cloudformation-template.yaml

---
AWSTemplateFormatVersion: '2010-09-09'
Description: >
  This template creates a Consul cluster using Amazon EC2 AutoScaling groups.
  
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: ASG cluster configuration
        Parameters:
          - AsgMaxSize
          - AsgMinSize
          - SubnetList
          - VpcId
          - InstanceType
          - Ami
          - KeyName

      - Label:
          default: Consul configuration
        Parameters:
          - ConsulVersion
          - ConsulToken
          - Environment
          - Exposure
          - HostedZoneId
          - DnsName
          - UseSsl
          - CertificateArn
          - BackupStorageBucketName

    ParameterLabels:
      Ami:
        default: The AMI used to start the cluster instances
      AsgMaxSize:
        default: The maximum number of instances to launch
      AsgMinSize:
        default: The minimum number of instances to keep in service
      SubnetList:
        default: The subnets in which the instances can run
      VpcId:
        default: The VPC to which the subnets belong
      ConsulVersion:
        default: The consul version to install
      ConsulToken:
        default: The consul admin token
      Environment:
        default: The environment for which the consul cluster will run
      InstanceType:
        default: The instance size to use for the consul cluster
      KeyName:
        default: The SSH key to use for booting up the instances
      Exposure:
        default: Whether to set the consul load balancer as internet-facing or internal
      HostedZoneId:
        default: The Hosted Zone ID to use in Route53 to expose the consul DnsName
      DnsName:
        default: The value of the Consul hostname
      UseSsl:
        default: Whether to use SSL when connecting via load balancer
      CertificateArn:
        default: The Certificate ARN to use when UseSsl is set to "true"
      BackupStorageBucketName:
        default: The S3 bucket in which to store Consul backups
      
Parameters:
  Ami:
    Type: String
    Default: ami-013be31976ca2c322
    Description: For optimal performance, use the latest Amazon Linux AMI (HVM) available
  AsgMaxSize:
    Type: Number
    Default: 6
  AsgMinSize:
    Type: Number
    Default: 4
  SubnetList:
    Type: List<AWS::EC2::Subnet::Id>
  VpcId:
    Type: AWS::EC2::VPC::Id
  ConsulVersion:
    Type: String
    Default: 1.4.0
  ConsulToken:
    Type: String
    NoEcho: true
    Default: d07b765f-2g23-55b2-0139-161fdg5ea385
    Description: https://www.uuidgenerator.net/
  Environment:
    Type: String
    AllowedValues:
    - dev
    - staging
    - prod
    Default: dev
  KeyName:
    Type: AWS::EC2::KeyPair::KeyName
  Exposure:
    Type: String
    AllowedValues:
    - internet-facing
    - internal
    Default: internet-facing
  HostedZoneId:
    Type: AWS::Route53::HostedZone::Id
  DnsName:
    Type: String
    Default: consul.aws.netbears.com
  UseSsl:
    Type: String
    AllowedValues:
    - true
    - false
    Default: true
  CertificateArn:
    Type: String
  BackupStorageBucketName:
    Type: String
    Default: netbears-consul-backup
  InstanceType:
    Type: String
    AllowedValues:
    - m5.large
    - m5.xlarge
    - m5.2xlarge
    - m5.4xlarge
    - m5.12xlarge
    - m5.24xlarge
    - m4.large
    - m4.xlarge
    - m4.2xlarge
    - m4.4xlarge
    - m4.10xlarge
    - m4.16xlarge
    - c5.large
    - c5.xlarge
    - c5.2xlarge
    - c5.4xlarge
    - c5.9xlarge
    - c5.18xlarge
    - c4.large
    - c4.xlarge
    - c4.2xlarge
    - c4.4xlarge
    - c4.8xlarge
    - g3.4xlarge
    - g3.8xlarge
    - g3.16xlarge
    - g2.2xlarge
    - g2.8xlarge
    - r4.large
    - r4.xlarge
    - r4.2xlarge
    - r4.4xlarge
    - r4.8xlarge
    - r4.16xlarge
    - d2.xlarge
    - d2.2xlarge
    - d2.4xlarge
    - d2.8xlarge
    - i3.large
    - i3.xlarge
    - i3.2xlarge
    - i3.4xlarge
    - i3.8xlarge
    - i3.16xlarge
    - i2.xlarge
    - i2.2xlarge
    - i2.4xlarge
    - i2.8xlarge

