template.yml

AWSTemplateFormatVersion: 2010-09-09

Parameters:
  EnvironmentName:
    Type: String

  VpcId:
    Type: String

  PrivateSubnetIds:
    Type: String

  PublicSubnetIds:
    Type: String

Mappings:
  Beanstalk2Route53HostedZoneId:
    us-west-2:
      HostedZoneId: Z33MTJ483KN6FU
    us-east-1:
      HostedZoneId: Z3DZXE0Q79N41H
    us-west-1:
      HostedZoneId: Z1M58G0W56PQJA
    eu-west-1:
      HostedZoneId: Z3NF1Z3NOM5OY2
    ap-northeast-1:
      HostedZoneId: Z2YN17T5R711GT
    ap-southeast-1:
      HostedZoneId: Z1WI8VXHPB1R38
    sa-east-1:
      HostedZoneId: Z2ES78Y61JGQKS

  Env2Domain:
    prod:
      SSLCertificateId: ApiThenewbostonComCertificateArn
    dev:
      SSLCertificateId: ApiDevThenewbostonComCertificateArn

Conditions:
  IsProd: !Equals [ !Ref EnvironmentName, "prod" ]

Resources:
  WebsiteApiRecordSet:
    Type: AWS::Route53::RecordSet
    Properties:
      Name: !If [ IsProd, "api.thenewboston.com", !Sub "api-${EnvironmentName}.thenewboston.com" ]
      Type: A
      HostedZoneId: ZDHCZ05S94NJT # thenewboston.com
      AliasTarget:
        DNSName: !GetAtt WebsiteApiEnvironment.EndpointURL
        HostedZoneId:
          Fn::FindInMap: [ Beanstalk2Route53HostedZoneId, !Ref AWS::Region, HostedZoneId ]

  WebsiteApiServiceRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - elasticbeanstalk.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSElasticBeanstalkEnhancedHealth
        - arn:aws:iam::aws:policy/service-role/AWSElasticBeanstalkService

  WebsiteApiRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole

  WebsiteApiPolicies:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: App
      Roles:
        - !Ref WebsiteApiRole
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action: "*"
            Resource: "*"

  WebsiteApiInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - !Ref WebsiteApiRole

  WebsiteApiSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Sub "${EnvironmentName}-website-api-http-ingress-sg"
      GroupDescription: !Sub "${EnvironmentName} WebsiteApi Security group to HTTP to allow connect"
      VpcId: !Ref VpcId
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0

  PGSQLSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Sub "${EnvironmentName}-website-api-postgresql-ingress-sg"
      GroupDescription: !Sub "${EnvironmentName} WebsiteApi Security group to RDS to allow connect"
      VpcId: !Ref VpcId
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 5432
          ToPort: 5432
          CidrIp: 0.0.0.0/0

  WebsiteApiPGInstance:
    Type: AWS::RDS::DBInstance
    DeletionPolicy: Snapshot
    UpdateReplacePolicy: Snapshot
    Properties:
      AllocatedStorage: "20"
      AllowMajorVersionUpgrade: false
      AutoMinorVersionUpgrade: true
      BackupRetentionPeriod: 10
      CopyTagsToSnapshot: true
      DBInstanceClass: "db.t2.micro"
      DBName: !Sub "${EnvironmentName}WebsiteApi"
      DBSubnetGroupName: !Ref WebsiteApiDBSubnetGroup
      EnableIAMDatabaseAuthentication: true
      Engine: postgres
      EngineVersion: "12.4"
      MasterUsername: root
      MasterUserPassword: "MasterUserPassword"
      StorageType: gp2
      MultiAZ: false
      VPCSecurityGroups:
        - !Ref PGSQLSecurityGroup
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName} PGInstance

  WebsiteApiDBSubnetGroup:
    Type: AWS::RDS::DBSubnetGroup
    Properties:
      DBSubnetGroupDescription: !Sub ${EnvironmentName} WebsiteApiDBSubnetGroup
      DBSubnetGroupName: !Sub ${EnvironmentName} WebsiteApiDBSubnetGroup
      SubnetIds:
        Fn::Split:
          - ','
          - Ref: PrivateSubnetIds
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName} WebsiteApiDBSubnetGroup

  WebsiteApiApp:
    Type: AWS::ElasticBeanstalk::Application
    Properties:
      Description: WebSiteApi Beanstalk App

  WebsiteApiAppVersion:
    Type: AWS::ElasticBeanstalk::ApplicationVersion
    Properties:
      ApplicationName: !Ref WebsiteApiApp
      Description: WebSiteApi Beanstalk App Version
      SourceBundle:
        S3Bucket: _ARTIFACT_BUCKET_
        S3Key: website-api/code._COMMIT_.zip

