deployment-runner-amd.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: This will install the deployment runner on the selected subnet. The organization id and key are unique to your account and used for authorization and communication with deployment servers.
Mappings:
  RegionMap:
    af-south-1:
      AMI: ami-04a4d5340d7c6f5a8
    ap-east-1:
      AMI: ami-0bb6b2c20c79249d9
    ap-northeast-1:
      AMI: ami-01e9b1393f6f885a6
    ap-northeast-2:
      AMI: ami-0aea0366403b20ba4
    ap-northeast-3:
      AMI: ami-0c4af26e0fe378594
    ap-south-1:
      AMI: ami-018bf378c35021448
    ap-south-2:
      AMI: ami-02ab24bbb70d8b23d
    ap-southeast-1:
      AMI: ami-084a70ad874e38927
    ap-southeast-2:
      AMI: ami-05eed9f4669298905
    ap-southeast-3:
      AMI: ami-04efe11c355a08799
    ap-southeast-4:
      AMI: ami-0422de4da5b499e43
    ca-central-1:
      AMI: ami-09e3a92e7e915066a
    eu-central-1:
      AMI: ami-0f57826d62bc45f9a
    eu-central-2:
      AMI: ami-0e0e1ce4dd6fdd547
    eu-north-1:
      AMI: ami-03ae2981efe8fdf66
    eu-south-1:
      AMI: ami-0ab85d5846ff5b685
    eu-south-2:
      AMI: ami-07d4ca1170cb1cc96
    eu-west-1:
      AMI: ami-072dfd6f721064ef5
    eu-west-2:
      AMI: ami-091af47000bc0bcc1
    eu-west-3:
      AMI: ami-0fa70be5370f3acba
    me-central-1:
      AMI: ami-01e71868cf9d675ff
    me-south-1:
      AMI: ami-03fada5f088680262
    sa-east-1:
      AMI: ami-0de65f7c84423a28f
    us-east-1:
      AMI: ami-0b5f24ecac7c8ece8
    us-east-2:
      AMI: ami-067597b36c985e7f5
    us-west-1:
      AMI: ami-03ec2424fb2711247
    us-west-2:
      AMI: ami-067589e69c0d9554f
Parameters:
  DeploymentRunnerSubnetId:
    AllowedPattern: ^(?!\s*$).+
    ConstraintDescription: Subnet is required
    Description: '[Required]. Please select Subnet where the runner will be deployed.'
    Type: AWS::EC2::Subnet::Id
  Key:
    AllowedPattern: ^[a-zA-Z0-9]+$
    ConstraintDescription: API key must only contain uppercase and lowercase letters and numbers
    Description: '[Do not update]. This is your unique prefilled token key identifier that is used for communication with deployment.io.'
    Type: String
  OrganizationID:
    AllowedPattern: ^[a-zA-Z0-9]+$
    ConstraintDescription: Organization ID must only contain uppercase and lowercase letters and numbers
    Description: '[Do not update]. This is your unique prefilled organization id.'
    Type: String
Resources:
  DeploymentEcsInstanceProfilelinuxamd:
    DependsOn:
      - DeploymentEcsInstanceRolelinuxamd
    Properties:
      InstanceProfileName:
        Fn::Join:
          - '-'
          - - ecsInstanceProfilelinuxamd
            - Ref: OrganizationID
            - Ref: AWS::Region
      Roles:
        - Ref: DeploymentEcsInstanceRolelinuxamd
    Type: AWS::IAM::InstanceProfile
  DeploymentEcsInstanceRolelinuxamd:
    Properties:
      AssumeRolePolicyDocument: |-
        {
          "Version": "2008-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": "ec2.amazonaws.com"
              },
              "Action": "sts:AssumeRole"
            }
          ]
        }
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role
      RoleName:
        Fn::Join:
          - '-'
          - - ecsInstanceRolelinuxamd
            - Ref: OrganizationID
            - Ref: AWS::Region
      Tags:
        - Key: created by
          Value: deployment.io
    Type: AWS::IAM::Role
  DeploymentLambdaCustomResourcelinuxamd:
    DependsOn:
      - DeploymentWaitConditionHandlelinuxamd
    Properties:
      ServiceToken:
        Fn::GetAtt:
          - DeploymentLambdalinuxamd
          - Arn
    Type: AWS::CloudFormation::CustomResource
  DeploymentLambdalinuxamd:
    Properties:
      Code:
        ZipFile: |4+
            import json
        
