app.tmpl

{{ define "app" }}
  {{ $app := .App }}
  {{ $manifest := .Manifest }}
  {
    "AWSTemplateFormatVersion" : "2010-09-09",
    "Conditions": {
      {{ template "balancer-conditions" .Manifest }}
      {{ template "process-conditions" .Manifest }}
      "Internal": { "Fn::Equals": [ { "Ref": "Internal" }, "Yes" ] },
      "NativeLogging": { "Fn::Equals": [ { "Ref": "NativeLogging" }, "Yes" ] },
      "Private": { "Fn::Equals": [ { "Ref": "Private" }, "Yes" ] },
      "BlankSecurityGroup" : {"Fn::Equals" : [{"Ref" : "SecurityGroup"}, ""]}
    },
    "Parameters" : {
      {{ template "balancer-params" .Manifest }}
      {{ template "process-params" .Manifest }}

      "Cluster": {
        "Type" : "String",
        "Default" : "",
        "Description" : ""
      },
      "DeploymentMaximum": {
        "Type": "Number",
        "Default": "200",
        "Description": "Maximum percentage of processes to keep running while deploying"
      },
      "DeploymentMinimum": {
        "Type": "Number",
        "Default": "50",
        "Description": "Minimum percentage of processes to keep running while deploying"
      },
      "Environment": {
        "Type": "String",
        "Default": "",
        "Description": ""
      },
      "Internal": {
        "Type": "String",
        "Description": "Only allow access to this app from inside the VPC",
        "Default": "No",
        "AllowedValues": [ "Yes", "No" ]
      },
      "Key": {
        "Type": "String",
        "Default": "",
        "Description": ""
      },
      "NativeLogging": {
        "Type": "String",
        "Description": "Use native ECS awslogs driver over convox/agent for logging",
        "Default": "No",
        "AllowedValues": [ "Yes", "No" ]
      },
      "Private": {
        "Type": "String",
        "Description": "Use SubnetsPrivate to specify VPC-side load balancer endpoints",
        "Default": "No",
        "AllowedValues": [ "Yes", "No" ]
      },
      "Release": {
        "Type" : "String",
        "Default" : "",
        "Description" : ""
      },
      "Repository": {
        "Type" : "String",
        "Default" : "",
        "Description" : "Source code repository"
      },
      "SecurityGroup": {
        "Type" : "String",
        "Default" : "",
        "Description" : "The Load balancer security group for this app"
      },
      "Subnets": {
        "Type" : "List<AWS::EC2::Subnet::Id>",
        "Default" : "",
        "Description" : "VPC subnets for this app"
      },
      "SubnetsPrivate": {
        "Type" : "List<AWS::EC2::Subnet::Id>",
        "Default" : "",
        "Description" : "VPC private subnets for this app"
      },
      "TaskRole": {
        "Type" : "String",
        "Default" : "",
        "Description" : "IAM Role to apply to ECS Tasks of this app"
      },
      "Version": {
        "Description": "(REQUIRED) Lambda CustomTopic Handler Release Version",
        "MinLength" : "1",
        "Type": "String"
      },
      "VPC": {
        "Type" : "AWS::EC2::VPC::Id",
        "Default" : "",
        "Description" : "VPC for this app"
      },
      "VPCCIDR": {
        "Type" : "String",
        "Default" : "",
        "Description" : "VPC CIDR for this app"
      }
    },
    "Mappings": {
      "PortProtocol": {
        "http": { "ListenerProtocol": "HTTP", "InstanceProtocol": "HTTP", "SecureInstanceProtocol": "HTTPS" },
        "https": { "ListenerProtocol": "HTTPS", "InstanceProtocol": "HTTP", "SecureInstanceProtocol": "HTTPS"  },
        "tcp": { "ListenerProtocol": "TCP", "InstanceProtocol": "TCP", "SecureInstanceProtocol": "SSL"  },
        "tls": { "ListenerProtocol": "SSL", "InstanceProtocol": "TCP", "SecureInstanceProtocol": "SSL"   }
      }
    },
    "Resources": {
      "CustomTopicRole": {
        "Type": "AWS::IAM::Role",
        "Properties": {
          "AssumeRolePolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
              {
                "Effect": "Allow",
                "Principal": { "Service": [ "lambda.amazonaws.com" ] },
                "Action": [ "sts:AssumeRole" ]
              }
            ]
          },
          "Path": "/convox/",
          "Policies": [
            {
              "PolicyName": "Administrator",
              "PolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [ { "Effect": "Allow", "Action": "*", "Resource": "*" } ]
              }
            }
          ]
        }
      },
      "CustomTopic": {
        "Type": "AWS::Lambda::Function",
        "Properties": {
          "Code": {
            "S3Bucket": { "Fn::Join": [ "-", [ "convox", { "Ref": "AWS::Region" } ] ] },
            "S3Key": { "Fn::Join": [ "", [ "release/", { "Ref": "Version" }, "/lambda/formation.zip" ] ] }
          },
          "Handler": "index.external",
          "MemorySize": "128",
          "Role": { "Fn::GetAtt": [ "CustomTopicRole", "Arn" ] },
          "Runtime": "nodejs4.3",
          "Timeout": "300"
        }
      },
      {{ template "balancer-resources" . }}
      {{ template "cronjob-resources" . }}
      {{ template "agent-resources" . }}
      {{ template "process-resources" .Manifest }}
      {{ template "process-services" . }}
      {{ template "registry-resources" .Manifest }}

