cloudformation.json

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Example ECS cluster for Empire",

  "Parameters": {
    "InstanceType": {
      "Type": "String",
      "Default": "t2.small",
      "AllowedValues": [ "t2.small","t2.medium","m3.medium","m3.large","m3.xlarge","m3.2xlarge","c4.large","c4.xlarge","c4.2xlarge","c4.4xlarge","c4.8xlarge","c3.large","c3.xlarge","c3.2xlarge","c3.4xlarge","c3.8xlarge","r3.large","r3.xlarge","r3.2xlarge","r3.4xlarge","r3.8xlarge","i2.xlarge","i2.2xlarge","i2.4xlarge","i2.8xlarge" ],
      "ConstraintDescription": "must be a valid EC2 instance type."
    },
    "EmpireVersion": {
      "Type": "String",
      "Default": "master",
      "Description": "Docker tag to specify the version of Empire to run."
    },
    "AmiId" : {
      "Type": "AWS::EC2::Image::Id",
      "Description": "AMI Id. Defaults to the official ECS Optimized Linux.",
      "Default": "ami-e7acf78d"
    },
    "KeyName": {
      "Type": "AWS::EC2::KeyPair::KeyName",
      "Description": "The name of the key pair to use to allow SSH access."
    },
    "EventsBackend": {
      "Type": "String",
      "Description": "The backend to use to publish Empire events to. Set this to SNS to create an SNS topic and publish events there.",
      "Default": "sns"
    },
    "DockerRegistry": {
      "Type": "String",
      "Description": "Docker private registry url",
      "Default": "https://index.docker.io/v1/"
    },
    "DockerUser": {
      "Type": "String",
      "Description": "Docker username for private registry",
      "Default": ""
    },
    "DockerPass": {
      "Type": "String",
      "Description": "Docker password for private registry",
      "Default": "",
      "NoEcho": true
    },
    "DockerEmail": {
      "Type": "String",
      "Description": "Docker registry email",
      "Default": ""
    },
    "MaxCapacity": {
      "Type": "String",
      "Description": "Maximum number of EC2 instances in the auto scaling group",
      "Default": "5"
    },
    "DesiredCapacity": {
      "Type": "String",
      "Description": "Desired number of EC2 instances in the auto scaling group",
      "Default": "3"
    },
    "AvailabilityZones": {
      "Type": "List<AWS::EC2::AvailabilityZone::Name>",
      "Description": "Comma delimited list of availability zones. MAX 2",
      "Default": "us-east-1a,us-east-1b"
    },
    "LaunchEmpire": {
      "Type": "Number",
      "Default": "1",
      "Description": "If 1, then launch Empire & Postgres as ECS tasks. If anything else, skip launching Empire (intended for dev use when Empire is ran locally)"
    }
  },

  "Conditions": {
    "DemoMode": {"Fn::Equals": [{"Ref": "LaunchEmpire"}, "1"]},
    "DevMode": {"Fn::Not": [{"Condition": "DemoMode"}]},
    "SNSEvents": {"Fn::Equals": [{"Ref": "EventsBackend"}, "sns"]}
  },

  "Resources": {

    "Vpc": {
      "Type": "AWS::EC2::VPC",
      "Properties": {
        "CidrBlock": "10.0.0.0/16",
        "EnableDnsSupport": "true",
        "EnableDnsHostnames": "true"
      }
    },

    "PubSubnetAz1" : {
      "Type": "AWS::EC2::Subnet",
      "DependsOn": "AttachGateway",
      "Properties": {
        "VpcId": { "Ref" : "Vpc" },
        "CidrBlock": "10.0.0.0/24",
        "AvailabilityZone": {
          "Fn::Select": ["0", { "Ref": "AvailabilityZones" }]
        }
      }
    },

    "PubSubnetAz2" : {
      "Type": "AWS::EC2::Subnet",
      "DependsOn": "AttachGateway",
      "Properties": {
        "VpcId": { "Ref" : "Vpc" },
        "CidrBlock": "10.0.1.0/24",
        "AvailabilityZone": {
          "Fn::Select": ["1", { "Ref": "AvailabilityZones" }]
        }
      }
    },

