genericsuite-be-scripts

AWSTemplateFormatVersion: '2010-09-09' Description: Deploy a Genericsuite application on EC2 instances (VPC, Subnets, Launch Template with a ECR Docker image, Instance Role, AutoScaling Group, and Security Group). Parameters: KeyName: Description: Name for the EC2 KeyPair to enable SSH access to the instance Type: AWS::EC2::KeyPair::KeyName EcrRepositoryName: Description: ECR docker images repository name Type: String EcrDockerImageUri: Description: Complete URI of the ECR repository Docker image Type: String EcrDockerImageTag: Description: ECR repository Docker image tag Type: String Default: latest AppName: Description: application name Type: String AppStage: Description: application stage (qa, prod, staging, demo, dev) Type: String AwsRegion: Description: application region Type: String KmsKeyAlias: Type: String Description: The alias of the KMS key to use for EBS encryption S3BucketName1: Description: App S3 Bucket name Type: String AsmSecretsName: Description: Secrets Manager - Secrets set name Type: String AsmEnvsName: Description: Secrets Manager - Environment variables set name Type: String AwsAccountId: Description: AWS account Id Type: String DomainStackName: Description: Name of the stack that created the domain resources Type: String DomainName: Description: Domain name for the ALB Type: String HostedZoneId: Description: The ID of the hosted zone where the domain is managed Type: AWS::Route53::HostedZone::Id Resources: VPC: Type: AWS::EC2::VPC Properties: CidrBlock: 10.0.0.0/16 EnableDnsHostnames: true EnableDnsSupport: true InstanceTenancy: default Tags: - Key: Name Value: !Sub ${AppName}-${AppStage}-vpc - Key: App Value: !Ref AppName - Key: Stage Value: !Ref AppStage Subnet1: Type: AWS::EC2::Subnet Properties: VpcId: !Ref VPC AvailabilityZone: !Select - 0 - !GetAZs '' CidrBlock: 10.0.1.0/24 MapPublicIpOnLaunch: true Tags: - Key: Name Value: !Sub ${AppName}-${AppStage}-subnet-1 - Key: App Value: !Ref AppName - Key: Stage Value: !Ref AppStage Subnet2: Type: AWS::EC2::Subnet Properties: VpcId: !Ref VPC AvailabilityZone: !Select - 1 - !GetAZs '' CidrBlock: 10.0.2.0/24 MapPublicIpOnLaunch: true Tags: - Key: Name Value: !Sub ${AppName}-${AppStage}-subnet-2 - Key: App Value: !Ref AppName - Key: Stage Value: !Ref AppStage InternetGateway: Type: AWS::EC2::InternetGateway Properties: Tags: - Key: Name Value: !Sub ${AppName}-${AppStage}-igw - Key: App Value: !Ref AppName - Key: Stage Value: !Ref AppStage VPCGatewayAttachment: Type: AWS::EC2::VPCGatewayAttachment Properties: VpcId: !Ref VPC InternetGatewayId: !Ref InternetGateway RouteTable: Type: AWS::EC2::RouteTable Properties: VpcId: !Ref VPC Tags: - Key: Name Value: !Sub ${AppName}-${AppStage}-rt - Key: App Value: !Ref AppName - Key: Stage Value: !Ref AppStage Ec2Route: Type: AWS::EC2::Route DependsOn: VPCGatewayAttachment Properties: RouteTableId: !Ref RouteTable DestinationCidrBlock: 0.0.0.0/0 GatewayId: !Ref InternetGateway SubnetRouteTableAssociation: Type: AWS::EC2::SubnetRouteTableAssociation Properties: SubnetId: !Ref Subnet1 RouteTableId: !Ref RouteTable Ec2InstanceRole: Type: AWS::IAM::Role Properties: RoleName: !Sub ${AppName}-${AppStage}-ec2-instance-role AssumeRolePolicyDocument: Version: '2012-10-17' Statement: - Effect: Allow Principal: Service: - ec2.amazonaws.com Action: - sts:AssumeRole Path: / ManagedPolicyArns: - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore - arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy # Bingo! this enabled SSM - arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM Policies: - PolicyName: Ec2InstancePolicy PolicyDocument: Version: '2012-10-17' Statement: - Effect: Allow Action: - ec2:Describe* Resource: '*' - PolicyName: Ec2S3AccessPolicy1 PolicyDocument: Version: '2012-10-17' Statement: - Effect: Allow Action: - s3:PutObject - s3:PutObjectAcl - s3:GetObject - s3:GetObjectAcl - s3:DeleteObject # Resource: arn:aws:s3:::AWS_S3_CHATBOT_ATTACHMENTS_BUCKET_placeholder/* Resource: !Sub arn:aws:s3:::${S3BucketName1}/* - PolicyName: Ec2LogsPolicy PolicyDocument: Version: '2012-10-17' Statement: - Effect: Allow Action: - logs:CreateLogGroup - logs:CreateLogStream - logs:PutLogEvents Resource: arn:*:logs:*:*:* - PolicyName: Ec2EcrLoginPolicy PolicyDocument: Version: '2012-10-17' Statement: - Effect: Allow Action: - ecr:GetAuthorizationToken Resource: '*' - PolicyName: Ec2EcrAccessPolicy PolicyDocument: Version: '2012-10-17' Statement: - Effect: Allow Action: - ecr:BatchCheckLayerAvailability - ecr:BatchGetImage - ecr:GetDownloadUrlForLayer Resource: # - !Sub arn:aws:ecr:${AwsRegion}:${AwsAccountId}:repository/AWS_ECR_REPOSITORY_NAME_placeholder - !Sub arn:aws:ecr:${AwsRegion}:${AwsAccountId}:repository/${EcrRepositoryName} - PolicyName: Ec2SecretsAccessPolicy PolicyDocument: Version: '2012-10-17' Statement: - Effect: Allow Action: - secretsmanager:GetSecretValue Resource: '*' # Resource: # # - arn:aws:secretsmanager:*:*:secret:AWS_SECRETS_MANAGER_SECRETS_NAME_placeholder # - !Sub arn:aws:secretsmanager:*:*:secret:${AsmSecretsName} # # - arn:aws:secretsmanager:*:*:secret:AWS_SECRETS_MANAGER_ENVS_NAME_placeholder # - !Sub arn:aws:secretsmanager:*:*:secret:${AsmEnvsName} - PolicyName: Ec2KmsAccessPolicy PolicyDocument: Version: '2012-10-17' Statement: - Effect: Allow Action: - kms:Decrypt - kms:GenerateDataKey* - kms:CreateGrant Resource: !Sub 'arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/*' # Resource: !Sub 'arn:aws:kms:${AWS::Region}:${AWS::AccountId}:alias/${KmsKeyAlias}' # Resource: '*' # Resource: # # - arn:aws:kms:AWS_REGION_placeholder:AWS_ACCOUNT_ID_placeholder:alias/AWS_KMS_KEY_ALIAS_placeholder # - !Sub arn:aws:kms:${AwsRegion}:${AwsAccountId}:alias/${KmsKeyAlias} - PolicyName: Ec2CloudWatchLogsPolicy PolicyDocument: Version: '2012-10-17' Statement: - Effect: Allow Action: - logs:CreateLogGroup - logs:CreateLogStream - logs:PutLogEvents - logs:DescribeLogStreams Resource: - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${AppName}-${AppStage}-ec2-logs:* Ec2InstanceProfile: Type: AWS::IAM::InstanceProfile Properties: InstanceProfileName: !Sub ${AppName}-${AppStage}-ec2-instance-profile Path: / Roles: - !Ref Ec2InstanceRole # - !ImportValue # Fn::Sub: "${KmsKeyAlias}:asg-role-arn" AppLogGroup: Type: AWS::Logs::LogGroup Properties: LogGroupName: !Sub ${AppName}-${AppStage}-ec2-logs RetentionInDays: 