      {{ template "security" }}
      {{ template "state" }}
    },
    "Outputs": {
      {{ template "balancer-outputs" .}}
      {{ template "process-outputs" .Manifest }}
      {{ template "registry-outputs" .Manifest }}

      "Settings": {
        "Value": { "Ref": "Settings" }
      }
    }
  }
{{ end }}

{{ define "process-conditions" }}
  {{ range $k := .EntryNames }}
    "Enabled{{ upper $k }}": { "Fn::Not": [{ "Fn::Equals": [ { "Fn::Select": [ 0, { "Ref": "{{ upper $k }}Formation" } ] }, "-1" ] }] },
  {{ end }}
{{ end }}

{{ define "process-params" }}
  {{ range $e := .Services }}
    "{{ upper $e.Name }}Formation": {
      "Type": "CommaDelimitedList",
      "Default": "{{ $e.DefaultParams }}",
      "Description": "Number of processes to run, CPU units to reserve, and MB of RAM to reserve"
    },
  {{ end }}
{{ end }}

{{ define "process-outputs" }}
  "LogGroup": {
    "Value": { "Ref": "LogGroup" }
  },
{{ end }}

{{ define "process-resources" }}
  "LogGroup": {
    "Type": "AWS::Logs::LogGroup"
  },
{{ end }}

