3-Base-Admin.yml

---
AWSTemplateFormatVersion: "2010-09-09"
Description: Admin Instance - Private Node server that generates IDs, sources, configures database, dispenses secrets for VPN servers. This uses a load balancer/autoscaling for automated AWS SSL Certificate assignment.

Parameters:

  Environment:
    Type: String
    Description: Name of the environment to bring up.

  # Optional
  UbuntuAMI:
    Type: String
    Description: Override AMI. If not specified, will use RegionMap.
    Default: ""

  InstanceType:
    Type: String
    Description: Instance Type
    Default: t3.micro

  AllowedIp:
    Type: String
    Description: IP allowed to access Admin
    Default: 192.168.0.0/32

Conditions:

  OverrideAMI: !Not [!Equals [!Ref UbuntuAMI, ""]]

Mappings:

  RegionMap:
    us-east-1:
      AMI: ami-0b93ce03dcbcb10f6
      InstanceType: t3.small
      EbsOptimized: true
    us-east-2:
      AMI: ami-0cbea92f2377277a4
      InstanceType: t3.small
      EbsOptimized: true
    us-west-1:
      AMI: ami-0d4360d9166cfc9cb
      InstanceType: t3.small
      EbsOptimized: true
    us-west-2:
      AMI: ami-0d31d7c9fc9503726
      InstanceType: t3.small
      EbsOptimized: true
    ap-south-1:
      AMI: ami-0ef82eeba2c7a0eeb
      InstanceType: t2.small
      EbsOptimized: false
    ap-northeast-2:
      AMI: ami-003bb1772f36a39a3
      InstanceType: t2.small
      EbsOptimized: false
    ap-southeast-1:
      AMI: ami-09f03fa5572692399
      InstanceType: t3.small
      EbsOptimized: true
    ap-southeast-2:
      AMI: ami-06139e5e22cc2f7b1
      InstanceType: t2.small
      EbsOptimized: false
    ap-northeast-1:
      AMI: ami-0c7cb70d3eb61492b
      InstanceType: t3.small
      EbsOptimized: true
    ca-central-1:
      AMI: ami-07a69147786eb0731
      InstanceType: t3.small
      EbsOptimized: true
    eu-central-1:
      AMI: ami-0b81e95bb0a06ea8c
      InstanceType: t3.small
      EbsOptimized: true
    eu-west-1:
      AMI: ami-029cfca952b331b52
      InstanceType: t3.small
      EbsOptimized: true
    eu-west-2:
      AMI: ami-035469b606478d63d
      InstanceType: t3.small
      EbsOptimized: true
    eu-west-3:
      AMI: ami-01952eddad7516aa7
      InstanceType: t2.small
      EbsOptimized: false
    sa-east-1:
      AMI: ami-055ecc74f0a802e8f
      InstanceType: t2.small
      EbsOptimized: false

Resources:

  AllowedIpParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Join [ '/', [ "", !Ref Environment, "ADMIN", "ALLOWED_IP" ] ]
      Type: String
      Value: !Ref AllowedIp

  TestAllowedIpParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Join [ '/', [ "", !Ref Environment, "TEST", "ADMIN", "ALLOWED_IP" ] ]
      Type: String
      Value: 192.168.0.0/32

  # ==================================================
  # ============= Instance Role ======================
  # ==================================================

  AdminRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
          - Fn::ImportValue:
              !Join [ '-', [ !Ref Environment, SSMManagedPolicy ] ]
      Policies:
        - PolicyName: !Sub ${Environment}-Admin
          PolicyDocument:
            Version: 2012-10-17
            Statement:
            - Effect: Allow
              Action:
                - ec2:AuthorizeSecurityGroupIngress
                - ec2:RevokeSecurityGroupIngress
              Resource:
                - !Sub arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:security-group/${AdminInternalLoadBalancerSecurityGroup.GroupId}
            - Effect: Allow
              Action:
                - ec2:DescribeSecurityGroups
              Resource: "*"
            - Effect: Allow
              Action:
                - ssm:GetParameter
                - ssm:PutParameter
              Resource:
                - !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${Environment}/COMMON/CURRENT_SOURCE_ID
            - Effect: Allow
              Action:
                - ssm:GetParametersByPath
              Resource:
                - !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${Environment}/COMMON
                - !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${Environment}/ADMIN
                - !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${Environment}/MAIN
                - !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${Environment}/RENEWER
                - !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${Environment}/SUPPORT
                - !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${Environment}/PARTNER
                - !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${Environment}/HELPER
                - !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${Environment}/WEBHOOK
                - !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${Environment}/DEBUG
            - Effect: Allow
              Action:
                - logs:CreateLogStream
                - logs:PutLogEvents
              Resource:
                - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${Environment}-Admin
                - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${Environment}-Admin:log-stream:*
                - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${Environment}-Admin-Node
                - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${Environment}-Admin-Node:log-stream:*
            - Effect: Allow
              Action:
                - logs:DescribeLogStreams
                - logs:PutLogEvents
              Resource:
                - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${Environment}-AdminAudit:*
            - Effect: Allow
              Action:
                - logs:DescribeLogStreams
              Resource:
                - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${Environment}-AdminAudit
            - Effect: Allow
              Action:
                - ses:SendEmail
                - ses:SendRawEmail
              Resource: "*"
            - Effect: Allow
              Action:
                - s3:ListBucket
              Resource:
                - !Sub
                  - arn:aws:s3:::${ClientBucket}
                  - ClientBucket:
                      Fn::ImportValue: !Sub ${Environment}-ClientBucket
                - !Sub
                  - arn:aws:s3:::${SuricataBucket}
                  - SuricataBucket:
                      Fn::ImportValue: !Sub ${Environment}-SuricataBucket
            - Effect: Allow
              Action:
                - s3:PutObject
                - s3:GetObject
                - s3:DeleteObject
                - s3:PutObjectAcl
                - s3:PutObjectVersionAcl
              Resource:
                - !Sub
                  - arn:aws:s3:::${ClientBucket}/*
                  - ClientBucket:
                      Fn::ImportValue: !Sub ${Environment}-ClientBucket
                - !Sub
                  - arn:aws:s3:::${SuricataBucket}/*
                  - SuricataBucket:
                      Fn::ImportValue: !Sub ${Environment}-SuricataBucket
            - Effect: Allow
              Action:
                - s3:PutObject
                - s3:PutObjectAcl
                - s3:PutObjectVersionAcl
              Resource:
                - !Sub
                  - arn:aws:s3:::${AdminAuditBucket}/*
                  - AdminAuditBucket:
                      Fn::ImportValue: !Sub ${Environment}-AdminAuditBucket
            - Effect: Allow
              Action:
                - sqs:*
              Resource: "*"

  AdminInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - !Ref AdminRole

  # ==================================================
  # =================== SECURITY GROUPS ==============
  # ==================================================

  AdminSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      VpcId:
        Fn::ImportValue:
          !Join [ '-', [ !Ref Environment, VPCId ] ]
      GroupDescription: Database Postgres In
      Tags:
        - Key: Name
          Value: Admin
        - Key: Environment
          Value: !Ref Environment

  AdminLoadBalancerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      VpcId:
        Fn::ImportValue:
           !Join [ '-', [ !Ref Environment, VPCId ] ]
      GroupDescription: HTTPS In
      Tags:
        - Key: Name
          Value: AdminLoadBalancer
        - Key: Environment
          Value: !Ref Environment

  AdminLoadBalancerAdminSecurityGroupIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      IpProtocol: tcp
      FromPort: 80
      ToPort: 80
      Description: Allow HTTP from Admin Load Balancer to Admin
      SourceSecurityGroupId: !Ref AdminLoadBalancerSecurityGroup
      GroupId: !Ref AdminSecurityGroup

  AllowedIpAdminLoadBalancerSecurityGroupIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      IpProtocol: tcp
      FromPort: 443
      ToPort: 443
      Description: Allow HTTPS from allowed IP to Admin Load Balancer
      CidrIp: !Ref AllowedIp
      GroupId: !Ref AdminLoadBalancerSecurityGroup

  AdminInternalLoadBalancerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      VpcId:
        Fn::ImportValue:
           !Join [ '-', [ !Ref Environment, VPCId ] ]
      GroupName: !Sub ${Environment}-AdminInternalLoadBalancer
      GroupDescription: Internal IPs in
      Tags:
        - Key: Name
          Value: AdminInternalLoadBalancer
        - Key: Environment
          Value: !Ref Environment

  AdminInternalLoadBalancerAdminSecurityGroupIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      IpProtocol: tcp
      FromPort: 80
      ToPort: 80
      Description: Allow HTTP from Admin Internal Load Balancer to Admin
      SourceSecurityGroupId: !Ref AdminInternalLoadBalancerSecurityGroup
      GroupId: !Ref AdminSecurityGroup

  AdminDatabaseSecurityGroupIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      IpProtocol: tcp
      FromPort: 5432
      ToPort: 5432
      Description: Allow Postgres from Admin to Database
      SourceSecurityGroupId: !Ref AdminSecurityGroup
      GroupId:
        Fn::ImportValue:
          !Join [ '-', [ !Ref Environment, DatabaseSecurityGroupId ] ]

  AdminRedisSecurityGroupIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      IpProtocol: tcp
      FromPort: 6379
      ToPort: 6379
      Description: Allow Redis from Admin to Redis
      SourceSecurityGroupId: !Ref AdminSecurityGroup
      GroupId:
        Fn::ImportValue:
          !Join [ '-', [ !Ref Environment, RedisSecurityGroupId ] ]

  AdminSourcesEFSSecurityGroupIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      IpProtocol: tcp
      FromPort: 2049
      ToPort: 2049
      Description: Allow NFS from Admin to SourcesEFS
      SourceSecurityGroupId: !Ref AdminSecurityGroup
      GroupId:
        Fn::ImportValue:
          !Join [ '-', [ !Ref Environment, SourcesEFSSecurityGroupId ] ]

  # ==================================================
  # ================== CODEPIPELINE ==================
  # ==================================================

  AdminCodeBuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: !Join [ '-', [ !Ref Environment, Admin ] ]
      ServiceRole:
        Fn::ImportValue:
           !Join [ '-', [ !Ref Environment, CodeBuildRoleArn ] ]
      Artifacts:
        Type: CODEPIPELINE
      BadgeEnabled: false
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        EnvironmentVariables:
          - Name: ENVIRONMENT
            Type: PLAINTEXT
            Value: !Ref Environment
          - Name: AWS_REGION
            Type: PLAINTEXT
            Value: !Ref AWS::Region
          - Name: PG_ADMIN_PASSWORD
            Type: PLAINTEXT
            Value: admin_pw
          - Name: GIT_BRANCH
            Type: PLAINTEXT
            Value:
              Fn::ImportValue:
                !Join [ '-', [ !Ref Environment, GitBranch ] ]
          - Name: NODE_TLS_REJECT_UNAUTHORIZED
            Type: PLAINTEXT
            Value: 0
        Type: LINUX_CONTAINER
        Image: aws/codebuild/standard:6.0
      Source:
        Type: CODEPIPELINE
      TimeoutInMinutes: 15
      VpcConfig:
        SecurityGroupIds:
          - Fn::ImportValue:
              !Join [ '-', [ !Ref Environment, TestCodeBuildSecurityGroupId ] ]
        Subnets:
          - Fn::ImportValue:
              !Join [ '-', [ !Ref Environment, TestPrivateSubnet ] ]
          - Fn::ImportValue:
              !Join [ '-', [ !Ref Environment, TestPrivateSubnet2 ] ]
        VpcId:
          Fn::ImportValue:
            !Join [ '-', [ !Ref Environment, TestVPCId ] ]
      Tags:
        - Key: Environment
          Value: !Ref Environment

