cfn-ec2-infrastructure.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: Code Training EC2 Deploy Infrastructure

Parameters:
  KeyName:
    Description: Name of an existing EC2 KeyPair to enable SSH access to the instances
    Type: AWS::EC2::KeyPair::KeyName
    ConstraintDescription: must be the name of an existing EC2 KeyPair.

  SSHLocation:
    Description: The IP address range that can be used to SSH to the EC2 instances
    Type: String
    MinLength: '9'
    MaxLength: '18'
    Default: 0.0.0.0/0
    AllowedPattern: "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
    ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x.

  KmsKeyIdArn:
    Type: String

  ImageId:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2

  Ec2TagKey:
    Type: String
    Default: Name
  Ec2TagValue:
    Type: String
    Default: CodeDeployDemo

Resources:
  CodeDeployServerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Enable HTTP access via port 80 and SSH access via port 22
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 80
        ToPort: 80
        CidrIp: 0.0.0.0/0
      - IpProtocol: tcp
        FromPort: 22
        ToPort: 22
        CidrIp: !Ref SSHLocation

  CodeDeployServer:
    Type: AWS::EC2::Instance
    DependsOn: CodeDeployApplication
    Metadata:
      Comment: Install a simple PHP application
      AWS::CloudFormation::Init:
        config:
          packages:
            yum:
              git: []
              wget: []
              ruby: []
          commands:
            copySourceCode:
              command: 'wget https://github.com/WordPress/WordPress/archive/master.zip && unzip master -d /tmp/WordPress_Temp && mkdir -p /tmp/WordPress && cp -paf /tmp/WordPress_Temp/WordPress-master/* /tmp/WordPress && rm -rf /tmp/WordPress_Temp && rm -f master.zip' 
          files:
            "/tmp/WordPress/scripts/install_dependencies.sh":
              content: !Sub |
                #!/bin/bash
                sudo amazon-linux-extras install php7.4
                sudo yum install -y httpd mariadb-server php
              mode: '000755'
              owner: "root"
              group: "root"
            "/tmp/WordPress/scripts/start_server.sh":
              content: !Sub |
                #!/bin/bash
                systemctl start mariadb.service
                systemctl start httpd.service
                systemctl start php-fpm.service
              mode: '000755'
              owner: "root"
              group: "root"
            "/tmp/WordPress/scripts/stop_server.sh":
              content: !Sub |
                #!/bin/bash
                isExistApp=pgrep httpd
                if [[ -n $isExistApp ]]; then
                systemctl stop httpd.service
                fi
                isExistApp=pgrep mysqld
                if [[ -n $isExistApp ]]; then
                systemctl stop mariadb.service
                fi
                isExistApp=pgrep php-fpm
                if [[ -n $isExistApp ]]; then
                systemctl stop php-fpm.service

                fi
              mode: '000755'
              owner: "root"
              group: "root"
            "/tmp/WordPress/scripts/create_test_db.sh":
              content: !Sub |
                #!/bin/bash
                mysql -uroot <<CREATE_TEST_DB
                CREATE DATABASE IF NOT EXISTS test;
                CREATE_TEST_DB
              mode: '000755'
              owner: "root"
              group: "root"
            "/tmp/WordPress/scripts/change_permissions.sh":
              content: !Sub |
                #!/bin/bash
                chmod -R 777 /var/www/html/WordPress
              mode: '000755'
              owner: "root"
              group: "root"
            "/tmp/WordPress/appspec.yml":
              content: !Sub |
                version: 0.0
                os: linux
                files:
                  - source: /
                    destination: /var/www/html/WordPress
                hooks:
                  BeforeInstall:
                    - location: scripts/install_dependencies.sh
                      timeout: 300
                      runas: root
                  AfterInstall:
                    - location: scripts/change_permissions.sh
                      timeout: 300
                      runas: root
                  ApplicationStart:
                    - location: scripts/start_server.sh
                    - location: scripts/create_test_db.sh
                      timeout: 300
                      runas: root
                  ApplicationStop:
                    - location: scripts/stop_server.sh
                      timeout: 300
                      runas: root
              mode: '000755'
              owner: "root"
              group: "root"
            "/etc/cfn/cfn-hup.conf":
              content: !Sub |
                [main]
                stack=${AWS::StackId}
                region=${AWS::Region}
              mode: "000400"
              owner: "root"
              group: "root"
            "/etc/cfn/hooks.d/cfn-auto-reloader.conf":
              content: !Sub |
                [cfn-auto-reloader-hook]
                triggers=post.update
                path=Resources.WebServerHost.Metadata.AWS::CloudFormation::Init
                action=/opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource WebServerHost --region ${AWS::Region}
              mode: "000400"
              owner: "root"
              group: "root"
          services:
            sysvinit:
              cfn-hup:
                enable: 'true'
                ensureRunning: 'true'
                files:
                  - "/etc/cfn/cfn-hup.conf"
                  - "/etc/cfn/hooks.d/cfn-auto-reloader.conf"
        installCDAgent:
          commands:
            installCDAgent:
              command: 'wget https://aws-codedeploy-us-east-1.s3.us-east-1.amazonaws.com/latest/install && chmod +x ./install && sudo ./install auto'
              cwd: '/tmp'
          services:
            sysvinit:
              codedeploy-agent:
                enabled: "true"
                ensureRunning: "true"
        configSets:
            "default":
            - "config"
            - "installCDAgent"
    CreationPolicy:
      ResourceSignal:
        Timeout: PT15M
    Properties:
      ImageId: !Ref ImageId
      KeyName: !Ref KeyName
      InstanceType: t3.small
      IamInstanceProfile: !Ref InstanceProfile # Reference Instance Profile
      SecurityGroups:
      - !Ref CodeDeployServerSecurityGroup
      UserData:
        Fn::Base64:
          !Sub |
            #!/bin/bash -xe
            
