service.yaml

---
AWSTemplateFormatVersion: 2010-09-09


Description: >-
  Blue/green ECS deployment for SATOSA


Metadata:
  AWS::CloudFormation::Interface:
    ParameterLabels:
      CertificateArn:
        default: ACM Certificate ARN
      ClusterDesiredSize:
        default: ECS Cluster - Desired Size
      ClusterMaxSize:
        default: ECS Cluster - Maximum Size
      ClusterMinSize:
        default: ECS Cluster - Minimum Size
      DomainName:
        default: Domain Name
      EcrPrivateRepoArn:
        default: ECR Private Repository ARN
      EcsImageId:
        default: ECS Image ID
      HostedZoneId:
        default: Route 53 Hosted Zone ID
      Hostname:
        default: Hostname
      ImageUri:
        default: Container Image URI
      InstanceType:
        default: EC2 Instance Type
      LaunchType:
        default: ECS Launch Type
      PrivateSubnet1Cidr:
        default: New VPC Private Subnet 1 IPv4 Address
      PrivateSubnet1Id:
        default: Existing VPC Private Subnet 1 ID
      PrivateSubnet2Cidr:
        default: New VPC Private Subnet 2 IPv4 Address
      PrivateSubnet2Id:
        default: Existing VPC Private Subnet 2 ID
      PublicSubnet1Cidr:
        default: New VPC Public Subnet 1 IPv4 Address
      PublicSubnet1Id:
        default: Existing VPC Public Subnet 1 ID
      PublicSubnet2Cidr:
        default: New VPC Public Subnet 2 IPv4 Address
      PublicSubnet2Id:
        default: Existing VPC Public Subnet 2 ID
      RepositoryCredentialsSecretArn:
        default: Image Repository Credentials Secret ARN
      Saml2BackEndKeyPairSecretArn:
        default: Service Provider Key-Pair Secret ARN
      Saml2FrontEndKeyPairSecretArn:
        default: Identity Provider Key-Pair Secret ARN
      SecretsManagerEncryptionKeyArn:
        default: Custom KMS Key ARN for Secrets Manager Encryption
      VpcCidr:
        default: New VPC IPv4 CIDR Block
      VpcId:
        default: Existing VPC ID
      VpcType:
        default: New or Existing VPC
      
    ParameterGroups:
      - Label:
          default: Service Configuration
        Parameters:
          - Hostname
          - DomainName
          - HostedZoneId
          - CertificateArn
          - SecretsManagerEncryptionKeyArn
          - Saml2BackEndKeyPairSecretArn
          - Saml2FrontEndKeyPairSecretArn
      - Label:
          default: Service Networking
        Parameters:
          - VpcType
          - VpcCidr
          - PublicSubnet1Cidr
          - PublicSubnet2Cidr
          - PrivateSubnet1Cidr
          - PrivateSubnet2Cidr
          - VpcId
          - PublicSubnet1Id
          - PublicSubnet2Id
          - PrivateSubnet1Id
          - PrivateSubnet2Id
      - Label:
          default: Service Hosting
        Parameters:
          - LaunchType
          - EcsImageId
          - InstanceType
          - ClusterMinSize
          - ClusterMaxSize
          - ClusterDesiredSize
          - ImageUri
          - EcrPrivateRepoArn
          - RepositoryCredentialsSecretArn


