ec2-spot-interruption-notice-cloudwatch-events.yaml

---
AWSTemplateFormatVersion: 2010-09-09
Description: Example of monitoring for EC2 Spot Instance Interruption Notices in CloudWatch
  Events
Mappings:
  CidrMappings:
    public-subnet-1:
      CIDR: 10.0.1.0/24
    public-subnet-2:
      CIDR: 10.0.2.0/24
    vpc:
      CIDR: 10.0.0.0/16
Metadata:
  Author:
    Description: Chad Schmutzer <schmutze@amazon.com>
  License:
    Description: 'Copyright 2017 Amazon.com, Inc. and its affiliates. All Rights Reserved.

      Licensed under the Amazon Software License (the "License"). You may not use this file
      except in compliance with the License. A copy of the License is located at

      http://aws.amazon.com/asl/

      or in the "license" file accompanying this file. This file is distributed on an "AS IS"
      BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
      License for the specific language governing permissions and limitations under the License.'
Outputs:
  awsRegionId:
    Description: The AWS Region ID your template was launched in
    Value:
      Ref: AWS::Region
  loadBalancer:
    Description: Application load balancer
    Value:
      Ref: loadBalancer
  loadBalancerTargetGroup:
    Description: Load balancer target group ARN
    Value:
      Ref: loadBalancerTargetGroup
  publicSubnet1:
    Description: Public subnet 1
    Value:
      Ref: publicSubnet1
  publicSubnet2:
    Description: Public subnet 2
    Value:
      Ref: publicSubnet2
  snsTopic:
    Description: SNS topic ARN
    Value:
      Ref: snsTopic
  spotFleetRole:
    Description: Spot Fleet role
    Value:
      Fn::GetAtt:
      - spotFleetRole
      - Arn
Resources:
  attachGateway:
    DependsOn:
    - vpc
    - internetGateway
    Properties:
      InternetGatewayId:
        Ref: internetGateway
      VpcId:
        Ref: vpc
    Type: AWS::EC2::VPCGatewayAttachment
  eventRule:
    DependsOn:
    - snsTopic
    Properties:
      Description: Events rule for EC2 Spot Instance Interruption Notices
      EventPattern:
        detail-type:
        - EC2 Spot Instance Interruption Warning
        source:
        - aws.ec2
      State: ENABLED
      Targets:
      - Arn:
          Ref: snsTopic
        Id:
          Fn::GetAtt:
          - snsTopic
          - TopicName
      - Arn:
          Fn::GetAtt:
          - lambdaFunction
          - Arn
        Id:
          Ref: lambdaFunction
    Type: AWS::Events::Rule
  internetGateway:
    DependsOn:
    - vpc
    Type: AWS::EC2::InternetGateway
  lambdaFunction:
    DependsOn:
    - lambdaFunctionRole
    Properties:
      Code:
        ZipFile: "import boto3\ndef handler(event, context):\n  instanceId = event['detail']['instance-id']\n\
          \  instanceAction = event['detail']['instance-action']\n  try:\n    ec2client = boto3.client('ec2')\n\
          \    describeTags = ec2client.describe_tags(Filters=[{'Name': 'resource-id','Values':[instanceId]},{'Name':'key','Values':['loadBalancerTargetGroup']}])\n\
          \  except:\n    print(\"No action being taken. Unable to describe tags for instance\
          \ id:\", instanceId)\n    return\n  try:\n    elbv2client = boto3.client('elbv2')\n\
          \    deregisterTargets = elbv2client.deregister_targets(TargetGroupArn=describeTags['Tags'][0]['Value'],Targets=[{'Id':instanceId}])\n\
          \  except:\n    print(\"No action being taken. Unable to deregister targets for instance\
          \ id:\", instanceId)\n    return\n  print(\"Spot Instance interruption notice detected.\
          \ Detaching instance from target:\")\n  print(instanceId, describeTags['Tags'][0]['Value'],\
          \ deregisterTargets, sep=\",\")\n  return\n"
      Handler: index.handler
      Role:
        Fn::GetAtt:
        - lambdaFunctionRole
        - Arn
      Runtime: python3.6
    Type: AWS::Lambda::Function
  lambdaFunctionPermission:
    Properties:
      Action: lambda:InvokeFunction
      FunctionName:
        Fn::GetAtt:
        - lambdaFunction
        - Arn
      Principal: events.amazonaws.com
      SourceArn:
        Fn::GetAtt:
        - eventRule
        - Arn
    Type: AWS::Lambda::Permission
  lambdaFunctionRole:
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action:
          - sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
        Version: 2012-10-17
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Path: /
      Policies:
      - PolicyDocument:
          Statement:
          - Action: elasticloadbalancing:DeregisterTargets
            Effect: Allow
            Resource: '*'
          - Action: ec2:DescribeTags