Conditions:
  LoadBalancerSsl: 
    Fn::Equals:
      - Ref: UseSsl
      - true

Resources: 
  HostRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
                - autoscaling.amazonaws.com
            Action: sts:AssumeRole
      Policies:
      - PolicyName:
          Fn::Sub: ${AWS::StackName}-Autoscaling
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - autoscaling:*
            Resource: "*"
      - PolicyName:
          Fn::Sub: ${AWS::StackName}-Ec2
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - ec2:*
            Resource: "*"
      - PolicyName:
          Fn::Sub: ${AWS::StackName}-ElasticLoadBalancing
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - elasticloadbalancing:*
            Resource: "*"
      - PolicyName:
          Fn::Sub: ${AWS::StackName}-Logs
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - logs:*
            Resource: "*"
      - PolicyName:
          Fn::Sub: ${AWS::StackName}-Iam
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - iam:PassRole
            - iam:ListRoles
            - iam:ListInstanceProfiles
            - iam:PutUserPolicy
            Resource: "*"
      - PolicyName:
          Fn::Sub: ${AWS::StackName}-s3
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - s3:*
            Resource: "*"

  HostProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
      - Ref: HostRole

  Sg:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription:
        Fn::Sub: ${AWS::StackName}-Sg
      VpcId:
        Ref: VpcId
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 0
        ToPort: 65535
        CidrIp: 0.0.0.0/0
      - IpProtocol: udp
        FromPort: 0
        ToPort: 65535
        CidrIp: 0.0.0.0/0

  BackupStorage:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    Properties:
      BucketName:
        Ref: BackupStorageBucketName

  ASG:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      VPCZoneIdentifier:
        Ref: SubnetList
      HealthCheckGracePeriod: '600'
      HealthCheckType: EC2
      LoadBalancerNames:
        - Ref: ConsulElb
      LaunchConfigurationName:
        Ref: Lc
      MinSize:
        Ref: AsgMinSize
      MaxSize:
        Ref: AsgMaxSize
      DesiredCapacity:
        Ref: AsgMinSize
      Tags:
      - Key: Name
        Value:
          Fn::Sub: ConsulCluster-${AWS::StackName}
        PropagateAtLaunch: true
      - Key: Team
        Value: NETBEARS
        PropagateAtLaunch: true
      - Key: Application
        Value: consul-server
        PropagateAtLaunch: true
      - Key: Environment
        Value:
          Ref: Environment
        PropagateAtLaunch: true
      - Key: StackName
        Value:
          Ref: AWS::StackName
        PropagateAtLaunch: true
      MetricsCollection:
      - Metrics:
        - GroupTotalInstances
        Granularity: 1Minute
    UpdatePolicy:
      AutoScalingRollingUpdate:
        MinInstancesInService:
          Ref: AsgMinSize
        MaxBatchSize: 1
        PauseTime: PT10M
        SuspendProcesses:
        - AZRebalance
        - AlarmNotification
        - HealthCheck
        - ReplaceUnhealthy
        - ScheduledActions