            import urllib3
            import os
            import boto3
            import time
            import cfnresponse
            import uuid
        
            http = urllib3.PoolManager()
        
        
            def handler(event, context):
                if event.get('RequestType') == 'Delete':
                    response_data = {'message': 'Deleting lambda'}
                    cfnresponse.send(event, context, cfnresponse.SUCCESS, response_data)
                    return
                try:
                    track_cloudformation_start()
                except:
                    print("failed to track cloudformation start")
                create_ecs_service_linked_role()
                arn = create_or_get_ecs_task_execution_role()
                encoded_body = json.dumps({
                    "Status": "SUCCESS",
                    "Reason": "ECS service link role setup completed",
                    "UniqueId": str(uuid.uuid4()),
                    "Data": "ECS service link role setup completed"
                })
                cfnresponse.send(event, context, cfnresponse.SUCCESS, {'message': 'Done executing lambda', 'eteRoleArn': arn})
                http.request('PUT', os.environ['WAIT_URL'], body=encoded_body)
                return
        
        
            def create_ecs_service_linked_role():
                iam = boto3.client('iam')
                try:
                    iam.create_service_linked_role(AWSServiceName='ecs.amazonaws.com')
                    time.sleep(60)
                except:
                    return
        
        
            roleTrustPolicy = """{
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Principal": {
                    "Service": "ecs-tasks.amazonaws.com"
                  },
                  "Action": "sts:AssumeRole"
                }
              ]
            }"""
        
        
            def create_or_get_ecs_task_execution_role():
                iam = boto3.client('iam')
                try:
                    response = iam.get_role(RoleName=os.environ['ECS_TASK_EXECUTION_ROLE_NAME'])
                    return response['Role']['Arn']
        
                except:
                    pass
        
                try:
                    response = iam.create_role(RoleName=os.environ['ECS_TASK_EXECUTION_ROLE_NAME'],
                                               AssumeRolePolicyDocument=roleTrustPolicy,
                                               Tags=[
                                                   {
                                                       'Key': 'created by',
                                                       'Value': 'deployment.io'
                                                   }
                                               ])
                    iam.attach_role_policy(
                        RoleName=os.environ['ECS_TASK_EXECUTION_ROLE_NAME'],
                        PolicyArn='arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy'
                    )
                    iam.attach_role_policy(
                        RoleName=os.environ['ECS_TASK_EXECUTION_ROLE_NAME'],
                        PolicyArn='arn:aws:iam::aws:policy/CloudWatchFullAccess'
                    )
                    iam.attach_role_policy(
                        RoleName=os.environ['ECS_TASK_EXECUTION_ROLE_NAME'],
                        PolicyArn='arn:aws:iam::aws:policy/SecretsManagerReadWrite'
                    )
                    return response['Role']['Arn']
                except:
                    return "arn is not valid"
        
        
            def track_cloudformation_start():
                url = "https://api.deployment.io/v1/onboarding/cf-start"
                payload = json.dumps({
                    "organizationId": os.environ['ORGANIZATION_ID'],
                    "token": os.environ['TOKEN'],
                })
                headers = {
                    'Content-Type': 'application/json'
                }
                resp = http.request("POST", url,
                                    body=payload,
                                    headers=headers,
                                    retries=False)
        