    "InternetGateway": {
      "Type": "AWS::EC2::InternetGateway"
    },

    "AttachGateway": {
      "Type": "AWS::EC2::VPCGatewayAttachment",
      "Properties": {
        "VpcId": { "Ref": "Vpc" },
        "InternetGatewayId": { "Ref": "InternetGateway" }
      }
    },

    "RouteViaIgw" : {
      "Type": "AWS::EC2::RouteTable",
      "Properties": {
        "VpcId": { "Ref": "Vpc" }
      }
    },

    "PublicRouteViaIgw": {
      "Type": "AWS::EC2::Route",
      "Properties": {
        "RouteTableId": { "Ref": "RouteViaIgw" },
        "DestinationCidrBlock": "0.0.0.0/0",
        "GatewayId": { "Ref": "InternetGateway" }
      }
    },

    "PubSubnet1RouteTableAssociation": {
      "Type": "AWS::EC2::SubnetRouteTableAssociation",
      "Properties": {
        "SubnetId": { "Ref": "PubSubnetAz1" },
        "RouteTableId": { "Ref": "RouteViaIgw" }
      }
    },

    "PubSubnet2RouteTableAssociation": {
      "Type": "AWS::EC2::SubnetRouteTableAssociation",
      "Properties": {
        "SubnetId": { "Ref": "PubSubnetAz2" },
        "RouteTableId": { "Ref": "RouteViaIgw" }
      }
    },

    "InternalDomain": {
      "Type": "AWS::Route53::HostedZone",
      "Properties": {
        "HostedZoneConfig": {
          "Comment": "Hosted zone for internal Empire services."
        },
        "Name": "empire.",
        "VPCs": [
          {
            "VPCId": { "Ref": "Vpc" },
            "VPCRegion": { "Ref": "AWS::Region" }
          }
        ]
      }
    },

    "DHCPOptions": {
      "Type" : "AWS::EC2::DHCPOptions",
      "Properties": {
        "DomainName": "empire",
        "DomainNameServers": [ "AmazonProvidedDNS" ]
      }
    },

    "VPCDHCPOptionsAssociation": {
      "Type" : "AWS::EC2::VPCDHCPOptionsAssociation",
      "Properties": {
        "DhcpOptionsId": { "Ref": "DHCPOptions" },
        "VpcId": { "Ref": "Vpc" }
      }
    },

    "InstanceSecurityGroup": {
      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "GroupDescription": "Container Instance Allowed Ports",
        "VpcId": { "Ref": "Vpc" },
        "SecurityGroupIngress": [
          {
            "IpProtocol": "tcp", "FromPort": "1", "ToPort": "65535",
            "CidrIp": "0.0.0.0/0"
          }
        ]
      }
    },

    "InternalLoadBalancerSecurityGroup": {
      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "GroupDescription": "Internal Load Balancer Allowed Ports",
        "VpcId": { "Ref": "Vpc" },
        "SecurityGroupIngress": [
          {
            "IpProtocol": "tcp", "FromPort": "80", "ToPort": "80",
            "CidrIp": "0.0.0.0/0"
          }
        ]
      }
    },

    "ExternalLoadBalancerSecurityGroup": {
      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "GroupDescription": "External Load Balancer Allowed Ports",
        "VpcId": { "Ref": "Vpc" },
        "SecurityGroupIngress": [
          {
            "IpProtocol": "tcp", "FromPort": "80", "ToPort": "80",
            "CidrIp": "0.0.0.0/0"
          },
          {
            "IpProtocol": "tcp", "FromPort": "443", "ToPort": "443",
            "CidrIp": "0.0.0.0/0"
          }
        ]
      }
    },