  Lc:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      ImageId:
        Ref: Ami
      EbsOptimized: true
      BlockDeviceMappings:
      - DeviceName: /dev/xvda
        Ebs:
          VolumeType: gp2
          VolumeSize: 25
      InstanceType:
        Ref: InstanceType
      IamInstanceProfile:
        Ref: HostProfile
      KeyName:
        Ref: KeyName
      SecurityGroups:
      - Ref: Sg
      UserData:
        Fn::Base64:
          Fn::Sub: |
            #cloud-config
            packages:
            - aws-cli
            - jq
            - ntp
            - curl
            - git
            - gcc
            - wget
            - python27-devel
            - python27-pip
            - net-tools
            - bind-tools
            - htop
            - zip
            - unzip
            write_files:
            - path: /opt/consul-config.json
              content: |
                {
                  "acl_datacenter": "${Environment}01-consul",
                  "acl_default_policy": "deny",
                  "acl_enforce_version_8": false,
                  "acl_master_token": "${ConsulToken}",
                  "client_addr": "0.0.0.0",
                  "data_dir": "/opt/consul-data",
                  "datacenter": "${Environment}01-consul",
                  "leave_on_terminate": true,
                  "retry_join": [
                    "provider=aws tag_key=StackName tag_value=${AWS::StackName} region=${AWS::Region}"
                  ],
                  "telemetry": {
                    "statsd_address": "ec2_host:9125"
                  }
                }
              permissions: '0644'
            - path: /etc/cron.d/consul-backup
              content: |
                0 * * * * root /opt/consul-backup.sh
              permissions: '0600'
            - path: /opt/consul-backup.sh
              content: |
                BACKUP_DATE=$(date +%d-%m-%Y)
                /usr/local/bin/consul-backinator backup -prefix=/ -token=${ConsulToken} -file=/opt/consul-backinator/kv -acls=/opt/consul-backinator/acls
                aws s3 cp /opt/consul-backinator/kv s3://${BackupStorageBucketName}/automatic/ec2_host/kv/$BACKUP_DATE/kv-backup
                aws s3 cp /opt/consul-backinator/kv.sig s3://${BackupStorageBucketName}/automatic/ec2_host/kv/$BACKUP_DATE/kv-backup.sig
                aws s3 cp /opt/consul-backinator/acls s3://${BackupStorageBucketName}/automatic/ec2_host/acls/$BACKUP_DATE/acls-backup
                aws s3 cp /opt/consul-backinator/acls.sig s3://${BackupStorageBucketName}/automatic/ec2_host/acls/$BACKUP_DATE/acls-backup.sig
              permissions: '0775'
            - path: /opt/statsd-exporter.consul.yaml
              content: |
                mappings:
                - match: consul.*.runtime.*
                  name: consul_runtime
                  labels:
                    host: ec2_host
                    type: $2
                - match: consul.runtime.total_gc_pause_ns
                  name: consul_runtime_total_gc_pause_ns
                  labels:
                    host: ec2_host
                    type: $2
                - match: consul.consul.health.service.query-tag.*.*.*
                  name: consul_health_service_query_tag
                  labels:
                    host: ec2_host
                    query: $1.$2.$3
                - match: consul.consul.health.service.query-tag.*.*.*.*
                  name: consul_health_service_query_tag
                  labels:
                    host: ec2_host
                    query: $1.$2.$3.$4
                - match: consul.consul.health.service.query-tag.*.*.*.*.*
                  name: consul_health_service_query_tag
                  labels:
                    host: ec2_host
                    query: $1.$2.$3.$4.$5
                - match: consul.consul.health.service.query-tag.*.*.*.*.*.*
                  name: consul_health_service_query_tag
                  labels:
                    host: ec2_host
                    query: $1.$2.$3.$4.$5.$6
                - match: consul.consul.health.service.query-tag.*.*.*.*.*.*.*
                  name: consul_health_service_query_tag
                  labels:
                    host: ec2_host
                    query: $1.$2.$3.$4.$5.$6.$7
                - match: consul.consul.health.service.query-tag.*.*.*.*.*.*.*.*
                  name: consul_health_service_query_tag
                  labels:
                    host: ec2_host
                    query: $1.$2.$3.$4.$5.$6.$7.$8
                - match: consul.consul.health.service.query-tag.*.*.*.*.*.*.*.*.*
                  name: consul_health_service_query_tag
                  labels:
                    host: ec2_host
                    query: $1.$2.$3.$4.$5.$6.$7.$8.$9
                - match: consul.consul.health.service.query-tag.*.*.*.*.*.*.*.*.*.*
                  name: consul_health_service_query_tag
                  labels:
                    host: ec2_host
                    query: $1.$2.$3.$4.$5.$6.$7.$8.$9.$10
                - match: consul.consul.health.service.query-tag.*.*.*.*.*.*.*.*.*.*.*
                  name: consul_health_service_query_tag
                  labels:
                    host: ec2_host
                    query: $1.$2.$3.$4.$5.$6.$7.$8.$9.$10.$11
                - match: consul.consul.health.service.query-tag.*.*.*.*.*.*.*.*.*.*.*.*
                  name: consul_health_service_query_tag
                  labels:
                    host: ec2_host
                    query: $1.$2.$3.$4.$5.$6.$7.$8.$9.$10.$11.$12
                - match: consul.consul.fsm.persist
                  name: consul_fsm_persist
                  labels:
                    host: ec2_host
                - match: consul.consul.catalog.deregister
                  name: consul_catalog_deregister
                  labels:
                    host: ec2_host
                - match: consul.consul.http.PUT.v1.agent.service_register
                  name: consul_http_PUT_v1_agent_service_register
                  labels:
                    host: ec2_host
                - match: consul.consul.http.GET.v1.kv.*
                  name: consul_http_GET_v1_kv
                  labels:
                    host: ec2_host
                - match: consul.consul.http.GET.v1.internal.ui.nodes
                  name: consul_http_GET_v1_internal_ui_nodes
                  labels:
                    host: ec2_host
                - match: consul.consul.http.GET.v1.internal.ui.node.*
                  name: consul_http_GET_v1_internal_ui_node
                  labels:
                    host: ec2_host
                - match: consul.consul.http.GET.v1.health.service.*
                  name: consul_http_GET_v1_health_service
                  labels:
                    host: ec2_host
                - match: consul.consul.http.GET.v1.catalog.datacenters
                  name: consul_http_GET_v1_catalog_datacenters
                  labels:
                    host: ec2_host
                - match: consul.consul.http.GET.v1.acl.list
                  name: consul_http_GET_v1_acl_list
                  labels:
                    host: ec2_host
                - match: consul.consul.dns.domain_query.*.*.*.*.*
                  name: consul_dns_domain_query
                  labels:
                    host: ec2_host
                    query: $1.$2.$3.$4.$5
                - match: consul.consul.health.service.not-found.*
                  name: consul_health_service_not_found
                  labels:
                    host: ec2_host
                    query: $1
                - match: consul.consul.health.service.query.*
                  name: consul_health_service_query
                  labels:
                    host: ec2_host
                    query: $1
                - match: consul.*.memberlist.health.score
                  name: consul_memberlist_health_score
                  labels:
                    host: ec2_host
                - match: consul.serf.queue.*
                  name: consul_serf_events
                  labels:
                    host: ec2_host
                    type: $1
                - match: consul.serf.snapshot.appendLine
                  name: consul_serf_snapshot_appendLine
                  labels:
                    host: ec2_host
                    type: $1
                - match: consul.serf.coordinate.adjustment-ms
                  name: consul_serf_coordinate_adjustment_ms
                  labels:
                    host: ec2_host
