oos.yml

ROSTemplateFormatVersion: '2015-09-01'
Description:
  zh-cn: 创建RAM角色与策略，定义OOS模板执行自动化删除黑洞任务，设置执行依赖与输出信息。
  en: Create RAM roles and policies, define OOS templates for automated deletion of
    black hole tasks, configure execution dependencies, and set output information.
Parameters:
  RoleName:
    Type: String
    Label: 角色名称
    Description: 名称为2-64个字符，以大小写字母，数字或中文开头，可包含(._-)。
    ConstraintDescription: '[2, 128] English or Chinese characters'
    Default: mytest
    MinLength: 2
    MaxLength: 128
  PolicyName1:
    Type: String
    Label: 策略名称
    Description: 名称为2-64个字符，以大小写字母，数字或中文开头，可包含(._-)。
    ConstraintDescription: '[2, 128] English or Chinese characters'
    Default: mytest1
    MinLength: 2
    MaxLength: 128
  PolicyName2:
    Type: String
    Label: 策略名称
    Description: 名称为2-64个字符，以大小写字母，数字或中文开头，可包含(._-)。
    ConstraintDescription: '[2, 128] English or Chinese characters'
    Default: mytest2
    MinLength: 2
    MaxLength: 128
  PolicyName3:
    Type: String
    Label: 策略名称
    Description: 名称为2-64个字符，以大小写字母，数字或中文开头，可包含(._-)。
    ConstraintDescription: '[2, 128] English or Chinese characters'
    Default: mytest3
    MinLength: 2
    MaxLength: 128
  PolicyName4:
    Type: String
    Label: 策略名称
    Description: 名称为2-64个字符，以大小写字母，数字或中文开头，可包含(._-)。
    ConstraintDescription: '[2, 128] English or Chinese characters'
    Default: mytest4
    MinLength: 2
    MaxLength: 128
  TemplateName:
    Type: String
    Label: 模板名称
    Description: 名称为2-64个字符，以大小写字母，数字或中文开头，可包含(._-)。
    ConstraintDescription: '[2, 128] English or Chinese characters'
    Default: mytest
    MinLength: 2
    MaxLength: 128
Resources:
  RamRole:
    Type: ALIYUN::RAM::Role
    Properties:
      RoleName:
        Ref: RoleName
      Description: mytest
      AssumeRolePolicyDocument:
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - oos.aliyuncs.com
        Version: '1'
      Policies:
      - PolicyName:
          Ref: PolicyName1
        PolicyDocument:
          Version: '1'
          Statement:
          - Action:
            - yundun-antiddosbag:DeleteBlackhole
            Resource:
            - '*'
            Effect: Allow
      - PolicyName:
          Ref: PolicyName2
        PolicyDocument:
          Version: '1'
          Statement:
          - Action:
            - ecs:DescribeInstances
            - ecs:RunCommand
            - ecs:DescribeInvocationResults
            - ecs:DescribeInvocations
            Resource:
            - '*'
            Effect: Allow
      - PolicyName:
          Ref: PolicyName3
        PolicyDocument:
          Version: '1'
          Statement:
          - Action:
            - slb:SetBackendServers
            - slb:DescribeLoadBalancers
            - slb:RemoveBackendServers
            Resource:
            - '*'
            Effect: Allow
      - PolicyName:
          Ref: PolicyName4
        PolicyDocument:
          Version: '1'
          Statement:
          - Action:
            - ecs:DescribeTags
            - ecs:StartInstance
            Resource:
            - '*'
            Effect: Allow
  Template:
    Type: ALIYUN::OOS::Template
    Properties:
      Content:
        Fn::Join:
        - '"'
        - - '{"FormatVersion":"OOS-2019-06-01","Description":"automaticly delete black
            hole.","Parameters":{"OOSAssumeRole":{"Description":"The RAM role to be
            assumed by OOS.","Type":"String","Default":'
          - Ref: RoleName