  AdminCodePipeline:
    Type: AWS::CodePipeline::Pipeline
    DependsOn:
      - AdminDeploymentGroup
      - AdminCodeBuildProject
      - AdminLaunchConfiguration
    Properties:
      ArtifactStore:
        EncryptionKey:
          Id:
            Fn::ImportValue:
              !Join [ '-', [ !Ref Environment, CodePipelineKeyId ] ]
          Type: KMS
        Location:
          Fn::ImportValue:
            !Join [ '-', [ !Ref Environment, ArtifactBucket ] ]
        Type: S3
      Name: !Join [ '-', [ !Ref Environment, Admin ] ]
      RoleArn:
        Fn::ImportValue:
           !Join [ '-', [ !Ref Environment, CodePipelineRoleArn ] ]
      Stages:
        - Name: CodeCommit
          Actions:
            - Name: AdminCodeCommit
              RunOrder: 1
              ActionTypeId:
                Category: Source
                Owner: AWS
                Provider: CodeCommit
                Version: 1
              Configuration:
                RepositoryName: !Sub ${Environment}-Admin
                BranchName:
                  Fn::ImportValue:
                    !Join [ '-', [ !Ref Environment, GitBranch ] ]
              OutputArtifacts:
                - Name: CodeCommitArtifact
        - Name: CodeBuild
          Actions:
            - Name: AdminCodeBuild
              RunOrder: 2
              ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: 1
              Configuration:
                ProjectName: !Ref AdminCodeBuildProject
              InputArtifacts:
                - Name: CodeCommitArtifact
              OutputArtifacts:
                - Name: CodeBuildArtifact
        - Name: CodeDeploy
          Actions:
            - Name: AdminCodeDeploy
              RunOrder: 3
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CodeDeploy
                Version: 1
              Configuration:
                ApplicationName: !Ref AdminApplication
                DeploymentGroupName: !Ref AdminDeploymentGroup
              InputArtifacts:
                - Name: CodeBuildArtifact

  AdminApplication:
    Type: AWS::CodeDeploy::Application
    Properties:
      ApplicationName: !Join [ '-', [ !Ref Environment, Admin ] ]

  AdminDeploymentGroup:
    Type: AWS::CodeDeploy::DeploymentGroup
    Properties:
      ApplicationName: !Ref AdminApplication
      AutoScalingGroups:
        - !Ref AdminAutoScalingGroup
      DeploymentConfigName: CodeDeployDefault.OneAtATime
      DeploymentStyle:
        DeploymentOption: WITH_TRAFFIC_CONTROL
        DeploymentType: IN_PLACE
      LoadBalancerInfo:
        TargetGroupInfoList:
          - Name: !GetAtt AdminTargetGroup.TargetGroupName
      ServiceRoleArn:
        Fn::ImportValue:
           !Join [ '-', [ !Ref Environment, CodeDeployRoleArn ] ]

  # ==================================================
  # ===================   ADMIN   ====================
  # ==================================================

  AdminLoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      #LoadBalancerAttributes: # prod only
      #  - Key: deletion_protection.enabled
      #    Value: true
      Scheme: internet-facing
      SecurityGroups:
        - !Ref AdminLoadBalancerSecurityGroup
      Subnets:
        - Fn::ImportValue:
            !Join [ '-', [ !Ref Environment, SubnetId ] ]
        - Fn::ImportValue:
            !Join [ '-', [ !Ref Environment, Subnet2Id ] ]
      Tags:
        - Key: Name
          Value: AdminLoadBalancer
        - Key: Environment
          Value: !Ref Environment
      Type: application
      IpAddressType: ipv4

  AdminInternalLoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      #LoadBalancerAttributes: # prod only
      #  - Key: deletion_protection.enabled
      #    Value: true
      Scheme: internal
      SecurityGroups:
        - !Ref AdminInternalLoadBalancerSecurityGroup
      Subnets:
        - Fn::ImportValue:
            !Join [ '-', [ !Ref Environment, SubnetInternalId ] ]
        - Fn::ImportValue:
            !Join [ '-', [ !Ref Environment, SubnetInternal2Id ] ]
      Tags:
        - Key: Name
          Value: AdminInternalLoadBalancer
        - Key: Environment
          Value: !Ref Environment
      Type: application
      IpAddressType: ipv4

  AdminDNSRecordSet:
    Type: AWS::Route53::RecordSet
    Properties:
      AliasTarget:
        DNSName: !GetAtt AdminLoadBalancer.DNSName
        EvaluateTargetHealth: false
        HostedZoneId: !GetAtt AdminLoadBalancer.CanonicalHostedZoneID
      Comment: !Join [ '-', [ !Ref Environment, AdminLoadBalancer ] ]
      HostedZoneName: !Sub
                        - ${Domain}.
                        - Domain:
                            Fn::ImportValue: !Sub ${Environment}-Domain
      Name: !Sub
              - admin.${Domain}
              - Domain:
                  Fn::ImportValue: !Sub ${Environment}-Domain
      Type: A

