ServiceTag:
Type: String
Description: Exact name of the Service as defined in the service catalog.
EnvironmentTag:
Type: String
Description: Used to distinguish between development, test, production,etc. environment types.
AllowedValues: [dev, tst, prd, trn, stg, cfg, sup, rpt]
Default: tst
ContactNetidTag:
Type: String
Description: Used to identify the netid of the person most familiar with the usage of the resource.
Default: szgilbert
AccountNumberTag:
Type: String
Description: Identifies the financial system account number.
SubAccountNumberTag:
Type: String
Description: Identifies the Sub account, which is NOT a number.
TicketNumberTag:
Type: String
Description: Used to identify the jira, Cherwell, or other ticketing system ticket number to link to more information about the need for the resource.
Mappings:
RegionMap:
us-east-1:
"AMIID": "ami-c481fad3"
us-west-1:
"AMIID": "ami-de347abe"
us-west-2:
"AMIID": "ami-f2d3638a"
eu-west-1:
"AMIID": "ami-d41d58a7"
Resources:
InstanceSG:
Type: 'AWS::EC2::SecurityGroup'
Properties:
GroupDescription: 'Allow traffic to jira'
VpcId: !Ref VPC
SecurityGroupIngress:
- IpProtocol: "tcp"
FromPort: "80"
ToPort: "80"
SourceSecurityGroupId: !Ref LBSecurityGroup
Description: "HTTP Redirection traffic from Load Balancer"
- IpProtocol: "tcp"
FromPort: "8088"
ToPort: "8088"
SourceSecurityGroupId: !Ref LBSecurityGroup
Description: "HTTP Application Traffic from Load Balancer"
- IpProtocol: "tcp"
FromPort: "22"
ToPort: "22"
CidrIp: "150.135.112.0/22"
Description: "Infradev VPN"
- IpProtocol: "tcp"
FromPort: "22"
ToPort: "22"
CidrIp: "10.138.0.0/17"
Description: "Mosaic VPN"
- IpProtocol: "tcp"
FromPort: "22"
ToPort: "22"
CidrIp: "128.196.130.211/32"
Description: "ben.uits Bastian Host"
EFSIngress:
Type: AWS::EC2::SecurityGroupIngress
Properties:
GroupId:
Fn::ImportValue:
!Sub "${jiraFoundationStack}-efs-sg"
IpProtocol: tcp
FromPort: '2049'
ToPort: '2049'
SourceSecurityGroupId: !Ref InstanceSG
DBIngress:
Type: AWS::EC2::SecurityGroupIngress
Properties:
GroupId:
Fn::ImportValue:
!Sub "${jiraRDSStack}-dbsecuritygroup"
IpProtocol: tcp
FromPort: '3306'
ToPort: '3306'
SourceSecurityGroupId: !Ref InstanceSG
EC2Role:
Type: 'AWS::IAM::Role'
Properties:
AssumeRolePolicyDocument:
Statement:
- Effect: Allow
Principal:
Service:
- ec2.amazonaws.com
Action:
- 'sts:AssumeRole'
Path: /
Policies:
- PolicyName: s3-access
PolicyDocument:
Statement:
- Effect: Allow
Action:
- 's3:*'
Resource: !Sub
- "arn:aws:s3:::${S3Bucket}*"
- S3Bucket:
Fn::ImportValue:
!Sub "${jiraFoundationStack}-jirabucket"
- PolicyName: logs-access
PolicyDocument:
Statement:
- Effect: Allow
Action:
- 'logs:CreateLogStream'
- 'logs:PutLogEvents'
Resource: '*'
EC2InstanceProfile:
Type: 'AWS::IAM::InstanceProfile'
Properties:
Path: /
Roles:
- !Ref EC2Role
jiraInstance:
Type: "AWS::EC2::Instance"
Metadata:
AWS::CloudFormation::Authentication:
rolebased:
type: "S3"
buckets:
- Fn::ImportValue:
!Sub "${jiraFoundationStack}-jirabucket"
roleName: !Ref EC2Role
AWS::CloudFormation::Init:
configSets:
bootStrap:
- "configureUser"
- "downloadMedia"
- "installMedia"
- "configureServer"
- "configureAccess"
- "uninstallJava"
- "configureService"
- "installMysql"
configureUser:
groups:
jiraadm: {}
users:
jira:
groups:
- jiraadm
homeDir: /opt/jira
downloadMedia:
files:
/tmp/jira.tgz:
mode: 644
owner: jira
group: jiraadm
source: !Sub
- "https://s3-${AWS::Region}.amazonaws.com/${S3Bucket}/installers/${InstallerFile}"
- S3Bucket:
Fn::ImportValue:
!Sub "${jiraFoundationStack}-jirabucket"
installMedia:
packages:
yum:
nginx: []
commands:
01ensureDirectory:
command: "mkdir -p /opt/jira"
02extractjira:
command: "cd /tmp; tar -zxf /tmp/jira.tgz"
03movejira:
command: "mv /tmp/opt/jira/jira-current /opt/jira/"
configureServer:
files:
/etc/nginx/nginx.conf:
mode: 775
owner: root
content: |
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
include /usr/share/nginx/modules/*.conf;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
client_max_body_size 30M;
keepalive_timeout 65;
types_hash_max_size 2048;
include /etc/nginx/mime.types;
default_type application/octet-stream;
include /etc/nginx/conf.d/*.conf;
}
/etc/nginx/conf.d/jira.conf:
mode: 775
owner: root
content: |
server {
listen *:80 default_server;
listen [::]:80 default_server;
return 301 https://$host$request_uri;
}
server {
listen 8088;
location / {
proxy_pass http://127.0.0.1:8080;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
proxy_connect_timeout 600;
proxy_send_timeout 600;
proxy_read_timeout 600;
send_timeout 600;
}
}
/etc/cron.d/jira.backup:
mode: 644
owner: root
group: root
content: !Sub
- |
12 23 * * * root aws s3 sync --sse AES256 /efs/jira/${jiraEnvironment} s3://${S3Bucket}/backups/${jiraEnvironment} >/dev/null 2>&1
- S3Bucket:
Fn::ImportValue:
!Sub "${jiraFoundationStack}-jirabucket"
/etc/init.d/jira:
mode: 775
owner: root
group: jiraadm
content: |
jira Application Stack CloudFormation Deployment
This CloudFormation template will deploy an application node for jira