ecs_cloud_formation_template.json

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Parameters": {
    "ClusterName": {
      "Description": "The name of the ECS cluster",
      "Type": "String",
      "Default": "GoCD"
    }
  },
  "Outputs": {
    "AccessKey": {
      "Value": {
        "Ref": "AccessKey"
      }
    },
    "SecretKey": {
      "Value": {
        "Fn::GetAtt": [
          "AccessKey",
          "SecretAccessKey"
        ]
      }
    },
    "GoCDEC2OptimizedRole": {
      "Value": {
        "Fn::GetAtt": [
          "GoCDEC2OptimizedRole",
          "Arn"
        ]
      }
    },
    "GoCDEC2OptimizedInstanceProfile": {
      "Value": {
        "Fn::GetAtt": [
          "GoCDEC2OptimizedInstanceProfile",
          "Arn"
        ]
      }
    }
  },
  "Resources": {
    "GoCDECSCluster": {
      "Type": "AWS::ECS::Cluster",
      "Properties": {
        "ClusterName": {
          "Ref": "ClusterName"
        }
      }
    },
    "AccessKey": {
      "Type": "AWS::IAM::AccessKey",
      "Properties": {
        "UserName": {
          "Ref": "GoCDECSPluginUser"
        }
      }
    },
    "GoCDECSPluginUser": {
      "Type": "AWS::IAM::User",
      "Properties": {
        "Policies": [
          {
            "PolicyName": "ManageEC2Instances",
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "ec2:RunInstances",
                    "ec2:CreateTags",
                    "ec2:TerminateInstances",
                    "ec2:DescribeInstances",
                    "ec2:DescribeSubnets",
                    "ec2:CreateVolume",
                    "ec2:AttachVolume",
                    "ec2:StopInstances",
                    "ec2:StartInstances",
                    "ec2:DeleteTags",
                    "iam:PassRole",
                    "iam:GetRole"
                  ],
                  "Resource": [
                    "*"
                  ]
                }
              ]
            }
          },
          {
            "PolicyName": "ManageECSInstances",
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "ecs:DescribeClusters",
                    "ecs:DeregisterContainerInstance",
                    "ecs:DescribeContainerInstances",
                    "ecs:ListContainerInstances",
                    "ecs:RegisterTaskDefinition",
                    "ecs:DeregisterTaskDefinition",
                    "ecs:DeleteTaskDefinitions",
                    "ecs:StartTask",
                    "ecs:StopTask",
                    "ecs:ListTasks",
                    "ecs:DescribeTasks",
                    "ecs:DescribeTaskDefinition"
                  ],
                  "Resource": [
                    "*"
                  ]
                }
              ]
            }
          }
        ]
      }
    },
    "GoCDEC2OptimizedRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": {
            "Effect": "Allow",
            "Principal": {
              "Service": [
                "ec2.amazonaws.com"
              ]
            },
            "Action": [
              "sts:AssumeRole"
            ]
          }
        },
        "Policies": [
          {
            "PolicyName": "AllowECSAgentToManageContainers",
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "ecs:DescribeClusters",
                    "ecs:DiscoverPollEndpoint",
                    "ecs:RegisterContainerInstance",
                    "ecs:DeregisterContainerInstance",
                    "ecs:Poll",
                    "ecs:StartTelemetrySession",
                    "ecs:SubmitContainerStateChange",
                    "ecs:SubmitTaskStateChange",
                    "logs:CreateLogStream",
                    "logs:PutLogEvents"
                  ],
                  "Resource": [
                    "*"
                  ]
                }
              ]
            }
          }
        ]
      }
    },
    "GoCDEC2OptimizedInstanceProfile": {
      "Type": "AWS::IAM::InstanceProfile",
      "Properties": {
        "Roles": [
          {
            "Ref": "GoCDEC2OptimizedRole"
          }
        ]
      }
    }
  }
}