    "LoadBalancer": {
      "Type": "AWS::ElasticLoadBalancing::LoadBalancer",
      "Condition": "DemoMode",
      "DependsOn": "AttachGateway",
      "Properties": {
        "SecurityGroups": [
          { "Ref": "InstanceSecurityGroup" }
        ],
        "Subnets": [
          { "Ref": "PubSubnetAz1" },
          { "Ref": "PubSubnetAz2" }
        ],
        "CrossZone": "true",
        "Listeners": [
          {
            "LoadBalancerPort": "80",
            "InstancePort": "8080",
            "Protocol": "TCP"
          }
        ],
        "HealthCheck": {
          "Target": "HTTP:8080/health",
          "HealthyThreshold": "10",
          "UnhealthyThreshold": "2",
          "Interval": "30",
          "Timeout": "5"
        }
      }
    },

    "InstanceRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "Path": "/",
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": [ "ec2.amazonaws.com" ]
              },
              "Action": [ "sts:AssumeRole" ]
            }
          ]
        }
      }
    },

    "InstancePolicies": {
      "Type": "AWS::IAM::Policy",
      "Properties": {
        "PolicyName": "ecs",
        "Roles": [ { "Ref": "InstanceRole" } ],
        "Users": [ { "Ref": "User" } ],
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "ec2:Describe*",
                "elasticloadbalancing:*",
                "ecs:*",
                "ecr:GetAuthorizationToken",
                "ecr:BatchCheckLayerAvailability",
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchGetImage",
                "iam:ListInstanceProfiles",
                "iam:ListRoles",
                "iam:PassRole",
                "iam:UploadServerCertificate",
                "iam:DeleteServerCertificate",
                "route53:*",
                "sns:*"
              ],
              "Resource": [
                "*"
              ]
            }
          ]
        }
      }
    },

    "ServiceRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "Path": "/",
        "AssumeRolePolicyDocument": {
          "Version": "2008-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": [ "ecs.amazonaws.com" ]
              },
              "Action": [ "sts:AssumeRole" ]
            }
          ]
        }
      }
    },

    "ServiceRolePolicies": {
      "Type": "AWS::IAM::Policy",
      "Properties": {
        "PolicyName": "ecsServiceRole",
        "Roles": [ { "Ref": "ServiceRole" } ],
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "ec2:Describe*",
                "elasticloadbalancing:*",
                "ecs:*",
                "iam:ListInstanceProfiles",
                "iam:ListRoles",
                "iam:PassRole",
                "route53:*"
              ],
              "Resource": [
                "*"
              ]
            }
          ]
        }
      }
    },

    "InstanceProfile": {
      "Type": "AWS::IAM::InstanceProfile",
      "Properties": {
        "Path": "/",
        "Roles": [ { "Ref": "InstanceRole" } ]
      }
    },

    "LaunchConfiguration": {
      "Type": "AWS::AutoScaling::LaunchConfiguration",
      "DependsOn": "Cluster",
      "Properties": {
        "ImageId": { "Ref": "AmiId" },
        "InstanceType": { "Ref": "InstanceType" },
        "AssociatePublicIpAddress": true,
        "IamInstanceProfile": { "Ref": "InstanceProfile" },
        "KeyName": { "Ref": "KeyName" },
        "SecurityGroups": [
          { "Ref": "InstanceSecurityGroup" }
        ],
        "UserData": {
          "Fn::Base64": {
            "Fn::Join": [
              "",
              [
                "#!/bin/bash\n",
                "echo ECS_CLUSTER=", { "Ref": "Cluster" }, " >> /etc/ecs/ecs.config\n",
                "echo ECS_ENGINE_AUTH_TYPE=dockercfg >> /etc/ecs/ecs.config\n",
                "echo ECS_ENGINE_AUTH_DATA=\"{\\\"", { "Ref": "DockerRegistry" }, "\\\":{\\\"auth\\\":\\\"", { "Fn::Base64": { "Fn::Join": [ ":", [ { "Ref": "DockerUser" }, { "Ref": "DockerPass" } ] ] } }, "\\\",\\\"email\\\":\\\"", { "Ref": "DockerEmail" }, "\\\"}}\" >> /etc/ecs/ecs.config\n",
                "echo \"{\\\"", { "Ref": "DockerRegistry" }, "\\\":{\\\"auth\\\":\\\"", { "Fn::Base64": { "Fn::Join": [ ":", [ { "Ref": "DockerUser" }, { "Ref": "DockerPass" } ] ] } }, "\\\",\\\"email\\\":\\\"", { "Ref": "DockerEmail" }, "\\\"}}\" >> /home/ec2-user/.dockercfg\n"
              ]
            ]
          }
        }
      }
    },