  AdminInternalDNSRecordSet:
    Type: AWS::Route53::RecordSet
    Properties:
      AliasTarget:
        DNSName: !GetAtt AdminInternalLoadBalancer.DNSName
        EvaluateTargetHealth: false
        HostedZoneId: !GetAtt AdminInternalLoadBalancer.CanonicalHostedZoneID
      Comment: !Join [ '-', [ !Ref Environment, AdminInternalLoadBalancer ] ]
      HostedZoneId:
        Fn::ImportValue: !Sub ${Environment}-PrivateHostedZoneId
      Name:
        !Join
          - ''
          - - admin.
            - !Sub ${Environment}-private
      Type: A

  AdminTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckIntervalSeconds: 10
      HealthCheckPath: /health
      HealthCheckPort: traffic-port
      HealthCheckProtocol: HTTP
      HealthCheckTimeoutSeconds: 3
      HealthyThresholdCount: 2
      UnhealthyThresholdCount: 2
      Matcher:
        HttpCode: 200
      Name: !Join [ '-', [ !Ref Environment, Admin ] ]
      Port: 80
      Protocol: HTTP
      Tags:
        - Key: Name
          Value: AdminTargetGroup
        - Key: Environment
          Value: !Ref Environment
      TargetGroupAttributes:
        - Key: deregistration_delay.timeout_seconds
          Value: 300
        - Key: stickiness.enabled
          Value: false
      VpcId:
        Fn::ImportValue:
          !Join [ '-', [ !Ref Environment, VPCId ] ]

  AdminInternalTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckIntervalSeconds: 20
      HealthCheckPath: /health
      HealthCheckPort: traffic-port
      HealthCheckProtocol: HTTP
      HealthCheckTimeoutSeconds: 3
      HealthyThresholdCount: 2
      UnhealthyThresholdCount: 2
      Matcher:
        HttpCode: 200
      Name: !Join [ '-', [ !Ref Environment, AdminInternal ] ]
      Port: 80
      Protocol: HTTP
      Tags:
        - Key: Name
          Value: AdminInternalTargetGroup
        - Key: Environment
          Value: !Ref Environment
      TargetGroupAttributes:
        - Key: deregistration_delay.timeout_seconds
          Value: 300
        - Key: stickiness.enabled
          Value: false
      VpcId:
        Fn::ImportValue:
          !Join [ '-', [ !Ref Environment, VPCId ] ]

  AdminLoadBalancerListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      Certificates:
        - CertificateArn:
            Fn::ImportValue: !Sub ${Environment}-DomainCertificate
      DefaultActions:
        - TargetGroupArn: !Ref AdminTargetGroup
          Type: forward
      LoadBalancerArn: !Ref AdminLoadBalancer
      Port: 443
      Protocol: HTTPS
      SslPolicy: ELBSecurityPolicy-TLS-1-2-Ext-2018-06

  # AdminLoadBalancerHttpRedirectListener:
  #   Type: AWS::ElasticLoadBalancingV2::Listener
  #   Properties:
  #     DefaultActions:
  #       - Type: redirect
  #         RedirectConfig:
  #           Port: 443
  #           Protocol: HTTPS
  #           StatusCode: HTTP_301
  #     LoadBalancerArn: !Ref AdminLoadBalancer
  #     Port: 80
  #     Protocol: HTTP

  AdminInternalLoadBalancerListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - TargetGroupArn: !Ref AdminInternalTargetGroup
          Type: forward
      LoadBalancerArn: !Ref AdminInternalLoadBalancer
      Port: 80
      Protocol: HTTP

  AdminAutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    CreationPolicy:
      AutoScalingCreationPolicy:
        MinSuccessfulInstancesPercent: 100
      ResourceSignal:
        Count: 1
        Timeout: PT20M
    UpdatePolicy:
      AutoScalingReplacingUpdate:
        WillReplace: true
    Properties:
      VPCZoneIdentifier:
        - Fn::ImportValue:
            !Join [ '-', [ !Ref Environment, SubnetId ] ]
        - Fn::ImportValue:
            !Join [ '-', [ !Ref Environment, Subnet2Id ] ]
        - Fn::ImportValue:
            !Join [ '-', [ !Ref Environment, SubnetInternalId ] ]
        - Fn::ImportValue:
            !Join [ '-', [ !Ref Environment, SubnetInternal2Id ] ]
      Cooldown: 300
      DesiredCapacity: 1
      MinSize: 1
      MaxSize: 1
      HealthCheckGracePeriod: 300
      HealthCheckType: EC2
      TerminationPolicies:
        - OldestInstance
      LaunchConfigurationName: !Ref AdminLaunchConfiguration
      Tags:
        - Key: Name
          Value: !Join [ '-', [ !Ref Environment, Admin ] ]
          PropagateAtLaunch: true
        - Key: Environment
          Value: !Ref Environment
          PropagateAtLaunch: true
      TargetGroupARNs:
        - !Ref AdminTargetGroup
        - !Ref AdminInternalTargetGroup