Parameters:
  CertificateArn:
    Type: String
    Description: >-
      The service stack will use this certificate in AWS Certificate Manager (ACM).
  ClusterDesiredSize:
    Type: Number
    Default: 2
    Description: >-
      When deploying ECS clusters on EC2, the stack will configure the Auto Scaling group to keep at least this many ECS container instances running at all times.
      It must greater than or equal to the cluster's minimum size and less than or equal to the cluster's maximum size.
  ClusterMaxSize:
    Type: Number
    Default: 2
    Description: >-
      When deploying ECS clusters on EC2, the stack will create the Auto Scaling group with no more than this many ECS container instances.
  ClusterMinSize:
    Type: Number
    Default: 2
    Description: >-
      When deploying ECS clusters on EC2, the stack will create the Auto Scaling group with at least this many ECS container instances.
  DomainName:
    Type: String
    Description: >-
      The domain name of the service, e.g., for "aai.example.com", the domain name would be "example.com".
  EcrPrivateRepoArn:
    Type: String
    Default: ''
    Description: >-
      (Optional) If specified, this stack will give the ECS task execution role read-only access to this ECR private repository.
      If neither this parameter nor RepositoryCredentialsSecretArn is specified, ECS will download the container image anonymously.
  EcsImageId:
    Type: String
    Default: ''
    Description: >-
      When deploying ECS clusters on EC2, the stack will create the Auto Scaling group with ECS container instances based on this Amazon Machine Image (AMI).
  HostedZoneId:
    Type: String
    Default: ''
    Description: >-
      (Optional) If specified, the service stack will create resource records for SATOSA in this Route 53 hosted zone.
      Note that the Route 53 hosted zone MUST exist in the same partition/account as this stack.
  Hostname:
    Type: String
    Description: >-
      The short name of the service, e.g., for "aai.example.com", the hostname would be "aai".
  ImageUri:
    Type: String
    Default: satosa
    Description: >-
      The stack will deploy this Docker container image:tag.
  InstanceType:
    Type: String
    Default: t3a.medium
    Description: >-
      When deploying ECS clusters on EC2, the stack will create the Auto Scaling group with ECS container instances based on this EC2 instance type.
  LaunchType:
    Type: String
    Default: FARGATE
    Description: >-
      The stack will deploy ECS-managed containers using Fargate or EC2.
      Selecting EC2 will create an Auto Scaling group of t3a.micro instances for the cluster.
      For more information on launch types, refer to https://docs.aws.amazon.com/AmazonECS/latest/developerguide/launch_types.html.
    AllowedValues:
      - EC2
      - FARGATE
  PrivateSubnet1Cidr:
    Type: String
    Default: 192.168.128.0/18
    Description: >-
      When creating a new VPC, the stack will use this subnet of the VPC's IPv4 CIDR block for the first private subnet.
  PrivateSubnet1Id:
    Type: String
    Default: ''
    Description: >-
      If using an existing VPC, the stack will use this subnet ID as the first private subnet.
  PrivateSubnet2Cidr:
    Type: String
    Default: 192.168.192.0/18
    Description: >-
      When creating a new VPC, the stack will use this subnet of the VPC's IPv4 CIDR block for the second private subnet.
  PrivateSubnet2Id:
    Type: String
    Default: ''
    Description: >-
      If using an existing VPC, the stack will use this subnet ID as the second private subnet.
  PublicSubnet1Cidr:
    Type: String
    Default: 192.168.0.0/18
    Description: >-
      When creating a new VPC, the stack will use this subnet of the VPC's IPv4 CIDR block for the first public subnet.
  PublicSubnet1Id:
    Type: String
    Default: ''
    Description: >-
      If using an existing VPC, the stack will use this subnet ID as the first public subnet.
  PublicSubnet2Cidr:
    Type: String
    Default: 192.168.64.0/18
    Description: >-
      When creating a new VPC, the stack will use this subnet of the VPC's IPv4 CIDR block for the second public subnet.
  PublicSubnet2Id:
    Type: String
    Default: ''
    Description: >-
      If using an existing VPC, the stack will use this subnet ID as the second public subnet.
  RepositoryCredentialsSecretArn:
    Type: String
    Default: ''
    Description: >-
      (Optional) If specified, the ECS task execution role will use container image repository credentials stored in this AWS Secrets Manager secret.
      For more information, refer to https://docs.aws.amazon.com/AmazonECS/latest/developerguide/private-auth.html.
      If neither this parameter nor EcrPrivateRepoArn is specified, ECS will download the container image anonymously.
  Saml2BackEndKeyPairSecretArn:
    Type: String
    Description: >-
      SATOSA's service provier back end will use this key-pair, stored in Amazon Secrets Manager, for SAML 2.0 request signing and response decryption.
  Saml2FrontEndKeyPairSecretArn:
    Type: String
    Description: >-
      SATOSA's identity provider front end will use this key-pair, stored in Amazon Secrets Manager, for SAML 2.0 response signing.
  SecretsManagerEncryptionKeyArn:
    Type: String
    Default: ''
    Description: >-
      (Optional) The stack will encrypt and decrypt Secrets Manager secrets with a KMS key identified by this ARN instead of the default.
  VpcCidr:
    Type: String
    Default: 192.168.0.0/16
    Description: >-
      When creating a new VPC, the stack will use this IPv4 CIDR block.
  VpcId:
    Type: String
    Default: ''
    Description: >-
      If using an existing VPC, the stack will create resources in the VPC with this identifier.
  VpcType:
    Type: String
    Default: New
    Description: >-
      The stack will create a new VPC (the default) or deploy into an existing one.
    AllowedValues:
      - New
      - Existing


