ktorbase.yml

AWSTemplateFormatVersion: 2010-09-09

Description: >
  Deploys the application and it's needed infrastructure:
  Security Group, IAM role, Load Balancer.
  Also adds a lambda that pushes an SNS topic when the application logs errors.
  ECS Cluster, ECR repository and the Parameter Store must be created separately beforehand.

Parameters:
  # ------------------------------------------------------------------------
  # Infrastructure-related parameters
  # ------------------------------------------------------------------------
  CertificateArn:
    Type: String
    Description: SSL Certificate for Load Balancer
  CwAgentSecurityGroupId:
    Type: AWS::EC2::SecurityGroup::Id
    Description: Security Group of the CloudWatch Agent (will be granted access to the Prometheus metrics port)
  EcsCluster:
    Type: String
    Description: ECS Cluster (short name or full ARN) to run the service in
  Environment:
    Type: String
    Description: The environment to be deployed
    AllowedValues:
      - test
      - prod
  JmxMetricsPort:
    Type: Number
    Description: Port number for the JMX metrics endpoint, intended to be scraped by the CloudWatch Agent
    Default: 9404
  ServiceCpu:
    Type: Number
    Description: CPU resources for the application
    AllowedValues:
      - 256
      - 512
      - 1024
      - 2048
      - 4096
  ServiceDeregistrationDelaySeconds:
    Type: Number
    Description: Load balancer deregistration delay for the application
  ServiceDeploymentMinimumPercent:
    Type: Number
    Description: Minimum tasks required to run during deployment (percentage)
    Default: 100
  ServiceDeploymentMaximumPercent:
    Type: Number
    Description: Maximum tasks required to run during deployment (percentage)
    Default: 200
  ServiceImageName:
    Type: String
    Description: Name of the application ECR Image
  ServiceImageVersion:
    Type: String
    Description: Version tag of the application ECR Image
  ServiceMemory:
    Type: Number
    Description: Memory resources for the application
    AllowedValues:
      - 512
      - 1024
      - 2048
      - 3072
      - 4096
      - 5120
      - 6144
      - 7168
      - 8192
  ServiceNodeCount:
    Type: Number
    Description: How many nodes to run for the application
  ExternalSubnets:
    ConstraintDescription: Must be a list of two or more Subnet IDs within the selected VPC.
    Description: Subnets (two or more) where your user-facing load balancer will be deployed. MUST be within the selected VPC.
    Type: List<AWS::EC2::Subnet::Id>
  InternalSubnets:
    ConstraintDescription: Must be a list of two or more Subnet IDs within the selected VPC.
    Description: Subnets (two or more) where your cluster nodes and other internal infrastructure will be deployed. MUST be within the selected VPC.
    Type: List<AWS::EC2::Subnet::Id>
  ParameterStoreArn:
    Type: String
    Description: Controls access to Parameter Store
  VpcId:
    ConstraintDescription: Must be the ID of a VPC.
    Description: Virtual Private Cloud
    Type: AWS::EC2::VPC::Id
  # ------------------------------------------------------------------------
  # App-related parameters
  # ------------------------------------------------------------------------
  AppBannerBackgroundColor:
    Type: String
    Description: Value for CSS `background-color` property of the banner, used for coloring based on environment
  AppBannerMenuBackgroundColor:
    Type: String
    Description: Value for CSS `background-color` property of the banner menu, used for coloring based on environment
  AppBaseUrl:
    Type: String
    Description: Base URL under which the application will be reachable, needed to be known by the application for linking back to itself
  AppSsoSaml:
    Type: String
    AllowedValues: [ "true", "false" ]
    Default: "false"
    Description: Set true to enable SAML SSO
  AppTitle:
    Type: String
    Description: Title as shown in browser window
  # ------------------------------------------------------------------------
  # SAML-related parameters
  # ------------------------------------------------------------------------
  SamlIdentityProviderCertificate:
    Type: String
    Description: X509 Certificate String
  SamlIdentityProviderEntityId:
    Type: String
    Description: Identity provider URL to fetch SAML metadata from
  SamlIdentityProviderLoginUrl:
    Type: String
    Description: Where to redirect users for single login service
  SamlIdentityProviderLogoutUrl:
    Type: String
    Description: Where to redirect users for single logout service

Outputs:
  SecurityGroupId:
    Value: !Ref SecurityGroup
  ServiceDnsName:
    Value: !GetAtt ServiceLoadBalancer.DNSName

Conditions:
  IsProdCondition:
    !Equals [!Ref Environment, prod]