  WebsiteApiConfigurationTemplate:
    Type: AWS::ElasticBeanstalk::ConfigurationTemplate
    Properties:
      ApplicationName: !Ref WebsiteApiApp
      Description: WebSiteApi Beanstalk App Configuration Template
      SolutionStackName: 64bit Amazon Linux 2 v3.1.2 running Python 3.7
      OptionSettings:
        - Namespace: aws:elasticbeanstalk:environment
          OptionName: EnvironmentType
          Value: LoadBalanced

        - Namespace: aws:elasticbeanstalk:environment
          OptionName: ServiceRole
          Value: !Ref WebsiteApiServiceRole

        - Namespace: aws:autoscaling:launchconfiguration
          OptionName: IamInstanceProfile
          Value: !Ref WebsiteApiInstanceProfile

        - Namespace: aws:autoscaling:launchconfiguration
          OptionName: SecurityGroups
          Value: !Ref WebsiteApiSecurityGroup

        - Namespace: aws:autoscaling:asg
          OptionName: MinSize
          Value: "1"

        - Namespace: aws:autoscaling:asg
          OptionName: MaxSize
          Value: "2"

        - Namespace: aws:elasticbeanstalk:cloudwatch:logs
          OptionName: StreamLogs
          Value: "true"

        - Namespace: aws:elasticbeanstalk:cloudwatch:logs
          OptionName: DeleteOnTerminate
          Value: "true"

        - Namespace: aws:ec2:vpc
          OptionName: VPCId
          Value: !Ref VpcId

        - Namespace: aws:ec2:vpc
          OptionName: Subnets
          Value: !Ref PrivateSubnetIds

        - Namespace: aws:ec2:vpc
          OptionName: ELBSubnets
          Value: !Ref PublicSubnetIds

        - Namespace: aws:elb:listener:443
          OptionName: SSLCertificateId
          Value:
            Fn::ImportValue: !Sub
              - ${FoundInMap}
              - { FoundInMap: !FindInMap [ Env2Domain, !Ref EnvironmentName, SSLCertificateId ] }

        - Namespace: aws:elb:listener:443
          OptionName: ListenerProtocol
          Value: HTTPS

        - Namespace: aws:elb:listener:443
          OptionName: InstancePort
          Value: 80

        - Namespace: aws:elasticbeanstalk:application:environment
          OptionName: DJANGO_APPLICATION_ENVIRONMENT
          Value: "production"

        - Namespace: aws:elasticbeanstalk:application:environment
          OptionName: POSTGRES_DB
          Value: !Sub "${EnvironmentName}WebsiteApi"

        - Namespace: aws:elasticbeanstalk:application:environment
          OptionName: POSTGRES_USER
          Value: "root"

        - Namespace: aws:elasticbeanstalk:application:environment
          OptionName: POSTGRES_PASSWORD
          Value: "MasterUserPassword"

        - Namespace: aws:elasticbeanstalk:application:environment
          OptionName: POSTGRES_HOST
          Value: !GetAtt WebsiteApiPGInstance.Endpoint.Address

        - Namespace: aws:elasticbeanstalk:application:environment
          OptionName: SOCIALACCOUNT_GITHUB_CLIENT_ID
          Value:
            Fn::Join:
              - ''
              - - '{{resolve:ssm:'
                - !Sub "${EnvironmentName}GithubClientId"
                - ':1}}'

        - Namespace: aws:elasticbeanstalk:application:environment
          OptionName: SOCIALACCOUNT_GITHUB_CLIENT_SECRET
          Value:
            Fn::Join:
              - ''
              - - '{{resolve:ssm:'
                - !Sub "${EnvironmentName}GithubSecretKey"
                - ':1}}'

        - Namespace: aws:elasticbeanstalk:application:environment
          OptionName: SOCIALACCOUNT_GITHUB_CALLBACK_URL
          Value:
            Fn::Join:
              - ''
              - - '{{resolve:ssm:'
                - !Sub "${EnvironmentName}GithubCallbackUrl"
                - ':2}}'

        - Namespace: aws:elasticbeanstalk:application:environment
          OptionName: SENTRY_DSN
          Value:
            Fn::Join:
              - ''
              - - '{{resolve:ssm:'
                - !Sub "${EnvironmentName}SentryDsn"
                - ':1}}'

  WebsiteApiEnvironment:
    Type: AWS::ElasticBeanstalk::Environment
    Properties:
      Description: WebSiteApi Beanstalk App Environment
      ApplicationName: !Ref WebsiteApiApp
      TemplateName: !Ref WebsiteApiConfigurationTemplate
      VersionLabel: !Ref WebsiteApiAppVersion