Conditions:
  WithEC2:
    !Equals [ !Ref LaunchType, EC2 ]
  WithEcrPrivateRepo:
    !Not [ !Equals [ !Ref EcrPrivateRepoArn, '' ] ]
  WithExistingVpc:
    !Equals [ !Ref VpcType, Existing ]
  WithFargate:
    !Equals [ !Ref LaunchType, FARGATE ]
  WithNewVpc:
    !Equals [ !Ref VpcType, New ]
  WithRepositoryCredentials:
    !Not [ !Equals [ !Ref RepositoryCredentialsSecretArn, '' ] ]
  WithRoute53:
    !Not [ !Equals [ !Ref HostedZoneId, '' ] ]
  WithSecretsManagerCustomKmsKey:
    !Not [ !Equals [ !Ref SecretsManagerEncryptionKeyArn, '' ] ]
  WithThirdPartyDns:
    !Equals [ !Ref HostedZoneId, '' ]


Transform:
  - AWS::CodeDeployBlueGreen


Hooks:
  CodeDeployBlueGreenHook:
    Type: AWS::CodeDeploy::BlueGreen
    Properties:
      TrafficRoutingConfig:
        Type: TimeBasedCanary
        TimeBasedCanary:
          StepPercentage: 15
          BakeTimeMins: 5
      Applications:
        - Target:
            Type: AWS::ECS::Service
            LogicalID: EcsService
          ECSAttributes:
            TaskDefinitions:
              - BlueTaskDefinition
              - GreenTaskDefinition
            TaskSets:
              - BlueTaskSet
              - GreenTaskSet
            TrafficRouting:
              ProdTrafficRoute:
                Type: AWS::ElasticLoadBalancingV2::Listener
                LogicalID: AlbListenerHttps
              TargetGroups:
                - BlueAlbTargetGroup
                - GreenAlbTargetGroup