  AdminLaunchConfiguration:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      AssociatePublicIpAddress: true
      BlockDeviceMappings:
        - DeviceName: /dev/sda1
          Ebs:
            DeleteOnTermination: true
            VolumeSize: 8
            VolumeType: gp2
      EbsOptimized: true
      IamInstanceProfile: !Ref AdminInstanceProfile
      ImageId: !If [OverrideAMI, !Ref UbuntuAMI, !FindInMap [RegionMap, !Ref "AWS::Region", AMI]]
      InstanceMonitoring: true
      InstanceType: !Ref InstanceType
      SecurityGroups:
        - !Ref AdminSecurityGroup
      UserData:
        "Fn::Base64":
          !Sub |
            #!/bin/bash -ex
            # Install Updates and Python3
            export DEBIAN_FRONTEND=noninteractive
            apt-get update && apt-get dist-upgrade -yq
            apt-get -yq install python3.8-distutils python3-pip python3 python3-setuptools
            # Install CloudFormation Bootstrap
            wget https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-latest.tar.gz
            tar -xvzf aws-cfn-bootstrap-py3-latest.tar.gz
            cd aws-cfn-bootstrap-2.0
            python3 setup.py install
            # Run CloudFormation Init
            cfn-init -c default --stack ${AWS::StackName} --resource AdminLaunchConfiguration --region ${AWS::Region}
            # Signal success to CloudFormation on reboot
            echo "@reboot root /usr/local/bin/cfn-signal --success true --stack ${AWS::StackName} --resource AdminAutoScalingGroup --region ${AWS::Region} 2>&1 | /usr/bin/logger -t cfn_success" >> /etc/cron.d/success_on_reboot
            echo "@reboot root /home/ubuntu/install-codedeploy.sh 2>&1 | /usr/bin/logger -t install_codedeploy" >> /etc/cron.d/install_codedeploy_on_reboot
            # Reboot to pick up latest patches
            reboot
    Metadata:
      AWS::CloudFormation::Init:
        configSets:
          default:
            - "unattended-upgrades"
            - "enable-swap"
            - "install-pip-and-curl-and-ruby"
            - "set-region-and-environment"
            - "install-aws-cloudwatch-and-cli"
            - "install-node"
            - "install-efs-requirements"
            - "mount-efs-sources"
            - "forward-node-port-on-reboot"
            - "install-pm2"
            - "install-codedeploy"
          updateable:
            - "update-nothing"
        unattended-upgrades:
          files:
            '/etc/apt/apt.conf.d/10periodic':
              content: |
                APT::Periodic::Update-Package-Lists "1";
                APT::Periodic::Download-Upgradeable-Packages "1";
                APT::Periodic::AutocleanInterval "7";
                APT::Periodic::Unattended-Upgrade "1";
              mode: '000644'
              owner: root
              group: root
            '/etc/apt/apt.conf.d/50unattended-upgrades':
              content: |
                Unattended-Upgrade::Allowed-Origins {
                  "${distro_id}:${distro_codename}";
                  "${distro_id}:${distro_codename}-security";
                  "${distro_id}ESM:${distro_codename}";
                };
              mode: '000644'
              owner: root
              group: root
        enable-swap:
          commands:
            0_enable_swap:
              command: |
                dd if=/dev/zero of=/var/spool/swap bs=1M count=1k
                mkswap /var/spool/swap
                chmod 0600 /var/spool/swap
                swapon /var/spool/swap
            1_persist_on_reboot:
              command: |
                echo "/var/spool/swap swap swap defaults 0 0" >> /etc/fstab
        update-nothing:
          commands:
            0_do_nothing:
              command: echo "Nothing to Update for Cfn"
        forward-node-port-on-reboot:
          commands:
            0_net_tools:
              command: apt install net-tools
            1_forward:
              command: |
                ETHDEVICE=$(ifconfig -s | grep BMRU | head -n 1 | cut -d" " -f1)
                echo "@reboot root /sbin/iptables -A PREROUTING -t nat -i $ETHDEVICE -p tcp --dport 80 -j REDIRECT --to-port 3000 2>&1 | /usr/bin/logger -t forward_node_port_on_reboot" > /etc/cron.d/forward_node_port_on_reboot
                chmod 0644 /etc/cron.d/forward_node_port_on_reboot
                iptables -A PREROUTING -t nat -i $ETHDEVICE -p tcp --dport 80 -j REDIRECT --to-port 3000
        install-pip-and-curl-and-ruby:
          packages:
            apt:
              curl: []
              python3-pip: []
              ruby: []
        set-region-and-environment:
          commands:
            0_set_environment:
              command: !Sub echo ENVIRONMENT=${Environment} >> /etc/environment
            1_set_region:
              command: !Sub echo AWS_DEFAULT_REGION=${AWS::Region} >> /etc/environment
            2_set_region_node:
              command: !Sub echo AWS_REGION=${AWS::Region} >> /etc/environment
            3_set_git_branch:
              command: !Sub
                - echo GIT_BRANCH=${Branch} >> /etc/environment
                - Branch:
                    Fn::ImportValue:
                      !Join [ '-', [ !Ref Environment, GitBranch ] ]
        install-aws-cloudwatch-and-cli:
          packages:
            apt:
              awscli: []
          files:
            '/home/ubuntu/cloudwatch.config':
              content: !Sub |
                {
                  "logs": {
                    "logs_collected": {
                      "files": {
                        "collect_list": [
                          {
                            "file_path": "/home/node/logs/app.log",
                            "log_group_name": "${Environment}-Admin-Node",
                            "log_stream_name": "{instance_id}-node-log"
                          },
                          {
                            "file_path": "/var/log/cloud-init.log",
                            "log_group_name": "${Environment}-Admin-Node",
                            "log_stream_name": "{instance_id}-cloud-init-placeholder"
                          },
                          {
                            "file_path": "/var/log/syslog",
                            "log_group_name": "${Environment}-Admin",
                            "log_stream_name": "{instance_id}-syslog"
                          },
                          {
                            "file_path": "/var/log/cloud-init.log",
                            "log_group_name": "${Environment}-Admin",
                            "log_stream_name": "{instance_id}-cloud-init"
                          },
                          {
                            "file_path": "/var/log/cloud-init-output.log",
                            "log_group_name": "${Environment}-Admin",
                            "log_stream_name": "{instance_id}-cloud-init-output"
                          },
                          {
                            "file_path": "/var/log/cfn-init.log",
                            "log_group_name": "${Environment}-Admin",
                            "log_stream_name": "{instance_id}-cfn-init"
                          },
                          {
                            "file_path": "/var/log/cfn-init-cmd.log",
                            "log_group_name": "${Environment}-Admin",
                            "log_stream_name": "{instance_id}-cfn-init-cmd"
                          },
                          {
                            "file_path": "/var/log/amazon/ssm/amazon-ssm-agent.log",
                            "log_group_name": "${Environment}-Admin",
                            "log_stream_name": "{instance_id}-aws-ssm"
                          },
