elasticache-redis.yaml

---
# Copyright 2018 widdix GmbH
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
AWSTemplateFormatVersion: '2010-09-09'
Description: 'State: ElastiCache redis, a cloudonaut.io template'
Metadata:
  'AWS::CloudFormation::Interface':
    ParameterGroups:
    - Label:
        default: 'Parent Stacks'
      Parameters:
      - ParentVPCStack
      - ParentClientStack
      - ParentKmsKeyStack
      - ParentZoneStack
      - ParentSSHBastionStack
      - ParentAlertStack
    - Label:
        default: 'ElastiCache Parameters'
      Parameters:
      - EngineVersion
      - CacheNodeType
      - TransitEncryption
      - AuthToken
      - SnapshotRetentionLimit
      - SnapshotName
      - SubDomainName
      - NumShards
      - NumReplicas
    - Label:
        default: 'Alerting Parameters'
      Parameters:
      - CPUUtilizationThreshold
      - DatabaseMemoryUsagePercentageThreshold
      - SwapUsageThreshold
      - EvictionsThreshold
      - ReplicationLagThreshold
Parameters:
  ParentVPCStack:
    Description: 'Stack name of parent VPC stack based on vpc/vpc-*azs.yaml template.'
    Type: String
  ParentClientStack:
    Description: 'Stack name of parent client stack based on state/client-sg.yaml template.'
    Type: String
  ParentKmsKeyStack:
    Description: 'Optional stack name of parent KMS key stack based on security/kms-key.yaml template.'
    Type: String
    Default: ''
  ParentZoneStack:
    Description: 'Optional stack name of parent zone stack based on vpc/vpc-zone-*.yaml template.'
    Type: String
    Default: ''
  ParentSSHBastionStack:
    Description: 'Optional but recommended stack name of parent SSH bastion host/instance stack based on vpc/vpc-ssh-bastion.yaml template.'
    Type: String
    Default: ''
  ParentAlertStack:
    Description: 'Optional but recommended stack name of parent alert stack based on operations/alert.yaml template.'
    Type: String
    Default: ''
  EngineVersion:
    Description: 'Redis version'
    Type: String
    AllowedValues: ['7.0', '6.2', '6.0', '5.0.6', '5.0.5', '5.0.4', '5.0.3', '5.0.0', '4.0.10'] # aws elasticache describe-cache-engine-versions --engine redis --query "CacheEngineVersions[].EngineVersion"
  CacheNodeType:
    Description: 'The compute and memory capacity of the nodes in the node group (shard).'
    Type: 'String'
    Default: 'cache.t2.micro'
  TransitEncryption:
    Description: 'Enable encryption for data in transit? (see https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/in-transit-encryption.html)'
    Type: 'String'
    Default: 'true'
    AllowedValues:
    - 'true'
    - 'false'
  AuthToken:
    Description: 'Optional password (16 to 128 characters) used to authenticate against Redis (requires TransitEncryption := true; leave blank to disable password-protection).'
    Type: 'String'
    Default: ''
    MaxLength: 128
  SnapshotRetentionLimit:
    Description: 'The number of days for which ElastiCache retains automatic snapshots before deleting them (set to 0 to disable backups).'
    Type: Number
    Default: 35
    MinValue: 0
    MaxValue: 35
  SnapshotName:
    Description: 'Optional name of a snapshot from which you want to restore (leave blank to create an empty cache).'
    Type: 'String'
    Default: ''
  SubDomainName:
    Description: 'Name that is used to create the DNS entry §{SubDomainName}.§{HostedZoneName} (required when ParentZoneStack is set, otherwise not considered)'
    Type: String
    Default: redis
  NumShards:
    Description: 'Number of shards in the cluster.'
    Type: 'Number'
    Default: 1
    MinValue: 1
    MaxValue: 250
  NumReplicas:
    Description: 'Number of replicas per shard.'
    Type: 'Number'
    Default: 1
    MinValue: 0
    MaxValue: 5
  CPUUtilizationThreshold:
    Description: 'The maximum percentage of CPU usage (set to -1 to disable).'
