template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: >
  Team Manual deployment into AWS Fargate.
  Managed by Tech Writers

Parameters:
  VpcStackName:
    Description: >
      The name of the stack that defines the VPC in which this container will
      run.
    Type: String

  PipelineStackName:
    Description: "The name of the pipeline stack that deploys this application stack"
    Type: String
    Default: "none"

  PermissionsBoundary:
    Description: "The ARN of the permissions boundary to apply when creating IAM roles"
    Type: String
    Default: "none"

Conditions:
  UsePermissionsBoundary:
    Fn::Not:
      - Fn::Equals:
          - !Ref PermissionsBoundary
          - "none"

  OutputPipelineStackName:
    Fn::Not:
      - Fn::Equals:
          - !Ref PipelineStackName
          - "none"

Mappings:
  # see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html
  ElasticLoadBalancerAccountIds:
    eu-west-2:
      AccountId: 652711504416

Resources:
  TechDocsDnsRecord:
    Type: AWS::Route53::RecordSet
    Properties:
      Name: "tech-docs.account.gov.uk"
      Type: A
      HostedZoneId: !ImportValue TechDocsPublicHostedZoneId
      AliasTarget:
        DNSName: !GetAtt ApplicationLoadBalancer.DNSName
        HostedZoneId: !GetAtt ApplicationLoadBalancer.CanonicalHostedZoneID

  TechDocsCertificate:
    Type: AWS::CertificateManager::Certificate
    Properties:
      DomainName: "tech-docs.account.gov.uk"
      SubjectAlternativeNames:
        - "docs.sign-in.service.gov.uk"
      DomainValidationOptions:
        - DomainName: "tech-docs.account.gov.uk"
          HostedZoneId: !ImportValue TechDocsPublicHostedZoneId
      ValidationMethod: DNS

  DocsSigninDnsRecord:
    Type: AWS::Route53::RecordSet
    Properties:
      Name: "docs.sign-in.service.gov.uk"
      Type: A
      HostedZoneId: !ImportValue DocsSigninPublicHostedZoneId
      AliasTarget:
        DNSName: !GetAtt ApplicationLoadBalancer.DNSName
        HostedZoneId: !GetAtt ApplicationLoadBalancer.CanonicalHostedZoneID

  #DocsSigninCertificate:
  #  Type: AWS::CertificateManager::Certificate
  #  Properties:
  #    DomainName: "docs.sign-in.service.gov.uk"
  #    DomainValidationOptions:
  #      - DomainName: "docs.sign-in.service.gov.uk"
  #        HostedZoneId: !ImportValue DocsSigninPublicHostedZoneId
  #    ValidationMethod: DNS

  #
  # Fargate cluster
  #

  FargateCluster:
    Type: AWS::ECS::Cluster
    Properties:
      ClusterSettings:
        - Name: containerInsights
          Value: enabled
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-FargateCluster"
        - Key: Service
          Value: ci/cd
        - Key: Source
          Value: govuk-one-login/team-manual/deploy/template.yaml #one day

  ContainerService:
    Type: AWS::ECS::Service
    Properties:
      Cluster: !Ref FargateCluster
      LaunchType: FARGATE
      LoadBalancers:
        - ContainerName: nginx
          ContainerPort: 80
          TargetGroupArn: !Ref ApplicationLoadBalancerTargetGroup
      HealthCheckGracePeriodSeconds: 30
      DesiredCount: 2
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: DISABLED
          SecurityGroups:
            - !GetAtt ContainerServiceSecurityGroup.GroupId
          Subnets:
            - Fn::ImportValue:
                !Sub "${VpcStackName}-PrivateSubnetIdA"
            - Fn::ImportValue:
                !Sub "${VpcStackName}-PrivateSubnetIdB"
      PropagateTags: SERVICE
      TaskDefinition: !Ref TaskDefinition
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-ContainerService"
        - Key: Service
          Value: ci/cd
        - Key: Source
          Value: govuk-one-login/team-manual/deploy/template.yaml
    DependsOn:
      - ApplicationLoadBalancerListener

  ContainerAutoScalingTarget:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    Properties:
      MaxCapacity: 2
      MinCapacity: 2
      ResourceId: !Join
        - '/'
        - - "service"
          - !Ref FargateCluster
          - !GetAtt ContainerService.Name
      RoleARN: !Sub "arn:aws:iam::${AWS::AccountId}:role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService"
      ScalableDimension: ecs:service:DesiredCount
      ServiceNamespace: ecs

  ContainerAutoScalingPolicy:
    DependsOn: ContainerAutoScalingTarget
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName: containerAutoScalingPolicy
      PolicyType: TargetTrackingScaling
      ResourceId: !Join
        - '/'
        - - "service"
          - !Ref FargateCluster
          - !GetAtt ContainerService.Name
      ScalableDimension: ecs:service:DesiredCount
      ServiceNamespace: ecs
      TargetTrackingScalingPolicyConfiguration:
        PredefinedMetricSpecification:
          PredefinedMetricType: ECSServiceAverageCPUUtilization
        TargetValue: 70

  ContainerServiceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security Group to access the Container Service
      GroupName: !Join
        - "-"
        - - !Ref AWS::StackName
          - ContainerService
          - Fn::Select:
              - 4
              - Fn::Split:
                  - "-"
                  - Fn::Select:
                      - 2
                      - Fn::Split:
                          - "/"
                          - Ref: AWS::StackId
      SecurityGroupIngress:
        - Description: Allow traffic from the load balancer on port 80
          SourceSecurityGroupId: !GetAtt ApplicationLoadBalancerSecurityGroup.GroupId
          IpProtocol: tcp
          FromPort: 80
          ToPort: 80
      VpcId:
        Fn::ImportValue:
          !Sub "${VpcStackName}-VpcId"
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-ContainerServiceSecurityGroup"
        - Key: Service
          Value: ci/cd
        - Key: Source
          Value: govuk-one-login/team-manual/deploy/template.yaml

  #
  # Fargate tasks
  #

  TaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        - Name: nginx
          Image: "CONTAINER-IMAGE-PLACEHOLDER"
          PortMappings:
            - ContainerPort: 80
              Protocol: tcp
          Essential: true
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: "/ecs/server"
              awslogs-region: "eu-west-2"
              awslogs-create-group: "true"
              awslogs-stream-prefix: "ecs"
      Cpu: 256
      Memory: 512
      ExecutionRoleArn: !GetAtt TaskExecutionRole.Arn
      Family: server
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-TaskDefinition"
        - Key: Service
          Value: ci/cd
        - Key: Source
          Value: govuk-one-login/tech-docs/template.yaml

  TaskExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
      Policies:
        - PolicyName: CreateLogGroup
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                Resource: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:*"
      PermissionsBoundary: !If
        - UsePermissionsBoundary
        - !Ref PermissionsBoundary
        - !Ref AWS::NoValue
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-TaskExecutionRole"
        - Key: Service
          Value: ci/cd
        - Key: Source
          Value: govuk-one-login/tech-docs/template.yaml


  # Application Load balancing
  #

  ApplicationLoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Scheme: internet-facing
      SecurityGroups:
        - !GetAtt ApplicationLoadBalancerSecurityGroup.GroupId
      Subnets:
        - subnet-045dd4d5c1dd1b35d #hard coded as not exposed by VPC (FirewallSubnetB)
        - subnet-0f5b4d93d9fd6aab0 #hard coded as not exposed by VPC (FirewallSubnetA)
        #- Fn::ImportValue:
        #    !Sub "${VpcStackName}-FirewallSubnetIdA"
        #- Fn::ImportValue:
        #    !Sub "${VpcStackName}-FirewallSubnetIdB"
      Type: application

      LoadBalancerAttributes:
        - Key: access_logs.s3.enabled
          Value: "true"
        - Key: access_logs.s3.bucket
          Value: !Ref AccessLogsBucket
        - Key: routing.http.drop_invalid_header_fields.enabled
          Value: "true"
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-ApplicationLoadBalancer"
        - Key: Service
          Value: ci/cd
        - Key: Source
          Value: govuk-one-login/tech-docs/template.yaml

  ApplicationLoadBalancerTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckEnabled: TRUE
      HealthCheckPort: 80
      HealthCheckProtocol: HTTP
      HealthCheckPath: /
      HealthCheckTimeoutSeconds: 2
      HealthCheckIntervalSeconds: 5
      HealthyThresholdCount: 2
      Port: 80
      Protocol: HTTP
      #ProtocolVersion: HTTP1
      Matcher:
        HttpCode: 200
      TargetType: ip
      VpcId:
        Fn::ImportValue:
          !Sub "${VpcStackName}-VpcId"
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-ALBTargetGroup"
        - Key: Service
          Value: ci/cd
        - Key: Source
          Value: govuk-one-login/tech-docs/template.yaml

  ApplicationLoadBalancerListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    # checkov:skip=CKV_AWS_2:Certificate generation must be resolved before the listener can use HTTPS.
    # checkov:skip=CKV_AWS_103:The load balancer cannot use TLS v1.2 until HTTPS is enabled.
    Metadata:
      checkov:
        skip:
          - id: "CKV_AWS_2"
            comment: "Certificate generation must be resolved before the listener can use HTTPS"
          - id: "CKV_AWS_103"
            comment: "The load balancer cannot use TLS v1.2 until HTTPS is enabled"
    Properties:
      DefaultActions:
        - Order: 1
          TargetGroupArn: !Ref ApplicationLoadBalancerTargetGroup
          Type: forward
      LoadBalancerArn: !Ref ApplicationLoadBalancer
      Port: 443
      Protocol: HTTPS
      SslPolicy: ELBSecurityPolicy-TLS13-1-2-2021-06
      Certificates:
        - CertificateArn: !Ref TechDocsCertificate

  ApplicationLoadBalancerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security Group for the Application Load Balancer
      GroupName: !Join
        - "-"
        - - !Ref AWS::StackName
          - ApplicationLoadBalancer
          - Fn::Select:
              - 4
              - Fn::Split:
                  - "-"
                  - Fn::Select:
                      - 2
                      - Fn::Split:
                          - "/"
                          - Ref: AWS::StackId
      VpcId:
        Fn::ImportValue:
          !Sub "${VpcStackName}-VpcId"
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-ALBSecurityGroup"
        - Key: Service
          Value: ci/cd
        - Key: Source
          Value: govuk-one-login/tech-docs/template.yaml

  ApplicationLoadBalancerSecurityGroupIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !GetAtt ApplicationLoadBalancerSecurityGroup.GroupId
      CidrIp: 0.0.0.0/0
      Description: Allow traffic from the internet on port 443
      IpProtocol: tcp
      FromPort: 443
      ToPort: 443

  ApplicationLoadBalancerSecurityGroupEgress:
    Type: AWS::EC2::SecurityGroupEgress
    Properties:
      GroupId: !GetAtt ApplicationLoadBalancerSecurityGroup.GroupId
      DestinationSecurityGroupId: !GetAtt ContainerServiceSecurityGroup.GroupId
      Description: Allow traffic to Container Service on port 80
      IpProtocol: tcp
      FromPort: 80
      ToPort: 80

  #
  # Logging
  #

  AccessLogsBucket:
    Type: AWS::S3::Bucket
    # checkov:skip=CKV_AWS_18:This is the access logs bucket. It should not log itself.
    Metadata:
      checkov:
        skip:
          - id: "CKV_AWS_18"
            comment: "This is the access logs bucket. It should not log itself."
    Properties:
      BucketName: !Join
        - "-"
        - - !Ref AWS::StackName
          - logs
          - Fn::Select:
              - 4
              - Fn::Split:
                  - '-'
                  - Fn::Select:
                      - 2
                      - Fn::Split:
                          - /
                          - Ref: AWS::StackId
      VersioningConfiguration:
        Status: Enabled
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-accesslogs"
        - Key: Service
          Value: ci/cd
        - Key: Source
          Value: govuk-one-login/team-manual/deploy/template.yaml
        - Key: CheckovRulesToSkip
          Value: CKV_AWS_18

  AccessLogsBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref AccessLogsBucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: AllowLoadBalancerToLogToS3
            Effect: Allow
            Principal:
              AWS: !Sub
                - "arn:aws:iam::${ElbAccountId}:root"
                - ElbAccountId: !FindInMap [ ElasticLoadBalancerAccountIds, !Ref AWS::Region, AccountId ]
            Action:
              - s3:PutObject
            Resource: !Sub "${AccessLogsBucket.Arn}/AWSLogs/${AWS::AccountId}/*"
          - Sid: AllowAwsLogDeliveryToLogToS3
            Effect: Allow
            Principal:
              Service: delivery.logs.amazonaws.com
            Action:
              - s3:PutObject
            Resource: !Sub "${AccessLogsBucket.Arn}/AWSLogs/${AWS::AccountId}/*"
            Condition:
              StringEquals:
                "s3:x-amz-acl": bucket-owner-full-control
                "aws:SourceAccount": !Ref AWS::AccountId
          - Sid: AllowAwsLogDeliveryToReadBucketAcl
            Effect: Allow
            Principal:
              Service: delivery.logs.amazonaws.com
            Action:
              - s3:GetBucketAcl
            Resource: !GetAtt AccessLogsBucket.Arn
            Condition:
              StringEquals:
                "aws:SourceAccount": !Ref AWS::AccountId

  KmsKey:
    Type: AWS::KMS::Key
    Properties:
      EnableKeyRotation: true
      KeyPolicy:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
            Action:
              - kms:*
            Resource: "*"
          - Effect: Allow
            Principal:
              Service: !Sub "logs.${AWS::Region}.amazonaws.com"
            Action:
              - "kms:Encrypt*"
              - "kms:Decrypt*"
              - "kms:ReEncrypt*"
              - "kms:GenerateDataKey*"
              - "kms:Describe*"
            Resource: "*"
            Condition:
              ArnLike:
                "kms:EncryptionContext:aws:logs:arn": !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:*"
      Tags:
        - Key: Service
          Value: ci/cd
        - Key: Name
          Value: !Sub "${AWS::StackName}-KmsKey"
        - Key: Source
          Value: govuk-one-login/team-manual/deploy/template.yaml


  WAFv2ACLAssociation:
    Type: AWS::WAFv2::WebACLAssociation
    Properties:
      ResourceArn: !Ref ApplicationLoadBalancer
      WebACLArn: !ImportValue docs-waf-Waf-WebAcl-arn

Outputs:

  PipelineStackName:
    Condition: OutputPipelineStackName
    Description: "The name of the pipeline stack that deploys this application stack"
    Value: !Ref PipelineStackName
  ALBDNS:
    Description: "The DNS of the application load balancer"
    Value: !GetAtt ApplicationLoadBalancer.DNSName
    Export:
      Name: TechDocsALBDNS
  ALBHostedZone:
    Description: "The DNS of the application load balancer"
    Value: !GetAtt ApplicationLoadBalancer.CanonicalHostedZoneID
    Export:
      Name: TechDocsALBHostedZone