aws-refarch-drupal-04-web.yaml

---
AWSTemplateFormatVersion: 2010-09-09

Description: Reference Architecture to host Drupal on AWS - Creates Drupal web Auto Scaling group

Metadata:

  AWS::CloudFormation::Interface:
    ParameterGroups:
    - Label:
        default: Web Parameters
      Parameters:
        - KeyName
        - WebInstanceType
        - WebAsgMax
        - WebAsgMin
        - WebSecurityGroup
        - WebSubnet0
        - WebSubnet1
        - WebSubnet2
        - PublicAlbTargetGroupArn
        - PublicAlbHostname
        - SslCertificate
    - Label:
        default: Drupal Parameters
      Parameters:
        - Title
        - DomainName
        - Directory
        - AdminUsername
        - AdminPassword
        - AdminEmail
        - Locale
    - Label:
        default: Database Parameters
      Parameters:
        - DatabaseClusterEndpointAddress
        - DatabaseName
        - DatabaseMasterUsername
        - DatabaseMasterPassword
    - Label:
        default: File System Parameters
      Parameters:
        - ElasticFileSystem
    - Label:
        default: Ansible
      Parameters:
        - AnsiblePullGitRepo
        - AnsibleVaultPassword
    - Label:
        default: Environment Type
      Parameters:
        - EnvironmentType

    ParameterLabels:
      DatabaseClusterEndpointAddress:
        default: DB Cluster Endpoint Address
      DatabaseMasterUsername:
        default: DB Master Username
      DatabaseMasterPassword:
        default: DB Master Password
      DatabaseName:
        default: DB Name
      ElasticFileSystem:
        default: EFS File System
      KeyName:
        default: Existing Key Pair
      AnsiblePullGitRepo:
        default: Ansible Playbook repository URL
      AnsibleVaultPassword:
        default: Ansible Vault password to decrypt sensible files
      PublicAlbTargetGroupArn:
        default: Public Alb Target Group Arn
      PublicAlbHostname:
        default: Public Alb Hostname
      SslCertificate:
        default: ACM Cert attached to Public Alb
      WebAsgMax:
        default: Web ASG Max
      WebAsgMin:
        default: Web ASG Min
      WebInstanceType:
        default: Web Instance Type
      WebSecurityGroup:
        default: Web Security Group
      WebSubnet0:
        default: Web Subnet for AZ 0
      WebSubnet1:
        default: Web Subnet for AZ 1
      WebSubnet2:
        default: Web Subnet for AZ 2
      AdminEmail:
        default: Admin Email
      AdminPassword:
        default: Admin Password
      AdminUsername:
        default: Admin Username
      Directory:
        default: Site Directory
      DomainName:
        default: Site Domain
      Locale:
        default: Language Code
      Title:
        default: Site Title
      EnvironmentType:
        default: production

Parameters:

  DatabaseClusterEndpointAddress:
    Description: The RDS cluster endpoint address.
    Type: String
  DatabaseMasterUsername:
    AllowedPattern: ^([a-zA-Z0-9]*)$
    Description: The Amazon RDS master username.
    ConstraintDescription: Must contain only alphanumeric characters and be at least 8 characters.
    MaxLength: 16
    MinLength: 1
    Type: String
  DatabaseMasterPassword:
    AllowedPattern: ^([a-z0-9A-Z`~!#$%^&*()_+,\\-])*$
    ConstraintDescription: Must be letters (upper or lower), numbers, and these special characters '_'`~!#$%^&*()_+,-
    Description: The Amazon RDS master password.
    MaxLength: 41
    MinLength: 8
    NoEcho: true
    Type: String
  DatabaseName:
    AllowedPattern: ^([a-zA-Z0-9]*)$
    Description: The Amazon RDS master database name.
    Type: String
  ElasticFileSystem:
    AllowedPattern: ^(fs-)([a-z0-9]{8})$
    Description: The Amazon EFS file system id.
    Type: String
  KeyName:
    AllowedPattern: ^([a-zA-Z0-9 @.`~!#$%^&*()_+,\\-])*$
    ConstraintDescription: Must be letters (upper or lower), numbers, and special characters.
    Description: Name of an EC2 KeyPair. Your bastion & Web instances will launch with this KeyPair.
    Type: AWS::EC2::KeyPair::KeyName
  AnsiblePullGitRepo:
    AllowedPattern: ^([a-z\-\:\/\.A-Z0-9]*)$
    Description: A git repository containing an Ansible Playbook to configure the instances.
    ConstraintDescription: Must contain only alphanumeric characters and be at least 8 characters.
    Type: String
  AnsibleVaultPassword:
    AllowedPattern: ^([a-zA-Z0-9`~!#$%^&*()_+,\\-])*$
    Description: Ansible Vault password to decrypt sensitive files
    ConstraintDescription: Must contain only alphanumeric characters and be at least 8 characters.
    Type: String
  PublicAlbTargetGroupArn:
    Description: The public application load balancer target group arn.
    Type: String
  PublicAlbHostname:
    Description: The hostname of the public ALB http form (e.g. http://abdc-12345-xyz.<region>.elb.amazonaws.com)
    Type: String
  SslCertificate:
    AllowedValues:
      - True
      - False
    Default: False
    Description: Is there an ACM SSL Certificate attached to the Public Alb?
    Type:
      String
  WebAsgMax:
    AllowedPattern: ^((?!0$)[1-2]?[0-9]|30)$
    ConstraintDescription: Must be a number between 1 and 30.
    Default: 4
    Description: Specifies the maximum number of EC2 instances in the Web Autoscaling Group.
    Type: String
  WebAsgMin:
    AllowedPattern: ^([0-0]?[0-9]|10)$
    ConstraintDescription: Must be a number between 0 and 10.
    Default: 2
    Description: Specifies the minimum number of EC2 instances in the Web Autoscaling Group.
    Type: String
  WebInstanceType:
    AllowedValues:
      - t2.micro
      - t2.small
      - t2.medium
      - t2.large
      - m4.large
      - m4.xlarge
      - m4.2xlarge
      - m4.4xlarge
      - m4.10xlarge
      - m3.medium
      - m3.large
      - m3.xlarge
      - m3.2xlarge
      - r3.large
      - r3.xlarge
      - r3.2xlarge
      - r3.4xlarge
      - r3.8xlarge
    ConstraintDescription: Must be a valid Amazon EC2 instance type.
    Default: t2.large
    Description: The Amazon EC2 instance type for your web instances.
    Type: String
  WebSecurityGroup:
    Description: Select the web security group.
    Type: AWS::EC2::SecurityGroup::Id
  WebSubnet0:
    Description: Select an existing web subnet for AZ 0.
    Type: AWS::EC2::Subnet::Id
  WebSubnet1:
    Description: Select an existing web subnet for AZ 1.
    Type: AWS::EC2::Subnet::Id
  WebSubnet2:
    Description: Select an existing web subnet for AZ 2.
    Type: AWS::EC2::Subnet::Id
  AdminEmail:
    AllowedPattern: ^(([^<>()\[\]\\.,;:\s@"]+(\.[^<>()\[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$
    Description: The Drupal admin email address.
    Type: String
  AdminPassword:
    AllowedPattern: ^([a-zA-Z0-9`~!#$%^&*()_+,\\-])*$
    ConstraintDescription: Must be letters (upper or lower), numbers, and these special characters '_'`~!#$%^&*()_+,-
    Description: The Drupal admin password.
    Type: String
    NoEcho: true
  AdminUsername:
    AllowedPattern: ^([a-zA-Z0-9])([a-zA-Z0-9_-])*([a-zA-Z0-9])$
    Description: The Drupal admin username.
    Type: String
  Directory:
    AllowedPattern: ^([a-zA-Z0-9])([a-zA-Z0-9_-])*([a-zA-Z0-9])$
    Description: The Drupal site directory.
    Type: String
  DomainName:
    AllowedPattern: ^$|(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$
    Description: '[ Optional ] The main domain name of the Drupal site (e.g. example.com). Leave empty to use the ALB DNS name for the Drupal site.'
    Type: String
  Locale:
    Description: The main language of the Drupal site, as per https://codex.Drupal.org/Installing_Drupal_in_Your_Language. The default is 'en_GB'.
    Type: String
    Default: en_GB
  Title:
    AllowedPattern: ^([a-zA-Z0-9])([a-zA-Z0-9 _-]*)([a-zA-Z0-9])$
    Description: The Drupal website title.
    Type: String
  EnvironmentType:
    Default: production
    AllowedValues:
      - production
      - staging
      - development
    Description: The type of environment this stack will be used for.
    Type: String

