cfn-asg-infrastructure.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Code Training ASG + ELB Deploy Infrastructure'

Parameters:
  KeyName:
    Description: Name of an existing EC2 KeyPair to enable SSH access to the instances
    Type: AWS::EC2::KeyPair::KeyName
    ConstraintDescription: must be the name of an existing EC2 KeyPair.

  SSHLocation:
    Description: The IP address range that can be used to SSH to the EC2 instances
    Type: String
    MinLength: '9'
    MaxLength: '18'
    Default: 0.0.0.0/0
    AllowedPattern: "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
    ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x.

  VPC:
    Type: 'AWS::EC2::VPC::Id'

  Subnets:
    Type: 'List<AWS::EC2::Subnet::Id>'
    Description: At least two public subnets in different Availability Zones in the selected VPC

  KmsKeyIdArn:
    Type: String

  ImageId:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2

  InstanceType:
    Type: String
    Default: t2.micro
    AllowedValues:
      - t2.micro
      - t2.small
      - t3.micro
      - t3.small

Resources:
  InstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: 'sts:AssumeRole'
            Principal:
              Service: ec2.amazonaws.com
            Effect: Allow
            Sid: ''
      Policies:
        - PolicyName: AuthenticatedS3GetObjects
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Action:
                  - 's3:Get*'
                  - 's3:List*'
                  - 's3:PutObject'
                Resource: 
                  - !GetAtt CodeDeployS3Bucket.Arn
                  - !Join
                    - '/'
                    - - !GetAtt CodeDeployS3Bucket.Arn
                      - '*'
                Effect: Allow
        - PolicyName: AllowCodeDeploy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Action:
                  - 'codedeploy:CreateApplication'
                  - 'codedeploy:CreateDeployment'
                  - 'codedeploy:GetDeploymentConfig'
                  - 'codedeploy:GetApplicationRevision'
                  - 'codedeploy:RegisterApplicationRevision'
                  - 'kms:GenerateDataKey'
                  - 'kms:Decrypt'
                Resource: '*'
                Effect: Allow
  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - !Ref InstanceRole

  CodeDeployS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub codedeploy-asg-${AWS::AccountId}-${AWS::Region}-s3
      VersioningConfiguration:
        Status: Enabled
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: 'aws:kms'
              KMSMasterKeyID: !Ref KmsKeyIdArn
      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerPreferred

  LaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    DependsOn: CodeDeployS3Bucket
    Metadata:
      Comment: Install a simple PHP application 2
      AWS::CloudFormation::Init:
        config:
          packages:
            yum:
              git: []
              wget: []
              ruby: []
          commands:
            copySourceCode:
              command: 'wget https://github.com/WordPress/WordPress/archive/master.zip && unzip master -d /tmp/WordPress_Temp && mkdir -p /tmp/WordPress && cp -paf /tmp/WordPress_Temp/WordPress-master/* /tmp/WordPress && rm -rf /tmp/WordPress_Temp && rm -f master.zip' 
          files:
            "/tmp/WordPress/scripts/install_dependencies.sh":
              content: !Sub |
                #!/bin/bash
                sudo amazon-linux-extras install php7.4
                sudo yum install -y httpd mariadb-server php
              mode: '000755'
              owner: "root"
              group: "root"
            "/tmp/WordPress/scripts/start_server.sh":
              content: !Sub |
                #!/bin/bash
                systemctl start mariadb.service
                systemctl start httpd.service
                systemctl start php-fpm.service
              mode: '000755'
              owner: "root"
              group: "root"
            "/tmp/WordPress/scripts/stop_server.sh":
              content: !Sub |
                #!/bin/bash
                isExistApp=pgrep httpd
                if [[ -n $isExistApp ]]; then
                systemctl stop httpd.service
                fi
                isExistApp=pgrep mysqld
                if [[ -n $isExistApp ]]; then
                systemctl stop mariadb.service
                fi
                isExistApp=pgrep php-fpm
                if [[ -n $isExistApp ]]; then
                systemctl stop php-fpm.service
                fi
              mode: '000755'
              owner: "root"
              group: "root"
            "/tmp/WordPress/scripts/create_test_db.sh":
              content: !Sub |
                #!/bin/bash
                mysql -uroot <<CREATE_TEST_DB
                CREATE DATABASE IF NOT EXISTS test;
                CREATE_TEST_DB
              mode: '000755'
              owner: "root"
              group: "root"
            "/tmp/WordPress/scripts/change_permissions.sh":
              content: !Sub |
                #!/bin/bash
                chmod -R 777 /var/www/html/WordPress
              mode: '000755'
              owner: "root"
              group: "root"
            "/tmp/WordPress/appspec.yml":
              content: !Sub |
                version: 0.0
                os: linux
                files:
                  - source: /
                    destination: /var/www/html/WordPress
                hooks:
                  BeforeInstall:
                    - location: scripts/install_dependencies.sh
                      timeout: 300
                      runas: root
                  AfterInstall:
                    - location: scripts/change_permissions.sh
                      timeout: 300
                      runas: root
                  ApplicationStart:
                    - location: scripts/start_server.sh
                    - location: scripts/create_test_db.sh
                      timeout: 300
                      runas: root
                  ApplicationStop:
                    - location: scripts/stop_server.sh
                      timeout: 300
                      runas: root
              mode: '000755'
              owner: "root"
              group: "root"
            "/etc/cfn/cfn-hup.conf":
              content: !Sub |
                [main]
                stack=${AWS::StackId}
                region=${AWS::Region}
              mode: "000400"
              owner: "root"
              group: "root"
            "/etc/cfn/hooks.d/cfn-auto-reloader.conf":
              content: !Sub |
                [cfn-auto-reloader-hook]
                triggers=post.update
                path=Resources.WebServerHost.Metadata.AWS::CloudFormation::Init
                action=/opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource WebServerHost --region ${AWS::Region}
              mode: "000400"
              owner: "root"
              group: "root"
          services:
            sysvinit:
              cfn-hup:
                enable: 'true'
                ensureRunning: 'true'
                files:
                  - "/etc/cfn/cfn-hup.conf"
                  - "/etc/cfn/hooks.d/cfn-auto-reloader.conf"
        installCDAgent:
          commands:
            installCDAgent:
              command: 'wget https://aws-codedeploy-us-east-1.s3.us-east-1.amazonaws.com/latest/install && chmod +x ./install && sudo ./install auto'
              cwd: '/tmp'
          services:
            sysvinit:
              codedeploy-agent:
                enabled: "true"
                ensureRunning: "true"
        configSets:
            "default":
            - "config"
            - "installCDAgent"
    Properties:
      LaunchTemplateName: CodeDeploy-ASG-LaunchTemplate
      LaunchTemplateData:
        DisableApiTermination: true
        IamInstanceProfile:
          Arn:        !GetAtt InstanceProfile.Arn
        ImageId:      !Ref ImageId
        InstanceType: !Ref InstanceType
        KeyName:      !Ref KeyName
        SecurityGroupIds: 
          - !Ref EC2SecurityGroup
        UserData:
          Fn::Base64: !Sub |
            #!/bin/bash -xe
            # Get the latest CloudFormation helper scripts
            yum install -y aws-cfn-bootstrap
            # Start cfn-init
            /opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource LaunchTemplate --region ${AWS::Region}
            cd /tmp/WordPress && \
            aws deploy push \
              --application-name WordPress_App \
              --s3-location s3://codedeploy-asg-${AWS::AccountId}-${AWS::Region}-s3/WordPressApp.zip \
              --ignore-hidden-files \
              --region ${AWS::Region}
            # cfn-init completed so signal success or not
            /opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource AutoScalingGroup --region ${AWS::Region}

  ELBSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: ELB Security Group
      VpcId: !Ref VPC
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 80
        ToPort: 80
        CidrIp: 0.0.0.0/0

  EC2SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: EC2 Security Group
      VpcId: !Ref VPC
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 80
        ToPort: 80
        SourceSecurityGroupId:
          Fn::GetAtt:
          - ELBSecurityGroup
          - GroupId
      - IpProtocol: tcp
        FromPort: 22
        ToPort: 22
        CidrIp: !Ref SSHLocation

  AutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      LaunchTemplate:
        LaunchTemplateId: !Ref LaunchTemplate
        Version: !GetAtt LaunchTemplate.LatestVersionNumber
      MaxSize: '3'
      MinSize: '1'
      # NotificationConfigurations:
      #   - TopicARN: !Ref NotificationTopic
      #     NotificationTypes: ['autoscaling:EC2_INSTANCE_LAUNCH', 'autoscaling:EC2_INSTANCE_LAUNCH_ERROR', 'autoscaling:EC2_INSTANCE_TERMINATE', 'autoscaling:EC2_INSTANCE_TERMINATE_ERROR']
      TargetGroupARNs:
        - !Ref TargetGroup
      VPCZoneIdentifier: !Ref Subnets

  TargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckIntervalSeconds: 30
      HealthCheckProtocol: HTTP
      HealthCheckTimeoutSeconds: 15
      HealthyThresholdCount: 5
      Matcher:
        HttpCode: '200'
      Name: EC2TargetGroup
      Port: 80
      Protocol: HTTP
      TargetGroupAttributes:
      - Key: deregistration_delay.timeout_seconds
        Value: '20'
      UnhealthyThresholdCount: 3
      VpcId: !Ref VPC

  ALBListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref TargetGroup
      LoadBalancerArn: !Ref ApplicationLoadBalancer
      Port: 80
      Protocol: HTTP

  ApplicationLoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Scheme: internet-facing
      Subnets: !Ref Subnets
      SecurityGroups:
        - !GetAtt ELBSecurityGroup.GroupId

  CodeDeployServiceRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Principal:
              Service:
                - "codedeploy.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Policies:
        -
          PolicyName: allow-ec2
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              -
                Effect: Allow
                Action:
                  - ec2:*
                  - autoscaling:*
                  - iam:PassRole
                Resource: "*"

  CodeDeployApplication: 
    Type: AWS::CodeDeploy::Application
    Properties:
      ApplicationName: CodeDeploy_ASG_WordPress_App
      ComputePlatform: Server  ### Allowed values: ECS | Lambda | Server

  CodeDeployDeploymentGroup:
    Type: "AWS::CodeDeploy::DeploymentGroup"
    DependsOn: AutoScalingGroup
    Properties:
      ApplicationName:      !Ref CodeDeployApplication
      ServiceRoleArn:       !GetAtt CodeDeployServiceRole.Arn
      AutoScalingGroups:
        - !Ref AutoScalingGroup
      DeploymentConfigName: CodeDeployDefault.OneAtATime
      DeploymentGroupName:  CodeDeployASGDeploymentGroup
      Deployment:
        Description: "Simple Deploy WordPress to an ASG"
        IgnoreApplicationStopFailures: true 
        Revision: 
          RevisionType: S3 
          S3Location: 
            Bucket:     !Ref CodeDeployS3Bucket 
            Key:        'WordPressApp.zip'
            BundleType: Zip