            Effect: Allow
            Resource: '*'
          Version: '2012-10-17'
        PolicyName:
          Fn::Join:
          - '-'
          - - Ref: AWS::StackName
            - lambdaFunctionRole
    Type: AWS::IAM::Role
  loadBalancer:
    DependsOn:
    - vpc
    - loadBalancerSecurityGroup
    Properties:
      Scheme: internet-facing
      SecurityGroups:
      - Ref: loadBalancerSecurityGroup
      - Fn::GetAtt:
        - vpc
        - DefaultSecurityGroup
      Subnets:
      - Ref: publicSubnet1
      - Ref: publicSubnet2
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
  loadBalancerListener:
    DependsOn:
    - loadBalancer
    - loadBalancerTargetGroup
    Properties:
      DefaultActions:
      - TargetGroupArn:
          Ref: loadBalancerTargetGroup
        Type: forward
      LoadBalancerArn:
        Ref: loadBalancer
      Port: 80
      Protocol: HTTP
    Type: AWS::ElasticLoadBalancingV2::Listener
  loadBalancerSecurityGroup:
    DependsOn:
    - vpc
    Properties:
      GroupDescription: Allow http to 0.0.0.0/0
      SecurityGroupIngress:
      - CidrIp: 0.0.0.0/0
        FromPort: 80
        IpProtocol: tcp
        ToPort: 80
      VpcId:
        Ref: vpc
    Type: AWS::EC2::SecurityGroup
  loadBalancerTargetGroup:
    DependsOn:
    - vpc
    Properties:
      HealthCheckIntervalSeconds: 5
      HealthCheckPath: /
      HealthCheckTimeoutSeconds: 2
      Port: 80
      Protocol: HTTP
      TargetGroupAttributes:
      - Key: deregistration_delay.timeout_seconds
        Value: 120
      UnhealthyThresholdCount: 2
      VpcId:
        Ref: vpc
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
  publicRoute:
    DependsOn:
    - publicRouteTable
    - internetGateway
    - attachGateway
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId:
        Ref: internetGateway
      RouteTableId:
        Ref: publicRouteTable
    Type: AWS::EC2::Route
  publicRouteTable:
    DependsOn:
    - vpc
    - attachGateway
    Properties:
      Tags:
      - Key: Name
        Value: Public Route Table
      VpcId:
        Ref: vpc
    Type: AWS::EC2::RouteTable
  publicSubnet1:
    DependsOn: attachGateway
    Properties:
      AvailabilityZone:
        Fn::Select:
        - 0
        - Fn::GetAZs:
            Ref: AWS::Region
      CidrBlock:
        Fn::FindInMap:
        - CidrMappings
        - public-subnet-1
        - CIDR
      MapPublicIpOnLaunch: true
      Tags:
      - Key: Name
        Value: Public Subnet 1
      VpcId:
        Ref: vpc
    Type: AWS::EC2::Subnet
  publicSubnet1RouteTableAssociation:
    DependsOn:
    - publicRouteTable
    - publicSubnet1
    - attachGateway
    Properties:
      RouteTableId:
        Ref: publicRouteTable
      SubnetId:
        Ref: publicSubnet1
    Type: AWS::EC2::SubnetRouteTableAssociation
  publicSubnet2:
    DependsOn: attachGateway
    Properties:
      AvailabilityZone:
        Fn::Select:
        - 1
        - Fn::GetAZs:
            Ref: AWS::Region
      CidrBlock:
        Fn::FindInMap:
        - CidrMappings
        - public-subnet-2
        - CIDR
      MapPublicIpOnLaunch: true
      Tags:
      - Key: Name
        Value: Public Subnet 2
      VpcId:
        Ref: vpc
    Type: AWS::EC2::Subnet
  publicSubnet2RouteTableAssociation:
    DependsOn:
    - publicRouteTable
    - publicSubnet2
    - attachGateway
    Properties:
      RouteTableId:
        Ref: publicRouteTable
      SubnetId:
        Ref: publicSubnet2
    Type: AWS::EC2::SubnetRouteTableAssociation
  snsTopic:
    Properties:
      DisplayName: SNS Topic for EC2 Spot Instance Interruption Notices
    Type: AWS::SNS::Topic
  snsTopicPolicy:
    DependsOn:
    - snsTopic
    Properties:
      PolicyDocument:
        Id:
          Fn::GetAtt:
          - snsTopic
          - TopicName
        Statement:
        - Action: sns:Publish
          Effect: Allow
          Principal:
            Service:
            - events.amazonaws.com
          Resource:
            Ref: snsTopic
        Version: '2012-10-17'
      Topics:
      - Ref: snsTopic
    Type: AWS::SNS::TopicPolicy
  spotFleetRole:
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action:
          - sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - spotfleet.amazonaws.com
        Version: 2012-10-17
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AmazonEC2SpotFleetTaggingRole
      Path: /
    Type: AWS::IAM::Role
  vpc:
    Properties:
      CidrBlock:
        Fn::FindInMap:
        - CidrMappings
        - vpc
        - CIDR
      EnableDnsHostnames: true
      EnableDnsSupport: true
    Type: AWS::EC2::VPC
...