{{ define "process-services" }}
  {{ $manifest := .Manifest }}
  {{ $app := .App }}
  {{ if $manifest.HasProcesses }}
    {{ range $e := $manifest.Services }}
      "{{ upper $e.Name }}ECSTaskDefinition": {
        "DependsOn": ["CustomTopic", "ServiceRole"],
        "Type": "Custom::ECSTaskDefinition",
        "Version": "1.0",
        "Properties": {
          "TaskRole": { "Ref": "TaskRole" },
          "ServiceToken": { "Fn::GetAtt": [ "CustomTopic", "Arn" ] },
          "Name": { "Fn::Join": [ "-", [ { "Ref": "AWS::StackName" }, "{{ $e.Name }}" ] ] },
          "Release": { "Ref": "Release" },
          "Environment": { "Ref": "Environment" },
          "Key": { "Ref": "Key" },
          "Tasks": [
            {
              "Name": "{{ $e.Name }}",
              "Image": "{{ $e.Image }}",
              {{if $e.Command.Array}}
                "Command": [
                  {{ range $index, $element := $e.Command.Array}}
                      {{if $index}},{{else}}{{end}}
                      "{{$element}}"
                  {{end}}
                ],
              {{else if ne $e.Command.String ""}}
                "Command": {{ value $e.Command.String }},
              {{end}}
              "Cpu": { "Fn::Select": [ 1, { "Ref": "{{ upper $e.Name }}Formation" } ] },
              "Memory": { "Fn::Select": [ 2, { "Ref": "{{ upper $e.Name }}Formation" } ] },
              "Environment": {
                "APP": "{{ $.App.Name }}",
                "RACK": "{{ env "RACK" }}",
                "AWS_REGION": "{{ env "AWS_REGION" }}",
                "LOG_GROUP": { "Fn::If": [ "NativeLogging",
                  { "Ref" : "AWS::NoValue" },
                  { "Ref": "LogGroup" }
                ] },
                {{ range $e.Environment }}
                  {{ if ne .Value "" }}
                    "{{ .Name }}": {{ value .Value }},
                  {{ end }}
                {{ end }}
                {{ range $key, $value := .LinkVars }}
                  "{{ $key }}": {{ $value }},
                {{ end }}
                "PROCESS": "{{ $e.Name }}"
              },
              "Volumes": [
                {{ range $e.MountableVolumes }}
                  {{ if .IsSystem }}
                    "{{.Host}}:{{.Container}}",
                  {{ else }}
                    { "Fn::Join": [ "", [ "/volumes/", { "Ref": "AWS::StackName" }, "/{{$e.Name}}{{.Host}}:{{.Container}}" ] ] },
                  {{ end }}
                {{ end }}
                { "Ref" : "AWS::NoValue" }
              ],
              "ExtraHosts": [
                {{ range $key, $value := $e.ExtraHostsMap }}
                  {
                    "HostName": "{{ $key }}",
                    "IpAddress": "{{ $value }}"
                  },
                {{ end }}
                { "Ref" : "AWS::NoValue" }
              ],
              "Services": [
                { "Ref" : "AWS::NoValue" }
              ],
              "PortMappings": [
                {{ range .Ports }}
                  {{ if and (eq .Protocol "tcp") ($e.HasBalancer) }}
                  { "Fn::Join": [ ":", [
                    { "Ref": "{{ upper $e.Name }}Port{{ .Balancer }}Host" },
                      "{{ .Container }}/{{ .Protocol }}"
                  ] ] },
                  {{ else }}
                    "{{ .Balancer }}:{{ .Container }}/{{ .Protocol }}",
                  {{ end }}
                {{ end }}
                { "Ref" : "AWS::NoValue" }
              ],
              "Privileged": "{{ $e.Privileged }}",
              "LogConfiguration": { "Fn::If": [ "NativeLogging",
                {
                  "LogDriver": "awslogs",
                  "Options": {
                    "awslogs-region": { "Ref": "AWS::Region" },
                    "awslogs-group": { "Ref": "LogGroup" },
                    "awslogs-stream-prefix": "convox"
                  }
                },
                { "Ref" : "AWS::NoValue" }
              ] }
            }
          ]
        }
      },
      "Service{{ upper $e.Name }}": {
        "Condition": "Enabled{{ upper $e.Name }}",
        "DependsOn": [
          {{ if $e.HasBalancer }}
            "{{ $manifest.BalancerResourceName $e.Name }}",
          {{ end }}
          "CustomTopic",
          "ServiceRole"
         ],
        "Type": "AWS::ECS::Service",
        "Properties": {
          "Cluster": { "Ref": "Cluster" },
          "DeploymentConfiguration": {
            "MinimumHealthyPercent": "{{ $e.DeploymentMinimum }}",
            "MaximumPercent": "{{ $e.DeploymentMaximum }}"
          },
          "DesiredCount": { "Fn::Select": [ 0, { "Ref": "{{ upper $e.Name }}Formation" } ] },
          {{ if $e.HasBalancer }}
            "LoadBalancers": [
              {
                "ContainerName": "{{ $e.Name }}",
                "ContainerPort": "{{ (index $e.TCPPorts 0).Container }}",
                "LoadBalancerName": { "Ref": "{{ $manifest.BalancerResourceName $e.Name }}" }
              }
            ],
            "Role": { "Fn::GetAtt": [ "ServiceRole", "Arn" ] },
          {{ end }}
          "TaskDefinition": { "Ref": "{{ upper $e.Name }}ECSTaskDefinition" }
        }
      },
    {{ end }}
  {{ end }}
{{ end }}

{{ define "balancer-conditions" }}
  {{ range .Balancers }}
    {{ $processName := upper .ProcessName }}
    {{ $balancerPrefix := printf "Balancer%s" $processName }}
    {{ range .PortMappings }}
      "Blank{{ $balancerPrefix }}Port{{ .Balancer }}Certificate": {
        "Fn::Equals": [ { "Ref": "{{ $processName }}Port{{ .Balancer }}Certificate" }, "" ]
      },
    {{ end }}
  {{ end }}
{{ end }}

{{ define "balancer-params" }}
  {{ range .Balancers }}
    {{ $balancer := . }}
    {{ range .PortMappings }}
      "{{ upper $balancer.ProcessName }}Port{{ .Balancer }}Certificate": {
        "Type" : "String",
        "Default" : "",
        "Description" : ""
      },
      "{{ upper $balancer.ProcessName }}Port{{ .Balancer }}Host": {
        "Type" : "String",
        "Default" : "{{ index $balancer.Randoms (itoa .Balancer) }}",
        "Description" : ""
      },
    {{ end }}
  {{ end }}
{{ end }}

