ecs-stack.yaml

AWSTemplateFormatVersion: '2010-09-09'

Parameters:
  StackName:
    Type: String
    Default: "vpc-stack"

  ImageUrl:
    Type: String
    Default: "REPO_URL/IMAGE:TAG"   # Replace REPO_URL, IMAGE, TAG values

  ContainerPort:
    Type: Number
    Default: 80

  ContainerCpu:
    Type: Number
    Default: 1024

  ContainerMemory:
    Type: Number
    Default: 2048

  Priority:
    Type: Number
    Default: 1

  DesiredCount:
    Type: Number
    Default: 1

  CertificateArn:
    Description: "AWS ACM Certificate for endpoint"
    Type: String
    Default: "ACM_CERT_NAME"  # Replace ACM_CERT_NAME values

  ContainerEnvValue:
    Type: String
    Default: "Value_if_any"

  HighCPUThreshold:
    Type: Number
    Default: 80

  LowCPUThreshold:
    Type: Number
    Default: 20

  MaxContainers:
    Type: Number
    Default: 4

  MinContainers:
    Type: Number
    Default: 1

  environment:
    Type: String
    Default: "prod"

  HealthCheckPath:
    Type: String
    Default: "/"

Resources:

  CloudWatchLogsGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Join [ "", ["/ecs/", !Ref environment, "-app" ]]
      RetentionInDays: 365

  ECSCluster:
    Type: AWS::ECS::Cluster
    Properties:
      ClusterName: !Join ['-', [!Ref environment, "app", "cluster"]]

  ECSTaskRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: "EcsTaskRole"
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service: [ ecs-tasks.amazonaws.com ]
          Action: [ "sts:AssumeRole" ]
      Policies:
        - PolicyName: "EcsTaskRolePolicy"
          PolicyDocument:
            Statement:
              - Effect: "Allow"
                Action:
                  - "ec2:*"
                  - "elasticloadbalancing:*"
                  - "cloudwatch:*"
                  - "logs:*"
                  - "ecr:*"
                Resource: "*"

  TaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ExecutionRoleArn: !Ref ECSTaskRole
      Family: !Join ['_', [!Ref environment, "app"]]
      Cpu: !Ref ContainerCpu
      Memory: !Ref ContainerMemory
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      ContainerDefinitions:
        - Name: "app_container"
          Cpu: !Ref ContainerCpu
          Memory: !Ref ContainerMemory
          Image: !Ref ImageUrl
          Essential: true
          Environment:
            - Name: ContainerEnvValue
              Value: !Ref ContainerEnvValue
          PortMappings:
            - ContainerPort: !Ref ContainerPort
              HostPort: !Ref ContainerPort
              Protocol: "tcp"
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: !Join [ "", ["/ecs/", !Ref environment, "-app" ]]
              awslogs-region: !Ref AWS::Region
              awslogs-stream-prefix: "ecs"

  Service:
    Type: AWS::ECS::Service
    DependsOn: LoadBalancerListener
    Properties:
      ServiceName: !Join ['_', [!Ref environment, "app","service"]]
      Cluster: !Ref ECSCluster
      LaunchType: FARGATE
      DeploymentConfiguration:
        MaximumPercent: 200
        MinimumHealthyPercent: 50
      DesiredCount: !Ref DesiredCount
      HealthCheckGracePeriodSeconds: 600
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: DISABLED
          SecurityGroups:
            - !Ref ECSSecurityGroup
          Subnets:
            - Fn::ImportValue: !Join [':', [!Ref 'StackName', 'PrivateSubnet1']]
            - Fn::ImportValue: !Join [':', [!Ref 'StackName', 'PrivateSubnet2']]
      TaskDefinition: !Ref TaskDefinition
      LoadBalancers:
        - ContainerName: "app_container"
          ContainerPort: !Ref ContainerPort
          TargetGroupArn: !Ref TargetGroup

  ECSSecurityGroup:
    Type: "AWS::EC2::SecurityGroup"
    Properties:
      GroupName: !Join ['-', [!Ref environment, "ecs","sg"]]
      GroupDescription: !Sub "Controls access to ${environment} ecs"
      SecurityGroupIngress:
        - SourceSecurityGroupId: !Ref LBSecurityGroup
          IpProtocol: "TCP"
          FromPort: !Ref ContainerPort
          ToPort: !Ref ContainerPort
      SecurityGroupEgress:
        - CidrIp: "0.0.0.0/0"
          IpProtocol: "-1"
          FromPort: 0
          ToPort: 0
      VpcId:
        Fn::ImportValue:
          !Join [':', [!Ref 'StackName', 'VPC']]