30 # Adjust as needed LoadBalancerSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupName: !Sub ${AppName}-${AppStage}-sg-lb GroupDescription: Enable SSH and HTTPS access VpcId: !Ref VPC SecurityGroupIngress: - IpProtocol: tcp FromPort: 443 ToPort: 443 CidrIp: 0.0.0.0/0 Tags: - Key: App Value: !Ref AppName - Key: Stage Value: !Ref AppStage InstanceSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupName: !Sub ${AppName}-${AppStage}-sg-ec2 GroupDescription: Enable SSH and HTTP access VpcId: !Ref VPC SecurityGroupIngress: - IpProtocol: tcp FromPort: 80 ToPort: 80 SourceSecurityGroupId: !Ref LoadBalancerSecurityGroup # # TODO: temporary until SSM is activated with the imdsv2 enabling. Remove 22 port access after it or an emergency use - IpProtocol: tcp FromPort: 22 ToPort: 22 CidrIp: 0.0.0.0/0 # Consider restricting this to your IP range Tags: - Key: App Value: !Ref AppName - Key: Stage Value: !Ref AppStage LaunchTemplate: Type: AWS::EC2::LaunchTemplate Properties: LaunchTemplateName: !Sub ${AppName}-${AppStage}-launch-template LaunchTemplateData: # Option: EC2 > Images > AMIs > Filter > Source: amazon/amzn2-ami-minimal-hvm-2.0.2024 # Amazon Linux 2 AMI | ami-001d6f67dd7ac8908 / Boot mode: – / amazon/amzn2-ami-minimal-hvm-2.0.20240124.0-x86_64-ebs / Deprecation time: Mon Jun 30, 2025 # ImageId: ami-001d6f67dd7ac8908 # Amazon Linux 2 AMI (HVM) - Kernel 5.10, SSD Volume Type # ami-0195204d5dce06d99 (64-bit (x86)) / ami-003d53c9bb0a387f4 (64-bit (Arm)) # Virtualization: hvm # ENA enabled: true # Root device type: ebs ImageId: ami-0195204d5dce06d99 # ImageId: ami-003d53c9bb0a387f4 # Option: EC2 > Instances > Instance types # Instance type | vCPUs | Architecture | Memory (GiB) | Storage (GB) | Storage type | Network performance | On-Demand Linux pricing | On-Demand Windows pricing # t2.nano | 1 | i386, x86_64 | 1 | - | -| Low to Moderate | 0.0058 USD per Hour | 0.0081 USD per Hour # t2.micro | 1 | i386, x86_64 | 1 | - | -| Low to Moderate | 0.0116 USD per Hour | 0.0162 USD per Hour # t2.small | 1 | i386, x86_64 | 2 | - | - | Low to Moderate | 0.023 USD per Hour | 0.032 USD per Hour InstanceType: t2.micro # t4g.nano | 2 | arm64 | 0.5 | - | - | Up to 5 Gigabit | 0.0042 USD per Hour # t4g.micro | 2 | arm64 | 1 | - | - | Up to 5 Gigabit | 0.0084 USD per Hour # t4g.small | 2 | arm64 | 2 | - | - | Up to 5 Gigabit | 0.0084 USD per Hour # InstanceType: t4g.micro KeyName: !Ref KeyName SecurityGroupIds: - !Ref InstanceSecurityGroup # https://aws.amazon.com/blogs/security/get-the-full-benefits-of-imdsv2-and-disable-imdsv1-across-your-aws-infrastructure/ # Enable imdsv2 : --metadata-options “HttpEndpoint=enabled,HttpTokens=required” # MetadataOptions: # HttpTokens: required # HttpEndpoint: enabled BlockDeviceMappings: - DeviceName: /dev/xvda Ebs: VolumeSize: 50 DeleteOnTermination: true VolumeType: gp2 # Encrypted: true # KmsKeyId: !Sub 'arn:aws:kms:${AWS::Region}:${AWS::AccountId}:alias/${KmsKeyAlias}' IamInstanceProfile: Name: !Ref Ec2InstanceProfile TagSpecifications: - ResourceType: instance Tags: - Key: Name Value: !Sub ${AppName}-${AppStage}-instance - Key: App Value: !Ref AppName - Key: Stage Value: !Ref AppStage - ResourceType: volume Tags: - Key: Name Value: !Sub ${AppName}-${AppStage}-root-volume - Key: App Value: !Ref AppName - Key: Stage Value: !Ref AppStage UserData: Fn::Base64: !Sub | #!