Resources:
  # conditionally deploy the service in a new VPC
  VPC:
    Type: AWS::EC2::VPC
    Condition: WithNewVpc
    Properties:
      CidrBlock: !Ref VpcCidr
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: !Ref AWS::StackName
  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Condition: WithNewVpc
    Properties:
      Tags:
        - Key: Name
          Value: !Ref AWS::StackName
  InternetGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Condition: WithNewVpc
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref VPC
  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Condition: WithNewVpc
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 0, !GetAZs '' ]
      CidrBlock: !Ref PublicSubnet1Cidr
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub ${AWS::StackName} Public Subnet (AZ1)
  PublicSubnet2:
    Type: AWS::EC2::Subnet
    Condition: WithNewVpc
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 1, !GetAZs  '' ]
      CidrBlock: !Ref PublicSubnet2Cidr
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub ${AWS::StackName} Public Subnet (AZ2)
  PrivateSubnet1:
    Type: AWS::EC2::Subnet
    Condition: WithNewVpc
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 0, !GetAZs  '' ]
      CidrBlock: !Ref PrivateSubnet1Cidr
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub ${AWS::StackName} Private Subnet (AZ1)
  PrivateSubnet2:
    Type: AWS::EC2::Subnet
    Condition: WithNewVpc
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 1, !GetAZs  '' ]
      CidrBlock: !Ref PrivateSubnet2Cidr
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub ${AWS::StackName} Private Subnet (AZ2)
  NatGateway1EIP:
    Type: AWS::EC2::EIP
    Condition: WithNewVpc
    DependsOn: InternetGatewayAttachment
    Properties:
      Domain: vpc
  NatGateway2EIP:
    Type: AWS::EC2::EIP
    Condition: WithNewVpc
    DependsOn: InternetGatewayAttachment
    Properties:
      Domain: vpc
  NatGateway1:
    Type: AWS::EC2::NatGateway
    Condition: WithNewVpc
    Properties:
      AllocationId: !GetAtt NatGateway1EIP.AllocationId
      SubnetId: !Ref PublicSubnet1
  NatGateway2:
    Type: AWS::EC2::NatGateway
    Condition: WithNewVpc
    Properties:
      AllocationId: !GetAtt NatGateway2EIP.AllocationId
      SubnetId: !Ref PublicSubnet2
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Condition: WithNewVpc
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub ${AWS::StackName} Public Routes
  DefaultPublicRoute:
    Type: AWS::EC2::Route
    Condition: WithNewVpc
    DependsOn: InternetGatewayAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway
  PublicSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Condition: WithNewVpc
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref PublicSubnet1
  PublicSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Condition: WithNewVpc
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref PublicSubnet2
  PrivateRouteTable1:
    Type: AWS::EC2::RouteTable
    Condition: WithNewVpc
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub ${AWS::StackName} Private Routes (AZ1)
  DefaultPrivateRoute1:
    Type: AWS::EC2::Route
    Condition: WithNewVpc
    Properties:
      RouteTableId: !Ref PrivateRouteTable1
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway1
  PrivateSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Condition: WithNewVpc
    Properties:
      RouteTableId: !Ref PrivateRouteTable1
      SubnetId: !Ref PrivateSubnet1
  PrivateRouteTable2:
    Type: AWS::EC2::RouteTable
    Condition: WithNewVpc
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub ${AWS::StackName} Private Routes (AZ2)
  DefaultPrivateRoute2:
    Type: AWS::EC2::Route
    Condition: WithNewVpc
    Properties:
      RouteTableId: !Ref PrivateRouteTable2
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway2
  PrivateSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Condition: WithNewVpc
    Properties:
      RouteTableId: !Ref PrivateRouteTable2
      SubnetId: !Ref PrivateSubnet2
  NewVpcWaitHandle:
    Type: AWS::CloudFormation::WaitConditionHandle
    Condition: WithNewVpc
    DependsOn:
      - VPC
      - InternetGateway
      - InternetGatewayAttachment
      - PublicSubnet1
      - PublicSubnet2
      - PrivateSubnet1
      - PrivateSubnet2
      - NatGateway1EIP
      - NatGateway2EIP
      - NatGateway1
      - NatGateway2
      - PublicRouteTable
      - DefaultPublicRoute
      - PublicSubnet1RouteTableAssociation
      - PublicSubnet2RouteTableAssociation
      - PrivateRouteTable1
      - DefaultPrivateRoute1
      - PrivateSubnet1RouteTableAssociation
      - PrivateRouteTable2
      - DefaultPrivateRoute2
      - PrivateSubnet2RouteTableAssociation
  ExistingVpcWaitHandle:        # no op
    Type: AWS::CloudFormation::WaitConditionHandle
    Condition: WithExistingVpc
  WaitForVpcDeployment:
    Type: AWS::CloudFormation::WaitCondition
    Properties:
      Handle: !If [ WithNewVpc, !Ref NewVpcWaitHandle, !Ref ExistingVpcWaitHandle ]
      Timeout: 1
      Count: 0

