main.yml

AWSTemplateFormatVersion: 2010-09-09

Parameters:
  EC2InstanceType:
    Type: String
  EC2AMI:
    Type: 'AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>'
    Default: '/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2'
  CodePipelineBucket:
    Type: String
    Description: 'The S3 bucket for CodePipeline artifacts.'
  GitHubOwner:
    Type: String
    Description: 'The username of the source GitHub repo.'
  GitHubRepo:
    Type: String
    Description: 'The source GitHub repo name (without the username).'
  GitHubBranch:
    Type: String
    Default: master
    Description: 'The source GitHub branch.'
  GitHubPersonalAccessToken:
    Type: String
    NoEcho: true
    Description: 'A GitHub personal access token with "repo" and
"admin:repo_hook" permissions.'


Resources:

  SecurityGroup:
    Type: "AWS::EC2::SecurityGroup"
    Properties:
      VpcId: !Ref VPC
      GroupDescription: !Sub 'Internal Security group for ${AWS::StackName}'
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 8080
          ToPort: 8080
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0
      Tags:
        - Key: Name
          Value: !Ref AWS::StackName

  InstanceRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          Effect: Allow
          Principal:
            Service:
              - "ec2.amazonaws.com"
          Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/CloudWatchFullAccess
        - arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforAWSCodeDeploy
      Policies:
        - PolicyName: ec2DescribeTags
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action: 'ec2:DescribeTags'
                Resource: '*'
      Tags:
        - Key: Name
          Value: !Ref AWS::StackName

  DeploymentRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          Effect: Allow
          Principal:
            Service:
              - codepipeline.amazonaws.com
              - codedeploy.amazonaws.com
              - codebuild.amazonaws.com
          Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonS3FullAccess
        - arn:aws:iam::aws:policy/CloudWatchFullAccess
        - arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess
        - arn:aws:iam::aws:policy/AWSCodePipeline_FullAccess
        - arn:aws:iam::aws:policy/AWSCodeDeployDeployerAccess
        - arn:aws:iam::aws:policy/AWSCodeBuildDeveloperAccess
        - arn:aws:iam::aws:policy/service-role/AWSCodeDeployRole

  BuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: !Ref AWS::StackName
      ServiceRole: !GetAtt DeploymentRole.Arn
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:2.0
      Source:
        Type: CODEPIPELINE

  DeploymentApplication:
    Type: AWS::CodeDeploy::Application
    Properties:
      ApplicationName: !Ref AWS::StackName
      ComputePlatform: Server

  StagingDeploymentGroup:
    Type: AWS::CodeDeploy::DeploymentGroup
    Properties:
      DeploymentGroupName: staging
      AutoScalingGroups:
        - !Ref ScalingGroup
      ApplicationName: !Ref DeploymentApplication
      DeploymentConfigName: CodeDeployDefault.AllAtOnce
      ServiceRoleArn: !GetAtt DeploymentRole.Arn
      Ec2TagFilters:
        - Key: aws:cloudformation:stack-name
          Type: KEY_AND_VALUE
          Value: !Ref AWS::StackName

  Pipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      Name: !Ref AWS::StackName
      ArtifactStore:
        Location: !Ref CodePipelineBucket
        Type: S3
      RoleArn: !GetAtt DeploymentRole.Arn
      Stages:
        - Name: Source
          Actions:
            - Name: Source
              ActionTypeId:
                Category: Source
                Owner: ThirdParty
                Version: 1
                Provider: GitHub
              OutputArtifacts:
                - Name: Source
              Configuration:
                Owner: !Ref GitHubOwner
                Repo: !Ref GitHubRepo
                Branch: !Ref GitHubBranch
                OAuthToken: !Ref GitHubPersonalAccessToken
                PollForSourceChanges: false
              RunOrder: 1
        - Name: Build
          Actions:
            - Name: Build
              ActionTypeId:
                Category: Build
                Owner: AWS
                Version: 1
                Provider: CodeBuild
              InputArtifacts:
                - Name: Source
              OutputArtifacts:
                - Name: Build
              Configuration:
                ProjectName: !Ref BuildProject
              RunOrder: 1
        - Name: Staging
          Actions:
            - Name: Staging
              InputArtifacts:
                - Name: Build
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Version: 1
                Provider: CodeDeploy
              Configuration:
                ApplicationName: !Ref DeploymentApplication
                DeploymentGroupName: !Ref StagingDeploymentGroup
              RunOrder: 1

