phonebook-docker-swarm-cfn-template.yml

AWSTemplateFormatVersion: 2010-09-09

Description: >
  This CloudFormation Template deploys Phonebook Application to five Docker Machines on EC2 Instances
  which are ready for Docker Swarm operations.

Parameters:
  KeyPairName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: Enter the name of your Key Pair for SSH connections.
    ConstraintDescription: Must be one of the existing EC2 KeyPair

Resources:
  InstanceConnectPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      PolicyDocument: #required
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - ec2-instance-connect:SendSSHPublicKey
            Resource:
              - !Sub arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:instance/*
            Condition: { "StringEquals": { "ec2:osuser": "ec2-user" } }
          - Effect: Allow
            Action:
              - ec2:DescribeInstances
            Resource: "*"

  EC2InstanceConnect:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - "sts:AssumeRole"
      ManagedPolicyArns:
        - !Ref InstanceConnectPolicy
        - arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess

  EC2ConnectProfile:
    Type: "AWS::IAM::InstanceProfile"
    Properties:
      Roles: #required
        - !Ref EC2InstanceConnect

  DockerMachinesSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Enable SSH and HTTP for Docker Machines
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 2377
          ToPort: 2377
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 7946
          ToPort: 7946
          CidrIp: 0.0.0.0/0
        - IpProtocol: udp
          FromPort: 7946
          ToPort: 7946
          CidrIp: 0.0.0.0/0
        - IpProtocol: udp
          FromPort: 4789
          ToPort: 4789
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 8080
          ToPort: 8080
          CidrIp: 0.0.0.0/0

  DockerSwarmManagerLT:
    Type: "AWS::EC2::LaunchTemplate"
    Properties:
      LaunchTemplateData:
        ImageId: ami-0947d2ba12ee1ff75
        InstanceType: t2.micro
        KeyName: !Ref KeyPairName
        IamInstanceProfile:
          Arn: !GetAtt EC2ConnectProfile.Arn
        SecurityGroupIds:
          - !GetAtt DockerMachinesSecurityGroup.GroupId
        UserData:
          Fn::Base64: !Sub |
            #! /bin/bash
            yum update -y
            amazon-linux-extras install docker -y
            systemctl start docker
            systemctl enable docker
            usermod -a -G docker ec2-user
            curl -L "https://github.com/docker/compose/releases/download/1.26.2/docker-compose-$(uname -s)-$(uname -m)" \
            -o /usr/local/bin/docker-compose
            chmod +x /usr/local/bin/docker-compose
            yum install python3 -y
            pip3 install ec2instanceconnectcli
            eval "$(mssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no  \
              --region ${AWS::Region} ${DockerManager1} docker swarm join-token manager | grep -i 'docker')"
            # uninstall aws cli version 1
            rm -rf /bin/aws
            curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
            unzip awscliv2.zip
            ./aws/install
            yum install amazon-ecr-credential-helper -y
            mkdir -p /home/ec2-user/.docker
            cd /home/ec2-user/.docker
            echo '{"credsStore": "ecr-login"}' > config.json

  DockerSwarmWorkerLT:
    Type: "AWS::EC2::LaunchTemplate"
    Properties:
      LaunchTemplateData:
        ImageId: ami-0947d2ba12ee1ff75
        InstanceType: t2.micro
        KeyName: !Ref KeyPairName
        IamInstanceProfile:
          Arn: !GetAtt EC2ConnectProfile.Arn
        SecurityGroupIds:
          - !GetAtt DockerMachinesSecurityGroup.GroupId
        UserData:
          Fn::Base64: !Sub |
            #! /bin/bash
            yum update -y
            amazon-linux-extras install docker -y
            systemctl start docker
            systemctl enable docker
            usermod -a -G docker ec2-user
            curl -L "https://github.com/docker/compose/releases/download/1.26.2/docker-compose-$(uname -s)-$(uname -m)" \
            -o /usr/local/bin/docker-compose
            chmod +x /usr/local/bin/docker-compose
            yum install python3 -y
            pip3 install ec2instanceconnectcli
            eval "$(mssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no  \
              --region ${AWS::Region} ${DockerManager1} docker swarm join-token worker | grep -i 'docker')"
            # uninstall aws cli version 1
            rm -rf /bin/aws
            curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
            unzip awscliv2.zip
            ./aws/install
            yum install amazon-ecr-credential-helper -y
            mkdir -p /home/ec2-user/.docker
            cd /home/ec2-user/.docker
            echo '{"credsStore": "ecr-login"}' > config.json