{{ define "balancer-outputs" }}
  {{ $app := .App }}
  {{ range .Manifest.Balancers }}
    {{ $balancer := . }}
    "Balancer{{ upper .ProcessName }}Host": {
      "Condition": "Enabled{{ upper .ProcessName }}",
      "Value": { "Fn::GetAtt": [ "{{ .ResourceName }}", "DNSName" ] }
    },
    {{ range .PortMappings }}
      "{{ upper $balancer.ProcessName }}Port{{ .Balancer }}Balancer": {
        "Condition": "Enabled{{ upper $balancer.ProcessName }}",
        "Value": "{{ .Balancer }}"
      },
      "{{ upper $balancer.ProcessName }}Port{{ .Balancer }}BalancerName": {
        "Condition": "Enabled{{ upper $balancer.ProcessName }}",
        "Value": { "Fn::If": [ "Internal",
          { "Fn::Join": [ "-", [ {{ $balancer.LoadBalancerName true $app.Name }}, "n" ] ] },
          {{ $balancer.LoadBalancerName true $app.Name }}
        ] }
      },
    {{ end }}
  {{ end }}
{{ end }}

{{ define "balancer-resources" }}
  {{ $app := .App }}
  {{ range .Manifest.Balancers }}
    {{ $balancer := . }}
    "{{ .ResourceName }}SecurityGroup": {
      "Condition": "Enabled{{ upper $balancer.ProcessName }}",
      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "GroupDescription": { "Fn::Join": [ " ", [ { "Ref": "AWS::StackName" }, "-balancer" ] ] },
        "SecurityGroupIngress": [
          {{ range .PortMappings }}
            {
              {{ if .Public }}
              "CidrIp": "0.0.0.0/0",
              {{ else }}
              "CidrIp": { "Ref": "VPCCIDR" },
              {{ end }}
              "IpProtocol": "{{ .Protocol }}",
              "FromPort": "{{ .Balancer }}",
              "ToPort": "{{ .Balancer }}"
            },
          {{ end }}
          { "Ref": "AWS::NoValue" }
        ],
        "VpcId": { "Ref": "VPC" }
      }
    },
    "{{ .ResourceName }}": {
      "Type": "AWS::ElasticLoadBalancing::LoadBalancer",
      "Condition": "Enabled{{ upper .ProcessName }}",
      "DependsOn": [ "{{ .ResourceName }}SecurityGroup" ],
      "Properties": {
        {{ if eq .Scheme "internal" }}
          "Scheme": "internal",
          "Subnets": { "Fn::If": [ "Private",
            { "Ref": "SubnetsPrivate" },
            { "Ref": "Subnets" }
          ] },
        {{ else }}
          "Scheme": { "Fn::If": [ "Internal", "internal", { "Ref": "AWS::NoValue" } ] },
          "Subnets": { "Fn::If": [ "Internal", { "Ref": "SubnetsPrivate" }, { "Ref": "Subnets" } ] },
        {{ end }}
        "ConnectionDrainingPolicy": { "Enabled": true, "Timeout": "{{ .DrainingTimeout }}" },
        "ConnectionSettings": { "IdleTimeout": "{{ .IdleTimeout }}" },
        "CrossZone": true,
        "HealthCheck": {
          "HealthyThreshold": "2",
          "Interval": "{{ .HealthInterval }}",
          "Target": { "Fn::Join": [ "", [
            "{{ .HealthProtocol }}:",
            { "Ref": "{{ upper .ProcessName }}Port{{ .HealthPort }}Host" },
            "{{ .HealthPath }}"
          ] ] },
          "Timeout": "{{ .HealthTimeout }}",
          "UnhealthyThreshold": "2"
        },
        "Listeners": [
          {{ range .PortMappings }}
            {
              {{ if $balancer.Protocol . }}
                "Protocol": "{{ $balancer.ListenerProtocol . }}",
              {{ else }}
                "Protocol": { "Fn::If": [ "BlankBalancer{{ upper $balancer.ProcessName }}Port{{ .Balancer }}Certificate", "TCP", "SSL" ] },
              {{ end }}
              "LoadBalancerPort": "{{ .Balancer }}",
              "InstanceProtocol": "{{ $balancer.InstanceProtocol . }}",
              "InstancePort": { "Ref": "{{ upper $balancer.ProcessName }}Port{{ .Balancer }}Host" },
              "SSLCertificateId": { "Fn::If": [ "BlankBalancer{{ upper $balancer.ProcessName }}Port{{ .Balancer }}Certificate",
                { "Ref": "AWS::NoValue" },
                { "Ref": "{{ upper $balancer.ProcessName }}Port{{ .Balancer }}Certificate" }
              ] }
            },
          {{ end }}
          { "Ref": "AWS::NoValue" }
        ],
        "Policies": [
          {{ range .PortMappings }}
            {{ if $balancer.ProxyProtocol . }}
              {
                "PolicyName": "EnableProxyProtocol",
                "PolicyType": "ProxyProtocolPolicyType",
                "Attributes": [{
                    "Name": "ProxyProtocol",
                    "Value": "true"
                }],
                "InstancePorts": [{ "Ref": "{{ upper $balancer.ProcessName }}Port{{ .Balancer }}Host" }]
              },
            {{ end }}
          {{ end }}
          { "Ref": "AWS::NoValue" }
        ],
        "LBCookieStickinessPolicy": [{ "PolicyName": "affinity" }],
        "LoadBalancerName": { "Fn::If": [ "Internal",
          { "Fn::Join": [ "-", [ {{ .LoadBalancerName true $app.Name }}, "n" ] ] },
          {{ .LoadBalancerName true $app.Name }}
        ] },
        "SecurityGroups" : [{ "Fn::If" : [
          "BlankSecurityGroup",
          {"Ref" : "{{ .ResourceName }}SecurityGroup"},
          {"Ref" : "SecurityGroup"}
        ]}]
      }
    },
  {{ end }}
{{ end }}