  # put the service behind an application load balancer
  AlbSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: !Sub ${AWS::StackName}-alb
      VpcId: !If [ WithNewVpc, !Ref VPC, !Ref VpcId ]
      SecurityGroupIngress:
        - CidrIp: 0.0.0.0/0
          IpProtocol: TCP
          FromPort: 80
          ToPort: 80
        - CidrIp: 0.0.0.0/0
          IpProtocol: TCP
          FromPort: 443
          ToPort: 443
  BlueAlbTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckIntervalSeconds: 5
      HealthCheckPath: /ping
      HealthCheckPort: '8080'
      HealthCheckProtocol: HTTP
      HealthCheckTimeoutSeconds: 2
      HealthyThresholdCount: 2
      Matcher:
        HttpCode: '200'
      Port: 8080
      Protocol: HTTP
      TargetGroupAttributes:
        - Key: stickiness.enabled
          Value: true
        - Key: stickiness.type
          Value: lb_cookie
        - Key: stickiness.lb_cookie.duration_seconds
          Value: 900
      TargetType: !If [ WithFargate, ip, instance ]
      UnhealthyThresholdCount: 4
      VpcId: !If [ WithNewVpc, !Ref VPC, !Ref VpcId ]
  GreenAlbTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckIntervalSeconds: 5
      HealthCheckPath: /ping
      HealthCheckPort: '8080'
      HealthCheckProtocol: HTTP
      HealthCheckTimeoutSeconds: 2
      HealthyThresholdCount: 2
      Matcher:
        HttpCode: '200'
      Port: 8080
      Protocol: HTTP
      TargetGroupAttributes:
        - Key: stickiness.enabled
          Value: true
        - Key: stickiness.type
          Value: lb_cookie
        - Key: stickiness.lb_cookie.duration_seconds
          Value: 900
      TargetType: !If [ WithFargate, ip, instance ]
      UnhealthyThresholdCount: 4
      VpcId: !If [ WithNewVpc, !Ref VPC, !Ref VpcId ]
  LoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    DependsOn: WaitForVpcDeployment
    Properties:
      Scheme: internet-facing
      SecurityGroups:
        - !Ref AlbSecurityGroup
      Subnets:
        - !If [ WithNewVpc, !Ref PublicSubnet1, !Ref PublicSubnet1Id ]
        - !If [ WithNewVpc, !Ref PublicSubnet2, !Ref PublicSubnet2Id ]
      Type: application
      IpAddressType: ipv4
  AlbListenerHttp:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: !Ref LoadBalancer
      Protocol: HTTP
      Port: 80
      DefaultActions:
        - Type: redirect
          RedirectConfig:
            Protocol: HTTPS
            Port: 443
            Host: "#{host}"
            Path: "/#{path}"
            Query: "#{query}"
            StatusCode: HTTP_301
  AlbListenerHttps:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: !Ref LoadBalancer
      Protocol: HTTPS
      Port: 443
      Certificates:
        - CertificateArn: !Ref CertificateArn
      DefaultActions:
        - Type: forward
          ForwardConfig:
            TargetGroups:
              - TargetGroupArn: !Ref BlueAlbTargetGroup
                Weight: 1
            TargetGroupStickinessConfig:
              Enabled: true
              DurationSeconds: 900

  # conditionally register the load balancer in DNS
  DnsRecord:
    Type: AWS::Route53::RecordSet
    Condition: WithRoute53
    Properties:
      HostedZoneId: !Ref HostedZoneId
      Name: !Sub ${Hostname}.${DomainName}
      Type: A                   # TODO: create second record set for AAAA (IPv6)
      AliasTarget:
        DNSName: !GetAtt LoadBalancer.DNSName
        HostedZoneId: !GetAtt LoadBalancer.CanonicalHostedZoneID

  # generate and manage the SATOSA state encryption key
  StateEncryptionKeySecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      GenerateSecretString:
        ExcludePunctuation: true
      KmsKeyId: !If [ WithSecretsManagerCustomKmsKey, !Ref SecretsManagerEncryptionKeyArn, !Ref AWS::NoValue ]
      Description: >-
        SATOSA uses cookies encrypted with this key to track the progress of an authentication flow.

