service.yml

AWSTemplateFormatVersion: 2010-09-09
Description: The template used to create an ECS Service from the ECS Console.
Parameters:
  ECSClusterName:
    Type: String
    Default: Place
  ECSServiceName:
    Type: String
    Default: wssService
  # Use existing security groups
  DefaultSecurityGroupIDs:
    Type: CommaDelimitedList
    Default: sg-06a3908c1245df706
  LoadBalancerSecurityGroupIDs:
    Type: CommaDelimitedList
    Default: sg-0bdafb39355b2597f
  ECSServiceSecurityGroupIDs:
    Type: CommaDelimitedList
    Default: sg-0bc68d48a6c1b2242
  SubnetIDs:
    Type: CommaDelimitedList
    Default: 'subnet-0357c98dba54ba094,subnet-01071625f1acd635e,subnet-01f882b6c38bb11d2'
  VpcID:
    Type: String
    Default: vpc-031206103a27a6094
  LoadBalancerName:
    Type: String
    Default: wssLoadBalancer
  TargetGroupName:
    Type: String
    Default: wssTargetGroup
  StaticS3BucketName:
    Type: String
    Default: statics3

Resources:
# ECS section
  ECSFargateCluster:
    Type: 'AWS::ECS::Cluster'
    Properties:
      ClusterName: !Sub '${ECSClusterName}-${AWS::StackName}'
      CapacityProviders: 
        - "FARGATE"
        - "FARGATE_SPOT"

  ECSService:
    Type: 'AWS::ECS::Service'
    Properties:
      Cluster: !Ref ECSFargateCluster
      TaskDefinition: 'arn:aws:ecs:us-east-2:047695596424:task-definition/webSockerServer:4'
      LaunchType: FARGATE
      ServiceName: !Sub '${ECSServiceName}-${AWS::StackName}'
      SchedulingStrategy: REPLICA
      DesiredCount: 2
      LoadBalancers:
        - ContainerName: websocketServer
          ContainerPort: 3000
          LoadBalancerName: !Ref 'AWS::NoValue'
          TargetGroupArn: !Ref TargetGroup
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: ENABLED
          SecurityGroups: !Ref ECSServiceSecurityGroupIDs
          Subnets: !Ref SubnetIDs
      PlatformVersion: LATEST
      DeploymentConfiguration:
        MaximumPercent: 200
        MinimumHealthyPercent: 100
        DeploymentCircuitBreaker:
          Enable: true
          Rollback: true
      DeploymentController:
        Type: ECS
      ServiceConnectConfiguration:
        Enabled: false
      Tags: []
      EnableECSManagedTags: true
    DependsOn:
      - Listener
  LoadBalancer:
    Type: 'AWS::ElasticLoadBalancingV2::LoadBalancer'
    Properties:
      Type: application
      Name: !Sub '${LoadBalancerName}-${AWS::StackName}'
      SecurityGroups: !Ref LoadBalancerSecurityGroupIDs
      Subnets: !Ref SubnetIDs
  TargetGroup:
    Type: 'AWS::ElasticLoadBalancingV2::TargetGroup'
    Properties:
      HealthCheckPath: /health
      Name: !Sub '${TargetGroupName}-${AWS::StackName}'
      Port: 80
      Protocol: HTTP
      TargetType: ip
      HealthCheckProtocol: HTTP
      VpcId: !Ref VpcID
  Listener:
    Type: 'AWS::ElasticLoadBalancingV2::Listener'
    Properties:
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref TargetGroup
      LoadBalancerArn: !Ref LoadBalancer
      Port: '3000'
      Protocol: HTTP

# Cloudfront section
  S3Bucket:
    Type: "AWS::S3::Bucket"
    Properties:
      BucketName: !Sub '${StaticS3BucketName}-${AWS::StackName}'
      BucketEncryption: 
        ServerSideEncryptionConfiguration: 
          - 
            ServerSideEncryptionByDefault: 
              SSEAlgorithm: "AES256"
            BucketKeyEnabled: true
      VersioningConfiguration: 
        Status: "Enabled"
      OwnershipControls: 
        Rules: 
          - 
            ObjectOwnership: "BucketOwnerEnforced"
      PublicAccessBlockConfiguration: 
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

  S3BucketPolicy:
    Type: "AWS::S3::BucketPolicy"
    Properties:
      Bucket: !Ref S3Bucket
      PolicyDocument: 
        Version: "2008-10-17"
        Id: "PolicyForCloudFrontPrivateContent"
        Statement: 
          - 
            Sid: "AllowCloudFrontServicePrincipal"
            Effect: "Allow"
            Principal: 
              Service: "cloudfront.amazonaws.com"
            Action: "s3:GetObject"
            Resource: !Sub "arn:aws:s3:::${S3Bucket}/*"
            Condition: 
              StringEquals: 
                "AWS:SourceArn": !Sub "arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistribution}"

