main.yml

AWSTemplateFormatVersion : '2010-09-09'
Description: Hello World application network infrastructure for the DevSecOps example
Parameters: 
  System: 
    Type: String
    Default: "DSO"
  Region: 
    Type: String
    Default: "us-east-1"
  Environment: 
    Type: String
  SharedEnvironment:
    Type: String
    Default: "shared"
  SecurityContext: 
    Type: String
  ProvisioningBucket:
    Type: String
    Description: "Name of the bucket used to provision the environment"
  ProvisioningBucketPath:
    Type: String
    Description: "Path in the bucket used to find files for provisioning the environment"
    Default: "cloud-formation"
  InstanceAMI:
    Type: AWS::EC2::Image::Id
    Description: "RHEL-7.3_HVM-20170613-x86_64-4-Hourly2-GP2"
    Default: "ami-9e2f0988"
  InstanceType:
    Type: String
    Default: "t2.medium"
  WaitTimeout:
    Type: Number
    Default: 1200
    Description: >-
      The length of time that wait conditions inside this template wait for a completion signal
Resources:
  Instance:
    Type: AWS::EC2::Instance
    DeletionPolicy: Delete
    Properties:
      DisableApiTermination: false
      SourceDestCheck: false
      IamInstanceProfile:
        Fn::ImportValue:
          !Sub "${System}-${SecurityContext}-helloworld-InstanceProfile"
      ImageId: !Ref InstanceAMI
      InstanceType: !Ref InstanceType
      KeyName: !Sub "${System}-${SecurityContext}-helloworld"
      Monitoring: true
      Tags:
        - Key: System
          Value: !Ref System
        - Key: Environment
          Value: !Ref Environment
        - Key: ServerType
          Value: "helloworld"
        - Key: Name
          Value: !Sub "${System}-${Environment}-helloworld"
      NetworkInterfaces:
        - AssociatePublicIpAddress: true
          DeleteOnTermination: true
          Description: Primary network interface
          DeviceIndex: 0
          SubnetId:
            Fn::ImportValue:
              !Sub "${System}-${SecurityContext}-helloworld-SubnetAZ1"
          GroupSet:
            - Fn::ImportValue:
                !Sub "${System}-${SharedEnvironment}-ssh-securitygroup"
            - Fn::ImportValue:
                !Sub "${System}-${SecurityContext}-helloworld-SecurityGroup"
      UserData: 
        Fn::Base64: !Sub |
          #!/bin/bash -ex
          version="0.1"
          STACK_NAME="${AWS::StackName}"
          REGION="${AWS::Region}"
          RESOURCE="Instance"
          CONFIG_SETS="provision"

          CLI_BOOTSTRAP_FILE="awscli-bundle.zip"
          CLI_BOOTSTRAP="https://s3.amazonaws.com/aws-cli/${!CLI_BOOTSTRAP_FILE}"
          CFN_BOOTSTRAP_FILE="aws-cfn-bootstrap-latest.tar.gz"
          CFN_BOOTSTRAP="https://s3.amazonaws.com/cloudformation-examples/${!CFN_BOOTSTRAP_FILE}"

          RHEL_VERSION=$(lsb_release -a | awk '/^Release:/ {print gensub(/\.([0-9]+)$/,"","g",$2);}')
          EPEL_URL="https://dl.fedoraproject.org/pub/epel/epel-release-latest-${!RHEL_VERSION}.noarch.rpm"

          function signal {
              local code="$1" wait_handle="$2" args=()
              if [ "$code" == "0" ]; then
                  args+=("--success true")
              else
                  args+=("--exit-code ${!code}")
              fi
              if [ "$wait_handle" != "" ]; then
                  args+=("$wait_handle")
              else
                  args+=("--resource $RESOURCE")
                  args+=("--region $REGION")
                  args+=("--stack $STACK_NAME")
              fi
              cfn-signal ${!args[@]}
          }