  PipelineWebhook:
    Type: AWS::CodePipeline::Webhook
    Properties:
      Authentication: GITHUB_HMAC
      AuthenticationConfiguration:
        SecretToken: !Ref GitHubPersonalAccessToken
      Filters:
        - JsonPath: $.ref
          MatchEquals: 'refs/heads/{Branch}'
      TargetPipeline: !Ref Pipeline
      TargetAction: Source
      Name: !Sub 'webhook-${AWS::StackName}'
      TargetPipelineVersion: !GetAtt Pipeline.Version
      RegisterWithThirdParty: true

  InstanceProfile:
    Type: "AWS::IAM::InstanceProfile"
    Properties:
      Roles:
        - Ref: InstanceRole

  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: !Ref AWS::StackName

  SubnetAZ1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 0, !GetAZs '' ]
      CidrBlock: 10.0.0.0/18
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Ref AWS::StackName
        - Key: AZ
          Value: !Select [ 0, !GetAZs '' ]

  SubnetAZ2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 1, !GetAZs '' ]
      CidrBlock: 10.0.64.0/18
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Ref AWS::StackName
        - Key: AZ
          Value: !Select [ 1, !GetAZs '' ]

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: !Ref AWS::StackName

  InternetGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref VPC

  RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Ref AWS::StackName

  DefaultPublicRoute:
    Type: AWS::EC2::Route
    DependsOn: InternetGatewayAttachment
    Properties:
      RouteTableId: !Ref RouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  SubnetRouteTableAssociationAZ1:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref RouteTable
      SubnetId: !Ref SubnetAZ1

  SubnetRouteTableAssociationAZ2:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref RouteTable
      SubnetId: !Ref SubnetAZ2

  LoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Type: application
      Scheme: internet-facing
      SecurityGroups:
        - !GetAtt SecurityGroup.GroupId
      Subnets:
        - !Ref SubnetAZ1
        - !Ref SubnetAZ2
      Tags:
        - Key: Name
          Value: !Ref AWS::StackName

  LoadBalancerListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref LoadBalancerTargetGroup
      LoadBalancerArn: !Ref LoadBalancer
      Port: 80
      Protocol: HTTP

  LoadBalancerTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      TargetType: instance
      Port: 8080
      Protocol: HTTP
      VpcId: !Ref VPC
      HealthCheckEnabled: true
      HealthCheckProtocol: HTTP
      Targets:
        - Id: !Ref Instance
        - Id: !Ref Instance2
      Tags:
        - Key: Name
          Value: !Ref AWS::StackName


  Instance:
    Type: AWS::EC2::Instance
    CreationPolicy:
      ResourceSignal:
        Timeout: PT5M
        Count: 1
    Properties:
      SubnetId: !Ref SubnetAZ1
      LaunchTemplate:
        LaunchTemplateId: !Ref InstanceLaunchTemplate
        Version: !GetAtt InstanceLaunchTemplate.LatestVersionNumber
      Tags:
        - Key: Name
          Value: !Ref AWS::StackName

  Instance2:
    Type: AWS::EC2::Instance
    CreationPolicy:
      ResourceSignal:
        Timeout: PT5M
        Count: 1
    Properties:
      SubnetId: !Ref SubnetAZ2
      LaunchTemplate:
        LaunchTemplateId: !Ref InstanceLaunchTemplate
        Version: !GetAtt InstanceLaunchTemplate.LatestVersionNumber
      Tags:
        - Key: Name
          Value: !Ref AWS::StackName

  ScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    UpdatePolicy:
      AutoScalingRollingUpdate:
        MinInstancesInService: "1"
        MaxBatchSize: "1"
        PauseTime: "PT15M"
        WaitOnResourceSignals: "true"
        SuspendProcesses:
          - HealthCheck
          - ReplaceUnhealthy
          - AZRebalance
          - AlarmNotification
          - ScheduledActions
    Properties:
      AutoScalingGroupName: !Sub 'ASG_${AWS::StackName}'
      AvailabilityZones:
        - !Select [ 0, !GetAZs '' ]
        - !Select [ 1, !GetAZs '' ]
      MinSize: 2
      MaxSize: 6
      HealthCheckGracePeriod: 0
      HealthCheckType: ELB
      LaunchTemplate:
        LaunchTemplateId: !Ref InstanceLaunchTemplate
        Version: !GetAtt InstanceLaunchTemplate.LatestVersionNumber
      TargetGroupARNs:
        - !Ref LoadBalancerTargetGroup
      MetricsCollection:
        -
          Granularity: "1Minute"
          Metrics:
            - "GroupMaxSize"
            - "GroupInServiceInstances"
      VPCZoneIdentifier:
        - !Ref SubnetAZ1
        - !Ref SubnetAZ2
      Tags:
        - Key: Name
          Value: !Ref AWS::StackName
          PropagateAtLaunch: "true"

  InstanceLaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    Metadata:
      AWS::CloudFormation::Init:
        config:
          packages:
            yum:
              ruby: []
              jq: []
          files:
            /home/ec2-user/install:
              source: !Sub "https://aws-codedeploy-${AWS::Region}.s3.amazonaws.com/latest/install"
              mode: "000755" # executable
          commands:
            00-install-cd-agent:
              command: "./install auto"
              cwd: "/home/ec2-user/"
    Properties:
      LaunchTemplateName: !Sub 'LaunchTemplate_${AWS::StackName}'
      LaunchTemplateData:
        ImageId: !Ref EC2AMI
        InstanceType: !Ref EC2InstanceType
        IamInstanceProfile:
          Arn: !GetAtt InstanceProfile.Arn
        Monitoring:
          Enabled: true
        SecurityGroupIds:
          - !GetAtt SecurityGroup.GroupId
        UserData:
          Fn::Base64: !Sub |
            #!/bin/bash -xe

            # send script output to /tmp so we can debug boot failures
            exec > /tmp/userdata.log 2>&1 

            # Update all packages
            yum -y update

            # Get latest cfn scripts; https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/best-practices.html#cfninit
            yum install -y aws-cfn-bootstrap
            
            cat > /tmp/install_script.sh << EOF 
              # START
              echo "Setting up NodeJS Environment"
              curl https://raw.githubusercontent.com/nvm-sh/nvm/v0.34.0/install.sh | bash

              # Dot source the files to ensure that variables are available within the current shell
              . /home/ec2-user/.nvm/nvm.sh
              . /home/ec2-user/.bashrc

              # Install NVM, NPM, Node.JS
              nvm alias default v12.7.0
              nvm install v12.7.0
              nvm use v12.7.0

              # Create log directory
              mkdir -p /home/ec2-user/app/logs
            EOF

            chown ec2-user:ec2-user /tmp/install_script.sh && chmod a+x /tmp/install_script.sh
            sleep 1; sudo su - ec2-user -c "/tmp/install_script.sh" 

            # Have CloudFormation install any files and packages from the metadata
            /opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --region ${AWS::Region} --resource InstanceLaunchTemplate

            # Query the EC2 metadata service for this instance's instance-id
            export INSTANCE_ID="`wget -q -O - http://169.254.169.254/latest/meta-data/instance-id`"

            # Query EC2 describeTags method and pull our the CFN Logical ID for this instance

            export LOGICAL_ID=`aws --region ${AWS::Region} ec2 describe-tags --filters "Name=resource-id,Values=${!INSTANCE_ID}" "Name=key,Values=aws:cloudformation:logical-id" | jq -r ".Tags[0].Value"`

            # Signal to CloudFormation that the instance is ready
            /opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --region ${AWS::Region} --resource ${!LOGICAL_ID}

Outputs:

  LBEndpoint:
    Description: The DNS name for the LB
    Value: !Sub "http://${LoadBalancer.DNSName}:80"
    Export:
      Name: LBendpoint