                - match: consul.consul.rpc.query
                  name: consul_rpc_query
                  labels:
                    host: ec2_host
                - match: consul.*.consul.session_ttl.active
                  name: consul_session_ttl_active
                  labels:
                    host: ec2_host
                - match: consul.raft.rpc.*
                  name: consul_raft_rpc
                  labels:
                    host: ec2_host
                    type: $1
                - match: consul.raft.rpc.appendEntries.storeLogs
                  name: consul_raft_rpc_appendEntries_storeLogs
                  labels:
                    host: ec2_host
                    type: $1
                - match: consul.raft.fsm.apply
                  name: consul_raft_fsm_apply
                  labels:
                    host: ec2_host
                - match: consul.raft.leader.lastContact
                  name: consul_raft_leader_lastcontact
                  labels:
                    host: ec2_host
                - match: consul.raft.leader.dispatchLog
                  name: consul_raft_leader_dispatchLog
                  labels:
                    host: ec2_host
                - match: consul.raft.commitTime
                  name: consul_raft_commitTime
                  labels:
                    host: ec2_host
                - match: consul.raft.replication.appendEntries.logs.*.*.*.*
                  name: consul_raft_replication_appendEntries_logs
                  labels:
                    host: ec2_host
                    query: $1.$2.$3.$4
                - match: consul.raft.replication.appendEntries.rpc.*.*.*.*
                  name: consul_raft_replication_appendEntries_rpc
                  labels:
                    host: ec2_host
                    query: $1.$2.$3.$4
                - match: consul.raft.replication.heartbeat.*.*.*.*
                  name: consul_raft_replication_heartbeat
                  labels:
                    host: ec2_host
                    query: $1.$2.$3.$4
                - match: consul.consul.rpc.request
                  name: consul_rpc_requests
                  labels:
                    host: ec2_host
                - match: consul.consul.rpc.accept_conn
                  name: consul_rpc_accept_conn
                  labels:
                    host: ec2_host
                - match: consul.memberlist.udp.*
                  name: consul_memberlist_udp
                  labels:
                    host: ec2_host
                    type: $1
                - match: consul.memberlist.tcp.*
                  name: consul_memberlist_tcp
                  labels:
                    host: ec2_host
                    type: $1
                - match: consul.memberlist.gossip
                  name: consul_memberlist_gossep
                  labels:
                    host: ec2_host
                - match: consul.memberlist.probeNode
                  name: consul_memberlist_probenode
                  labels:
                    host: ec2_host
                - match: consul.memberlist.pushPullNode
                  name: consul_memberlist_pushpullnode
                  labels:
                    host: ec2_host
                - match: consul.consul.http.GET.v1.catalog.datacenters
                  name: consul_http_GET_catalog_datacenters
                  labels:
                    host: ec2_host
                - match: consul.consul.http.GET.v1.coordinate.nodes
                  name: consul_http_GET_coordinate_nodes
                  labels:
                    host: ec2_host
                - match: consul.consul.http.GET.v1.health.service.*
                  name: consul_http_GET_health_service
                  labels:
                    host: ec2_host
                - match: consul.consul.http.GET.v1.internal.ui.nodes.*
                  name: consul_http_GET_internal_ui_nodes
                  labels:
                    host: ec2_host
                - match: consul.consul.http.GET.v1.internal.ui.services
                  name: consul_http_GET_internal_ui_services
                  labels:
                    host: ec2_host
                - match: consul.consul.http.GET.v1.session.node.*
                  name: consul_http_GET_session_node
                  labels:
                    host: ec2_host
                - match: consul.consul.http.GET.v1.kv.*.*.*
                  name: consul_http_GET_kv
                  labels:
                    host: ec2_host
                - match: consul.consul.leader.barrier
                  name: consul_leader_barrier
                  labels:
                    host: ec2_host
                - match: consul.consul.leader.reconcileMember
                  name: consul_leader_reconcileMember
                  labels:
                    host: ec2_host
                - match: consul.consul.leader.reconcile
                  name: consul_leader_reconcile
                  labels:
                    host: ec2_host
                - match: consul.consul.fsm.coordinate.batch-update
                  name: consul_fsm_coordinate_batch_update
                  labels:
                    host: ec2_host
                - match: consul.consul.fsm.register
                  name: consul_fsm_register
                  labels:
                    host: ec2_host
                - match: consul.consul.fsm.deregister
                  name: consul_fsm_deregister
                  labels:
                    host: ec2_host
                - match: consul.consul.catalog.register
                  name: consul_catalog_register
                  labels:
                    host: ec2_host
                - match: consul.consul.catalog.deregister
                  name: consul_catalog_deregister
                  labels:
                    host: ec2_host
                - match: consul.consul.fsm.tombstone.reap
                  name: consul_fsm_tombstone_reap
                  labels:
                    host: ec2_host
                - match: consul.consul.leader.reapTombstones
                  name: consul_leader_reapTombstones
                  labels:
                    host: ec2_host
              permissions: '0644'
            runcmd:
            - mkdir -p /opt/consul-data
            - curl -O https://releases.hashicorp.com/consul/${ConsulVersion}/consul_${ConsulVersion}_linux_amd64.zip
            - unzip consul_${ConsulVersion}_linux_amd64.zip
            - rm -f consul_${ConsulVersion}_linux_amd64.zip
            - mv consul /usr/local/bin
            - chmod +x /usr/local/bin/consul
            - ip=$(wget -T10 -t2 -qO - http://169.254.169.254/latest/meta-data/local-ipv4 || hostname -i) && sed -i "s/ec2_host/$ip/" /opt/consul-backup.sh
            - ip=$(wget -T10 -t2 -qO - http://169.254.169.254/latest/meta-data/local-ipv4 || hostname -i) && sed -i "s/ec2_host/$ip/" /opt/consul-config.json
            - mkdir -p /opt/consul-backinator
            - wget https://github.com/myENA/consul-backinator/releases/download/v1.6.5/consul-backinator-1.6.5-amd64-linux.tar.gz
            - tar -xzf consul-backinator-1.6.5-amd64-linux.tar.gz
            - rm -f consul-backinator-1.6.5-amd64-linux.tar.gz
            - mv consul-backinator-1.6.5-amd64-linux/consul-backinator-1.6.5 /usr/local/bin/consul-backinator
            - chmod +x /usr/local/bin/consul-backinator
            - wget https://github.com/prometheus/node_exporter/releases/download/v0.16.0/node_exporter-0.16.0.linux-amd64.tar.gz
            - tar xvf node_exporter-0.16.0.linux-amd64.tar.gz
            - cp node_exporter-0.16.0.linux-amd64/node_exporter /usr/local/bin
            - chmod +x /usr/local/bin/node_exporter
            - /usr/local/bin/node_exporter &
            - wget https://github.com/prometheus/statsd_exporter/releases/download/v0.8.0/statsd_exporter-0.8.0.linux-amd64.tar.gz
            - tar xvf statsd_exporter-0.8.0.linux-amd64.tar.gz
            - mv statsd_exporter-0.8.0.linux-amd64/statsd_exporter /usr/local/bin/statsd_exporter
            - chmod +x /usr/local/bin/statsd_exporter
            - ip=$(wget -T10 -t2 -qO - http://169.254.169.254/latest/meta-data/local-ipv4 || hostname -i) && sed -i "s/ec2_host/$ip/" /opt/statsd-exporter.consul.yaml
            - /usr/local/bin/statsd_exporter --statsd.mapping-config=/opt/statsd-exporter.consul.yaml &
            - ip=$(wget -T10 -t2 -qO - http://169.254.169.254/latest/meta-data/local-ipv4 || hostname -i) && consul agent -config-file /opt/consul-config.json -node $ip -advertise $ip -server -bootstrap-expect 3 -ui