    "AutoScalingGroup": {
      "Type": "AWS::AutoScaling::AutoScalingGroup",
      "Properties": {
        "AvailabilityZones": { "Ref": "AvailabilityZones" },
        "VPCZoneIdentifier": [{ "Fn::Join" : [",", [ { "Ref" : "PubSubnetAz1" }, { "Ref" : "PubSubnetAz2" } ] ] }],
        "LaunchConfigurationName": { "Ref": "LaunchConfiguration" },
        "MinSize": "1",
        "MaxSize": { "Ref": "MaxCapacity" },
        "DesiredCapacity": { "Ref": "DesiredCapacity" },
        "Tags": [
          {
            "Key": "Name",
            "Value": "Empire minion",
            "PropagateAtLaunch": "true"
          }
        ]
      }
    },

    "User": {
      "Type": "AWS::IAM::User",
      "Properties": { }
    },

    "AccessKey": {
      "Type": "AWS::IAM::AccessKey",
      "Properties": {
        "Status": "Active",
        "UserName": { "Ref": "User" }
      }
    },

    "Cluster": {
      "Type": "AWS::ECS::Cluster"
    },

    "TaskDefinition": {
      "Type": "AWS::ECS::TaskDefinition",
      "Condition": "DemoMode",
      "Properties": {
        "ContainerDefinitions": [
          {
            "Name": "postgres",
            "Image": "postgres",
            "Cpu": 512,
            "Memory": 256,
            "EntryPoint": [],
            "Environment": [],
            "Command": [],
            "PortMappings": [
              {
                "HostPort": 5432,
                "ContainerPort": 5432
              }
            ],
            "VolumesFrom": [],
            "Links": [],
            "MountPoints": [],
            "Essential": "true"
          },
          {
            "Name": "empire",
            "Image": { "Fn::Join": [":", ["remind101/empire", { "Ref": "EmpireVersion" }]] },
            "Cpu": 512,
            "Memory": 256,
            "EntryPoint": [],
            "Environment": [
              {
                "Name": "AWS_REGION",
                "Value": { "Ref": "AWS::Region" }
              },
              {
                "Name": "EMPIRE_DATABASE_URL",
                "Value": "postgres://postgres:postgres@postgres/postgres?sslmode=disable"
              },
              {
                "Name": "EMPIRE_ECS_CLUSTER",
                "Value": { "Ref": "Cluster"  }
              },
              {
                "Name": "EMPIRE_ELB_VPC_ID",
                "Value": { "Ref": "Vpc" }
              },
              {
                "Name": "EMPIRE_ELB_SG_PRIVATE",
                "Value": { "Ref": "InternalLoadBalancerSecurityGroup" }
              },
              {
                "Name": "EMPIRE_ELB_SG_PUBLIC",
                "Value": { "Ref": "ExternalLoadBalancerSecurityGroup" }
              },
              {
                "Name": "EMPIRE_ROUTE53_INTERNAL_ZONE_ID",
                "Value": { "Ref": "InternalDomain" }
              },
              {
                "Name": "EMPIRE_EC2_SUBNETS_PRIVATE",
                "Value": { "Fn::Join": [ ",", [{ "Ref": "PubSubnetAz1" }, { "Ref": "PubSubnetAz2" }] ] }
              },
              {
                "Name": "EMPIRE_ECS_SERVICE_ROLE",
                "Value": { "Ref": "ServiceRole" }
              },
              {
                "Name": "EMPIRE_EC2_SUBNETS_PUBLIC",
                "Value": { "Fn::Join": [ ",", [{ "Ref": "PubSubnetAz1" }, { "Ref": "PubSubnetAz2" }] ] }
              },
              {
                "Name": "EMPIRE_EVENTS_BACKEND",
                "Value": "sns"
              },
              {
                "Name": "EMPIRE_SNS_TOPIC",
                "Value": { "Ref": "EventsTopic" }
              }
            ],
            "Command": ["server", "-automigrate=true"],
            "PortMappings": [
              {
                "HostPort": 8080,
                "ContainerPort": 8080
              }
            ],
            "VolumesFrom": [],
            "Links": [
              "postgres:postgres"
            ],
            "MountPoints": [
              {
                "SourceVolume": "dockerSocket",
                "ContainerPath": "/var/run/docker.sock",
                "ReadOnly": false
              },
              {
                "SourceVolume": "dockerCfg",
                "ContainerPath": "/root/.dockercfg",
                "ReadOnly": false
              }
            ],
            "Essential": true
          }
        ],
        "Volumes": [
          {
            "Name": "dockerSocket",
            "Host": {
              "SourcePath": "/var/run/docker.sock"
            }
          },
          {
            "Name": "dockerCfg",
            "Host": {
              "SourcePath": "/home/ec2-user/.dockercfg"
            }
          }
        ]
      }
    },