                return

      Description: Check if AWS ECS Service linked Role exists. If not, create it and wait for it to be stable
      Environment:
        Variables:
          ECS_TASK_EXECUTION_ROLE_NAME:
            Fn::Join:
              - '-'
              - - eTERole-linuxamd
                - Ref: OrganizationID
                - Ref: AWS::Region
          ORGANIZATION_ID:
            Ref: OrganizationID
          TOKEN:
            Ref: Key
          WAIT_URL:
            Ref: DeploymentWaitConditionHandlelinuxamd
      Handler: index.handler
      Role:
        Fn::GetAtt:
          - DeploymentRunnerLambdaRolelinuxamd
          - Arn
      Runtime: python3.9
      Tags:
        - Key: created by
          Value: deployment.io
      Timeout: 100
    Type: AWS::Lambda::Function
  DeploymentRunnerASGlinuxamd:
    DependsOn:
      - DeploymentRunnerLaunchTemplatelinuxamd
    Properties:
      AutoScalingGroupName:
        Fn::Join:
          - '-'
          - - dr-asg-linuxamd
            - Ref: OrganizationID
            - Ref: AWS::Region
      DefaultInstanceWarmup: 5
      DesiredCapacity: "0"
      LaunchTemplate:
        LaunchTemplateId:
          Ref: DeploymentRunnerLaunchTemplatelinuxamd
        Version:
          Fn::GetAtt:
            - DeploymentRunnerLaunchTemplatelinuxamd
            - LatestVersionNumber
      MaxSize: "2"
      MinSize: "0"
      VPCZoneIdentifier:
        - Ref: DeploymentRunnerSubnetId
    Type: AWS::AutoScaling::AutoScalingGroup
  DeploymentRunnerAwsControllerServicelinuxamd:
    DependsOn:
      - DeploymentRunnerClusterlinuxamd
      - DeploymentRunnerAwsControllerTaskDefinitionlinuxamd
    Properties:
      Cluster:
        Fn::Join:
          - '-'
          - - dr-linuxamd
            - Ref: OrganizationID
      DeploymentConfiguration:
        MaximumPercent: 100
        MinimumHealthyPercent: 0
      DesiredCount: 1
      EnableECSManagedTags: false
      EnableExecuteCommand: false
      LaunchType: FARGATE
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: ENABLED
          Subnets:
            - Ref: DeploymentRunnerSubnetId
      PropagateTags: TASK_DEFINITION
      SchedulingStrategy: REPLICA
      ServiceName:
        Fn::Join:
          - '-'
          - - dr-aws-controller-linuxamd
            - Ref: OrganizationID
            - Ref: AWS::Region
      Tags:
        - Key: Name
          Value:
            Fn::Join:
              - '-'
              - - dr-aws-controller-linuxamd
                - Ref: OrganizationID
                - Ref: AWS::Region
        - Key: created by
          Value: deployment.io
      TaskDefinition:
        Ref: DeploymentRunnerAwsControllerTaskDefinitionlinuxamd
    Type: AWS::ECS::Service
  DeploymentRunnerAwsControllerTaskDefinitionlinuxamd:
    DependsOn:
      - DeploymentWaitConditionlinuxamd
      - DeploymentRunnerTaskRolelinuxamd
    Properties:
      ContainerDefinitions:
        - DisableNetworking: false
          Environment:
            - Name: Token
              Value:
                Ref: Key
            - Name: OrganizationID
              Value:
                Ref: OrganizationID
            - Name: Service
              Value: go.deployment.io:443
            - Name: DockerImage
              Value: docker.io/arorankit/deployment-runner-aws-controller-amd64:4
            - Name: DockerRunnerImage
              Value: docker.io/arorankit/deployment-runner-amd64:27
            - Name: Region
              Value:
                Ref: AWS::Region
            - Name: Memory
              Value: 6 GB
            - Name: ExecutionRoleArn
              Value:
                Fn::GetAtt:
                  - DeploymentLambdaCustomResourcelinuxamd
                  - eteRoleArn
            - Name: TaskRoleArn
              Value:
                Ref: DeploymentRunnerTaskRolelinuxamd
            - Name: AWSAccountID
              Value:
                Ref: AWS::AccountId
          Essential: true
          Image: docker.io/arorankit/deployment-runner-aws-controller-amd64:4
          Interactive: false
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-create-group: "true"
              awslogs-group: dr-aws-controller-logs-group-linuxamd
              awslogs-region:
