'

  AutoscalingFunction:
    Type: AWS::Serverless::Function
    Properties:
      Description: !Sub Polls Buildkite and triggers scale out of elastic stack ${RootStackName}
      CodeUri: handler.zip
      Role: !If [ CreateRole, !GetAtt ExecutionRole.Arn, !Ref AutoscalingLambdaExecutionRole ]
      PermissionsBoundary: !If [ SetRolePermissionsBoundaryARN, !Ref RolePermissionsBoundaryARN, !Ref "AWS::NoValue" ]
      Timeout: 120
      Handler: bootstrap
      Runtime: provided.al2
      Architectures:
        - x86_64
      MemorySize: 128
      VpcConfig:
        SecurityGroupIds: !If [ SetSecurityGroups, !Split [',', !Join [',', !Ref SecurityGroupIds]], !Ref "AWS::NoValue" ]
        SubnetIds: !If [ SetSubnets, !Split [',', !Join [',', !Ref SubnetIds]], !Ref "AWS::NoValue" ]
      Environment:
        Variables:
          BUILDKITE_AGENT_TOKEN_SSM_KEY: !Ref BuildkiteAgentTokenParameter
          BUILDKITE_QUEUE:               !Ref BuildkiteQueue
          AGENTS_PER_INSTANCE:           !Ref AgentsPerInstance
          CLOUDWATCH_METRICS:            "1"
          DISABLE_SCALE_IN:              !Ref DisableScaleIn
          ASG_NAME:                      !Ref AgentAutoScaleGroup
          MIN_SIZE:                      !Ref MinSize
          MAX_SIZE:                      !Ref MaxSize
          SCALE_OUT_FACTOR:              !Ref ScaleOutFactor
          INSTANCE_BUFFER:               !Ref InstanceBuffer
          INCLUDE_WAITING:               !Ref ScaleOutForWaitingJobs
          LAMBDA_TIMEOUT:                "50s"
          LAMBDA_INTERVAL:               !Ref MinPollInterval
          MAX_DESCRIBE_SCALING_ACTIVITIES_PAGES: !Ref MaxDescribeScalingActivitiesPages
      Events:
        Timer:
          Type: Schedule
          Properties:
            Schedule: !Sub "rate(${EventSchedulePeriod})"

  # This mirrors the group that would be created by the lambda, but enforces
  # a retention period and also ensures it's removed when the stack is removed
  LogGroup:
    Type: "AWS::Logs::LogGroup"
    Properties:
      LogGroupName: !Sub "/aws/lambda/${AutoscalingFunction}"
      RetentionInDays: !Ref LogRetentionDays

Outputs:
  ExecutionRoleName:
    Description: Name of the Lambda IAM execution role.
    Value: !If [ CreateRole, !Ref ExecutionRole, '' ]