    "Service": {
      "Type" : "AWS::ECS::Service",
      "Condition": "DemoMode",
      "DependsOn": ["Cluster","ServiceRole","ServiceRolePolicies"],
      "Properties" : {
        "Cluster" : { "Ref": "Cluster" },
        "DesiredCount" : 1,
        "LoadBalancers" : [
          {
            "ContainerName": "empire",
            "ContainerPort": 8080,
            "LoadBalancerName": { "Ref": "LoadBalancer" }
          }
        ],
        "Role" : { "Ref": "ServiceRole" },
        "TaskDefinition" : { "Ref": "TaskDefinition" }
      }
    },

    "EventsTopic": {
      "Type": "AWS::SNS::Topic",
      "Condition": "SNSEvents",
      "Properties": {
        "DisplayName": "Empire Events",
        "TopicName" : "events"
      }
    }
  },

  "Outputs": {
    "Subnets": {
      "Description": "The subnets created",
      "Value": { "Fn::Join": [ ",", [{ "Ref": "PubSubnetAz1" }, { "Ref": "PubSubnetAz2" }] ] }
    },
    "ELBName": {
      "Description": "The name of the ELB for the Empire controller",
      "Value": { "Ref": "LoadBalancer" },
      "Condition": "DemoMode"
    },
    "Cluster": {
      "Description": "Name of the ECS Cluster",
      "Value": { "Ref": "Cluster" }
    },
    "ServiceRole": {
      "Description": "Role to assume when creating an ECS service with an ELB attached",
      "Value": { "Ref": "ServiceRole" }
    },
    "AccessKeyId": {
      "Description": "Access key that can be used for a development instance of Empire",
      "Value": { "Ref": "AccessKey" }
    },
    "SecretAccessKey": {
      "Description": "Access key that can be used for a development instance of Empire",
      "Value": { "Fn::GetAtt": [ "AccessKey", "SecretAccessKey" ] }
    },
    "VPC": {
      "Description": "The id of the VPC",
      "Value": { "Ref": "Vpc" }
    },
    "ELBDNSName": {
      "Description": "The DNS name of the ELB for the Empire controller",
      "Value": { "Fn::GetAtt": [ "LoadBalancer", "DNSName" ] },
      "Condition": "DemoMode"
    },
    "InternalELBSG": {
      "Description": "The Internal ELB Security Group",
      "Value": { "Ref": "InternalLoadBalancerSecurityGroup" }
    },
    "ExternalELBSG": {
      "Description": "The External ELB Security Group",
      "Value": { "Ref": "ExternalLoadBalancerSecurityGroup" }
    },
    "InternalZoneID": {
      "Description": "The zone ID for the internal hosted zone.",
      "Value": { "Ref": "InternalDomain" }
    }
  }
}