Conditions:

  NoSslCertificate:
    !Equals [ False, !Ref SslCertificate ]
  MoreThan2AZ:
    !Or [
      !Equals [ !Ref 'AWS::Region', us-east-1 ],
      !Equals [ !Ref 'AWS::Region', us-east-2 ],
      !Equals [ !Ref 'AWS::Region', us-west-2 ],
      !Equals [ !Ref 'AWS::Region', eu-west-1 ],
      !Equals [ !Ref 'AWS::Region', sa-east-1 ],
      !Equals [ !Ref 'AWS::Region', ap-northeast-1 ],
      !Equals [ !Ref 'AWS::Region', ap-southeast-2 ]
    ]
  NoDomainName:
    !Equals [ '', !Ref DomainName ]

Mappings:

  RegionMap:
    ap-northeast-1:
      AMI: ami-00a5245b4816c38e6
    ap-northeast-2:
      AMI: ami-00dc207f8ba6dc919
    ap-south-1:
      AMI: ami-0ad42f4f66f6c1cc9
    ap-southeast-1:
      AMI: ami-05b3bcf7f311194b3
    ap-southeast-2:
      AMI: ami-02fd0b06f06d93dfc
    ca-central-1:
      AMI: ami-07423fb63ea0a0930
    eu-central-1:
      AMI: ami-0cfbf4f6db41068ac
    eu-west-1:
      AMI: ami-08935252a36e25f85
    eu-west-2:
      AMI: ami-01419b804382064e4
    sa-east-1:
      AMI: ami-05145e0b28ad
    us-east-1:
      AMI: ami-0080e4c5bc078760e
    us-east-2:
      AMI: ami-0cd3dfa4e37921605
    us-west-1:
      AMI: ami-0ec6517f6edbf8044
    us-west-2:
      AMI: ami-01e24be29428c15b2

Resources:

  WebInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
      - !Ref WebInstanceRole
  WebInstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - ec2.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: /
      Policies:
      - PolicyName: logs
        PolicyDocument:
          Version: 2012-10-17
          Statement:
          - Effect: Allow
            Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            - logs:DescribeLogStreams
            Resource:
            - arn:aws:logs:*:*:*
  WebAutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      Cooldown: 60
      HealthCheckGracePeriod: 120
      HealthCheckType: EC2
      LaunchConfigurationName: !Ref WebLaunchConfiguration
      MaxSize: !Ref WebAsgMax
      MinSize: !Ref WebAsgMin
      Tags:
        - Key: Name
          Value: !Join [ '', [ 'Web ASG / ', !Ref 'AWS::StackName' ] ]
          PropagateAtLaunch: true
      TargetGroupARNs:
        - !Ref PublicAlbTargetGroupArn
      VPCZoneIdentifier:
        !If [
          MoreThan2AZ,
          [ !Ref WebSubnet0, !Ref WebSubnet1, !Ref WebSubnet2 ],
          [ !Ref WebSubnet0, !Ref WebSubnet1 ]
        ]
      TerminationPolicies:
        - OldestLaunchConfiguration
        - OldestInstance
    CreationPolicy:
      ResourceSignal:
        Count: 0
        Timeout: PT20M
  WebServerScaleUpPolicy:
    Type: AWS::AutoScaling::ScalingPolicy
    Properties:
      AdjustmentType: ChangeInCapacity
      AutoScalingGroupName: !Ref WebAutoScalingGroup
      Cooldown: '60'
      ScalingAdjustment: '1'
  WebServerScaleDownPolicy:
    Type: AWS::AutoScaling::ScalingPolicy
    Properties:
      AdjustmentType: ChangeInCapacity
      AutoScalingGroupName: !Ref WebAutoScalingGroup
      Cooldown: '60'
      ScalingAdjustment: "-1"
  CPUAlarmHigh:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: Scale-up if CPU > 90% for 10 minutes
      MetricName: CPUUtilization
      Namespace: AWS/EC2
      Statistic: Average
      Period: '300'
      EvaluationPeriods: '2'
      Threshold: '90'
      AlarmActions:
        - Ref: "WebServerScaleUpPolicy"
      Dimensions:
      - Name: AutoScalingGroupName
        Value: !Ref WebAutoScalingGroup
      ComparisonOperator: GreaterThanThreshold
  CPUAlarmLow:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: Scale-down if CPU < 70% for 10 minutes
      MetricName: CPUUtilization
      Namespace: AWS/EC2
      Statistic: Average
      Period: '300'
      EvaluationPeriods: '2'
      Threshold: '70'
      AlarmActions:
        - Ref: "WebServerScaleDownPolicy"
      Dimensions:
      - Name: AutoScalingGroupName
        Value: !Ref WebAutoScalingGroup
      ComparisonOperator: LessThanThreshold
  WebLaunchConfiguration:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      IamInstanceProfile: !Ref WebInstanceProfile
      ImageId: !FindInMap [ RegionMap, !Ref 'AWS::Region', AMI ]
      InstanceMonitoring: true
      InstanceType: !Ref WebInstanceType
      KeyName: !Ref KeyName
      SecurityGroups:
      - !Ref WebSecurityGroup
      BlockDeviceMappings:
      - DeviceName: "/dev/xvda"
        Ebs:
          VolumeSize: "30"
      UserData:
        Fn::Base64:
          Fn::Sub :
            - |
              #!/bin/bash -xe
              # Prevent repo errors.
              yum clean all
              # Enable EPEL repo
              yum-config-manager --enable epel
              # Update package list.
              yum update -y
              # Install awslogs, git, mysql, jq and ansible.
              yum install -y awslogs mysql git ansible jq
              # Change region on the awslogs config.
              sed -i "s|^region.*|region = ${AWS::Region}|g" /etc/awslogs/awscli.conf
              # Start awslogs and add to boot.
              service awslogs start
              chkconfig awslogs on
              # Mount the EFS filesystem.
              mkdir /shared
              mount -t nfs4 -o nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2 ${ElasticFileSystem}.efs.${AWS::Region}.amazonaws.com:/ /shared/
              # Store vars for later use.
              echo "export ENVIRONMENT=${EnvironmentType}" >> /etc/profile.d/vars.sh
              echo "export ANSIBLE_REPO=${AnsibleRepo}" >> /etc/profile.d/vars.sh
              runuser -l ec2-user -c 'echo ${AnsibleVaultPassword} > /home/ec2-user/.ansible_vault_password'
              runuser -l ec2-user -c 'ansible-pull -d /home/ec2-user/ansible -U ${AnsibleRepo} --extra-vars "mysql_host=${DatabaseClusterEndpointAddress} mysql_user=${MysqlUsername} mysql_pass=${MysqlPassword}" --vault-password-file /home/ec2-user/.ansible_vault_password'
              # Delete the ansible password file.
              rm /home/ec2-user/.ansible_vault_password
              # Clear the logs.
              sed -i '/ansible-pull/d' /var/log/cloud-init-output.log
              /opt/aws/bin/cfn-signal --exit-code $? --stack ${AWS::StackName} --resource WebAutoScalingGroup --region ${AWS::Region}
            - MysqlUsername: !Ref DatabaseMasterUsername
              MysqlPassword: !Ref DatabaseMasterPassword
              AnsibleRepo: !Ref AnsiblePullGitRepo
              AnsibleVaultPassword: !Ref AnsibleVaultPassword

Outputs:

  Opcachestatus:
    Value: !Join [ '', [ !Ref PublicAlbHostname, '/opcache-instanceid.php' ] ]