  CloudFrontCachePolicy:
    Type: "AWS::CloudFront::CachePolicy"
    Properties:
      CachePolicyConfig: 
        Name: !Sub 'apiCloudfrontCache-${AWS::StackName}'
        Comment: "Caching policy for API calls at the CDN level"
        DefaultTTL: 5
        MaxTTL: 5
        MinTTL: 1
        ParametersInCacheKeyAndForwardedToOrigin: 
          EnableAcceptEncodingGzip: true
          EnableAcceptEncodingBrotli: true
          CookiesConfig: 
            CookieBehavior: "none"
          HeadersConfig: 
            HeaderBehavior: "none"
          QueryStringsConfig: 
            QueryStringBehavior: "none"

  CloudFrontOriginAccessControl:
    Type: "AWS::CloudFront::OriginAccessControl"
    Properties:
      OriginAccessControlConfig: 
        Name: !GetAtt S3Bucket.RegionalDomainName
        OriginAccessControlOriginType: "s3"
        SigningBehavior: "always"
        SigningProtocol: "sigv4"

  CloudFrontDistribution:
    Type: "AWS::CloudFront::Distribution"
    Properties:
      DistributionConfig: 
        Origins: 
        - 
          ConnectionAttempts: 3
          ConnectionTimeout: 10
          DomainName: !GetAtt S3Bucket.RegionalDomainName
          Id: !GetAtt S3Bucket.RegionalDomainName
          OriginPath: "/static"
          S3OriginConfig:
            OriginAccessIdentity: ''  # Need to specify empty though legacy to avoid error 
          OriginAccessControlId: !GetAtt CloudFrontOriginAccessControl.Id
        - 
          ConnectionAttempts: 3
          ConnectionTimeout: 10
          CustomOriginConfig: 
            HTTPPort: 3000
            HTTPSPort: 443
            OriginKeepaliveTimeout: 5
            OriginProtocolPolicy: "http-only"
            OriginReadTimeout: 30
            OriginSSLProtocols: 
            - "TLSv1.2"
          DomainName: !GetAtt LoadBalancer.DNSName
          Id: !GetAtt LoadBalancer.DNSName
          OriginPath: ""
        DefaultCacheBehavior: 
          AllowedMethods: 
          - "HEAD"
          - "DELETE"
          - "POST"
          - "GET"
          - "OPTIONS"
          - "PUT"
          - "PATCH"
          CachedMethods: 
          - "HEAD"
          - "GET"
          Compress: true
          CachePolicyId: !Ref CloudFrontCachePolicy
          OriginRequestPolicyId: "33f36d7e-f396-46d9-90e0-52428a34d9dc" # aws managed
          SmoothStreaming: false
          TargetOriginId: !GetAtt LoadBalancer.DNSName
          ViewerProtocolPolicy: "allow-all"
        CacheBehaviors: 
        - 
          AllowedMethods: 
          - "HEAD"
          - "GET"
          Compress: true
          CachePolicyId: "4135ea2d-6df8-44a3-9df3-4b5a84be39ad" # aws managed
          PathPattern: "/app/*"
          SmoothStreaming: false
          TargetOriginId: !GetAtt S3Bucket.RegionalDomainName
          ViewerProtocolPolicy: "allow-all"
        Comment: "rplace Cloudfront distribution"
        PriceClass: "PriceClass_All"
        Enabled: true
        ViewerCertificate: 
          CloudFrontDefaultCertificate: true
        Restrictions: 
          GeoRestriction: 
            RestrictionType: "none"
        HttpVersion: "http2and3"
        DefaultRootObject: ""
        IPV6Enabled: true

Outputs:
  ClusterName:
    Description: The cluster used to create the service.
    Value: !Ref ECSClusterName
  ECSService:
    Description: The created service.
    Value: !Ref ECSService
  LoadBalancer:
    Description: The created load balancer.
    Value: !Ref LoadBalancer
  Listener:
    Description: The created listener.
    Value: !Ref Listener
  TargetGroup:
    Description: The created target group.
    Value: !Ref TargetGroup
  StaticBucketName:
    Description: The created static S3 bucket.
    Value: !Ref S3Bucket
  CloudFrontURL:
    Description: The created CloudFront URL.
    Value: !Join
      - ""
      - - "https://"
        - !GetAtt CloudFrontDistribution.DomainName
        - "/app/index.html"