Resources:
  # ------------------------------------------------------------------------
  # Security Group
  # ------------------------------------------------------------------------
  SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      VpcId: !Ref VpcId
      GroupName: !Sub ${AWS::StackName}-security-group
      GroupDescription: !Sub ${AWS::StackName}-security-group
      SecurityGroupIngress:
        - IpProtocol: TCP
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0
        - IpProtocol: TCP
          FromPort: 443
          ToPort: 443
          CidrIpv6: ::/0
        - IpProtocol: TCP
          FromPort: !Ref JmxMetricsPort
          ToPort: !Ref JmxMetricsPort
          SourceSecurityGroupId: !Ref CwAgentSecurityGroupId

  SecurityGroupIngressLoop:
    Type: AWS::EC2::SecurityGroupIngress
    DependsOn: SecurityGroup
    Properties:
      GroupId: !Ref SecurityGroup
      IpProtocol: -1
      FromPort: -1
      ToPort: -1
      SourceSecurityGroupId: !Ref SecurityGroup


  # ------------------------------------------------------------------------
  # Task Execution Role
  # ------------------------------------------------------------------------
  TaskExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${AWS::StackName}-task-execution-role
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: ""
            Effect: Allow
            Principal:
              Service:
                - ecs-tasks.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
      Policies:
        - PolicyName: parameter-store-read
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - ssm:GetParameters
                  - secretsmanager:GetSecretValue
                  - kms:Decrypt
                Resource:
                  - !Ref ParameterStoreArn


  # ------------------------------------------------------------------------
  # Task Role
  # ------------------------------------------------------------------------
  TaskRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${AWS::StackName}-task-role
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: ""
            Effect: Allow
            Principal:
              Service:
                - ecs-tasks.amazonaws.com
            Action:
              - sts:AssumeRole


  # ------------------------------------------------------------------------
  # Service
  # ------------------------------------------------------------------------
  ServiceLoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Name: !Sub ${AWS::StackName}
      Type: application
      IpAddressType: ipv4
      Scheme: internet-facing
      SecurityGroups:
        - !Ref SecurityGroup
      Subnets: !Ref ExternalSubnets

  ServiceTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      VpcId: !Ref VpcId
      Name: !Sub ${AWS::StackName}
      TargetType: ip
      Protocol: HTTP
      Port: 9090
      HealthCheckProtocol: HTTP
      HealthCheckPath: /health
      HealthCheckPort: traffic-port
      HealthyThresholdCount: 5
      UnhealthyThresholdCount: 2
      HealthCheckTimeoutSeconds: 5
      HealthCheckIntervalSeconds: 30
      Matcher:
        HttpCode: 200
      TargetGroupAttributes:
        - Key: deregistration_delay.timeout_seconds
          Value: !Ref ServiceDeregistrationDelaySeconds

  ServiceLoadBalancerListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      Certificates:
        - CertificateArn: !Ref CertificateArn
      Protocol: HTTPS
      Port: 443
      LoadBalancerArn: !Ref ServiceLoadBalancer
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref ServiceTargetGroup

  ServiceLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub ${AWS::StackName}

  ServiceTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: !Sub ${AWS::StackName}
      Cpu: !Ref ServiceCpu
      Memory: !Ref ServiceMemory
      NetworkMode: awsvpc
      TaskRoleArn: !GetAtt TaskRole.Arn
      ExecutionRoleArn: !GetAtt TaskExecutionRole.Arn
      RequiresCompatibilities:
        - FARGATE
      ContainerDefinitions:
        - Name: service
          Image: !Sub "${ServiceImageName}:${ServiceImageVersion}"
          PortMappings:
            - ContainerPort: 9090
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: !Ref ServiceLogGroup
              awslogs-region: !Sub ${AWS::Region}
              awslogs-stream-prefix: !Sub ${AWS::StackName}
          Secrets:
            - Name: APPLICATION_SECRET
              ValueFrom: !If [IsProdCondition, /ktorbase-prod/application-secret, /ktorbase-test/application-secret]
          Environment:
            - Name: APP_BANNER_BACKGROUND_COLOR
              Value: !Ref AppBannerBackgroundColor
            - Name: APP_BANNER_MENU_BACKGROUND_COLOR
              Value: !Ref AppBannerMenuBackgroundColor
            - Name: APP_BASE_URL
              Value: !Ref AppBaseUrl
            - Name: APP_SSO_SAML
              Value: !Ref AppSsoSaml
            - Name: APP_TITLE
              Value: !Ref AppTitle
            - Name: SAML_IDENTITY_PROVIDER_CERTIFICATE
              Value: !Ref SamlIdentityProviderCertificate
            - Name: SAML_IDENTITY_PROVIDER_ENTITY_ID
              Value: !Ref SamlIdentityProviderEntityId
            - Name: SAML_IDENTITY_PROVIDER_LOGIN_URL
              Value: !Ref SamlIdentityProviderLoginUrl
            - Name: SAML_IDENTITY_PROVIDER_LOGOUT_URL
              Value: !Ref SamlIdentityProviderLogoutUrl
          DockerLabels:
            Java_EMF_Metrics: true
            ECS_PROMETHEUS_EXPORTER_PORT: !Ref JmxMetricsPort