  # configure logging
  EcsLogGroup:
    Type: AWS::Logs::LogGroup
    DeletionPolicy: Retain
    Properties:
      LogGroupName: !Sub /ecs/${AWS::StackName}

  # deploy the ECS cluster
  EcsCluster:
    Type: AWS::ECS::Cluster
  EcsSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    DependsOn: AlbSecurityGroup
    Properties:
      GroupDescription: !Sub ${AWS::StackName}-ecs
      VpcId: !If [ WithNewVpc, !Ref VPC, !Ref VpcId ]
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 8080
          ToPort: 8080
          SourceSecurityGroupId: !Ref AlbSecurityGroup

  # conditionally host the ECS cluster on EC2
  EcsRole:
    Type: AWS::IAM::Role
    Condition: WithEC2
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              Service: !Sub ec2.${AWS::URLSuffix}
      ManagedPolicyArns:        # FIXME: least privileged access
        - arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role
  EcsInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Condition: WithEC2
    Properties:
      Roles:
        - !Ref EcsRole
  EcsLaunchConfiguration:
    Type: AWS::AutoScaling::LaunchConfiguration
    Condition: WithEC2
    Metadata:
      AWS::CloudFormation::Init:
        config:
          commands:
            01_add_instance_to_cluster:
              command: !Sub echo ECS_CLUSTER=${EcsCluster} > /etc/ecs/ecs.config
          files:
            # allows CloudFormation to make updates to running EC2
            # instances via the UpdateStack API action, cf.,
            # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-hup.html
            /etc/cfn/cfn-hup.conf:
              mode: 00400
              owner: root
              group: root
              content: !Sub |
                [main]
                stack=${AWS::StackId}
                region=${AWS::Region}
            # cf., https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-init.html
            /etc/cfn/hooks.d/cfn-auto-reloader.conf:
              content: !Sub |
                [cfn-auto-reloader-hook]
                triggers=post.update
                path=Resources.EcsLaunchConfiguration.Metadata.AWS::CloudFormation::Init
                action=/opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource EcsLaunchConfiguration --region ${AWS::Region}
          services:
            sysvinit:
              cfn-hup:
                enabled: true
                ensureRunning: true
                files:
                  - /etc/cfn/cfn-hup.conf
                  - /etc/cfn/hooks.d/cfn-auto-reloader.conf
    Properties:
      ImageId: !Ref EcsImageId
      InstanceType: !Ref InstanceType
      IamInstanceProfile: !Ref EcsInstanceProfile
      SecurityGroups:
        - !Ref EcsSecurityGroup
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash
          yum install -y aws-cfn-bootstrap
          /opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource EcsLaunchConfiguration --region ${AWS::Region}
          /opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource EcsAutoScalingGroup --region ${AWS::Region}
  EcsAutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Condition: WithEC2
    Properties:
      MinSize: !Ref ClusterMinSize
      MaxSize: !Ref ClusterMaxSize
      DesiredCapacity: !Ref ClusterDesiredSize
      LaunchConfigurationName: !Ref EcsLaunchConfiguration
      VPCZoneIdentifier:
        Fn::If:
          - WithNewVpc
          - [ !Ref PrivateSubnet1, !Ref PrivateSubnet2 ]
          - [ !Ref PrivateSubnet1Id, !Ref PrivateSubnet2Id ]
    CreationPolicy:
      ResourceSignal:
        Timeout: PT15M
    UpdatePolicy:
      AutoScalingRollingUpdate:
        MinInstancesInService: 1
        MaxBatchSize: 1
        PauseTime: PT15M
        WaitOnResourceSignals: true

