FinMod Boomi Atom Template

This CloudFormation template creates an ECS cluster with tasks that will serve as a local atoms.

Metadata

Metadata is mostly for organizing and presenting Parameters in a better way when using CloudFormation in the AWS Web UI.

   - ECSSubnet
   - ALBSubnetPri
   - ALBSubnetSec

Parameters

These are the input parameters for this template. All of these parameters must be supplied for this template to be deployed.

ECSSubnet: Description: "Select the subnet to use for the container (e.g., subnet-b0247ggh)" Type: 'AWS::EC2::Subnet::Id' MinLength: 1 ALBSubnetPri: Description: "Select the primary subnet to use for the load balancer (e.g., subnet-b0247ggh)" Type: AWS::EC2::Subnet::Id MinLength: 1 ALBSubnetSec: Description: "Select the secondary subnet to use for the load balancer (e.g., subnet-b0247ggh)" Type: AWS::EC2::Subnet::Id MinLength: 1

Resources

All of the resources deployed by the template.

File System

Defines the EFS volume needed for this stack Resource: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-efs-filesystem.html

EFS Mount Points

EFS Mountpoints must be created for each Availability Zone in the VPC. This is also where you define access controls, as access to EFS is controlled by these security groups.

A pair of mount points must be created for each EFS volume.

Copied from efs_volume.yaml template.

EFS Access Point

Defines the access point for the EFS volume Resource: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-efs-accesspoint.html

   CreationInfo:
     OwnerGid: "1002"
     OwnerUid: "1001"
     Permissions: "0755"

EFS Security Group

This security group defines what resources are able to access the EFS shared filesystem. Resource: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group.html

ECS Container Instance Role

This is the IAM role that will be applied to the ECS Instances. Any AWS specific permissions that the node might need should be defined here.

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html https://docs.aws.amazon.com/AmazonECS/latest/developerguide/instance_IAM_role.html

Instance Profile

This is just a little construct to connect a set of roles together into a profile. The profile is referenced by ec2 instances.

Instance Security Group

Security group for the host nodes themselves. Needs to permit incoming traffice from the ALB, and any other authorized incoming sources. Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group.html

Defines the Application Load Balancer Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-elasticloadbalancingv2-loadbalancer.html

Application Load Balancer (ALB) Resources

Defines the Application Load Balancer Security Group Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group.html

Defines the ALB Target Group Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-elasticloadbalancingv2-targetgroup.html

Defines the ALB Listener Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-elasticloadbalancingv2-listener.html

Route53 DNS Record

Create a DNS entry in Route53 for this environment. This creates a CNAME pointing at the DNS name of the Load Balancer. Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-route53-recordset.html

Append a period after the hosted zone DNS name

Defines the ECS Log Group Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-logs-loggroup.html

Launch Config for the Auto Scaling Group for the ECS Cluster Copied from kfs_nexus_ecs.yaml template

Auto Scaling Group for Web/App/Batch Will be used in current non-prod environment Copied from kfs_nexus_ecs.yaml template

ECS Resources

Defines the ECS Cluster Resource: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecs-cluster.html

Need to make sure the LB is created before the ECS cluster is created

Defines the ECS Task Definition Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecs-taskdefinition.html

       - ContainerPath: "/mnt/boomi"  # not needed for EC2; ECS tries to update the permissions on the install dir
         SourceVolume: "BoomiEFS"

        RootDirectory: !Ref AppEFSMountPath  # e.g. "/" or "/devfinmod336", not used with AccessPoint resource

ECS Service

Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecs-service.html

 NetworkConfiguration:
   AwsvpcConfiguration:
     AssignPublicIp: DISABLED
     Subnets:
       - !ImportValue kuali-vpc-private-subnet-a
       - !ImportValue kuali-vpc-private-subnet-b
     SecurityGroups:
       - !Ref ECSSecurityGroup

• PlacementConstraints, ...

ECS Service Role

Defines the ECS Security Group Ingress Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group-ingress.html ECSMulicastIngress: Type: AWS::EC2::SecurityGroupIngress Properties: IpProtocol: udp FromPort: 45588 ToPort: 45588 SourceSecurityGroupId: !Ref ECSSecurityGroup GroupId: !Ref ECSSecurityGroup Defines the ECS Security Group Ingress Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group-ingress.html ECSUnicastIngress: Type: AWS::EC2::SecurityGroupIngress Properties: IpProtocol: tcp FromPort: 7800 ToPort: 7800 SourceSecurityGroupId: !Ref ECSSecurityGroup GroupId: !Ref ECSSecurityGroup

Use to add the Instance SG to the DB SG This is needed to allow the atom to connect to the DB

Route53 DNS Record

Defines the ALB DNS Record Set Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-route53-recordset.html ALBDNSRecord: Type: AWS::Route53::RecordSet Properties: AliasTarget: HostedZoneId: !GetAtt ALB.CanonicalHostedZoneID DNSName: !GetAtt ALB.DNSName HostedZoneName: !Sub "${DNSHostedZone}." Name: !Sub "${DNSAliasName}.${DNSHostedZone}." Type: A

Outputs

Output values that can be viewed from the AWS CloudFormation console.