ecs-cluster.yaml

Description: >
  This template deploys an ECS cluster to the provided VPC and subnets using an
  Auto Scaling Group
Parameters:
  EnvironmentName:
    Description: An environment name that will be prefixed to resource names
    Type: String
  InstanceType:
    Description: Which instance type should we use to build the ECS cluster?
    Type: String
    Default: t3.large
  VPC:
    Description: Choose which VPC this ECS cluster should be deployed to
    Type: 'AWS::EC2::VPC::Id'
  Subnets:
    Description: Choose which subnets this ECS cluster should be deployed to
    Type: 'List<AWS::EC2::Subnet::Id>'
  SecurityGroup:
    Description: Select the Security Group to use for the ECS cluster hosts
    Type: 'AWS::EC2::SecurityGroup::Id'
  ECSAMI:
    Description: ECS-Optimized AMI ID
    Type: 'AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>'
    Default: /aws/service/ecs/optimized-ami/amazon-linux/recommended/image_id
  KeyPairName:
    Description: Name of an existing EC2 KeyPair to enable SSH access to the ECS instances.
    Type: String

Resources:
  ECSCluster:
    Type: 'AWS::ECS::Cluster'
    Properties:
      ClusterName: !Join
        - ''
        - - !Ref EnvironmentName
          - '-cluster'

  LoadBalancerTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Name: !Sub ${EnvironmentName}-TGforALB
      VpcId: !Ref VPC
      Port: 80
      Protocol: HTTP
      Matcher:
        HttpCode: 200-299
      HealthCheckIntervalSeconds: 10
      HealthCheckPath: /
      HealthCheckProtocol: HTTP
      HealthCheckTimeoutSeconds: 5
      HealthyThresholdCount: 2
      TargetGroupAttributes:
        - Key: deregistration_delay.timeout_seconds
          Value: 10
      Tags:
        - Key: ECSClusterName
          Value: !Ref ECSCluster

  #HTTPS Target Group
  LoadBalancerHTTPSTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Name: !Sub ${EnvironmentName}-HTTPS-TGforALB
      VpcId: !Ref VPC
      Port: 443
      Protocol: HTTPS
      Matcher:
        HttpCode: 200-299
      HealthCheckIntervalSeconds: 10
      HealthCheckPath: /alb-status
      HealthCheckProtocol: HTTPS
      HealthCheckTimeoutSeconds: 5
      HealthyThresholdCount: 2
      TargetGroupAttributes:
        - Key: deregistration_delay.timeout_seconds
          Value: 10
      Tags:
        - Key: ECSClusterName
          Value: !Ref ECSCluster

  ECSAutoScalingGroup:
    DependsOn: ECSCluster
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      VPCZoneIdentifier: !Ref Subnets
      MinSize: 2
      MaxSize: 5
      DesiredCapacity: 2
      MixedInstancesPolicy:
        InstancesDistribution:
          OnDemandBaseCapacity: 1
          OnDemandPercentageAboveBaseCapacity: 10
        LaunchTemplate:
          LaunchTemplateSpecification:
            LaunchTemplateId: !Ref ECSLaunchTemplate
            Version: !GetAtt ECSLaunchTemplate.LatestVersionNumber
          Overrides:
            - InstanceType: t2.small
            - InstanceType: t3.small
            - InstanceType: t2.medium
            - InstanceType: t3.medium
            - InstanceType: t3.large
      HealthCheckType: EC2
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName} ECS host
          PropagateAtLaunch: true
        - Key: ECSClusterName
          Value: !Ref ECSCluster
          PropagateAtLaunch: true
        - Key: Description
          Value: "This instance is the part of the Auto Scaling group"
          PropagateAtLaunch: true
    CreationPolicy:
      ResourceSignal:
        Timeout: PT15M
    UpdatePolicy:
      AutoScalingRollingUpdate:
        MinInstancesInService: 1
        MaxBatchSize: 1
        PauseTime: PT15M
        SuspendProcesses:
          - HealthCheck
          - ReplaceUnhealthy
          - AZRebalance
          - AlarmNotification
          - ScheduledActions
        WaitOnResourceSignals: true

  ECSLaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    Properties:
      LaunchTemplateName: !Join
        - ''
        - - !Ref EnvironmentName
          - '-template'
      LaunchTemplateData:
        IamInstanceProfile:
          Arn: !GetAtt ECSInstanceProfile.Arn
        ImageId: !Ref ECSAMI
        KeyName: !Ref KeyPairName
        InstanceType: !Ref InstanceType
        Monitoring:
          Enabled: true
        SecurityGroupIds:
          - !Ref SecurityGroup
        UserData:
          "Fn::Base64": !Sub |
            #!/bin/bash -xe
            yum install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm
            yum install -y https://s3.amazonaws.com/amazoncloudwatch-agent/amazon_linux/amd64/latest/amazon-cloudwatch-agent.rpm
            yum install -y aws-cfn-bootstrap hibagent stress-ng jq
            /opt/aws/bin/cfn-init -v --region ${AWS::Region} --stack ${AWS::StackName} --resource ECSLaunchTemplate
            /opt/aws/bin/cfn-signal -e $? --region ${AWS::Region} --stack ${AWS::StackName} --resource ECSAutoScalingGroup
            /usr/bin/enable-ec2-spot-hibernation
    Metadata:
      AWS::CloudFormation::Init:
        config:
          packages:
            yum:
              collectd: []