  # controls what the ECS agent can do,
  # cf. https://blog.ruanbekker.com/blog/2021/07/31/difference-with-ecs-task-and-execution-iam-roles-on-aws/
  TaskExecRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              Service: !Sub ecs-tasks.${AWS::URLSuffix}
      Policies:
        - PolicyName: Logging
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: !GetAtt EcsLogGroup.Arn
        - PolicyName: ReadSecrets
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action: secretsmanager:GetSecretValue
                Resource:
                  - !Ref Saml2BackEndKeyPairSecretArn
                  - !Ref Saml2FrontEndKeyPairSecretArn
                  - !Ref StateEncryptionKeySecret
  # either give the ECS agent read-only access to the ECR private
  # repository that holds the container image to be deployed,...
  EcrPrivateRepoPolicy:
    Type: AWS::IAM::Policy
    Condition: WithEcrPrivateRepo
    Properties:
      PolicyName: !Sub ${AWS::StackName}-EcrPrivateRepoPolicy
      Roles:
        - !Ref TaskExecRole
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: LogIntoRegistry
            Effect: Allow
            Action: ecr:GetAuthorizationToken
            Resource: '*'
          - Sid: PullImage
            Effect: Allow
            Action:
              - ecr:BatchCheckLayerAvailability
              - ecr:GetDownloadUrlForLayer
              - ecr:BatchGetImage
            Resource: !Ref EcrPrivateRepoArn
  # ...or give the ECS agent read-only access to an AWS Secrets
  # Manager secret that holds the username/password to the third-party
  # container image repository that holds the container image to be
  # deployed
  RepositoryCredentialsPolicy:
    Type: AWS::IAM::Policy
    Condition: WithRepositoryCredentials
    Properties:
      PolicyName: !Sub ${AWS::StackName}-RepositoryCredentialsPolicy
      Roles:
        - !Ref TaskExecRole
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action: secretsmanager:GetSecretValue
            Resource: !Ref RepositoryCredentialsSecretArn
  # give the ECS agent permission to decrypt secrets encrypted with a
  # custom KMS key, if one was used
  SecretsManagerCustomKmsKeyPolicy:
    Type: AWS::IAM::Policy
    Condition: WithSecretsManagerCustomKmsKey
    Properties:
      PolicyName: !Sub ${AWS::StackName}-SecretsManagerCustomKmsKeyPolicy
      Roles:
        - !Ref TaskExecRole
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action: kms:Decrypt
            Resource: !Ref SecretsManagerEncryptionKeyArn