                Ref: AWS::Region
              awslogs-stream-prefix: "4"
          Name:
            Fn::Join:
              - '-'
              - - dr-aws-controller-linuxamd
                - Ref: OrganizationID
                - Ref: AWS::Region
          Privileged: false
          PseudoTerminal: false
          ReadonlyRootFilesystem: false
      Cpu: .25 vCPU
      ExecutionRoleArn:
        Fn::GetAtt:
          - DeploymentLambdaCustomResourcelinuxamd
          - eteRoleArn
      Family:
        Fn::Join:
          - '-'
          - - dr-aws-controller-linuxamd
            - Ref: OrganizationID
            - Ref: AWS::Region
      Memory: 0.5 GB
      NetworkMode: awsvpc
      RuntimePlatform:
        CpuArchitecture: X86_64
        OperatingSystemFamily: LINUX
      Tags:
        - Key: Name
          Value:
            Fn::Join:
              - '-'
              - - dr-aws-controller-linuxamd
                - Ref: OrganizationID
                - Ref: AWS::Region
        - Key: created by
          Value: deployment.io
      TaskRoleArn:
        Ref: DeploymentRunnerTaskRolelinuxamd
    Type: AWS::ECS::TaskDefinition
  DeploymentRunnerCClinuxamd:
    DependsOn:
      - DeploymentRunnerASGlinuxamd
      - DeploymentWaitConditionlinuxamd
    Properties:
      AutoScalingGroupProvider:
        AutoScalingGroupArn:
          Ref: DeploymentRunnerASGlinuxamd
      Name:
        Fn::Join:
          - '-'
          - - dr-capacity-provider-linuxamd
            - Ref: OrganizationID
            - Ref: AWS::Region
      Tags:
        - Key: created by
          Value: deployment.io
        - Key: capacity provider
          Value:
            Fn::Join:
              - '-'
              - - dr-capacity-provider-linuxamd
                - Ref: OrganizationID
                - Ref: AWS::Region
    Type: AWS::ECS::CapacityProvider
  DeploymentRunnerClusterlinuxamd:
    DependsOn:
      - DeploymentRunnerCClinuxamd
    Properties:
      CapacityProviders:
        - FARGATE
        - Fn::Join:
            - '-'
            - - dr-capacity-provider-linuxamd
              - Ref: OrganizationID
              - Ref: AWS::Region
      ClusterName:
        Fn::Join:
          - '-'
          - - dr-linuxamd
            - Ref: OrganizationID
      Tags:
        - Key: created by
          Value: deployment.io
    Type: AWS::ECS::Cluster
  DeploymentRunnerLambdaRolelinuxamd:
    Properties:
      AssumeRolePolicyDocument: |-
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": "lambda.amazonaws.com"
              },
              "Action": "sts:AssumeRole"
            }
          ]
        }
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - iam:CreateServiceLinkedRole
                Condition:
                  StringLike:
                    iam:AWSServiceName: ecs.amazonaws.com
                Effect: Allow
                Resource:
                  - arn:aws:iam::*:role/aws-service-role/ecs.amazonaws.com/*
                Sid: "01"
              - Action:
                  - iam:CreateRole
                  - iam:GetRole
                  - iam:TagRole
                  - iam:AttachRolePolicy
                  - iam:PutRolePolicy
                Effect: Allow
                Resource:
                  - arn:aws:iam::*:role/*
                Sid: "02"
            Version: "2012-10-17"
          PolicyName:
            Fn::Join:
              - '-'
              - - dr-lambda-policy-linuxamd
                - Ref: OrganizationID
                - Ref: AWS::Region
      RoleName:
        Fn::Join:
          - '-'
          - - dr-lambda-linuxamd
            - Ref: OrganizationID
            - Ref: AWS::Region
      Tags:
        - Key: created by
          Value: deployment.io
    Type: AWS::IAM::Role
  DeploymentRunnerLaunchTemplatelinuxamd:
    Properties:
      LaunchTemplateData:
        IamInstanceProfile:
          Arn:
            Fn::GetAtt:
              - DeploymentEcsInstanceProfilelinuxamd
              - Arn
        ImageId:
          Fn::FindInMap:
            - RegionMap
            - Ref: AWS::Region
            - AMI
        InstanceType: m6a.large
        NetworkInterfaces:
          - DeviceIndex: 0
            SubnetId:
              Ref: DeploymentRunnerSubnetId