            # Get the latest CloudFormation helper scripts
            yum install -y aws-cfn-bootstrap
            
            # Start cfn-init
            /opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource CodeDeployServer --region ${AWS::Region}

            cd /tmp/WordPress && \
            aws deploy push \
              --application-name codeDeploy_ec2_wordpress_app \
              --s3-location s3://codedeploydemo-${AWS::AccountId}-${AWS::Region}-s3/WordPressApp.zip \
              --ignore-hidden-files \
              --region ${AWS::Region}

            # cfn-init completed so signal success or not
            /opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource CodeDeployServer --region ${AWS::Region}
      Tags:
        - Key:   !Ref Ec2TagKey 
          Value: !Ref Ec2TagValue
        - Key: 'auto-delete'
          Value: 'no'

  InstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: 'sts:AssumeRole'
            Principal:
              Service: ec2.amazonaws.com
            Effect: Allow
            Sid: ''
      Policies:
        - PolicyName: AuthenticatedS3GetObjects
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Action:
                  - 's3:Get*'
                  - 's3:List*'
                  - 's3:PutObject'
                Resource: 
                  - !GetAtt CodeDeployS3Bucket.Arn
                  - !Join
                    - '/'
                    - - !GetAtt CodeDeployS3Bucket.Arn
                      - '*'
                Effect: Allow
        - PolicyName: AllowCodeDeploy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Action:
                  - 'codedeploy:CreateApplication'
                  - 'codedeploy:CreateDeployment'
                  - 'codedeploy:GetDeploymentConfig'
                  - 'codedeploy:GetApplicationRevision'
                  - 'codedeploy:RegisterApplicationRevision'
                  - 'kms:GenerateDataKey'
                  - 'kms:Decrypt'
                Resource: '*'
                Effect: Allow
  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - !Ref InstanceRole

  CodeDeployS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub codedeploydemo-${AWS::AccountId}-${AWS::Region}-s3
      VersioningConfiguration:
        Status: Enabled
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: 'aws:kms'
              KMSMasterKeyID: !Ref KmsKeyIdArn
      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerPreferred

  CodeDeployServiceRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Principal:
              Service:
                - "codedeploy.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Policies:
        -
          PolicyName: allow-ec2
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              -
                Effect: Allow
                Action:
                  - ec2:*
                Resource: "*"

  CodeDeployApplication: 
    Type: AWS::CodeDeploy::Application
    Properties:
      ApplicationName: codeDeploy_ec2_wordpress_app
      ComputePlatform: Server  ### Allowed values: ECS | Lambda | Server

  CodeDeployDeploymentGroup:
    Type: "AWS::CodeDeploy::DeploymentGroup"
    DependsOn: CodeDeployServer
    Properties:
      ApplicationName: !Ref CodeDeployApplication
      ServiceRoleArn: !GetAtt CodeDeployServiceRole.Arn
      DeploymentConfigName: CodeDeployDefault.OneAtATime
      DeploymentGroupName: 'CodeDeployDemoDeploymentGroup'
      Deployment:
        Description: "Tutorial: Deploy WordPress to a non-Windows instance"
        IgnoreApplicationStopFailures: true 
        Revision: 
          RevisionType: S3 
          S3Location: 
            Bucket: !Ref CodeDeployS3Bucket 
            Key: 'WordPressApp.zip'
            BundleType: Zip
      Ec2TagFilters: 
        - Key:   !Ref Ec2TagKey
          Value: !Ref Ec2TagValue
          Type: "KEY_AND_VALUE"