{{ define "cronjob-resources" }}
  {{ if .App.CronJobs .Manifest }}
    "CronRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": { "Service": [ "lambda.amazonaws.com" ] },
              "Action": [ "sts:AssumeRole" ]
            }
          ]
        },
        "Path": "/convox/",
        "Policies": [
          {
            "PolicyName": "CronJob",
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": "ecs:RunTask",
                  "Resource": "*",
                  "Condition": {
                    "ArnEquals": {
                      "ecs:cluster": { "Fn::Join": [ "", [
                        "arn:aws:ecs:",
                        { "Ref": "AWS::Region" },
                        ":",
                        { "Ref": "AWS::AccountId" },
                        ":cluster/",
                        "{{ env "CLUSTER" }}"
                      ] ] }
                    }
                  }
                },
                {
                  "Effect": "Allow",
                  "Action": [
                    "logs:CreateLogGroup",
                    "logs:CreateLogStream",
                    "logs:PutLogEvents"
                  ],
                  "Resource": { "Fn::Join": [ "", [ "arn:aws:logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] }
                },
                {
                  "Effect": "Allow",
                  "Action": [
                    "logs:CreateLogStream",
                    "logs:PutLogEvents"
                  ],
                  "Resource": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "LogGroup", "Arn" ] }, ":*" ] ] }
                }
              ]
            }
          }
        ]
      }
    },
    "CronFunction": {
      "Type": "AWS::Lambda::Function",
      "DependsOn": [ "CronRole" ],
      "Properties": {
        "Handler": "index.handler",
        "Role": { "Fn::GetAtt": [ "CronRole", "Arn" ] },
        "Runtime": "nodejs4.3",
        "Timeout": 50,
        "Code": {
          "ZipFile": { "Fn::Join": ["\n", [
            "'use strict';",
            "var aws = require('aws-sdk');",
            "var ecs = new aws.ECS({maxRetries:10});",
            "var logs = new aws.CloudWatchLogs();",
            "var cluster = '{{ env "CLUSTER" }}';",
            { "Fn::Join": [ "", [ "var logGroup = '", { "Ref": "LogGroup" }, "';" ] ] },
            { "Fn::Join": [ "", [ "var release = '", { "Ref": "Release" }, "';" ] ] },
            "var taskDefinitions = {",
            {{ range .Manifest.Services }}
              { "Fn::Join": [ "", [ "    '{{ .Name }}': '", { "Ref": "{{ upper .Name }}ECSTaskDefinition" }, "'," ] ] },
            {{ end }}
            "    '':''",
            "}",
            "exports.handler = function(event, context) {",
            "    var command = event.command.replace(/&#(\\d+);/g, function(match, dec) {",
            "      return String.fromCharCode(dec);",
            "    });",
            "    var params = {",
            "        startedBy: 'cron',",
            "        taskDefinition: taskDefinitions[event.process],",
            "        cluster: cluster,",
            "        count: 1,",
            "        overrides: {",
            "            containerOverrides: [",
            "                { name:event.process, command:[ 'sh', '-c', command ] }",
            "            ]",
            "        }",
            "    };",
            "    var skew = Math.floor(Math.random()*10000);",
            "    log(event.process + ':' + release + '/cron skew=' + skew + 'ms command=' + event.command, function(err) {",
            "        console.log('err2', err);",
            "        setTimeout(function() { ecs.runTask(params, context.done) }, skew);",
            "    });",
            "};",
            "function log(message, cb) {",
            "    var stream = 'cron-' + (new Date()).getTime();",
            "    var params = {",
            "        logGroupName: logGroup,",
            "        logStreamName: stream",
            "    }",
            "    logs.createLogStream(params, function(err) {",
            "        console.log('err', err);",
            "        var params = {",
            "            logEvents: [",
            "                { message: message, timestamp: (new Date()).getTime() }",
            "            ],",
            "            logGroupName: logGroup,",
            "            logStreamName: stream",
            "        }",
            "        console.log(message);",
            "        logs.putLogEvents(params, cb);",
            "    })",
            "}"
          ] ] }
        }
      }
    },
  {{ end }}
  {{ range .App.CronJobs .Manifest }}
    "{{ .ShortName }}Rule": {
      "Type": "AWS::Events::Rule",
      "Properties": {
        "Name": "{{ .LongName }}-schedule",
        "ScheduleExpression": "{{ .Schedule }}",
        "Targets": [{
          "Arn": { "Fn::GetAtt": [ "CronFunction", "Arn" ] },
          "Id": "{{ .LongName }}Target",
          "Input": "{\"process\": \"{{ .Process }}\", \"command\": \"{{ .Command }}\"}"
        }]
      }
    },
    "{{ .ShortName }}LambdaPermission": {
      "Type" : "AWS::Lambda::Permission",
      "Properties" : {
        "Action" : "lambda:InvokeFunction",
        "FunctionName" : { "Fn::GetAtt": [ "CronFunction", "Arn" ] },
        "Principal" : "events.amazonaws.com",
        "SourceArn" : { "Fn::GetAtt": [ "{{ .ShortName }}Rule", "Arn" ] }
      }
    },
  {{ end }}
{{ end }}