          commands:
            01_add_instance_to_cluster:
              command: !Sub echo ECS_CLUSTER=${ECSCluster} >> /etc/ecs/ecs.config
            02_enable_task_iam_role:
              command: !Sub echo ECS_ENABLE_TASK_IAM_ROLE=true >> /etc/ecs/ecs.config
            03_enable_cloudwatch_agent:
              command: !Sub /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -c ssm:${ECSCloudWatchParameter} -s

          files:
            /etc/cfn/cfn-hup.conf:
              mode: 000400
              owner: root
              group: root
              content: !Sub |
                [main]
                stack=${AWS::StackId}
                region=${AWS::Region}

            /etc/cfn/hooks.d/cfn-auto-reloader.conf:
              content: !Sub |
                [cfn-auto-reloader-hook]
                triggers=post.update
                path=Resources.ECSLaunchTemplate.Metadata.AWS::CloudFormation::Init
                action=/opt/aws/bin/cfn-init -v --region ${AWS::Region} --stack ${AWS::StackName} --resource ECSLaunchTemplate

          services:
            sysvinit:
              cfn-hup:
                enabled: true
                ensureRunning: true
                files:
                  - /etc/cfn/cfn-hup.conf
                  - /etc/cfn/hooks.d/cfn-auto-reloader.conf

  # Increments the number of EC2 instances in the group by 1 when the policy is executed.
  InstanceScaleOutPolicy:
    Type: AWS::AutoScaling::ScalingPolicy
    Properties:
      AdjustmentType: "ChangeInCapacity"
      AutoScalingGroupName: !Ref ECSAutoScalingGroup
      Cooldown: "60"
      ScalingAdjustment: 1

  InstanceCPUScaleOutAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: Instance CPU utilization greater than 75%
      AlarmDescription: Alarm if cpu utilization greater than 75% of reserved cpu
      Namespace: AWS/EC2
      MetricName: CPUUtilization
      Dimensions:
        - Name: AutoScalingGroupName
          Value: !Ref ECSAutoScalingGroup
      Statistic: Maximum
      Period: "60"
      EvaluationPeriods: "1"
      Threshold: "75"
      ComparisonOperator: GreaterThanThreshold
      ActionsEnabled: true
      AlarmActions:
        - !Ref InstanceScaleOutPolicy

  # Decrements the number of EC2 instances in the group by 1 when the policy is executed.
  InstanceScaleInPolicy:
    Type: AWS::AutoScaling::ScalingPolicy
    Properties:
      AdjustmentType: ChangeInCapacity
      AutoScalingGroupName: !Ref ECSAutoScalingGroup
      Cooldown: "60"
      ScalingAdjustment: -1

  InstanceCPUScaleInAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: Instance CPU utilization less than 40%
      AlarmDescription: Alarm if cpu utilization less than 40% of reserved cpu
      Namespace: AWS/EC2
      MetricName: CPUUtilization
      Dimensions:
        - Name: AutoScalingGroupName
          Value: !Ref ECSAutoScalingGroup
      Statistic: Maximum
      # 20 minutes
      Period: "1200"
      EvaluationPeriods: "1"
      Threshold: "40"
      ComparisonOperator: LessThanThreshold
      ActionsEnabled: true
      AlarmActions:
        - !Ref InstanceScaleInPolicy

  # End of autoscaling policy

  # This IAM Role is attached to all of the ECS hosts. It is based on the default role
  # published here:
  # http://docs.aws.amazon.com/AmazonECS/latest/developerguide/instance_IAM_role.html
  #
  # You can add other IAM policy statements here to allow access from your ECS hosts
  # to other AWS services. Please note that this role will be used by ALL containers
  # running on the ECS host.