  CpuUtilizationTargetTracking:
    Type: AWS::AutoScaling::ScalingPolicy
    Properties:
      AutoScalingGroupName:
        Ref: ASG
      PolicyType: TargetTrackingScaling
      TargetTrackingConfiguration:
        TargetValue: 70
        PredefinedMetricSpecification:
          PredefinedMetricType: ASGAverageCPUUtilization

  ConsulElb:
    Type: AWS::ElasticLoadBalancing::LoadBalancer
    Properties:
      ConnectionSettings:
        IdleTimeout: 70
      HealthCheck:
        HealthyThreshold: 3
        Interval: 5
        Target: HTTP:8500/ui/
        Timeout: 3
        UnhealthyThreshold: 2
      Listeners:
      - InstancePort: 8500
        LoadBalancerPort: 80
        Protocol: TCP
      - InstancePort: 8300
        LoadBalancerPort: 8300
        Protocol: TCP
      - InstancePort: 8301
        LoadBalancerPort: 8301
        Protocol: TCP
      - InstancePort: 8302
        LoadBalancerPort: 8302
        Protocol: TCP
      - InstancePort: 8400
        LoadBalancerPort: 8400
        Protocol: TCP
      - InstancePort: 8500
        LoadBalancerPort: 8500
        Protocol: TCP
      - InstancePort: 8600
        LoadBalancerPort: 8600
        Protocol: TCP
      - Fn::If:
        - LoadBalancerSsl
        - InstancePort: 8500
          LoadBalancerPort: 443
          Protocol: SSL
          SSLCertificateId:
            Ref: CertificateArn
        - Ref: AWS::NoValue
      Scheme:
        Ref: Exposure
      SecurityGroups:
      - Ref: Sg
      Subnets:
        Ref: SubnetList
      Tags:
      - Key: Team
        Value: NETBEARS
      - Key: Application
        Value: consul-server
      - Key: Environment
        Value:
          Ref: Environment
      - Key: StackName
        Value:
          Ref: AWS::StackName