          function is_installed {
              local name="$1"
              local found=$(yum list $name | grep $name)
              if [ "$found" != "" ]; then
                return 0
              fi
              return 1
          }

          function find_dir_with_pattern {
              local name="$1"
              find . -maxdepth 1 -type d -regex $name -print | head -1
          }

          function install_cli {
              yum install -y unzip
              curl $CLI_BOOTSTRAP -o $CLI_BOOTSTRAP_FILE
              unzip $CLI_BOOTSTRAP_FILE -d /tmp/aws-install
              /tmp/aws-install/awscli-bundle/install --install-dir "/opt/aws" -b /usr/local/bin/aws
              yum remove -y unzip
          }

          function install_cfn {
              local cfn_dir
              curl $CFN_BOOTSTRAP -o $CFN_BOOTSTRAP_FILE
              /opt/aws/bin/easy_install --script-dir "/opt/aws/bin" $CFN_BOOTSTRAP_FILE
              tar -xvzf $CFN_BOOTSTRAP_FILE
              cfn_dir=$(find_dir_with_pattern './aws-cfn-bootstrap-[0-9]\.[0-9]')
              if [ "$cfn_dir" == "" ] || [ ! -d "$cfn_dir" ]; then
                  echo "Did not find a directory aws-cfn-bootstrap-.*"
                  return 1
              fi
              cd $cfn_dir
              python setup.py build
              python setup.py install
              ln -s /usr/init/redhat/cfn-hup /etc/init.d/cfn-hup
              chmod 775 /usr/init/redhat/cfn-hup
          }

          function install {
              yum update -y
              yum install -y $EPEL_URL
              yum install -y dos2unix
              if is_installed "aws-cfn-bootstrap"; then
                  yum update -y aws-cfn-bootstrap
              else
                  mkdir -p /tmp/aws-install
                  pushd /tmp/aws-install
                  install_cli || return 1
                  install_cfn || return 2
                  popd
                  rm -rf /tmp/aws-install
              fi
          }

          function provision {
              export PATH="${!PATH}:/opt/aws/bin"
              cfn-init --verbose --stack "$STACK_NAME" --region "$REGION" \
                  --resource "$RESOURCE" --configsets "$CONFIG_SETS"
              signal $? "${InstanceReadyHandle}" || return 1
          }
          install || exit 1
          provision || exit 2
    Metadata: 
      AWS::CloudFormation::Authentication:
        S3AccessCredentials:
          type: "S3"
          roleName: !Sub "${System}-${SecurityContext}-helloworld"
          buckets: 
            - !Ref ProvisioningBucket
      AWS::CloudFormation::Init: 
        configSets:
          provision:
            - "awslogs"
            - "cfn-hup"
            - "docker"
            - "scripts"
            - "helloworld"
        awslogs:
          files:
            /tmp/awslogs-agent-setup.py:
              source: "https://s3.amazonaws.com/aws-cloudwatch/downloads/latest/awslogs-agent-setup.py"
              group: "root"
              owner: "root"
              mode: "000400"
            /etc/awslogs/awscli.conf:
              content: !Sub |
                 region = ${AWS::Region}
              mode: "000400"
              owner: "root"
              group: "root"
            /etc/awslogs/awslogs.conf:
              content: !Sub |
                [general]
                state_file= /var/awslogs/state/agent-state

                [yum]
                file = /var/log/yum.log
                log_group_name = ${System}-${Environment}-helloworld
                log_stream_name = yum.log

                [messages]
                file = /var/log/messages
                log_group_name = ${System}-${Environment}-helloworld
                log_stream_name = messages.log
                
                [cfn-hup]
                file = /var/log/cfn-hup.log
                log_group_name = ${System}-${Environment}-helloworld
                log_stream_name = cfn-hup.log

                [cfn-init]
                file = /var/log/cfn-init.log
                log_group_name = ${System}-${Environment}-helloworld
                log_stream_name = cfn-init.log