/bin/bash exec > >(tee /var/log/user-data.log|logger -t user-data -s 2>/dev/console) 2>&1 echo "Starting GS instance boot sequence..." echo ">>--> `date` | Run | yum update -y" yum update -y echo ">>--> `date` | Run | yum install aws-cli jq amazon-ssm-agent amazon-cloudwatch-agent -y" yum install aws-cli jq amazon-ssm-agent amazon-cloudwatch-agent -y echo ">>--> `date` | Run | Create CloudWatch agent configuration file" cat <<EOF > /opt/aws/amazon-cloudwatch-agent/bin/config.json { "agent": { "metrics_collection_interval": 60, "run_as_user": "root" }, "logs": { "logs_collected": { "files": { "collect_list": [ { "file_path": "/var/log/user-data.log", "log_group_name": "${AppName}-${AppStage}-ec2-logs", "log_stream_name": "{instance_id}-user-data-logs" }, { "file_path": "/var/log/docker", "log_group_name": "${AppName}-${AppStage}-ec2-logs", "log_stream_name": "{instance_id}-docker-logs" } ] } } }, "metrics": { "metrics_collected": { "disk": { "measurement": [ "used_percent" ], "metrics_collection_interval": 60, "resources": [ "/" ] }, "mem": { "measurement": [ "mem_used_percent" ], "metrics_collection_interval": 60 } } } } EOF /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -s -c file:/opt/aws/amazon-cloudwatch-agent/bin/config.json echo ">>--> `date` | Run | amazon-linux-extras install docker -y" amazon-linux-extras install docker -y echo ">>--> `date` | Run | service amazon-ssm-agent start" systemctl start amazon-ssm-agent echo ">>--> `date` | Run | service docker start" systemctl start docker systemctl enable docker echo ">>--> `date` | Run | aws ecr get-login-password --region ${AWS::Region} | docker login --username AWS --password-stdin ${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com" aws ecr get-login-password --region ${AWS::Region} | docker login --username AWS --password-stdin ${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com echo ">>--> `date` | Run | docker pull ${EcrDockerImageUri}:${EcrDockerImageTag}" docker pull ${EcrDockerImageUri}:${EcrDockerImageTag} > /dev/null 2>&1 echo ">>--> `date` | Run | docker run -d -p 80:80 --name gs_app_be -e CLOUD_PROVIDER=aws -e APP_NAME=${AppName} -e APP_STAGE=${AppStage} -e AWS_REGION=${AWS::Region} ${EcrDockerImageUri}:${EcrDockerImageTag}" docker run -d -p 80:80 --name gs_app_be -e CLOUD_PROVIDER=aws -e APP_NAME=${AppName} -e APP_STAGE=${AppStage} -e AWS_REGION=${AWS::Region} ${EcrDockerImageUri}:${EcrDockerImageTag} echo ">>--> `date` | Run | docker ps" if [ "$(docker ps -q -f name=gs_app_be)" ]; then echo "Container is running successfully." else echo "Container failed to start. Check docker logs." docker logs gs_app_be fi echo ">>--> `date` | GS instance boot sequence finished" SSMVPCEndpoint: Type: AWS::EC2::VPCEndpoint Properties: ServiceName: !Sub com.amazonaws.