  EcsService:
    Type: AWS::ECS::Service
    Properties:
      Cluster: !Ref EcsCluster
      DesiredCount: 1
      DeploymentController:
        Type: EXTERNAL
  BlueTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: !Ref AWS::StackName
      RequiresCompatibilities:
        - !Ref LaunchType
      NetworkMode: !If [ WithFargate, awsvpc, bridge ]
      # Cpu and Memory must be string values, not integers, due to a
      # bug in the AWS::CodeDeploy::BlueGreen hook
      Cpu: '2048'
      Memory: !If [ WithFargate, '4096', '3884' ]
      # cf. https://docs.aws.amazon.com/AmazonECS/latest/developerguide/using_data_volumes.html
      Volumes:
        - Name: secrets         # store secrets on local ephemeral storage
      ExecutionRoleArn: !GetAtt TaskExecRole.Arn
      ContainerDefinitions:
        - Name: secrets-sidecar
          Image: docker/ecs-secrets-sidecar:1.0
          Essential: false
          MountPoints:
            - ContainerPath: /run/secrets/
              SourceVolume: secrets
          # copy secrets/parameters to the named environment variables
          Secrets:
            - Name: saml2_backend
              ValueFrom: !Ref Saml2BackEndKeyPairSecretArn
            - Name: saml2_frontend
              ValueFrom: !Ref Saml2FrontEndKeyPairSecretArn
            - Name: state_encryption_key
              ValueFrom: !Ref StateEncryptionKeySecret
          # if the secret/parameter is a string (i.e., Keys is null),
          # create /run/secrets/<SECRET> containing the secret's
          # value; if the secret is a JSON mapping, create
          # /run/secrets/<SECRET>/<KEY> containing the value of each
          # of the named keys in the secret
          Command:
            - >-
              [
                  {
                      "Name": "saml2_backend",
                      "Keys": [
                          "certificate",
                          "key"
                      ]
                  },
                  {
                      "Name": "saml2_frontend",
                      "Keys": [
                          "certificate",
                          "key"
                      ]
                  },
                  {
                      "Name": "state_encryption_key",
                      "Keys": null
                  }
              ]
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: !Ref EcsLogGroup
              awslogs-region: !Ref AWS::Region
              awslogs-stream-prefix: task
        - Name: satosa
          RepositoryCredentials:
            Fn::If:
              - WithRepositoryCredentials
              - CredentialsParameter: !Ref RepositoryCredentialsSecretArn
              - !Ref AWS::NoValue
          Image: !Ref ImageUri
          Essential: true
          MountPoints:
            - ContainerPath: /run/secrets/
              SourceVolume: secrets
          PortMappings:
            - HostPort: 8080
              Protocol: tcp
              ContainerPort: 8080
          Environment:
            - Name: BASE_URL
              Value: !Sub https://${Hostname}.${DomainName}
            - Name: STATE_ENCRYPTION_KEY_FILE
              Value: /run/secrets/state_encryption_key
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: !Ref EcsLogGroup
              awslogs-region: !Ref AWS::Region
              awslogs-stream-prefix: task
  BlueTaskSet:
    Type: AWS::ECS::TaskSet
    Properties:
      LaunchType: !Ref LaunchType
      Cluster: !Ref EcsCluster
      Service: !Ref EcsService
      TaskDefinition: !Ref BlueTaskDefinition
      PlatformVersion: !If [ WithFargate, 1.4.0, !Ref AWS::NoValue ]
      NetworkConfiguration:
        AwsVpcConfiguration:
          AssignPublicIp: !If [ WithFargate, ENABLED, DISABLED ]
          SecurityGroups:
            - !If [ WithFargate, !Ref EcsSecurityGroup, !Ref AWS::NoValue ]
          Subnets:
            - !If [ WithFargate, !If [ WithNewVpc, !Ref PrivateSubnet1, !Ref PrivateSubnet1Id ], !Ref AWS::NoValue ]
            - !If [ WithFargate, !If [ WithNewVpc, !Ref PrivateSubnet2, !Ref PrivateSubnet2Id ], !Ref AWS::NoValue ]
      LoadBalancers:
        - ContainerName: satosa
          ContainerPort: 8080
          TargetGroupArn: !Ref BlueAlbTargetGroup
      Scale:
        Unit: PERCENT
        Value: 100
  PrimaryTaskSet:
    Type: AWS::ECS::PrimaryTaskSet
    Properties:
      Cluster: !Ref EcsCluster
      Service: !Ref EcsService
      TaskSetId: !GetAtt BlueTaskSet.Id


Outputs:
  EcsLogGroupName:
    Value: !Ref EcsLogGroup
    Description: >-
      Use the name of the ECS cluster's log group to manage its retention policy, which is not controlled by this CloudFormation template.

  LoadBalancerDnsName:
    Condition: WithThirdPartyDns
    Value: !GetAtt LoadBalancer.DNSName
    Description: >-
      Map the service's hostname to the load balancer's DNS name shown here.

  LoadBalancerHostedZoneId:
    Condition: WithThirdPartyDns
    Value: !GetAtt LoadBalancer.CanonicalHostedZoneID
    Description: >-
      If creating an alias record set in Route 53 outside of this stack, use this value as the load balancer's canonical hosted zone ID.