serverless-resources.yml

pythonBuildsSecurityGroup:
  Type: AWS::EC2::SecurityGroup
  Properties:
    GroupDescription: PythonBuilds jobs - ${self:provider.stage}
    GroupName: PythonBuildsJobs-${self:provider.stage}
    VpcId: ${self:custom.vpcId}
    Tags: ${self:provider.tagsList}

# s3 bucket
S3Bucket:
  Type: AWS::S3::Bucket
  Properties:
    BucketName: ${self:custom.${self:provider.stage}.s3Bucket}

S3BucketPolicy:
  Type: AWS::S3::BucketPolicy
  Properties:
    Bucket: !Ref S3Bucket
    PolicyDocument:
      Statement:
        - Sid: 'Grant a CloudFront Origin Identity access to support private content'
          Action:
            - 's3:GetObject'
          Effect: Allow
          Resource: !Join
            - ''
            - - 'arn:aws:s3:::'
              - !Ref S3Bucket
              - '/*'
          Principal:
            AWS: 'arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E22AXWZT9RAHBI'

pythonBuildsSpotFleetIamRole:
  Type: AWS::IAM::Role
  Properties:
    Path: /service-role/
    AssumeRolePolicyDocument:
      Version: '2012-10-17'
      Statement:
        - Effect: Allow
          Principal:
            Service:
              - spotfleet.amazonaws.com
          Action: sts:AssumeRole
    ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AmazonEC2SpotFleetTaggingRole
pythonBuildsInstanceIamRole:
  Type: AWS::IAM::Role
  Properties:
    AssumeRolePolicyDocument:
      Version: '2012-10-17'
      Statement:
        - Effect: 'Allow'
          Principal:
            Service:
              - 'ec2.amazonaws.com'
          Action:
            - 'sts:AssumeRole'
    Path: '/'
    ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role

pythonBuildsIamInstanceProfile:
  Type: AWS::IAM::InstanceProfile
  Properties:
    Path: '/'
    Roles:
      - Ref: pythonBuildsInstanceIamRole
pythonBuildsEcsTaskIamRole:
  Type: AWS::IAM::Role
  Properties:
    Path: /service-role/
    AssumeRolePolicyDocument:
      Version: '2012-10-17'
      Statement:
        - Effect: Allow
          Principal:
            Service:
              - ecs-tasks.amazonaws.com
          Action: sts:AssumeRole
    ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
    Policies:
      - PolicyName: 's3-python-builds-bucket'
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - s3:*
              Resource:
                - arn:aws:s3:::${self:custom.${self:provider.stage}.s3Bucket}
                - arn:aws:s3:::${self:custom.${self:provider.stage}.s3Bucket}/*

pythonBuildsEcsLaunchTemplate:
  Type: AWS::EC2::LaunchTemplate
  Properties:
    LaunchTemplateName: python-builds-${self:provider.stage}-batch-managed-ecs-larger-volume
    LaunchTemplateData:
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            VolumeType: gp3
            VolumeSize: 64
            Encrypted: true
      MetadataOptions:
        HttpTokens: required
        HttpPutResponseHopLimit: 2

pythonBuildsBatchComputeEnvironment:
  Type: AWS::Batch::ComputeEnvironment
  Properties:
    Type: MANAGED
    ComputeResources:
      AllocationStrategy: BEST_FIT_PROGRESSIVE
      Ec2Configuration:
        - ImageType: ECS_AL2023
      LaunchTemplate:
        LaunchTemplateId:
          Ref: pythonBuildsEcsLaunchTemplate
      SpotIamFleetRole:
        "Fn::GetAtt": [ pythonBuildsSpotFleetIamRole, Arn ]
      SecurityGroupIds:
        - "Fn::GetAtt": [ pythonBuildsSecurityGroup, GroupId ]
      Subnets: ${self:custom.subnets}
      Type: SPOT
      BidPercentage: 100
      InstanceRole:
        "Fn::GetAtt": [ pythonBuildsIamInstanceProfile, Arn ]
      InstanceTypes:
        - m6i
        - m5
        - m5a
        - r6i
        - r5
        - r5a
        - c6i
        - c5
        - c5a
      Ec2KeyPair: ${self:custom.ec2KeyPair}
      Tags: ${self:provider.tagsMap}
      MinvCpus: 0
      DesiredvCpus: 0
      MaxvCpus: 1024
      UpdateToLatestImageVersion: true

