servers.yml

Description: >
  Luis Fernandez / UdacityProjectLuis
  This template deploys a the servers

Parameters:

  EnvironmentName:
    Description: An Environment name that will be prefixed to resources
    Type: String

  DNSProtocol:
    Description: An DNS protocol that will be prefixed to resources
    Type: String

  ApplicationS3Bucket:
    Description: Bucket name for Application
    Type: String

  InstanceType:
    Description: WebServer EC2 instance type
    Type: String
    Default: t3.medium

Resources:

  LBSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow http traffic to the load balancer
      VpcId:
        Fn::ImportValue:
          !Sub "${EnvironmentName}-VPC-ID"
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0

  WebServerSecGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow http traffic to our hosts and SHH for local only
      VpcId:
        Fn::ImportValue:
          !Sub "${EnvironmentName}-VPC-ID"
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp:
            Fn::ImportValue:
              !Sub ${EnvironmentName}-BASTION-ONE-HOST-CIDR
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp:
            Fn::ImportValue:
              !Sub ${EnvironmentName}-BASTION-TWO-HOST-CIDR

  WebAppLaunchConfig:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      ImageId: ami-07b4f3c02c7f83d59
      KeyName:
        Fn::ImportValue:
          !Sub ${EnvironmentName}-JUMPBOX-SSH-KEY-NAME
      IamInstanceProfile: !Ref IamInstanceProfile
      SecurityGroups:
        - Ref: WebServerSecGroup
      InstanceType: !Ref InstanceType
      BlockDeviceMappings:
        - DeviceName: "/dev/sdk"
          Ebs:
            VolumeSize: '10'
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash
          apt-get update -y
          apt-get install unzip awscli -y
          apt-get install apache2 -y
          systemctl start apache2.service
          cd /var/www/html
          aws s3 cp s3://udacity-demo-1/udacity.zip .
          unzip -o udacity.zip

  WebAppGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      VPCZoneIdentifier:
        - Fn::ImportValue:
            !Sub "${EnvironmentName}-PRIVATE-NETS"
      LaunchConfigurationName:
        Ref: WebAppLaunchConfig
      MinSize: '4'
      MaxSize: '5'
      TargetGroupARNs:
        - Ref: WebAppTargetGroup

  WebAppLB:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Subnets:
        - Fn::ImportValue: !Sub "${EnvironmentName}-PUBLIC-ONE-SUBNET"
        - Fn::ImportValue: !Sub "${EnvironmentName}-PUBLIC-TWO-SUBNET"
      SecurityGroups:
        - Ref: LBSecurityGroup

  Listener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - Type: forward
          TargetGroupArn:
            Ref: WebAppTargetGroup
      LoadBalancerArn:
        Ref: WebAppLB
      Port: '80'
      Protocol: HTTP

  ALBListenerRule:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      Actions:
        - Type: forward
          TargetGroupArn: !Ref WebAppTargetGroup
      Conditions:
        - Field: path-pattern
          Values: [/]
      ListenerArn: !Ref Listener
      Priority: 1

  WebAppTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    DependsOn:
      - WebAppLB
    Properties:
      HealthCheckIntervalSeconds: 20
      HealthCheckPath: /
      HealthCheckProtocol: HTTP
      HealthCheckTimeoutSeconds: 10
      HealthyThresholdCount: 2
      Port: 80
      Protocol: HTTP
      UnhealthyThresholdCount: 5
      VpcId:
        Fn::ImportValue:
          !Sub "${EnvironmentName}-VPC-ID"

  UdacityS3ReadOnlyEC2:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: "/"

  IamPolicies:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: root
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: "s3:*"
            Resource: "*"
      Roles:
        - !Ref UdacityS3ReadOnlyEC2

  IamInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: "/"
      Roles:
        - !Ref UdacityS3ReadOnlyEC2

  WebServerScaleUpPolicy:
    Type: AWS::AutoScaling::ScalingPolicy
    Properties:
      AdjustmentType: ChangeInCapacity
      AutoScalingGroupName: !Ref WebAppGroup
      Cooldown: '60'
      ScalingAdjustment: '1'

  CPUAlarmHigh:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: Scale-up if CPU > 95% for 5 minutes
      MetricName: CPUUtilization
      Namespace: AWS/EC2
      Statistic: Average
      Period: '300'
      EvaluationPeriods: '3'
      Threshold: '95'
      AlarmActions:
      - Ref: WebServerScaleUpPolicy
      Dimensions:
        - Name: AutoScalingGroupName
          Value:
            Ref: WebAppGroup
      ComparisonOperator: GreaterThanThreshold

Outputs:
  WebAppLB:
    Description: A reference to the Loadbalancer DNS Name
    Value:
      Fn::Join:
        - ''
        - - !Sub ${DNSProtocol}
          - Fn::GetAtt:
            - WebAppLB
            - DNSName
    Export:
      Name: !Sub ${EnvironmentName}-LOAD-BALANCER-DNS