                          {
                            "file_path": "/var/log/aws/codedeploy-agent/codedeploy-agent.log",
                            "log_group_name": "${Environment}-Admin",
                            "log_stream_name": "{instance_id}-aws-codedeploy-agent"
                          },
                          {
                            "file_path": "/opt/codedeploy-agent/deployment-root/deployment-logs/codedeploy-agent-deployments.log",
                            "log_group_name": "${Environment}-Admin",
                            "log_stream_name": "{instance_id}-aws-codedeploy-deployments"
                          },
                          {
                            "file_path": "/opt/aws/amazon-cloudwatch-agent/logs/amazon-cloudwatch-agent.log",
                            "log_group_name": "${Environment}-Admin",
                            "log_stream_name": "{instance_id}-cloudwatch-logs"
                          },
                          {
                            "file_path": "/var/log/unattended-upgrades/unattended-upgrades.log",
                            "log_group_name": "${Environment}-Admin",
                            "log_stream_name": "{instance_id}-unattended-upgrades"
                          },
                          {
                            "file_path": "/var/log/unattended-upgrades/unattended-upgrades-dpkg.log",
                            "log_group_name": "${Environment}-Admin",
                            "log_stream_name": "{instance_id}-unattended-upgrades-dpkg"
                          },
                          {
                            "file_path": "/var/run/reboot-required.pkgs",
                            "log_group_name": "${Environment}-Admin",
                            "log_stream_name": "{instance_id}-reboot-required"
                          },
                          {
                            "file_path": "/tmp/CURRENT_NODE_VERSION",
                            "log_group_name": "${Environment}-Admin",
                            "log_stream_name": "{instance_id}-current-node-version"
                          }
                        ]
                      }
                    }
                  },
                  "metrics": {
                    "append_dimensions": {
                      "InstanceId": "${!aws:InstanceId}",
                      "AutoScalingGroupName": "${!aws:AutoScalingGroupName}"
                    },
                    "aggregation_dimensions": [["AutoScalingGroupName"]],
                    "metrics_collected": {
                      "cpu": {
                        "measurement": [
                          "cpu_usage_active",
                          "cpu_usage_iowait",
                          "cpu_usage_user",
                          "cpu_usage_system"
                        ],
                        "metrics_collection_interval": 60,
                        "totalcpu": true
                      },
                      "disk": {
                        "measurement": [
                          "used_percent",
                          "inodes_free"
                        ],
                        "metrics_collection_interval": 60,
                        "resources": [
                          "/"
                        ]
                      },
                      "diskio": {
                        "measurement": [
                          "io_time"
                        ],
                        "metrics_collection_interval": 60,
                        "resources": [
                          "/"
                        ]
                      },
                      "mem": {
                        "measurement": [
                          "mem_used_percent"
                        ],
                        "metrics_collection_interval": 60
                      },
                      "swap": {
                        "measurement": [
                          "swap_used_percent"
                        ],
                        "metrics_collection_interval": 60
                      }
                    }
                  }
                }
              mode: '000644'
              owner: root
              group: root
          commands:
            0_install_cloudwatch:
              command: |
                apt-get -yq install unzip
                wget -q https://s3.amazonaws.com/amazoncloudwatch-agent/linux/amd64/latest/AmazonCloudWatchAgent.zip -P /tmp
                unzip /tmp/AmazonCloudWatchAgent.zip -d /home/ubuntu/cloudwatch_agent
                cd /home/ubuntu/cloudwatch_agent
                ./install.sh
                /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -c file:/home/ubuntu/cloudwatch.config -s
        install-efs-requirements:
          packages:
            apt:
              nfs-common: []
          commands:
            0_get_aws_efs_utils:
              command: git clone https://github.com/aws/efs-utils /tmp/efs-utils
            1_install_binutils:
              command: apt-get -y install binutils
            2_build_aws_efs_utils:
              command: ./build-deb.sh
              cwd: /tmp/efs-utils
            3_install_aws_efs_utils:
              command: apt-get -y install ./build/amazon-efs-utils*deb
              cwd: /tmp/efs-utils
        mount-efs-sources:
          commands:
            0_create_directory:
              command: mkdir -p /home/node/sources
            1_mount_efs:
              command: !Sub
                - mount -t efs -o tls ${SourcesEFSId}:/ /home/node/sources
                - SourcesEFSId:
                    Fn::ImportValue: !Sub ${Environment}-SourcesEFSId
            2_verify_mounted:
              command: if grep -qs '/home/node/sources ' /proc/mounts; then echo "Sources Mounted"; else echo "Error Mounting Source"; exit 1; fi
            3_touch_MOUNTED:
              command: touch /home/node/sources/MOUNTED
            4_change_ownership:
              command: chown -R node:node /home/node/sources
            5_persist_efs_on_reboot:
              command: !Sub
                - echo "${SourcesEFSId}:/ /home/node/sources  efs tls,_netdev  0 0" >> /etc/fstab
                - SourcesEFSId:
                    Fn::ImportValue: !Sub ${Environment}-SourcesEFSId
        install-node:
          commands:
            0_create_user:
              command: |
                      adduser \
                        --system \
                        --shell /bin/bash \
                        --gecos 'Node user' \
                        --group \
                        --disabled-password \
                        --home /home/node \
                        node
            1_setup:
              command: curl -sL https://deb.nodesource.com/setup_16.x | bash -
            2_install:
              command: apt-get install -yq nodejs
            3_update_npm:
              command: npm install -g npm@8
            4_install_n:
              command: npm install -g n
        install-pm2:
          commands:
            0_install:
              command: npm install pm2 -g
            1_restart_on_reboot:
              command: env PATH=$PATH:/usr/local/bin /usr/lib/node_modules/pm2/bin/pm2 startup systemd -u node --hp /home/node
        install-codedeploy:
          files:
            '/home/ubuntu/install-codedeploy.sh':
              content: !Sub |
                export PATH=$PATH:/usr/local/sbin:/usr/sbin:/sbin
                wget -nv "https://aws-codedeploy-${AWS::Region}.s3.amazonaws.com/latest/install" -O /tmp/install
                /bin/chmod +x /tmp/install && /tmp/install auto
              mode: '000544'
              owner: root
              group: root

