ecs-task-rebalancer.json

{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Description": "Creates a lambda to proactively rebalance ECS tasks based on ECS Event Stream",
    "Parameters": {
        "ECSClusterNameExport": {
            "Type": "String",
            "Description": "Export from the ecs cluster creation stack.",
            "Default": "DemoECSClusterName"
        }
    },
    "Resources": {
        "LambdaExecutionRole": {
            "Type": "AWS::IAM::Role",
            "Properties": {
                "AssumeRolePolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Principal": {
                                "Service": ["lambda.amazonaws.com"]
                            },
                            "Action": ["sts:AssumeRole"]
                        }
                    ]
                },
                "Path": "/",
                "Policies": [
                    {
                        "PolicyName": "root",
                        "PolicyDocument": {
                            "Version": "2012-10-17",
                            "Statement": [
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "xray:PutTraceSegments",
                                        "xray:PutTelemetryRecords"
                                    ],
                                    "Resource": ["*"]
                                },
                                {
                                    "Action": [
                                        "ecs:describeContainerInstances",
                                        "ecs:listTaskDefinitions",
                                        "ecs:describeTaskDefinition",
                                        "ecs:registerTaskDefinition",
                                        "ecs:listServices",
                                        "ecs:DescribeServices",
                                        "ecs:updateService"
                                    ],
                                    "Effect": "Allow",
                                    "Resource": "*"
                                },
                                {
                                    "Sid": "IAMPassRoleForCloudWatchEvents",
                                    "Effect": "Allow",
                                    "Action": "iam:PassRole",
                                    "Resource": "arn:aws:iam::*:role/AWS_Events_Invoke_Targets"
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "logs:CreateLogGroup",
                                        "logs:CreateLogStream",
                                        "logs:PutLogEvents"
                                    ],
                                    "Resource": "arn:aws:logs:*:*:*"
                                }
                            ]
                        }
                    }
                ]
            }
        },
        "LambdaFunction": {
            "Type": "AWS::Lambda::Function",
            "Properties": {
                "Handler": "ecs-task-rebalancer.lambda_handler",
                "Role": { "Fn::GetAtt": ["LambdaExecutionRole", "Arn"] },
                "Code": {
                    "S3Bucket": { "Fn::ImportValue": "DemoS3BucketName" },
                    "S3Key": "ecs-task-rebalancer.zip"
                },
                "Runtime": "python3.9",
                "Timeout": "60",
                "TracingConfig": {
                    "Mode": "Active"
                },
                "Environment": {
                    "Variables": {
                        "ECSClusterName": {
                            "Fn::ImportValue": {
                                "Fn::Sub": "${ECSClusterNameExport}"
                            }
                        }
                    }
                }
            }
        },
        "ScheduledRule": {
            "Type": "AWS::Events::Rule",
            "Properties": {
                "Description": "ScheduledRule",
                "EventPattern": {
                    "source": ["aws.ecs"],
                    "detail-type": ["ECS Container Instance State Change"],
                    "detail": {
                        "clusterArn": [
                            {
                                "Fn::Join": [
                                    ":",
                                    [
                                        "arn",
                                        "aws",
                                        "ecs",
                                        { "Ref": "AWS::Region" },
                                        { "Ref": "AWS::AccountId" },
                                        {
                                            "Fn::Join": [
                                                "/",
                                                [
                                                    "cluster",
                                                    {
                                                        "Fn::ImportValue": {
                                                            "Fn::Sub": "${ECSClusterNameExport}"
                                                        }
                                                    }
                                                ]
                                            ]
                                        }
                                    ]
                                ]
                            }
                        ]
                    }
                },
                "State": "ENABLED",
                "Targets": [
                    {
                        "Arn": { "Fn::GetAtt": ["LambdaFunction", "Arn"] },
                        "Id": "TargetFunctionV1"
                    }
                ]
            }
        },
        "PermissionForEventsToInvokeLambda": {
            "Type": "AWS::Lambda::Permission",
            "Properties": {
                "FunctionName": { "Ref": "LambdaFunction" },
                "Action": "lambda:InvokeFunction",
                "Principal": "events.amazonaws.com",
                "SourceArn": { "Fn::GetAtt": ["ScheduledRule", "Arn"] }
            }
        }
    }
}