    Type: Number
    Default: 80
    MinValue: -1
    MaxValue: 100
  DatabaseMemoryUsagePercentageThreshold:
    Description: 'The maximum percentage of memory usage (set to -1 to disable).'
    Type: Number
    Default: 90
    MinValue: -1
    MaxValue: 100
  SwapUsageThreshold:
    Description: 'The maximum bytes of swap usage (set to -1 to disable).'
    Type: Number
    Default: 67108864 # 64 MB in Bytes
    MinValue: -1
  EvictionsThreshold:
    Description: 'The maximum number of evictions (set to -1 to disable).'
    Type: Number
    Default: 1000
    MinValue: -1
  ReplicationLagThreshold:
    Description: 'The maximum seconds of replication lag (set to -1 to disable).'
    Type: Number
    Default: 30
    MinValue: -1
Mappings:
  EngineVersionMap:
    '7.0':
      CacheParameterGroupFamily: redis7
    '6.2':
      CacheParameterGroupFamily: 'redis6.x'
    '6.0':
      CacheParameterGroupFamily: 'redis6.x'
    '5.0.6':
      CacheParameterGroupFamily: 'redis5.0'
    '5.0.4':
      CacheParameterGroupFamily: 'redis5.0'
    '5.0.3':
      CacheParameterGroupFamily: 'redis5.0'
    '5.0.0':
      CacheParameterGroupFamily: 'redis5.0'
    '4.0.10':
      CacheParameterGroupFamily: 'redis4.0'
    '3.2.6':
      CacheParameterGroupFamily: 'redis3.2'
Conditions:
  HasKmsKey: !Not [!Equals [!Ref ParentKmsKeyStack, '']]
  HasZone: !Not [!Equals [!Ref ParentZoneStack, '']]
  HasSSHBastionSecurityGroup: !Not [!Equals [!Ref ParentSSHBastionStack, '']]
  HasAlertTopic: !Not [!Equals [!Ref ParentAlertStack, '']]
  HasAuthToken: !Not [!Equals [!Ref AuthToken, '']]
  HasSnapshotName: !Not [!Equals [!Ref SnapshotName, '']]
  HasAutomaticFailoverEnabled: !Not [!Equals [!Ref NumReplicas, 0]]
  HasCPUUtilizationThresholdAndAlertTopic: !And [!Not [!Equals [!Ref CPUUtilizationThreshold, '']], !Condition HasAlertTopic]
  HasDatabaseMemoryUsagePercentageThresholdAndAlertTopic: !And [!Not [!Equals [!Ref DatabaseMemoryUsagePercentageThreshold, '']], !Condition HasAlertTopic]
  HasSwapUsageThresholdAndAlertTopic: !And [!Not [!Equals [!Ref SwapUsageThreshold, '']], !Condition HasAlertTopic]
  HasEvictionsThresholdAndAlertTopic: !And [!Not [!Equals [!Ref EvictionsThreshold, '']], !Condition HasAlertTopic]
  HasReplicationLagThresholdAndAlertTopic: !And [!Not [!Equals [!Ref ReplicationLagThreshold, '']], !Condition HasAlertTopic]
  HasClusterModeEnabled: !Not [!Equals [!Ref NumShards, 1]]
  HasClusterModeDisabled: !Not [!Condition HasClusterModeEnabled]
Resources:
  RecordSet:
    Condition: HasZone
    Type: 'AWS::Route53::RecordSet'
    Properties:
      HostedZoneId:
        'Fn::ImportValue': !Sub '${ParentZoneStack}-HostedZoneId'
      Name: !Sub
      - '${SubDomainName}.${HostedZoneName}'
      - SubDomainName: !Ref SubDomainName
        HostedZoneName:
          'Fn::ImportValue': !Sub '${ParentZoneStack}-HostedZoneName'
      ResourceRecords:
      - !If [HasClusterModeEnabled, !GetAtt 'ReplicationGroup.ConfigurationEndPoint.Address', !GetAtt 'ReplicationGroup.PrimaryEndPoint.Address']
      TTL: 60
      Type: CNAME
  CacheParameterGroup:
    Type: 'AWS::ElastiCache::ParameterGroup'
    Properties:
      CacheParameterGroupFamily: !FindInMap [EngineVersionMap, !Ref EngineVersion, CacheParameterGroupFamily]
      Description: !Ref 'AWS::StackName'
      Properties: !If [HasClusterModeEnabled, {'cluster-enabled': 'yes'}, {}]
  CacheSubnetGroupName:
    Type: 'AWS::ElastiCache::SubnetGroup'
    Properties:
      Description: !Ref 'AWS::StackName'
      SubnetIds: !Split
      - ','
      - 'Fn::ImportValue': !Sub '${ParentVPCStack}-SubnetsPrivate'
  SecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: !Ref 'AWS::StackName'
      VpcId:
        'Fn::ImportValue': !Sub '${ParentVPCStack}-VPC'
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 6379
        ToPort: 6379
        SourceSecurityGroupId:
          'Fn::ImportValue': !Sub '${ParentClientStack}-ClientSecurityGroup'
  SecurityGroupInSSHBastion:
    Type: 'AWS::EC2::SecurityGroupIngress'
    Condition: HasSSHBastionSecurityGroup
    Properties:
      GroupId: !Ref SecurityGroup
      IpProtocol: tcp
      FromPort: 6379
      ToPort: 6379
      SourceSecurityGroupId:
        'Fn::ImportValue': !Sub '${ParentSSHBastionStack}-SecurityGroup'
  ReplicationGroup:
    DeletionPolicy: Snapshot
    UpdateReplacePolicy: Snapshot
    Type: 'AWS::ElastiCache::ReplicationGroup'
    Properties:
      ReplicationGroupDescription: !Ref 'AWS::StackName'
      AtRestEncryptionEnabled: true
      AuthToken: !If [HasAuthToken, !Ref AuthToken, !Ref 'AWS::NoValue']
      AutomaticFailoverEnabled: !If [HasAutomaticFailoverEnabled, true, false]
      MultiAZEnabled: !If [HasAutomaticFailoverEnabled, true, false]
      CacheNodeType: !Ref CacheNodeType
      CacheParameterGroupName: !Ref CacheParameterGroup
      CacheSubnetGroupName: !Ref CacheSubnetGroupName
      Engine: redis
      EngineVersion: !Ref EngineVersion
      KmsKeyId: !If [HasKmsKey, {'Fn::ImportValue': !Sub '${ParentKmsKeyStack}-KeyId'}, !Ref 'AWS::NoValue']
      NotificationTopicArn: !If [HasAlertTopic, {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}, !Ref 'AWS::NoValue']
      NumNodeGroups: !Ref NumShards
      ReplicasPerNodeGroup: !Ref NumReplicas
      PreferredMaintenanceWindow: 'sat:07:00-sat:08:00'
      SecurityGroupIds:
      - !Ref SecurityGroup
      SnapshotName: !If [HasSnapshotName, !Ref SnapshotName, !Ref 'AWS::NoValue']
      SnapshotRetentionLimit: !Ref SnapshotRetentionLimit
      SnapshotWindow: '00:00-03:00'
      TransitEncryptionEnabled: !Ref TransitEncryption
    UpdatePolicy:
      UseOnlineResharding: true
  Node1CPUUtilizationTooHighAlarm:
    Condition: HasCPUUtilizationThresholdAndAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: !Sub 'Average CPU utilization over last 10 minutes higher than ${CPUUtilizationThreshold}%'
      Namespace: 'AWS/ElastiCache'
      MetricName: CPUUtilization
      Statistic: Average
      Period: 600
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: !Ref CPUUtilizationThreshold
      AlarmActions:
      - 'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'
      Dimensions:
      - Name: CacheClusterId
        Value: !Sub '${ReplicationGroup}-001'
  Node2CPUUtilizationTooHighAlarm:
    Condition: HasCPUUtilizationThresholdAndAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: !Sub 'Average CPU utilization over last 10 minutes higher than ${CPUUtilizationThreshold}%'
      Namespace: 'AWS/ElastiCache'
      MetricName: CPUUtilization
      Statistic: Average
      Period: 600
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: !Ref CPUUtilizationThreshold
      AlarmActions:
      - 'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'
      Dimensions:
      - Name: CacheClusterId
        Value: !Sub '${ReplicationGroup}-002'
  Node1EngineCPUUtilizationTooHighAlarm:
    Condition: HasCPUUtilizationThresholdAndAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: !Sub 'Average engine CPU utilization over last 10 minutes higher than ${CPUUtilizationThreshold}%'
      Namespace: 'AWS/ElastiCache'
      MetricName: EngineCPUUtilization
      Statistic: Average
      Period: 600
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: !Ref CPUUtilizationThreshold
      AlarmActions:
      - 'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'
      Dimensions:
      - Name: CacheClusterId
        Value: !Sub '${ReplicationGroup}-001'
  Node2EngineCPUUtilizationTooHighAlarm:
    Condition: HasCPUUtilizationThresholdAndAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: !Sub 'Average engine CPU utilization over last 10 minutes higher than ${CPUUtilizationThreshold}%'
      Namespace: 'AWS/ElastiCache'
      MetricName: EngineCPUUtilization
      Statistic: Average
      Period: 600
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: !Ref CPUUtilizationThreshold
      AlarmActions:
      - 'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'
      Dimensions:
      - Name: CacheClusterId
        Value: !Sub '${ReplicationGroup}-002'
  Node1DatabaseMemoryUsagePercentageTooHighAlarm:
    Condition: HasDatabaseMemoryUsagePercentageThresholdAndAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: !Sub 'Average memory usage over last 10 minutes higher than ${DatabaseMemoryUsagePercentageThreshold}, performance may suffer'
      Namespace: 'AWS/ElastiCache'
      MetricName: DatabaseMemoryUsagePercentage
      Statistic: Average
      Period: 600
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: !Ref DatabaseMemoryUsagePercentageThreshold
      AlarmActions:
      - 'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'
      Dimensions:
      - Name: CacheClusterId
        Value: !Sub '${ReplicationGroup}-001'
  Node2DatabaseMemoryUsagePercentageTooHighAlarm:
    Condition: HasDatabaseMemoryUsagePercentageThresholdAndAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: !Sub 'Average memory usage over last 10 minutes higher than ${DatabaseMemoryUsagePercentageThreshold}, performance may suffer'
      Namespace: 'AWS/ElastiCache'
      MetricName: DatabaseMemoryUsagePercentage
      Statistic: Average
      Period: 600
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: !Ref DatabaseMemoryUsagePercentageThreshold
      AlarmActions:
      - 'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'
      Dimensions:
      - Name: CacheClusterId
        Value: !Sub '${ReplicationGroup}-002'
  Node1SwapUsageTooHighAlarm:
    Condition: HasSwapUsageThresholdAndAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: !Sub 'Average swap usage over last 10 minutes higher than ${SwapUsageThreshold} bytes, performance may suffer'
      Namespace: 'AWS/ElastiCache'
      MetricName: SwapUsage
      Statistic: Average
      Period: 600
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: !Ref SwapUsageThreshold
      AlarmActions:
      - 'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'
      Dimensions:
      - Name: CacheClusterId
        Value: !Sub '${ReplicationGroup}-001'
  Node2SwapUsageTooHighAlarm:
    Condition: HasSwapUsageThresholdAndAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: !Sub 'Average swap usage over last 10 minutes higher than ${SwapUsageThreshold} bytes, performance may suffer'
      Namespace: 'AWS/ElastiCache'
      MetricName: SwapUsage
      Statistic: Average
      Period: 600
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: !Ref SwapUsageThreshold
      AlarmActions:
      - 'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'
      Dimensions:
      - Name: CacheClusterId
        Value: !Sub '${ReplicationGroup}-002'
  Node1EvictionsTooHighAlarm:
    Condition: HasEvictionsThresholdAndAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: !Sub 'Average evictions over last 10 minutes higher than ${EvictionsThreshold}, cache hit ratio may suffer'
      Namespace: 'AWS/ElastiCache'
      MetricName: Evictions
      Statistic: Average
      Period: 600
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: !Ref EvictionsThreshold