        TagSpecifications:
          - ResourceType: instance
            Tags:
              - Key: created by
                Value: deployment.io
              - Key: instance launch template
                Value:
                  Fn::Join:
                    - '-'
                    - - dr-template-linuxamd
                      - Ref: OrganizationID
                      - Ref: AWS::Region
        UserData:
          Fn::Base64:
            Fn::Join:
              - "\n"
              - - '#!/bin/bash'
                - Fn::Join:
                    - ""
                    - - 'echo "ECS_CLUSTER='
                      - Fn::Join:
                          - '-'
                          - - 'dr-linuxamd'
                            - Ref: OrganizationID
                      - '" >> /etc/ecs/ecs.config'
      LaunchTemplateName:
        Fn::Join:
          - '-'
          - - dr-template-linuxamd
            - Ref: OrganizationID
            - Ref: AWS::Region
      TagSpecifications:
        - ResourceType: launch-template
          Tags:
            - Key: created by
              Value: deployment.io
            - Key: launch template
              Value:
                Fn::Join:
                  - '-'
                  - - dr-template-linuxamd
                    - Ref: OrganizationID
                    - Ref: AWS::Region
      VersionDescription: launch template for deployment runner ec2 instance
    Type: AWS::EC2::LaunchTemplate
  DeploymentRunnerServicelinuxamd:
    DependsOn:
      - DeploymentRunnerClusterlinuxamd
      - DeploymentRunnerTaskDefinitionlinuxamd
    Properties:
      CapacityProviderStrategy:
        - CapacityProvider:
            Fn::Join:
              - '-'
              - - dr-capacity-provider-linuxamd
                - Ref: OrganizationID
                - Ref: AWS::Region
          Weight: 1
      Cluster:
        Fn::Join:
          - '-'
          - - dr-linuxamd
            - Ref: OrganizationID
      DeploymentConfiguration:
        MaximumPercent: 100
        MinimumHealthyPercent: 0
      DesiredCount: 0
      EnableECSManagedTags: false
      EnableExecuteCommand: false
      PropagateTags: TASK_DEFINITION
      SchedulingStrategy: REPLICA
      ServiceName:
        Fn::Join:
          - '-'
          - - dr-linuxamd
            - Ref: OrganizationID
            - Ref: AWS::Region
      Tags:
        - Key: Name
          Value:
            Fn::Join:
              - '-'
              - - dr-linuxamd
                - Ref: OrganizationID
                - Ref: AWS::Region
        - Key: created by
          Value: deployment.io
      TaskDefinition:
        Ref: DeploymentRunnerTaskDefinitionlinuxamd
    Type: AWS::ECS::Service
  DeploymentRunnerTaskDefinitionlinuxamd:
    DependsOn:
      - DeploymentWaitConditionlinuxamd
      - DeploymentRunnerTaskRolelinuxamd
    Properties:
      ContainerDefinitions:
        - DisableNetworking: false
          Environment:
            - Name: Token
              Value:
                Ref: Key
            - Name: OrganizationID
              Value:
                Ref: OrganizationID
            - Name: Service
              Value: go.deployment.io:443
            - Name: DockerImage
              Value: docker.io/arorankit/deployment-runner-amd64:27
            - Name: Region
              Value:
                Ref: AWS::Region
            - Name: Memory
              Value: 6 GB
            - Name: ExecutionRoleArn
              Value:
                Fn::GetAtt:
                  - DeploymentLambdaCustomResourcelinuxamd
                  - eteRoleArn
            - Name: TaskRoleArn
              Value:
                Ref: DeploymentRunnerTaskRolelinuxamd
            - Name: AWSAccountID
              Value:
                Ref: AWS::AccountId
          Essential: true
          Image: docker.io/arorankit/deployment-runner-amd64:27
          Interactive: false
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-create-group: "true"
              awslogs-group: dr-logs-group-linuxamd
              awslogs-region:
                Ref: AWS::Region
              awslogs-stream-prefix: "27"
          MountPoints:
            - ContainerPath: /var/run/docker.sock