pythonBuildsBatchJobQueue:
  Type: AWS::Batch::JobQueue
  Properties:
    ComputeEnvironmentOrder:
      - Order: 1
        ComputeEnvironment:
          Ref: pythonBuildsBatchComputeEnvironment
    State: ENABLED
    Priority: 1

pythonBuildsBatchJobDefinitionUbuntu2004:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ pythonBuildsEcsTaskIamRole, Arn ]
      Image: !Sub "${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/python-builds:ubuntu-2004"
    Timeout:
      AttemptDurationSeconds: 7200
pythonBuildsBatchJobDefinitionUbuntu2204:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ pythonBuildsEcsTaskIamRole, Arn ]
      Image: !Sub "${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/python-builds:ubuntu-2204"
    Timeout:
      AttemptDurationSeconds: 7200
pythonBuildsBatchJobDefinitionUbuntu2404:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ pythonBuildsEcsTaskIamRole, Arn ]
      Image: !Sub "${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/python-builds:ubuntu-2404"
    Timeout:
      AttemptDurationSeconds: 7200
pythonBuildsBatchJobDefinitionDebian11:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ pythonBuildsEcsTaskIamRole, Arn ]
      Image: !Sub "${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/python-builds:debian-11"
    Timeout:
      AttemptDurationSeconds: 7200
pythonBuildsBatchJobDefinitionDebian12:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ pythonBuildsEcsTaskIamRole, Arn ]
      Image: !Sub "${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/python-builds:debian-12"
    Timeout:
      AttemptDurationSeconds: 7200
pythonBuildsBatchJobDefinitionCentos8:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ pythonBuildsEcsTaskIamRole, Arn ]
      Image: !Sub "${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/python-builds:centos-8"
    Timeout:
      AttemptDurationSeconds: 7200
pythonBuildsBatchJobDefinitionRhel9:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ pythonBuildsEcsTaskIamRole, Arn ]
      Image: !Sub "${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/python-builds:rhel-9"
    Timeout:
      AttemptDurationSeconds: 7200

pythonBuildsBatchJobDefinitionOpensuse155:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ pythonBuildsEcsTaskIamRole, Arn ]
      Image: !Sub "${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/python-builds:opensuse-155"
    Timeout:
      AttemptDurationSeconds: 7200

# step function cloudwatch event trigger resources
pythonBuildsEventRuleIamRole:
  Type: AWS::IAM::Role
  Properties:
    Path: /service-role/
    AssumeRolePolicyDocument:
      Version: '2012-10-17'
      Statement:
        - Effect: Allow
          Principal:
            Service:
              - events.amazonaws.com
          Action: sts:AssumeRole
    Policies:
      - PolicyName: 'allow-step-function-execution'
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - states:StartExecution
              Resource:
                Ref: PythonBuildsStepFunction

pythonBuildsEventRule:
  Type: AWS::Events::Rule
  Properties:
    Description: Check for New python Versions
    ScheduleExpression: rate(1 hour)
    State: ${self:custom.${self:provider.stage}.eventRuleState}
    Targets:
      - Id: pythonbuilds
        Input: '{}'
        RoleArn:
          Fn::GetAtt: [ pythonBuildsEventRuleIamRole, Arn ]
        Arn:
          Ref: PythonBuildsStepFunction

pythonBuildsTopic:
  Type: AWS::SNS::Topic
  Properties:
    DisplayName: Python Builds
    TopicName: ${self:custom.${self:provider.stage}.snsTopicName}