      AlarmActions:
      - 'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'
      Dimensions:
      - Name: CacheClusterId
        Value: !Sub '${ReplicationGroup}-001'
  Node2EvictionsTooHighAlarm:
    Condition: HasEvictionsThresholdAndAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: !Sub 'Average evictions over last 10 minutes higher than ${EvictionsThreshold}, cache hit ratio may suffer'
      Namespace: 'AWS/ElastiCache'
      MetricName: Evictions
      Statistic: Average
      Period: 600
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: !Ref EvictionsThreshold
      AlarmActions:
      - 'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'
      Dimensions:
      - Name: CacheClusterId
        Value: !Sub '${ReplicationGroup}-002'
  Node1ReplicationLagTooHighAlarm:
    Condition: HasReplicationLagThresholdAndAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: !Sub 'Average replication lag over last 10 minutes higher than ${ReplicationLagThreshold} seconds'
      Namespace: 'AWS/ElastiCache'
      MetricName: ReplicationLag
      Statistic: Average
      Period: 600
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: !Ref ReplicationLagThreshold
      AlarmActions:
      - 'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'
      Dimensions:
      - Name: CacheClusterId
        Value: !Sub '${ReplicationGroup}-001'
  Node2ReplicationLagTooHighAlarm:
    Condition: HasReplicationLagThresholdAndAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: !Sub 'Average replication lag over last 10 minutes higher than ${ReplicationLagThreshold} seconds'
      Namespace: 'AWS/ElastiCache'
      MetricName: ReplicationLag
      Statistic: Average
      Period: 600
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: !Ref ReplicationLagThreshold
      AlarmActions:
      - 'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'
      Dimensions:
      - Name: CacheClusterId
        Value: !Sub '${ReplicationGroup}-002'
Outputs:
  TemplateID:
    Description: 'cloudonaut.io template id.'
    Value: 'state/elasticache-redis'
  TemplateVersion:
    Description: 'cloudonaut.io template version.'
    Value: '__VERSION__'
  StackName:
    Description: 'Stack name.'
    Value: !Sub '${AWS::StackName}'
  ClusterName:
    Description: 'The name of the cluster'
    Value: !Ref ReplicationGroup
    Export:
      Name: !Sub '${AWS::StackName}-ClusterName'
  PrimaryEndPointAddress:
    Condition: HasClusterModeDisabled
    Description: 'The DNS address of the primary read-write cache node.'
    Value: !GetAtt 'ReplicationGroup.PrimaryEndPoint.Address'
    Export:
      Name: !Sub '${AWS::StackName}-PrimaryEndPointAddress'
  PrimaryEndPointPort:
    Condition: HasClusterModeDisabled
    Description: 'The port that the primary read-write cache engine is listening on.'
    Value: !GetAtt 'ReplicationGroup.PrimaryEndPoint.Port'
    Export:
      Name: !Sub '${AWS::StackName}-PrimaryEndPointPort'
  ConfigurationEndPointAddress:
    Condition: HasClusterModeEnabled
    Description: 'The DNS address of the configuration node.'
    Value: !GetAtt 'ReplicationGroup.ConfigurationEndPoint.Address'
    Export:
      Name: !Sub '${AWS::StackName}-ConfigurationEndPointAddress'
  ConfigurationEndPointPort:
    Condition: HasClusterModeEnabled
    Description: 'The port of the configuration node.'
    Value: !GetAtt 'ReplicationGroup.ConfigurationEndPoint.Port'
    Export:
      Name: !Sub '${AWS::StackName}-ConfigurationEndPointPort'
  SecurityGroupId:
    Description: 'The security group used to manage access to Elasticache Redis.'
    Value: !Ref SecurityGroup
    Export:
      Name: !Sub '${AWS::StackName}-SecurityGroupId'