  # ==================================================
  # ============ APPLICATION ERROR ALERTS ============
  # ==================================================

  AdminNodeEmailerSubscriptionFilter:
    Type: AWS::Logs::SubscriptionFilter
    DependsOn:
      - AdminAutoScalingGroup
    Properties:
      DestinationArn:
        Fn::ImportValue:
          !Join [ '-', [ !Ref Environment, ErrorEmailerFunctionArn ] ]
      FilterPattern: '{ $.level = "error" }'
      LogGroupName: !Join [ '-', [ !Ref Environment, Admin-Node] ]

  # ==================================================
  # ================= CLOUDWATCH ALARMS ==============
  # ==================================================

  AdminTargetGroupUnhealthyHostAlarm:
    Type: AWS::CloudWatch::Alarm
    DependsOn:
      - AdminAutoScalingGroup
    Properties:
      ActionsEnabled: true
      AlarmActions:
        - Fn::ImportValue:
            !Join [ '-', [ !Ref Environment, CloudWatchAlarmEmailerTopic ] ]
      AlarmDescription: !Sub ${Environment} | Admin Unhealthy Host
      MetricName: UnHealthyHostCount
      Namespace: AWS/ApplicationELB
      Statistic: Minimum
      Period: '60'
      EvaluationPeriods: '2'
      Threshold: '1'
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: breaching
      Dimensions:
      - Name: TargetGroup
        Value: !GetAtt AdminTargetGroup.TargetGroupFullName
      - Name: LoadBalancer
        Value: !GetAtt AdminLoadBalancer.LoadBalancerFullName

  AdminTargetGroupHealthyHostAlarm:
    Type: AWS::CloudWatch::Alarm
    DependsOn:
      - AdminAutoScalingGroup
      - AdminTargetGroupUnhealthyHostAlarm
    Properties:
      ActionsEnabled: true
      AlarmActions:
        - Fn::ImportValue:
            !Join [ '-', [ !Ref Environment, CloudWatchAlarmEmailerTopic ] ]
      AlarmDescription: !Sub ${Environment} | Admin Healthy Host
      MetricName: HealthyHostCount
      Namespace: AWS/ApplicationELB
      Statistic: Maximum
      Period: '60'
      EvaluationPeriods: '2'
      Threshold: '1'
      ComparisonOperator: LessThanThreshold
      TreatMissingData: breaching
      Dimensions:
      - Name: TargetGroup
        Value: !GetAtt AdminTargetGroup.TargetGroupFullName
      - Name: LoadBalancer
        Value: !GetAtt AdminLoadBalancer.LoadBalancerFullName

  AdminTargetGroupLatencyAlarm:
    Type: AWS::CloudWatch::Alarm
    DependsOn:
      - AdminAutoScalingGroup
      - AdminTargetGroupHealthyHostAlarm
    Properties:
      ActionsEnabled: true
      AlarmActions:
        - Fn::ImportValue:
            !Join [ '-', [ !Ref Environment, CloudWatchAlarmEmailerTopic ] ]
      AlarmDescription: !Sub ${Environment} | Admin Latency
      MetricName: TargetResponseTime
      Namespace: AWS/ApplicationELB
      Statistic: Average
      Period: '60'
      EvaluationPeriods: '2'
      Threshold: '2'
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: ignore
      Dimensions:
      - Name: TargetGroup
        Value: !GetAtt AdminTargetGroup.TargetGroupFullName
      - Name: LoadBalancer
        Value: !GetAtt AdminLoadBalancer.LoadBalancerFullName

  CpuAlarm:
    Type: AWS::CloudWatch::Alarm
    DependsOn:
      - AdminAutoScalingGroup
      - AdminTargetGroupLatencyAlarm
    Properties:
      ActionsEnabled: true
      AlarmActions:
        - Fn::ImportValue:
            !Join [ '-', [ !Ref Environment, CloudWatchAlarmEmailerTopic ] ]
      AlarmDescription: !Sub ${Environment} | Admin CPU
      MetricName: "cpu_usage_active"
      Namespace: CWAgent
      Statistic: Average
      Period: '60'
      EvaluationPeriods: '2'
      Threshold: '60'
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: breaching
      Dimensions:
      - Name: AutoScalingGroupName
        Value: !Ref AdminAutoScalingGroup

  LowMemoryAlarm:
    Type: AWS::CloudWatch::Alarm
    DependsOn:
      - AdminAutoScalingGroup
      - AdminTargetGroupLatencyAlarm
    Properties:
      ActionsEnabled: true
      AlarmActions:
        - Fn::ImportValue:
            !Join [ '-', [ !Ref Environment, CloudWatchAlarmEmailerTopic ] ]
      AlarmDescription: !Sub ${Environment} | Admin Low Memory
      MetricName: "mem_used_percent"
      Namespace: CWAgent
      Statistic: Maximum
      Period: '300'
      EvaluationPeriods: '1'
      Threshold: '80'
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: breaching
      Dimensions:
      - Name: AutoScalingGroupName
        Value: !Ref AdminAutoScalingGroup

