cloudformation.yaml

---
AWSTemplateFormatVersion: 2010-09-09
Description: Load balancer and task role for the ECS service

Parameters:
  Environment:
    Type: String
    AllowedValues: [ uat, prd ]

Resources:

  ECSTaskRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - ecs-tasks.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: read-write-dynamo-table
          PolicyDocument:
            Statement:
            - Effect: Allow
              Action:
                - 'dynamodb:Put*'
                - 'dynamodb:Update*'
                - 'dynamodb:Query'
                - 'dynamodb:Scan'
                - 'dynamodb:Get*'
                - 'dynamodb:List*'
                - 'dynamodb:BatchGetItem'
                - 'dynamodb:DescribeTable'
              Resource:
                - !GetAtt 'TemplateSummaryTIDTable.Arn'
                - !GetAtt 'TemplateVersionTIDTable.Arn'
        - PolicyName: read-write-s3-buckets
          PolicyDocument:
            Statement:
            - Effect: Allow
              Action:
                - 's3:Get*'
                - 's3:List*'
                - 's3:Put*'
              Resource:
                - 'arn:aws:s3:::ovo-comms-templates'
                - 'arn:aws:s3:::ovo-comms-templates/*'
                - 'arn:aws:s3:::ovo-comms-templates-raw'
                - 'arn:aws:s3:::ovo-comms-templates-raw/*'
                - 'arn:aws:s3:::ovo-comms-template-assets'
                - 'arn:aws:s3:::ovo-comms-template-assets/*'
        - PolicyName: read-credstash
          PolicyDocument:
            Statement:
            - Effect: Allow
              Action:
                - 'kms:Decrypt'
              Resource:
                - !Sub "arn:aws:kms:eu-west-1:${AWS::AccountId}:key/*"
            - Effect: Allow
              Action:
                - 'dynamodb:GetItem'
                - 'dynamodb:Query'
              Resource:
                - !Sub "arn:aws:dynamodb:eu-west-1:${AWS::AccountId}:table/credential-store"

  LoadBalancerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: 'Open port 443 to OVO IP range'

      # All the CIDR blocks for the various OVO offices and VPNs
      # Based on https://ovotech.atlassian.net/wiki/pages/viewpage.action?pageId=40435724
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: '443'
          ToPort: '443'
          CidrIp: 137.221.132.180/32 # Bristol Rivergate
        - IpProtocol: tcp
          FromPort: '443'
          ToPort: '443'
          CidrIp: 137.221.132.196/32 # Bristol Rivergate again
        - IpProtocol: tcp
          FromPort: '443'
          ToPort: '443'
          CidrIp: 137.221.132.212/32 # NGD
        - IpProtocol: tcp
          FromPort: '443'
          ToPort: '443'
          CidrIp: 137.221.132.228/32 # NGD again
        - IpProtocol: tcp
          FromPort: '443'
          ToPort: '443'
          CidrIp: 109.232.58.84/32 # London Astley House
        - IpProtocol: tcp
          FromPort: '443'
          ToPort: '443'
          CidrIp: 109.232.60.4/32 # London Astley House again
        - IpProtocol: tcp
          FromPort: '443'
          ToPort: '443'
          CidrIp: 137.221.142.4/32 # Bristol Templeback
        - IpProtocol: tcp
          FromPort: '443'
          ToPort: '443'
          CidrIp: 137.221.142.20/32 # Bristol Templeback again
        - IpProtocol: tcp
          FromPort: '443'
          ToPort: '443'
          CidrIp: 137.221.144.116/32 # London Kensington Church Street
        - IpProtocol: tcp
          FromPort: '443'
          ToPort: '443'
          CidrIp: 137.221.144.132/32 # London Kensington Church Street again
        - IpProtocol: tcp
          FromPort: '443'
          ToPort: '443'
          CidrIp: 80.169.147.205/32 # London Paddington
        - IpProtocol: tcp
          FromPort: '443'
          ToPort: '443'
          CidrIp: 84.246.176.192/27 # BCP site
        - IpProtocol: tcp
          FromPort: '443'
          ToPort: '443'
          CidrIp: 37.157.52.74/32 # Corgi

      SecurityGroupEgress:
      - IpProtocol: tcp
        FromPort: '32768'
        ToPort: '61000'
        DestinationSecurityGroupId:
          Fn::ImportValue:
            !Sub "${Environment}-Ecs-SecurityGroup-Id"
      Tags:
      - Key: Environment
        Value:
          Ref: Environment
      VpcId:
        Fn::ImportValue:
          !Sub "${Environment}-VPC-Id"

  LoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      LoadBalancerAttributes:
        - Key: access_logs.s3.enabled
          Value: true
        - Key: access_logs.s3.bucket
          Value: ovo-comms-logs
        - Key: access_logs.s3.prefix
          Value: !Sub "template-manager/${Environment}/loadbalancer"
      Scheme: internet-facing
      SecurityGroups:
        - Ref: LoadBalancerSecurityGroup
      Subnets:
      - Fn::ImportValue:
          !Sub "${Environment}-VPC-PublicSubnet1-Id"
      - Fn::ImportValue:
          !Sub "${Environment}-VPC-PublicSubnet2-Id"
      - Fn::ImportValue:
          !Sub "${Environment}-VPC-PublicSubnet3-Id"
      Tags:
        - Key: Environment
          Value:
            Ref: Environment
        - Key: Service
          Value: template-manager

  ECSTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckPath: '/healthcheck'
      HealthCheckProtocol: HTTP
      Port: 80
      Protocol: HTTP
      TargetGroupAttributes:
        - Key: deregistration_delay.timeout_seconds
          Value: 30
      Tags:
        - Key: Environment
          Value:
            Ref: Environment
      VpcId:
        Fn::ImportValue:
          !Sub "${Environment}-VPC-Id"
          
  ALBListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
      - Type: forward
        TargetGroupArn: !Ref 'ECSTargetGroup'
      LoadBalancerArn: !Ref 'LoadBalancer'
      Port: '443'
      Protocol: HTTPS
      Certificates:
      - CertificateArn:
          Fn::ImportValue:
            !Sub "${Environment}-Certificate-Arn"

  ECSALBListenerRule:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      Actions:
      - Type: forward
        TargetGroupArn: !Ref 'ECSTargetGroup'
      Conditions:
      - Field: path-pattern
        Values: [/]
      ListenerArn: !Ref 'ALBListener'
      Priority: 1

  TemplateSummaryTIDTable:
    Type: AWS::DynamoDB::Table
    Properties:
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
      - AttributeName: templateId
        AttributeType: S
      KeySchema:
      - AttributeName: templateId
        KeyType: HASH

  TemplateVersionTIDTable:
    Type: AWS::DynamoDB::Table
    Properties:
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
      - AttributeName: templateId
        AttributeType: S
      - AttributeName: publishedAt
        AttributeType: N
      KeySchema:
      - AttributeName: templateId
        KeyType: HASH
      - AttributeName: publishedAt
        KeyType: RANGE

  TemplateManagerErrorResponseAlarm:
      Type: "AWS::CloudWatch::Alarm"
      Properties:
        ComparisonOperator: GreaterThanOrEqualToThreshold
        Namespace: "AWS/ApplicationELB"
        Dimensions:
          - Name: LoadBalancer
            Value: !GetAtt 'LoadBalancer.LoadBalancerFullName'
        MetricName: HTTPCode_Target_5XX_Count
        AlarmActions:
          - !ImportValue "CloudwatchPagerDutyTopic"
        OKActions:
          - !ImportValue "CloudwatchPagerDutyTopic"
        Period: 60
        EvaluationPeriods: 1
        Statistic: Sum
        Threshold: 1

  TemplateManagerELBErrorResponseAlarm:
      Type: "AWS::CloudWatch::Alarm"
      Properties:
        ComparisonOperator: GreaterThanOrEqualToThreshold
        Namespace: "AWS/ApplicationELB"
        Dimensions:
          - Name: LoadBalancer
            Value: !GetAtt 'LoadBalancer.LoadBalancerFullName'
        MetricName: HTTPCode_ELB_5XX_Count
        AlarmActions:
          - !ImportValue "CloudwatchPagerDutyTopic"
        OKActions:
          - !ImportValue "CloudwatchPagerDutyTopic"
        Period: 60
        EvaluationPeriods: 1
        Statistic: Sum
        Threshold: 1

Outputs:
    TemplateSummaryTableArn:
      Value: !GetAtt 'TemplateSummaryTIDTable.Arn'
      Export:
        Name: "TemplateSummaryTableArn"

    TemplateSummaryTableArnV2:
      Value: !GetAtt 'TemplateSummaryTIDTable.Arn'
      Export:
        Name: "TemplateSummary-TableArn"

    TemplateSummaryTableName:
      Value: !Ref TemplateSummaryTIDTable
      Export:
        Name: "TemplateSummary-TableName"