${AWS::Region}.ssm VpcId: !Ref VPC VpcEndpointType: Interface PrivateDnsEnabled: true SubnetIds: - !Ref Subnet1 - !Ref Subnet2 SecurityGroupIds: - !Ref InstanceSecurityGroup SSMAccessRole: Type: AWS::IAM::Role Properties: RoleName: !Sub ${AppName}-${AppStage}-ssm-access-role AssumeRolePolicyDocument: Version: '2012-10-17' Statement: - Effect: Allow Principal: Service: ec2.amazonaws.com Action: sts:AssumeRole ManagedPolicyArns: - arn:aws:iam::aws:policy/AmazonSSMFullAccess AutoScalingGroup: Type: AWS::AutoScaling::AutoScalingGroup Properties: AutoScalingGroupName: !Sub ${AppName}-${AppStage}-asg LaunchTemplate: LaunchTemplateId: !Ref LaunchTemplate Version: !GetAtt LaunchTemplate.LatestVersionNumber VPCZoneIdentifier: - !Ref Subnet1 - !Ref Subnet2 MinSize: '1' MaxSize: '2' DesiredCapacity: '1' TargetGroupARNs: - !Ref TargetGroup HealthCheckType: ELB HealthCheckGracePeriod: 1200 # 300 -> 5 min, 600 -> 10 min, 900 -> 15 min, 1200 -> 20 min Tags: - Key: App Value: !Ref AppName PropagateAtLaunch: true - Key: Stage Value: !Ref AppStage PropagateAtLaunch: true LoadBalancer: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: !Sub ${AppName}-${AppStage}-alb Subnets: - !Ref Subnet1 - !Ref Subnet2 SecurityGroups: - !Ref LoadBalancerSecurityGroup Scheme: internet-facing Tags: - Key: App Value: !Ref AppName - Key: Stage Value: !Ref AppStage TargetGroup: Type: AWS::ElasticLoadBalancingV2::TargetGroup Properties: Name: !Sub ${AppName}-${AppStage}-tg VpcId: !Ref VPC Port: 80 Protocol: HTTP HealthCheckProtocol: HTTP HealthCheckPort: 80 HealthCheckPath: / Matcher: HttpCode: 200 TargetType: instance Tags: - Key: App Value: !Ref AppName - Key: Stage Value: !Ref AppStage # HTTPListener: # Type: AWS::ElasticLoadBalancingV2::Listener # Properties: # LoadBalancerArn: !Ref LoadBalancer # Port: 80 # Protocol: HTTP # DefaultActions: # - Type: forward # TargetGroupArn: !Ref TargetGroup HTTPSListener: Type: AWS::ElasticLoadBalancingV2::Listener Properties: LoadBalancerArn: !Ref LoadBalancer Port: 443 Protocol: HTTPS SslPolicy: ELBSecurityPolicy-2016-08 Certificates: - CertificateArn: Fn::ImportValue: !Sub "${DomainStackName}-CertificateArn" DefaultActions: - Type: forward TargetGroupArn: !Ref TargetGroup UpdateRoute53RecordSet: Type: Custom::UpdateRoute53RecordSet Properties: ServiceToken: !GetAtt UpdateRoute53RecordSetFunction.Arn HostedZoneId: !Ref HostedZoneId RecordSetId: Fn::ImportValue: !Sub "${DomainStackName}-Route53RecordSetId" AliasTarget: DNSName: !GetAtt LoadBalancer.DNSName HostedZoneId: !GetAtt LoadBalancer.CanonicalHostedZoneID EvaluateTargetHealth: false UpdateRoute53RecordSetFunction: Type: AWS::Lambda::Function Properties: Description: !Sub "${AppName}-${AppStage}-ec2-updt-route53" Runtime: python3.11 Handler: index.handler Role: !GetAtt LambdaExecutionRole.Arn Code: ZipFile: | import boto3 import cfnresponse def handler(event, context): if event['RequestType'] == 'Delete': cfnresponse.send(event, context, cfnresponse.SUCCESS, {}) return hosted_zone_id = event['ResourceProperties']['HostedZoneId'] record_set_id = event['ResourceProperties']['RecordSetId'] alias_target = event['ResourceProperties']['AliasTarget'] alias_target['EvaluateTargetHealth'] = str(alias_target['EvaluateTargetHealth']) == 'true' route53_client = boto3.client('route53') try: response = route53_client.change_resource_record_sets( HostedZoneId=hosted_zone_id, ChangeBatch={ 