  SwapUsageAlarm:
    Type: AWS::CloudWatch::Alarm
    DependsOn:
      - AdminAutoScalingGroup
      - LowMemoryAlarm
    Properties:
      ActionsEnabled: true
      AlarmActions:
        - Fn::ImportValue:
            !Join [ '-', [ !Ref Environment, CloudWatchAlarmEmailerTopic ] ]
      AlarmDescription: !Sub ${Environment} | Admin Swap Usage
      MetricName: "swap_used_percent"
      Namespace: CWAgent
      Statistic: Maximum
      Period: '300'
      EvaluationPeriods: '1'
      Threshold: '15'
      ComparisonOperator: GreaterThanThreshold
      TreatMissingData: breaching
      Dimensions:
      - Name: AutoScalingGroupName
        Value: !Ref AdminAutoScalingGroup

  DiskUsageAlarm:
    Type: AWS::CloudWatch::Alarm
    DependsOn:
      - AdminAutoScalingGroup
      - SwapUsageAlarm
    Properties:
      ActionsEnabled: true
      AlarmActions:
        - Fn::ImportValue:
            !Join [ '-', [ !Ref Environment, CloudWatchAlarmEmailerTopic ] ]
      AlarmDescription: !Sub ${Environment} | Admin Disk Usage
      MetricName: "disk_used_percent"
      Namespace: CWAgent
      Statistic: Maximum
      Period: '300'
      EvaluationPeriods: '1'
      Threshold: '75'
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: breaching
      Dimensions:
      - Name: AutoScalingGroupName
        Value: !Ref AdminAutoScalingGroup

  UpgradeCheckAlarm:
    Type: AWS::CloudWatch::Alarm
    DependsOn:
      - AdminAutoScalingGroup
      - DiskUsageAlarm
    Properties:
      ActionsEnabled: true
      AlarmActions:
        - Fn::ImportValue:
            !Join [ '-', [ !Ref Environment, CloudWatchAlarmEmailerTopic ] ]
      AlarmDescription: !Sub ${Environment} | Admin Upgrade Check
      MetricName: "Last Upgrade Check Seconds"
      Namespace: CVPN/Shared
      Statistic: Maximum
      Period: '43200'
      EvaluationPeriods: '1'
      Threshold: '172800'
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: breaching
      Dimensions:
      - Name: Environment
        Value: !Ref Environment
      - Name: AutoScalingGroupName
        Value: !Ref AdminAutoScalingGroup

  RestartCheckAlarm:
    Type: AWS::CloudWatch::Alarm
    DependsOn:
      - AdminAutoScalingGroup
      - UpgradeCheckAlarm
    Properties:
      ActionsEnabled: true
      AlarmActions:
        - Fn::ImportValue:
            !Join [ '-', [ !Ref Environment, CloudWatchAlarmEmailerTopic ] ]
      AlarmDescription: !Sub ${Environment} | Admin Restart Check
      MetricName: "# Packages Require Restart"
      Namespace: CVPN/Shared
      Statistic: Minimum
      Period: '43200'
      EvaluationPeriods: '1'
      Threshold: '1'
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: breaching
      Dimensions:
      - Name: Environment
        Value: !Ref Environment
      - Name: AutoScalingGroupName
        Value: !Ref AdminAutoScalingGroup

  SecurityPackagesAlarm:
    Type: AWS::CloudWatch::Alarm
    DependsOn:
      - AdminAutoScalingGroup
      - RestartCheckAlarm
    Properties:
      ActionsEnabled: true
      AlarmActions:
        - Fn::ImportValue:
            !Join [ '-', [ !Ref Environment, CloudWatchAlarmEmailerTopic ] ]
      AlarmDescription: !Sub ${Environment} | Admin Security Packages Upgradable
      MetricName: "# Security Packages Upgradable"
      Namespace: CVPN/Shared
      Statistic: Minimum
      Period: '43200'
      EvaluationPeriods: '2'
      Threshold: '1'
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: breaching
      Dimensions:
      - Name: Environment
        Value: !Ref Environment
      - Name: AutoScalingGroupName
        Value: !Ref AdminAutoScalingGroup

  NodeUpdateCheckAlarm:
    Type: AWS::CloudWatch::Alarm
    DependsOn:
      - AdminAutoScalingGroup
      - SecurityPackagesAlarm
    Properties:
      ActionsEnabled: true
      AlarmActions:
        - Fn::ImportValue:
            !Join [ '-', [ !Ref Environment, CloudWatchAlarmEmailerTopic ] ]
      AlarmDescription: !Sub ${Environment} | Admin Node Update Check
      MetricName: "NodeJS Outdated"
      Namespace: CVPN/Shared
      Statistic: Minimum
      Period: '43200'
      EvaluationPeriods: '1'
      Threshold: '1'
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: breaching
      Dimensions:
      - Name: Environment
        Value: !Ref Environment
      - Name: AutoScalingGroupName
        Value: !Ref AdminAutoScalingGroup

  AdminCodePipelineAlert:
    Type: AWS::Events::Rule
    Properties:
      Description: Alert when CodePipeline Fails
      EventPattern:
        source:
          - "aws.codepipeline"
        detail-type:
          - "CodePipeline Pipeline Execution State Change"
        detail:
          state:
            - "FAILED"
          pipeline:
            - !Ref AdminCodePipeline
      State: ENABLED
      Targets:
        - Arn:
            Fn::ImportValue:
              !Join [ '-', [ !Ref Environment, CloudWatchAlarmEmailerTopic ] ]
          Id: !Join [ '-', [ !Ref Environment, Admin-CodePipeline-Alert ] ]