  ECSRole:
    Type: 'AWS::IAM::Role'
    Properties:
      Path: /
      RoleName: !Sub '${EnvironmentName}-ECSRole-${AWS::Region}'
      AssumeRolePolicyDocument: |
        {
            "Statement": [{
                "Action": "sts:AssumeRole",
                "Effect": "Allow",
                "Principal": {
                  "Service": ["ec2.amazonaws.com"]
                }
            }]
        }
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AmazonEC2SpotFleetTaggingRole'
        - 'arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM'
        - 'arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy'
        - 'arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role'
      Policies:
        - PolicyName: ecs-service
          PolicyDocument: |
            {
                "Statement": [
                  {
                    "Effect": "Allow",
                    "Action": [
                        "ecs:CreateCluster",
                        "ecs:DeregisterContainerInstance",
                        "ecs:DiscoverPollEndpoint",
                        "ecs:UpdateContainerInstancesState",
                        "ecs:Poll",
                        "ecs:RegisterContainerInstance",
                        "ecs:StartTelemetrySession",
                        "ecs:Submit*",
                        "ecr:BatchCheckLayerAvailability",
                        "ecr:BatchGetImage",
                        "ecr:GetDownloadUrlForLayer",
                        "ecr:GetAuthorizationToken"],
                    "Resource": "*"
                }]
            }
  ECSInstanceProfile:
    Type: 'AWS::IAM::InstanceProfile'
    Properties:
      Roles:
        - !Ref ECSRole

  ECSServiceAutoScalingRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          Action:
            - 'sts:AssumeRole'
          Effect: Allow
          Principal:
            Service:
              - application-autoscaling.amazonaws.com
      Path: /
      Policies:
        - PolicyName: ecs-service-autoscaling
          PolicyDocument:
            Statement:
              Effect: Allow
              Action:
                - 'application-autoscaling:*'
                - 'cloudwatch:DescribeAlarms'
                - 'cloudwatch:PutMetricAlarm'
                - 'ecs:DescribeServices'
                - 'ecs:UpdateService'
              Resource: '*'

  ECSCloudWatchParameter:
    Type: 'AWS::SSM::Parameter'
    Properties:
      Description: ECS
      Name: !Sub 'AmazonCloudWatch-${ECSCluster}-ECS'
      Type: String
      Value: !Sub |
        {
          "logs": {
            "force_flush_interval": 5,
            "logs_collected": {
              "files": {
                "collect_list": [
                  {
                    "file_path": "/var/log/messages",
                    "log_group_name": "${ECSCluster}-/var/log/messages",
                    "log_stream_name": "{instance_id}",
                    "timestamp_format": "%b %d %H:%M:%S"
                  },
                  {
                    "file_path": "/var/log/dmesg",
                    "log_group_name": "${ECSCluster}-/var/log/dmesg",
                    "log_stream_name": "{instance_id}"
                  },
                  {
                    "file_path": "/var/log/docker",
                    "log_group_name": "${ECSCluster}-/var/log/docker",
                    "log_stream_name": "{instance_id}",
                    "timestamp_format": "%Y-%m-%dT%H:%M:%S.%f"
                  },
                  {
                    "file_path": "/var/log/ecs/ecs-init.log",
                    "log_group_name": "${ECSCluster}-/var/log/ecs/ecs-init.log",
                    "log_stream_name": "{instance_id}",
                    "timestamp_format": "%Y-%m-%dT%H:%M:%SZ"
                  },
                  {
                    "file_path": "/var/log/ecs/ecs-agent.log.*",
                    "log_group_name": "${ECSCluster}-/var/log/ecs/ecs-agent.log",
                    "log_stream_name": "{instance_id}",
                    "timestamp_format": "%Y-%m-%dT%H:%M:%SZ"
                  },
                  {
                    "file_path": "/var/log/ecs/audit.log",
                    "log_group_name": "${ECSCluster}-/var/log/ecs/audit.log",
                    "log_stream_name": "{instance_id}",
                    "timestamp_format": "%Y-%m-%dT%H:%M:%SZ"
                  }
                ]
              }
            }
          },
          "metrics": {
            "append_dimensions": {
              "AutoScalingGroupName": "${!aws:AutoScalingGroupName}",
              "InstanceId": "${!aws:InstanceId}",
              "InstanceType": "${!aws:InstanceType}"
            },
            "metrics_collected": {
              "collectd": {
                "metrics_aggregation_interval": 60
              },
              "disk": {
                "measurement": [
                  "used_percent"
                ],
                "metrics_collection_interval": 60,
                "resources": [
                  "/"
                ]
              },
              "mem": {
                "measurement": [
                  "mem_used_percent"
                ],
                "metrics_collection_interval": 60
              },
              "statsd": {
                "metrics_aggregation_interval": 60,
                "metrics_collection_interval": 10,
                "service_address": ":8125"
              }
            }
          }
        }

Outputs:
  Cluster:
    Description: A reference to the ECS cluster
    Value: !Ref ECSCluster
  ECSServiceAutoScalingRole:
    Description: A reference to ECS service auto scaling role
    Value: !GetAtt ECSServiceAutoScalingRole.Arn
  ECSAutoScalingGroupName:
    Description: A reference to ECS AutoScaling Group Name
    Value: !Ref ECSAutoScalingGroup
  TargetGroup:
    Description: HTTP Target group
    Value: !Ref LoadBalancerTargetGroup
  HTTPSTargetGroup:
    Description: HTTPS Target group
    Value: !Ref LoadBalancerHTTPSTargetGroup