Kuali SonarQube CloudFormation Deployment

This CloudFormation template will build an ECS stack to support the Kuali team's SonarQube instance that is backed by EFS for the related data storage.

Parameters

These are the input parameters for this template. All of these parameters must be supplied for this template to be deployed.

To address in the future for DR purposes. DRS3Bucket: Description: 'Disaster Recovery Bucket Name' Default: "edu-arizona-dr-kuali" Type: String

Metadata

Metadata is mostly for organizing and presenting Parameters in a better way when using CloudFormation in the AWS Web UI.

These are all of the actual AWS resources created for this application.

Instance Role

This is the IAM role that will be applied to the ECS Instances. Any AWS specific permissions that the node might need should be defined here.

 Policies:
 -
   PolicyName: "dr-backup-access"
   PolicyDocument:
     Version: '2012-10-17'
     Statement:
     -
       Sid: Stmt1452033379000
       Effect: Allow
       Action:
       - s3:ListBucket
       - s3:PutObject
       Resource:
       - !Sub "arn:aws:s3:::${DRS3Bucket}"
       - !Sub "arn:aws:s3:::${DRS3Bucket}/*"

Instance Profile

This is just a little construct to connect a set of roles together into a profile. The profile is referenced by ec2 instances.

Instance Security Group

Security group for the host nodes themselves. Needs to permit incoming traffice from the ELB, and any other authorized incoming sources.

Application Load Balancer (ALB)

Defines the Application Load Balancer Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-elasticloadbalancingv2-loadbalancer.html

https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_LoadBalancerAttribute.html

DB Security Group

Defines the Security Group for the RDS Database. This restricts DB access to only the devices in the InstanceSecurityGroup, so our App nodes.

ELB Target group for SonarQube ECS Cluster

ELB Listeners for SonarQube Application LB

Route53 DNS Record

Create a DNS entry in Route53 for this environment. This creates a CNAME pointing at the DNS name of the Load Balancer.

Append a period after the hosted zone DNS name

Need to create a LogGroup in order for the ECS service to log details of the build If this does not exist the ECS Service will not come up

Launch Config for the Auto Scaling Group for the ECS Cluster

Install nfs-utils

Create /efs folder

Mount /efs

create the dirs on the efs mount that will be used to persist data.

Set any ECS agent configuration options

Auto Scaling Group for Web/App/Batch Will be used in current non-prod environment

ECS Cluster

ECS Task Definition

See https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecs-taskdefinition-containerdefinitions.html

Persistent storage for SonarQube handled via Docker volumes and bind mounts. https://docs.aws.amazon.com/AmazonECS/latest/developerguide/using_data_volumes.html

Using a DockerVolumeConfiguration property along with the MountPoints property from above will allow for using Docker volumes.
See https://docs.aws.amazon.com/AmazonECS/latest/developerguide/docker-volumes.html

Docker will map volume to default location on EC2 host at /var/lib/docker/volumes/efs-sonar-ext/_data.
If docker container is restarted then the "extensions" directory will persist.
If the EC2 host is restarted then the "extensions" dir will NOT persist.

Using a Host property along with the MountPoints property from above will allow for using bind mounts. See https://docs.aws.amazon.com/AmazonECS/latest/developerguide/bind-mounts.html

Mapping explictly set using SourcePath property on EC2 host mapped to EFS. If docker container is restarted then the "extensions" directory will persist.
If the EC2 host is restarted then the SourcePath location dir will also persist.

ECS Service

ECS Service Role

Outputs

Output values that can be viewed from the AWS CloudFormation console.