  ServiceService:
    Type: AWS::ECS::Service
    DependsOn: ServiceLoadBalancerListener
    Properties:
      ServiceName: !Sub "${AWS::StackName}-service"
      Cluster: !Ref EcsCluster
      DeploymentConfiguration:
        MaximumPercent: !Ref ServiceDeploymentMaximumPercent
        MinimumHealthyPercent: !Ref ServiceDeploymentMinimumPercent
      LaunchType: FARGATE
      PlatformVersion: 1.3.0
      TaskDefinition: !Ref ServiceTaskDefinition
      DesiredCount: !Ref ServiceNodeCount
      LoadBalancers:
        - ContainerName: service
          ContainerPort: 9090
          TargetGroupArn: !Ref ServiceTargetGroup
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: DISABLED
          SecurityGroups:
            - !Ref SecurityGroup
          Subnets: !Ref InternalSubnets
      SchedulingStrategy: REPLICA


  # ------------------------------------------------------------------------
  # LogAlert
  # ------------------------------------------------------------------------
  LogAlertLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub lambda/${AWS::StackName}

  LogAlertTaskExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: ""
            Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      RoleName: !Sub ${AWS::StackName}-log-alert-task-execution-role
      Policies:
        - PolicyName: lambda-log-alert
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - logs:PutLogEvents
                  - logs:CreateLogStream
                  - logs:CreateLogGroup
                Resource:
                  - !GetAtt LogAlertLogGroup.Arn
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                Resource:
                  - "*"
              - Effect: Allow
                Action:
                  - sns:*
                Resource:
                  - "*"

  LogAlertErrorMetricFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      FilterPattern: "ERROR"
      LogGroupName: !Ref ServiceLogGroup
      MetricTransformations:
        - MetricName: !Sub "${AWS::StackName}-error"
          MetricNamespace: "LogMetrics"
          MetricValue: 1

  LogAlertExceptionMetricFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      FilterPattern: "Exception"
      LogGroupName: !Ref ServiceLogGroup
      MetricTransformations:
        - MetricName: !Sub "${AWS::StackName}-exception"
          MetricNamespace: "LogMetrics"
          MetricValue: 1

  LogAlertSnsTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: !Sub ${AWS::StackName}-error

  LogAlertLambda:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        ZipFile: !Sub "
          const AWS = require(\"aws-sdk\");
          const zlib = require(\"zlib\");

          exports.handler = function(event, context) {
            const payload = Buffer.from(event.awslogs.data, \"base64\");
            const parsed = JSON.parse(zlib.gunzipSync(payload).toString(\"utf8\"));
            const stringified = parsed.logEvents.map(e => \"- \" + JSON.stringify(e));
            const listLogEvents = stringified.join(\"\\n\");

            console.log('Decoded payload:', listLogEvents);

            const sns = new AWS.SNS();
            var params = {
              Message: \"Service ${AWS::StackName} reported ERROR:\\n\\n\" + listLogEvents,
              Subject: \"Service Monitoring - ERROR - ${AWS::StackName}\",
              TopicArn: \"arn:aws:sns:eu-central-1:${AWS::AccountId}:${AWS::StackName}-error\"
            };
            sns.publish(params, context.done);
          };"
      Handler: "index.handler"
      Role: !GetAtt LogAlertTaskExecutionRole.Arn
      Runtime: nodejs12.x
      Tags:
        - Key: "lambda-console:blueprint"
          Value: "cloudwatch-logs-process-data"

  LogAlertLambdaCloudwatchInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref LogAlertLambda
      Principal: logs.amazonaws.com
      Action: lambda:InvokeFunction
      SourceArn: !GetAtt ServiceLogGroup.Arn

  LogAlertSubscription:
    Type: AWS::Logs::SubscriptionFilter
    Properties:
      DestinationArn: !GetAtt LogAlertLambda.Arn
      FilterPattern: "ERROR"
      LogGroupName: !Ref ServiceLogGroup