'Changes': [ { 'Action': 'UPSERT', 'ResourceRecordSet': { 'Name': record_set_id, 'Type': 'A', 'AliasTarget': alias_target } } ] } ) cfnresponse.send(event, context, cfnresponse.SUCCESS, { 'Message': 'Route53 record set updated successfully' }) except Exception as e: cfnresponse.send(event, context, cfnresponse.FAILED, { 'Reason': str(e) }) # Give a fixed name for the UpdateRoute53RecordSetFunction log group so it don't generate a new log group each time it runs UpdateRoute53RecordSetFunctionLogGroup: Type: AWS::Logs::LogGroup Properties: # LogGroupName: !Sub /aws/lambda/${UpdateRoute53RecordSetFunction} LogGroupName: !Sub /aws/lambda/${AppName}-${AppStage}-ec2-updt-route53 RetentionInDays: 1 LambdaExecutionRole: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Version: '2012-10-17' Statement: - Effect: Allow Principal: Service: lambda.amazonaws.com Action: sts:AssumeRole ManagedPolicyArns: - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole Policies: - PolicyName: Route53Access PolicyDocument: Version: '2012-10-17' Statement: - Effect: Allow Action: - route53:ChangeResourceRecordSets Resource: '*' # ScalingPolicyUp: # Type: AWS::AutoScaling::ScalingPolicy # Properties: # AutoScalingGroupName: !Ref AutoScalingGroup # PolicyType: TargetTrackingScaling # TargetTrackingConfiguration: # PredefinedMetricSpecification: # PredefinedMetricType: ASGAverageCPUUtilization # TargetValue: 90.0 # ScalingPolicyDown: # Type: AWS::AutoScaling::ScalingPolicy # Properties: # AutoScalingGroupName: !Ref AutoScalingGroup # PolicyType: SimpleScaling # ScalingAdjustment: -1 # AdjustmentType: ChangeInCapacity # HighCPUAlarm: # Type: AWS::CloudWatch::Alarm # Properties: # AlarmDescription: "Alarm if CPU exceeds 90% for 5 minutes" # Namespace: AWS/EC2 # MetricName: CPUUtilization # Dimensions: # - Name: AutoScalingGroupName # Value: !Ref AutoScalingGroup # Statistic: Average # Period: 300 # EvaluationPeriods: 1 # Threshold: 90 # ComparisonOperator: GreaterThanThreshold # AlarmActions: # - !Ref ScalingPolicyUp # LowCPUAlarm: # Type: AWS::CloudWatch::Alarm # Properties: # AlarmDescription: "Alarm if CPU is below 90% for 5 minutes" # Namespace: AWS/EC2 # MetricName: CPUUtilization # Dimensions: # - Name: AutoScalingGroupName # Value: !Ref AutoScalingGroup # Statistic: Average # Period: 300 # EvaluationPeriods: 1 # Threshold: 90 # ComparisonOperator: LessThanOrEqualToThreshold # AlarmActions: # - !Ref ScalingPolicyDown Outputs: LoadBalancerDNSName: Description: DNS Name of the load balancer Value: !GetAtt LoadBalancer.DNSName Export: Name: !Sub "${AWS::StackName}-LoadBalancerDNSName" LoadBalancerFullName: Description: ALB Full Name Value: !GetAtt LoadBalancer.LoadBalancerFullName Export: Name: !Sub "${AWS::StackName}-LoadBalancerFullName" LoadBalancerArn: Description: ARN of the Load Balancer Value: !Ref LoadBalancer Export: Name: !Sub "${AWS::StackName}-LoadBalancerArn" TargetGroupArn: Description: ARN of the Target Group Value: !Ref TargetGroup Export: Name: !Sub "${AWS::StackName}-TargetGroupArn" AutoScalingGroupArn: Description: ARN of the Auto Scaling Group Value: !Ref AutoScalingGroup Export: Name: !Sub "${AWS::StackName}-AutoScalingGroupArn"