cfn.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: "Deploys a service and client in AppRunner to demonstrate metric collection"
Parameters:
  WeatherServiceImageRepoArn:
    Description: ARN of the ECR repository where the weather service image is stored
    Type: String
    AllowedPattern: "arn:aws:ecr:.+"
  WeatherServiceUriWithTag:
    Description: The URI of the weather service image that should be running, including its SHA-256 digest.
    Type: String
  WeatherServiceContainerPort:
    Type: Number
    Default: 3000
  WeatherServiceLoadBalancerPort:
    Type: Number
    Default: 80
  DatadogSecretArn:
    Description: ARN of the secret containing the Datadog ID we will be using
    Type: String
    AllowedPattern: "arn:aws:secretsmanager:.+"
  DatadogDdSiteVariable:
    Description: The DD_SITE environment variable expected by Datadog.  API key won't work without the correct DD_SITE.
    Type: String
  SimulatedClientUriWithTag:
    Description: The URI of the simulated client image that should be running, including its SHA-256 digest.
    Type: String
  VPCIPRange:
    Type: String
    Default: 10.0.0.0/16
  PublicSubnetAZ1IPRange:
    Type: String
    Default: 10.0.1.0/24
  PublicSubnetAZ2IPRange:
    Type: String
    Default: 10.0.2.0/24
Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VPCIPRange
      EnableDnsHostnames: true
      EnableDnsSupport: true
  InternetGateway:
    Type: AWS::EC2::InternetGateway
  VPCGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref VPC
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
  PublicSubnetDefaultRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway
    DependsOn: VPCGatewayAttachment
  PublicSubnetAZ1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Ref PublicSubnetAZ1IPRange
      MapPublicIpOnLaunch: true
      AvailabilityZone: !Select [0, !GetAZs ""]
  PublicSubnetAZ1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnetAZ1
      RouteTableId: !Ref PublicRouteTable
  PublicSubnetAZ2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Ref PublicSubnetAZ2IPRange
      MapPublicIpOnLaunch: true
      AvailabilityZone: !Select [1, !GetAZs ""]
  PublicSubnetAZ2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnetAZ2
      RouteTableId: !Ref PublicRouteTable
  Cluster:
    Type: AWS::ECS::Cluster
    Properties:
      ClusterName: MetricsDemoCluster
      ClusterSettings:
        - Name: containerInsights
          Value: enabled
  WeatherService:
    Type: AWS::ECS::Service
    DependsOn: LoadBalancerListener
    Properties: 
      ServiceName: WeatherService
      Cluster: !Ref Cluster
      TaskDefinition: !Ref WeatherServiceTaskDefinition
      DeploymentConfiguration:
        MinimumHealthyPercent: 100
        MaximumPercent: 200
      DesiredCount:  1
      HealthCheckGracePeriodSeconds: 60
      LaunchType: FARGATE
      NetworkConfiguration: 
        AwsvpcConfiguration:
          AssignPublicIp: ENABLED
          Subnets:
            - !Ref PublicSubnetAZ1
            - !Ref PublicSubnetAZ2
          SecurityGroups:
            - !Ref WeatherServiceSecurityGroup
      LoadBalancers:
        - ContainerName: WeatherService
          ContainerPort: !Ref WeatherServiceContainerPort
          TargetGroupArn: !Ref WeatherServiceTargetGroup
  WeatherServiceTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    DependsOn:
      - WeatherServiceLogGroup
      - WeatherServiceDatadogSidecarLogGroup
    Properties:
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      Cpu: 256
      Memory: 2GB
      ExecutionRoleArn: !Ref WeatherServiceExecutionRole
      TaskRoleArn: !Ref WeatherServiceTaskRole
      ContainerDefinitions:
        - Name: WeatherService
          Image: !Ref WeatherServiceUriWithTag
          PortMappings:
            - ContainerPort: !Ref WeatherServiceContainerPort
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region: !Ref AWS::Region
              awslogs-group: !Ref WeatherServiceLogGroup
              awslogs-stream-prefix: ecs
          Environment:
            - Name: AWS_XRAY_DAEMON_ADDRESS 
              Value: xray-sidecar:2000
        - Name: datadog-agent
          Image: 'public.ecr.aws/datadog/agent:latest'
          Secrets:
            - Name: DD_API_KEY
              ValueFrom: !Ref DatadogSecretArn
          Environment:
            - Name: ECS_FARGATE
              Value: true
            - Name: DD_APM_ENABLED
              Value: true
            - Name: DD_APM_NON_LOCAL_TRAFFIC
              Value: true
            - Name: DD_DOGSTATSD_NON_LOCAL_TRAFFIC
              Value: true
            - Name: DD_LOGS_ENABLED
              Value: true
            - Name: DD_LOGS_CONFIG_CONTAINER_COLLECT_ALL
              Value: true
            - Name: DD_SITE
              Value: !Ref DatadogDdSiteVariable
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region: !Ref AWS::Region
              awslogs-group: !Ref WeatherServiceDatadogSidecarLogGroup
              awslogs-stream-prefix: ecs
        - Name: xray-sidecar
          Image: 'amazon/aws-xray-daemon'
