AWSTemplateFormatVersion: '2010-09-09' Description: OpsWeb Application

Parameters: TaskName: MinLength: '3' Type: String Description: Short application slug, ie 'opsweb'. Lowercase letters, numbers and dashes only Default: opsweb AllowedPattern: "[a-z0-9-]*" EnvSlug: MinLength: '2' Type: String Description: Short environment slug, ie 'dev', or 'markdev'. Lowercase letters, numbers and dashes only AllowedPattern: "[a-z0-9]*"

BaseStackName: Type: String Description: "ECS Base Stack Name" Default: "toolshed-ecs" DockerImage: Description: 'Docker Image, i.e.: ecs/sftphub:latest' Type: String HostedZoneName: Description: Name of the Route53 HostedZone to use Type: String Default: "uits-nonprod-aws.arizona.edu" SSLCertificateARN: Type: String Description: Full ARN of the SSL Certificate to use on the load balancer Default: "arn:aws:acm:us-west-2:722748364533:certificate/8be5393d-4519-4189-afd5-39aeb9abf82a" DatabaseHost: Description: IP or DNS of the database host Type: String DatabaseUser: Description: Database Username Type: String NoEcho: 'true' DatabasePassword: Description: Database Password Type: String NoEcho: 'true' DatabaseSchema: Description: Database Schema Name Type: String EDSURL: Description: EDS URL Type: String EDSUsername: Description: EDS Username Type: String NoEcho: 'true' EDSPassword: Description: EDS Password Type: String NoEcho: 'true' ServiceTag: Description: Refers to the application (Uaccess Learning, Uaccess Employee, Uaccess Student) Type: String Default: "Toolshed" EnvironmentTag: Description: Type of environment that is using this resource, such as 'dev', 'tst', 'prd'. Type: String ContactNetidTag: Description: NetID of person most familiar with resource Type: String Default: "fischerm" AccountNumberTag: Description: Identifies the financial system account number Type: String SubAccountTag: Description: Identifies the financial system subaccount number Type: String TicketNumberTag: Description: Jira Ticket Number Type: String

Metadata: AWS::CloudFormation::Interface: ParameterGroups: - Label: default: Application Information Parameters: - TaskName - EnvSlug - DockerImage - BaseStackName - HostedZoneName - SSLCertificateARN - Label: default: Tags Parameters: - ServiceTag - EnvironmentTag - ContactNetidTag - AccountNumberTag - SubAccountTag - TicketNumberTag

AppDnsRecord: Type: AWS::Route53::RecordSet Properties:

HostedZoneName: !Sub "${HostedZoneName}." Name: !Sub "opsweb.${HostedZoneName}." Type: CNAME TTL: '900' ResourceRecords: - Fn::ImportValue: !Sub "${BaseStackName}-alb-dns" #ECS Task Definition EcsTask: Type: "AWS::ECS::TaskDefinition" Properties: Family: !Sub "${TaskName}-${EnvSlug}" NetworkMode: "bridge" ContainerDefinitions: - Name: !Sub "${TaskName}-${EnvSlug}" Essential: "true" Image: !Ref DockerImage PortMappings: - ContainerPort: "80" Hostname: !Sub "opsweb.${HostedZoneName}" Cpu: "200" MemoryReservation: "256" Privileged: "true" Environment: - Name: PHP_ENVIRONMENT_TYPE Value: docker_production - Name: PHP_OPSWEB_DB_HOST Value: !Ref DatabaseHost - Name: PHP_OPSWEB_DB_USER Value: !Ref DatabaseUser - Name: PHP_OPSWEB_DB_PASS Value: !Ref DatabasePassword - Name: PHP_OPSWEB_DATABASE Value: !Ref DatabaseSchema - Name: PHP_OPSWEB_EDS_HOST Value: !Ref EDSURL - Name: PHP_OPSWEB_EDS_LOGIN Value: !Ref EDSUsername - Name: PHP_OPSWEB_EDS_PASS Value: !Ref EDSPassword LogConfiguration: LogDriver: "awslogs" Options: awslogs-group: !Ref EcsLogGroup awslogs-region: !Ref "AWS::Region" awslogs-stream-prefix: opsweb

EcsService: Type: "AWS::ECS::Service" #Waiting for the DNS record to be created beause we know the LB has been #created if the DNS record is created, and the LB needs to be created #before the ECS service is created DependsOn: - AppDnsRecord - EcsLogGroup Properties: ServiceName: !Sub "${TaskName}-${EnvSlug}" Cluster: Fn::ImportValue: !Sub "${BaseStackName}-ecs" TaskDefinition: !Ref EcsTask DesiredCount: 1 Role: !Ref EcsServiceRole LoadBalancers: - ContainerName: !Sub "${TaskName}-${EnvSlug}" ContainerPort: "80" TargetGroupArn: !Ref AlbTargetGroup #For now we will spread across AZs PlacementStrategies: - Field: "attribute:ecs.availability-zone" Type: "spread" DeploymentConfiguration: MaximumPercent: "200" #Need to create a LogGroup in order for the ECS service to log details of the build #If this does not exist the ECS Service will not come up EcsLogGroup: Type: AWS::Logs::LogGroup Properties: LogGroupName: !Sub "${TaskName}-${EnvSlug}-ecs-lg" RetentionInDays: 30

EcsServiceRole: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Version: '2012-10-17' Statement: - Effect: Allow Principal: Service: - ecs.amazonaws.com Action: - sts:AssumeRole Path: "/" ManagedPolicyArns: - arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role - arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole

AlbTargetGroup: Type: AWS::ElasticLoadBalancingV2::TargetGroup Properties: HealthCheckIntervalSeconds: 60 UnhealthyThresholdCount: 10 HealthCheckPath: / Matcher: HttpCode: "200-399" Port: 80 Protocol: HTTP VpcId: Fn::ImportValue: !Sub "${BaseStackName}-vpcid" Tags: - Key: service Value: !Ref ServiceTag - Key: environment Value: !Ref EnvironmentTag - Key: contactnetid Value: !Ref ContactNetidTag - Key: accountnumber Value: !Ref AccountNumberTag - Key: ticketnumber Value: !Ref TicketNumberTag

ListenerRuleA: Type: AWS::ElasticLoadBalancingV2::ListenerRule Properties: Actions: - Type: forward TargetGroupArn: !Ref AlbTargetGroup Conditions: - Field: host-header Values: - !Sub "opsweb.${HostedZoneName}" ListenerArn: Fn::ImportValue: !Sub "${BaseStackName}-alb-listener" Priority: 20 ListenerRuleB: Type: AWS::ElasticLoadBalancingV2::ListenerRule Properties: Actions: - Type: forward TargetGroupArn: !Ref AlbTargetGroup Conditions: - Field: host-header Values: - opsweb.uits.arizona.edu ListenerArn: Fn::ImportValue: !Sub "${BaseStackName}-alb-listener" Priority: 30

Outputs: AppURL: Description: Application URL Value: !Sub "https://opsweb.${HostedZoneName}"