          - '}},"RamRole":"{{OOSAssumeRole}}","Tasks":[{"Name":"ddosbgp_event_blackhole","Action":"ACS::EventTrigger","Properties":{"Product":"ddosbgp","Name":["ddosbgp_event_blackhole"],"Level":["CRITICAL"],"Content":{"action":["add"]}},"Outputs":{"InstanceId":{"ValueSelector":".content.instanceId","Type":"String"},"Ip":{"ValueSelector":".content.ip","Type":"String"}}},{"Name":"DeleteBlackhole","Action":"ACS::ExecuteAPI","Properties":{"Service":"ddosbgp","API":"DeleteBlackhole","Parameters":{"InstanceId":"{{
            ddosbgp_event_blackhole.InstanceId }}","Ip":"{{ddosbgp_event_blackhole.Ip}}"}},"Description":"DeleteBlackhole."}],"Outputs":{"InstanceId":{"Value":"{{
            ddosbgp_event_blackhole.InstanceId }}","Type":"String"},"Ip":{"Value":"{{
            ddosbgp_event_blackhole.Ip }}","Type":"String"}}}'
      TemplateName:
        Ref: TemplateName
    DependsOn: RamRole
  Execution:
    Type: ALIYUN::OOS::Execution
    Properties:
      Parameters: {}
      TemplateName:
        Fn::GetAtt:
        - Template
        - TemplateName
      ResourceOptions:
        SuccessStatuses:
        - Running
        - Success
        - Queued
        - Waiting
        CancelOnDelete: true
    DependsOn: RamRole
Outputs:
  ExecutionPolicy:
    Description: Execution Policy
    Value:
      Fn::GetAtt:
      - Template
      - ExecutionPolicy
  TemplateName:
    Description: Template Name
    Value:
      Fn::GetAtt:
      - Template
      - TemplateName
  TemplateId:
    Description: Template ID
    Value:
      Fn::GetAtt:
      - Template
      - TemplateId
  Status:
    Description: Execution status.
    Value:
      Fn::GetAtt:
      - Execution
      - Status
  WindowsCurlCli:
    Description: 'Convenience attribute, provides curl CLI command prefix for Windows,
      which can be used to notify oos execution instead of OOS API NotifyExecution.
      You can notify approve to oos execution by adding --data-binary "{\"data\":
      {\"NotifyType\": \"Approve\"}}" You can also notify execution via ROS API SignalResource.
      API parameters Status and UniqueId are ignored. Use API parameter Data to pass
      data.'
    Value:
      Fn::GetAtt:
      - Execution
      - WindowsCurlCli
  PowerShellCurlCli:
    Description: 'Convenience attribute, provides curl CLI command prefix for PowerShell,
      which can be used to notify oos execution instead of OOS API NotifyExecution.
      You can notify approve to oos execution by adding -Body ''{"data": {"NotifyType":
      "Approve"}}'' You can also notify execution via ROS API SignalResource. API
      parameters Status and UniqueId are ignored. Use API parameter Data to pass data.'
    Value:
      Fn::GetAtt:
      - Execution
      - PowerShellCurlCli
  Outputs:
    Description: Execution output.
    Value:
      Fn::GetAtt:
      - Execution
      - Outputs
  ExecutionId:
    Description: Execution ID.
    Value:
      Fn::GetAtt:
      - Execution
      - ExecutionId
  CurlCli:
    Description: 'Convenience attribute, provides curl CLI command prefix, which can
      be used to notify oos execution instead of OOS API NotifyExecution. You can
      notify approve to oos execution by adding --data-binary ''{"data": {"NotifyType":
      "Approve"}}''  You can also notify execution via ROS API SignalResource. API
      parameters Status and UniqueId are ignored. Use API parameter Data to pass data.'
    Value:
      Fn::GetAtt:
      - Execution
      - CurlCli
  StatusMessage:
    Description: Execution status information.
    Value:
      Fn::GetAtt:
      - Execution
      - StatusMessage
  Counters:
    Description: 'Task statistics: FailedTasks, SuccessTasks, TotalTasks.'
    Value:
      Fn::GetAtt:
      - Execution
      - Counters