  LBSecurityGroup:
    Type: "AWS::EC2::SecurityGroup"
    Properties:
      GroupName: !Join ['-', [!Ref environment, "lb","sg"]]
      GroupDescription: !Sub "Controls access to ${environment} lb"
      SecurityGroupIngress:
        - CidrIp: "0.0.0.0/0"
          IpProtocol: "TCP"
          FromPort: 443
          ToPort: 443
      SecurityGroupEgress:
        - CidrIp: "0.0.0.0/0"
          IpProtocol: "-1"
          FromPort: 0
          ToPort: 0
      VpcId:
        Fn::ImportValue:
          !Join [':', [!Ref 'StackName', 'VPC']]

  LoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Name: !Join ['-', [!Ref environment, "lb"]]
      Subnets:
        - Fn::ImportValue: !Join [':', [!Ref 'StackName', 'PublicSubnet1']]
        - Fn::ImportValue: !Join [':', [!Ref 'StackName', 'PublicSubnet2']]
      SecurityGroups:
        - !Ref LBSecurityGroup

  TargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Name: !Join ['-', [!Ref environment, "target", "group"]]
      Port: !Ref ContainerPort
      Protocol: HTTP
      VpcId:
        Fn::ImportValue:
          !Join [':', [!Ref 'StackName', 'VPC']]
      TargetType: ip
      HealthCheckIntervalSeconds: 15
      HealthCheckPath: !Ref HealthCheckPath
      HealthCheckProtocol: HTTP
      HealthCheckTimeoutSeconds: 5
      HealthyThresholdCount: 3
      UnhealthyThresholdCount: 2

  LoadBalancerListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: !Ref LoadBalancer
      Port: 443
      Protocol: HTTPS
      Certificates:
        - CertificateArn: !Ref CertificateArn
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref TargetGroup

  ECSAutoscalingRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: "ECSAutoscalingRole"
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service: [ application-autoscaling.amazonaws.com ]
          Action: [ "sts:AssumeRole" ]
      Policies:
        - PolicyName: "ECSAutoscalingRolePolicy"
          PolicyDocument:
            Statement:
              - Effect: "Allow"
                Action:
                  - "application-autoscaling:*"
                  - "cloudwatch:DescribeAlarms"
                  - "cloudwatch:PutMetricAlarm"
                  - "ecs:DescribeServices"
                  - "ecs:UpdateService"
                Resource: "*"

  ECSAutoscalingTarget:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    Properties:
      RoleARN: !GetAtt ECSAutoscalingRole.Arn
      MaxCapacity: !Ref MaxContainers
      MinCapacity: !Ref MinContainers
      ResourceId: !Join [ "/", [ "service", !Ref ECSCluster, !GetAtt Service.Name]]
      ScalableDimension: "ecs:service:DesiredCount"
      ServiceNamespace: ecs

  ECSscaleUp:
    Type : "AWS::ApplicationAutoScaling::ScalingPolicy"
    Properties:
      PolicyName: !Join [ "-", [ !Ref environment, "ecs","scale","up"]]
      PolicyType: StepScaling
      ResourceId: !Join [ "/", [ "service", !Ref ECSCluster, !GetAtt Service.Name]]
      ScalableDimension: "ecs:service:DesiredCount"
      ServiceNamespace: ecs
      StepScalingPolicyConfiguration:
        AdjustmentType: "ChangeInCapacity"
        Cooldown: 60
        MetricAggregationType: "Average"
        StepAdjustments:
          -
           MetricIntervalLowerBound: 0
           ScalingAdjustment: 1
    DependsOn: ECSAutoscalingTarget

  ECSscaleDown:
    Type : "AWS::ApplicationAutoScaling::ScalingPolicy"
    Properties:
      PolicyName: !Join [ "-", [ !Ref environment, "ecs","scale","down"]]
      PolicyType: StepScaling
      ResourceId: !Join [ "/", [ "service", !Ref ECSCluster, !GetAtt Service.Name]]
      ScalableDimension: "ecs:service:DesiredCount"
      ServiceNamespace: ecs
      StepScalingPolicyConfiguration:
        AdjustmentType: "ChangeInCapacity"
        Cooldown: 120
        MetricAggregationType: "Average"
        StepAdjustments:
          -
           MetricIntervalLowerBound: 0
           ScalingAdjustment: -1
    DependsOn: ECSAutoscalingTarget

  HighCPUAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmActions:
        - !Ref ECSscaleUp
      AlarmName: !Join [ "-", [ !Ref environment, "cpu","high"]]
      ComparisonOperator: "GreaterThanOrEqualToThreshold"
      EvaluationPeriods: 1
      MetricName: "CPUUtilization"
      Namespace: "AWS/ECS"
      Period: 60
      Statistic: "Average"
      Threshold: !Ref HighCPUThreshold

  LowCPUAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmActions:
        - !Ref ECSscaleDown
      AlarmName: !Join [ "-", [ !Ref environment, "cpu","low"]]
      ComparisonOperator: "LessThanThreshold"
      EvaluationPeriods: 1
      MetricName: "CPUUtilization"
      Namespace: "AWS/ECS"
      Period: 60
      Statistic: "Average"
      Threshold: !Ref LowCPUThreshold