                [cfn-init-cmd]
                file = /var/log/cfn-init-cmd.log
                log_group_name = ${System}-${Environment}-helloworld
                log_stream_name = cfn-init.log

                [cloud-init]
                file = /var/log/cloud-init.log
                log_group_name = ${System}-${Environment}-helloworld
                log_stream_name = cloud-init.log

                [cloud-init-output]
                file = /var/log/cloud-init-output.log
                log_group_name = ${System}-${Environment}-helloworld
                log_stream_name = cloud-init.log

                [handler]
                file = /var/log/handler.log
                log_group_name = ${System}-${Environment}-helloworld
                log_stream_name = handler.log
              group: "root"
              owner: "root"
              mode: "000400"
          commands:
            1-install-agent:
              command: !Sub |
                python /tmp/awslogs-agent-setup.py --region ${AWS::Region} \
                    --non-interactive --configfile /etc/awslogs/awslogs.conf
          services:
            sysvinit:
              awslogs:
                enabled: "true"
                ensureRunning: "true"
                files:
                  - /etc/awslogs/awscli.conf
                  - /etc/awslogs/awslogs.conf
        cfn-hup:
          files:
            /etc/cfn/cfn-hup.conf:
              content: !Sub |
                [main]
                stack=${AWS::StackName}
                region=${AWS::Region}
                interval=5
                verbose=true
              mode: "000400"
              owner: "root"
              group: "root"
            /etc/cfn/hooks.d/cfn-auto-reloader.conf:
              content: !Sub |
                [cfn-auto-reloader-hook]
                triggers=post.update
                path=Resources.Instance.Metadata.AWS::CloudFormation::Init
                action=/opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource Instance --configsets provision --region ${AWS::Region}
                runas=root
              mode: "000400"
              owner: "root"
              group: "root"
          services:
            sysvinit:
              cfn-hup: 
                enabled: "true"
                ensureRunning: "true"
                files:
                  - /etc/cfn/cfn-hup.conf
                  - /etc/cfn/hooks.d/cfn-auto-reloader.conf
        docker:
          commands:
            0-install:
              command: !Sub |
                  yum install --setopt=obsoletes=0 docker-ce-17.03.2.ce-1.el7.centos.x86_64 \
                    docker-ce-selinux-17.03.2.ce-1.el7.centos.noarch
                  yum install -y yum-utils device-mapper-persistent-data lvm2
                  yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
                  yum-config-manager --enable docker-ce-edge
                  yum makecache fast
                  yum -y --enablerepo=rhui-REGION-rhel-server-extras install container-selinux
                  yum -y install docker-ce                  
                  chkconfig docker on
                  service docker start
        scripts:
          commands:
            0-create-directory:
              command: !Sub |
                mkdir -p /opt/dso
                chown root:root /opt/dso
                chmod 755 /opt/dso
        helloworld:
          files:
            /opt/dso/deploy-app:
              source: !Sub "https://s3.amazonaws.com/${ProvisioningBucket}/${ProvisioningBucketPath}/${System}/${Environment}/helloworld-app/deploy-app.sh"
              group: "root"
              owner: "root"
              mode: "000700"
          commands:
            # Dummy app to verify the deployment
            # Subsequently use /opt/dso/deploy-app <tag> <server> <credentials> to deploy
            0-install-exampleimage:
              command: !Sub |
                docker run -d -p 80:80 --name webserver kitematic/hello-world-nginx
  InstanceReadyHandle: 
    Type: "AWS::CloudFormation::WaitConditionHandle"
  InstanceIsReady: 
    Type: "AWS::CloudFormation::WaitCondition"
    Properties: 
      Handle: !Ref "InstanceReadyHandle"
      Timeout: !Ref WaitTimeout
      Count: 1
Outputs:
  PublicIp:
    Value: !GetAtt Instance.PublicIp
    Export: 
      Name: !Sub "${System}-${Environment}-helloworld-PublicIp"