  ConsulDnsRecord:
    Type: AWS::Route53::RecordSetGroup
    Properties:
      HostedZoneId:
        Ref: HostedZoneId
      Comment: 
        Fn::Sub: Route53-record-for-${AWS::StackName}.
      RecordSets:
      - Name:
          Ref: DnsName
        Type: A
        AliasTarget:
          HostedZoneId:
            Fn::GetAtt: ConsulElb.CanonicalHostedZoneNameID
          DNSName:
            Fn::GetAtt: ConsulElb.DNSName

Outputs:

  ConsulUi:
    Export:
      Name:
        Fn::Sub: ${AWS::StackName}-ConsulDnsRecord
    Value:
      Fn::If:
        - LoadBalancerSsl
        - Fn::Sub: https://${DnsName}/ui/${Environment}01-consul/services
        - Fn::Sub: http://${DnsName}/ui/${Environment}01-consul/services

  ConsulElbCanonicalHostedZoneNameID:
    Export:
      Name:
        Fn::Sub: ${AWS::StackName}-ConsulElbCanonicalHostedZoneNameID
    Value:
      Fn::GetAtt: ConsulElb.CanonicalHostedZoneNameID

  ConsulElbDNSName:
    Export:
      Name:
        Fn::Sub: ${AWS::StackName}-ConsulElbDNSName
    Value:
      Fn::GetAtt: ConsulElb.DNSName