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region: !Ref AWS::Region
              awslogs-group: !Ref WeatherServiceXraySidecarLogGroup
              awslogs-stream-prefix: ecs
  WeatherServiceTaskRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: WeatherServiceTaskRole
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action: 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess'
      Policies:
        - PolicyName: datadog-permissions
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action: 
                  - 'ecs:ListClusters'
                  - 'ecs:ListContainerInstances'
                  - 'ecs:DescribeContainerInstances'
                Resource:
                  - '*'
        - PolicyName: write-metrics
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - 'cloudwatch:PutMetricData'
                Resource:
                  - '*'
  WeatherServiceExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: WeatherServiceExecutionRole
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action: 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy'
      Policies:
        - PolicyName: read-datadog-api-key
          PolicyDocument:
            Version: 2012-10-17
            Statement:
            - Effect: Allow
              Action:
              - 'secretsmanager:GetSecretValue'
              Resource:
              - !Ref DatadogSecretArn
  WeatherServiceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: WeatherServiceSecurityGroup
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: !Ref WeatherServiceContainerPort
          ToPort: !Ref WeatherServiceContainerPort
          SourceSecurityGroupId: !Ref LoadBalancerSecurityGroup
  WeatherServiceTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckIntervalSeconds: 20
      HealthCheckPath: /WeatherForecast?city=Dallas&includeRadar=true&includeSatellite=false
      HealthCheckTimeoutSeconds: 10
      UnhealthyThresholdCount: 2
      HealthyThresholdCount: 2
      Name: WeatherServiceTargetGroup
      Port: !Ref WeatherServiceContainerPort
      Protocol: HTTP
      TargetGroupAttributes:
        - Key: deregistration_delay.timeout_seconds
          Value: 60
      TargetType: ip
      VpcId: !Ref VPC
  LoadBalancerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: LoadBalancerSecurityGroup
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: !Ref WeatherServiceLoadBalancerPort
          ToPort: !Ref WeatherServiceLoadBalancerPort
          CidrIp: 0.0.0.0/0
  LoadBalancerListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - TargetGroupArn: !Ref WeatherServiceTargetGroup
          Type: forward
      LoadBalancerArn: !Ref LoadBalancer
      Port: !Ref WeatherServiceLoadBalancerPort
      Protocol: HTTP
  LoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    DependsOn: InternetGateway
    Properties:
      Name: LoadBalancer
      Scheme: internet-facing
      SecurityGroups:
        - !Ref LoadBalancerSecurityGroup
      Subnets:
            - !Ref PublicSubnetAZ1
            - !Ref PublicSubnetAZ2
  WeatherServiceLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /ecs/WeatherService/WeatherServiceContainer
  WeatherServiceDatadogSidecarLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /ecs/WeatherService/DatadogSidecarContainer
  WeatherServiceXraySidecarLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /ecs/WeatherService/XraySidecarContainer
  SimulatedClient:
    Type: AWS::ECS::Service
    Properties: 
      ServiceName: SimulatedClient
      Cluster: !Ref Cluster
      TaskDefinition: !Ref SimulatedClientTaskDefinition
      DesiredCount:  1
      LaunchType: FARGATE
      NetworkConfiguration: 
        AwsvpcConfiguration:
          AssignPublicIp: ENABLED
          Subnets:
            - !Ref PublicSubnetAZ1
            - !Ref PublicSubnetAZ2
  SimulatedClientTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    DependsOn:
      - SimulatedClientLogGroup
    Properties:
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      Cpu: 256
      Memory: 0.5GB
      ExecutionRoleArn: !Ref SimulatedClientExecutionRole
      ContainerDefinitions:
        - Name: SimulatedClient
          Image: !Ref SimulatedClientUriWithTag
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region: !Ref AWS::Region
              awslogs-group: !Ref SimulatedClientLogGroup
              awslogs-stream-prefix: ecs
          Environment:
            - Name: WEATHER_SERVICE_HOSTNAME
              Value: !GetAtt LoadBalancer.DNSName
            - Name: PROTOCOL
              Value: http
            - Name: VU_COUNT
              Value: 10
  SimulatedClientExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: SimulatedClientExecutionRole
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action: 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy'
  SimulatedClientLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /ecs/SimulatedClient/SimulatedClientContainer
Outputs:
  LoadBalancerHostname:
    Description: Load balancer hostname
    Value: !GetAtt LoadBalancer.DNSName