              SourceVolume: docker-socket
            - ContainerPath: /tmp
              SourceVolume: temp
          Name:
            Fn::Join:
              - '-'
              - - dr-linuxamd
                - Ref: OrganizationID
                - Ref: AWS::Region
          Privileged: false
          PseudoTerminal: false
          ReadonlyRootFilesystem: false
      ExecutionRoleArn:
        Fn::GetAtt:
          - DeploymentLambdaCustomResourcelinuxamd
          - eteRoleArn
      Family:
        Fn::Join:
          - '-'
          - - dr-linuxamd
            - Ref: OrganizationID
            - Ref: AWS::Region
      Memory: 6 GB
      NetworkMode: host
      RuntimePlatform:
        CpuArchitecture: X86_64
        OperatingSystemFamily: LINUX
      Tags:
        - Key: Name
          Value:
            Fn::Join:
              - '-'
              - - dr-linuxamd
                - Ref: OrganizationID
                - Ref: AWS::Region
        - Key: created by
          Value: deployment.io
      TaskRoleArn:
        Ref: DeploymentRunnerTaskRolelinuxamd
      Volumes:
        - Host:
            SourcePath: /var/run/docker.sock
          Name: docker-socket
        - Host:
            SourcePath: /tmp
          Name: temp
    Type: AWS::ECS::TaskDefinition
  DeploymentRunnerTaskRolelinuxamd:
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Condition:
              ArnLike:
                aws:SourceArn:
                  Fn::Join:
                    - ""
                    - - 'arn:aws:ecs:'
                      - Ref: AWS::Region
                      - ':'
                      - Ref: AWS::AccountId
                      - :*
              StringEquals:
                aws:SourceAccount:
                  Ref: AWS::AccountId
            Effect: Allow
            Principal:
              Service:
                - ecs-tasks.amazonaws.com
        Version: "2012-10-17"
      Description: This IAM Role is assigned to deployment runner task installed on your AWS account. At no point access is given to any other account or task.
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - iam:PutRolePolicy
                  - iam:GetRolePolicy
                  - iam:GetRole
                  - iam:PassRole
                Effect: Allow
                Resource:
                  - Fn::Join:
                      - ""
                      - - 'arn:aws:iam::'
                        - Ref: AWS::AccountId
                        - :role/*
                Sid: "01"
              - Action:
                  - iam:CreateServiceLinkedRole
                Effect: Allow
                Resource:
                  - Fn::Join:
                      - ""
                      - - 'arn:aws:iam::'
                        - Ref: AWS::AccountId
                        - :role/ecs.amazonaws.com/*
                  - Fn::Join:
                      - ""
                      - - 'arn:aws:iam::'
                        - Ref: AWS::AccountId
                        - :role/aws-service-role/elasticloadbalancing.amazonaws.com/*
                  - Fn::Join:
                      - ""
                      - - 'arn:aws:iam::'
                        - Ref: AWS::AccountId
                        - :role/aws-service-role/rds.amazonaws.com/*
                Sid: "02"
            Version: "2012-10-17"
          PolicyName:
            Fn::Join:
              - '-'
              - - dr-policy-linuxamd
                - Ref: OrganizationID
                - Ref: AWS::Region
      RoleName:
        Fn::Join:
          - '-'
          - - dr-task-role-linuxamd
            - Ref: OrganizationID
            - Ref: AWS::Region
      Tags:
        - Key: Name
          Value:
            Fn::Join:
              - '-'
              - - dr-task-role-linuxamd
                - Ref: OrganizationID
                - Ref: AWS::Region
        - Key: created by
          Value: deployment.io
    Type: AWS::IAM::Role
  DeploymentWaitConditionHandlelinuxamd:
    Properties: {}
    Type: AWS::CloudFormation::WaitConditionHandle
  DeploymentWaitConditionlinuxamd:
    Properties:
      Handle:
        Ref: DeploymentWaitConditionHandlelinuxamd
      Timeout: "300"
    Type: AWS::CloudFormation::WaitCondition