  DockerManager1:
    Type: AWS::EC2::Instance
    DependsOn:
      - DockerMachinesSecurityGroup
      - InstanceConnectPolicy
      - EC2InstanceConnect
    Properties:
      ImageId: ami-0947d2ba12ee1ff75
      InstanceType: t2.micro
      KeyName: !Ref KeyPairName
      IamInstanceProfile: !Ref EC2ConnectProfile
      SecurityGroupIds:
        - !GetAtt DockerMachinesSecurityGroup.GroupId
      Tags:
        - Key: Name
          Value: !Sub Docker Grand Master Manager 1st of ${AWS::StackName}
      UserData:
        Fn::Base64: !Sub
          - |
            #! /bin/bash
            yum update -y
            hostnamectl set-hostname Grand-Master
            amazon-linux-extras install docker -y
            systemctl start docker
            systemctl enable docker
            usermod -a -G docker ec2-user
            curl -L "https://github.com/docker/compose/releases/download/1.26.2/docker-compose-$(uname -s)-$(uname -m)" \
            -o /usr/local/bin/docker-compose
            chmod +x /usr/local/bin/docker-compose
            docker swarm init
            aws ecr get-login-password --region ${AWS::Region} | docker login --username AWS --password-stdin ${ECR_REGISTRY}
            docker service create \
              --name=viz \
              --publish=8080:8080/tcp \
              --constraint=node.role==manager \
              --mount=type=bind,src=/var/run/docker.sock,dst=/var/run/docker.sock \
              dockersamples/visualizer
            yum install git -y
            # uninstall aws cli version 1
            rm -rf /bin/aws
            curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
            unzip awscliv2.zip
            ./aws/install
            yum install amazon-ecr-credential-helper -y
            mkdir -p /home/ec2-user/.docker
            cd /home/ec2-user/.docker
            echo '{"credsStore": "ecr-login"}' > config.json
            aws ecr create-repository \
                --repository-name ${APP_REPO_NAME} \
                --image-scanning-configuration scanOnPush=false \
                --image-tag-mutability MUTABLE \
                --region ${AWS::Region}
            docker build --force-rm -t "${ECR_REGISTRY}/${APP_REPO_NAME}:latest" ${GITHUB_REPO}
            docker push "${ECR_REGISTRY}/${APP_REPO_NAME}:latest"
            mkdir -p /home/ec2-user/phonebook
            cd /home/ec2-user/phonebook
            cat << EOF | tee .env
            ECR_REGISTRY=${ECR_REGISTRY}
            APP_REPO_NAME=${APP_REPO_NAME}
            EOF
            curl -o "docker-compose.yml" -L ${GIT_FILE_URL}docker-compose.yml
            curl -o "init.sql" -L ${GIT_FILE_URL}init.sql
            docker-compose config | docker stack deploy --with-registry-auth -c - phonebook
          - ECR_REGISTRY: !Sub ${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com
            APP_REPO_NAME: infraform-repo/phonebook-app
            GITHUB_REPO: https://github.com/infraform/docker-swarm-elastic-container-app.git
            GIT_FILE_URL: https://raw.githubusercontent.com/infraform/docker-swarm-elastic-container-app/master/

  DockerManager2:
    Type: AWS::EC2::Instance
    DependsOn:
      - DockerManager1
    Properties:
      LaunchTemplate:
        LaunchTemplateId: !Ref DockerSwarmManagerLT
        Version: !GetAtt DockerSwarmManagerLT.LatestVersionNumber
      Tags:
        - Key: Name
          Value: !Sub Docker Manager 2nd of ${AWS::StackName}

  DockerManager3:
    Type: AWS::EC2::Instance
    DependsOn:
      - DockerManager2
    Properties:
      LaunchTemplate:
        LaunchTemplateId: !Ref DockerSwarmManagerLT
        Version: !GetAtt DockerSwarmManagerLT.LatestVersionNumber
      Tags:
        - Key: Name
          Value: !Sub Docker Manager 3rd of ${AWS::StackName}

  DockerWorker1:
    Type: AWS::EC2::Instance
    DependsOn:
      - DockerManager1
    Properties:
      LaunchTemplate:
        LaunchTemplateId: !Ref DockerSwarmWorkerLT
        Version: !GetAtt DockerSwarmWorkerLT.LatestVersionNumber
      Tags:
        - Key: Name
          Value: !Sub Docker Worker 1st of ${AWS::StackName}

  DockerWorker2:
    Type: AWS::EC2::Instance
    DependsOn:
      - DockerWorker1
    Properties:
      LaunchTemplate:
        LaunchTemplateId: !Ref DockerSwarmWorkerLT
        Version: !GetAtt DockerSwarmWorkerLT.LatestVersionNumber
      Tags:
        - Key: Name
          Value: !Sub Docker Worker 2nd of ${AWS::StackName}

Outputs:
  1stDockerManagerDashboard:
    Description: Dashboard for Docker Swarm Cluster
    Value: !Sub
      - http://${PublicAddress}:8080
      - PublicAddress: !GetAtt DockerManager1.PublicDnsName

  1stDockerManagerDNSName:
    Description: Docker Manager 1st DNS Name
    Value: !Sub
      - ${PublicAddress}
      - PublicAddress: !GetAtt DockerManager1.PublicDnsName

  2ndDockerManagerDNSName:
    Description: Docker Manager 2nd DNS Name
    Value: !Sub
      - ${PublicAddress}
      - PublicAddress: !GetAtt DockerManager2.PublicDnsName

  3rdDockerManagerDNSName:
    Description: Docker Manager 3rd DNS Name
    Value: !Sub
      - ${PublicAddress}
      - PublicAddress: !GetAtt DockerManager3.PublicDnsName

  1stDockerWorkerDNSName:
    Description: Docker Worker 1st DNS Name
    Value: !Sub
      - ${PublicAddress}
      - PublicAddress: !GetAtt DockerWorker1.PublicDnsName

  2ndDockerWorkerDNSName:
    Description: Docker Worker 2nd DNS Name
    Value: !Sub
      - ${PublicAddress}
      - PublicAddress: !GetAtt DockerWorker2.PublicDnsName