{{ define "agent-resources" }}
  {{ if .App.Agents .Manifest }}
    "AgentRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": { "Service": [ "lambda.amazonaws.com" ] },
              "Action": [ "sts:AssumeRole" ]
            }
          ]
        },
        "Path": "/convox/",
        "Policies": [
          {
            "PolicyName": "AgentJob",
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": "ecs:*",
                  "Resource": "*",
                  "Condition": {
                    "ArnEquals": {
                      "ecs:cluster": { "Fn::Join": [ "", [
                        "arn:aws:ecs:",
                        { "Ref": "AWS::Region" },
                        ":",
                        { "Ref": "AWS::AccountId" },
                        ":cluster/",
                        "{{ env "CLUSTER" }}"
                      ] ] }
                    }
                  }
                },
                {
                  "Effect": "Allow",
                  "Action": [
                    "logs:CreateLogGroup",
                    "logs:CreateLogStream",
                    "logs:PutLogEvents"
                  ],
                  "Resource": { "Fn::Join": [ "", [ "arn:aws:logs:", { "Ref": "AWS::Region" }, ":", { "Ref": "AWS::AccountId" }, ":log-group:/aws/lambda/*" ] ] }
                },
                {
                  "Effect": "Allow",
                  "Action": [
                    "logs:CreateLogStream",
                    "logs:PutLogEvents"
                  ],
                  "Resource": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "LogGroup", "Arn" ] }, ":*" ] ] }
                }
              ]
            }
          }
        ]
      }
    },
    "AgentFunction": {
      "Type": "AWS::Lambda::Function",
      "DependsOn": [ "AgentRole" ],
      "Properties": {
        "Handler": "index.handler",
        "Role": { "Fn::GetAtt": [ "AgentRole", "Arn" ] },
        "Runtime": "nodejs4.3",
        "Timeout": 50,
        "Code": {
          "ZipFile": { "Fn::Join": ["\n", [
            {{ $code := .App.AgentFunctionCode }}
            {{ index $code "head" }}
            {{ range .App.Agents .Manifest }}
              { "Fn::Join": [ "", ["  '", { "Ref": "{{ upper .Service.Name }}ECSTaskDefinition" }, "'," ] ] },
            {{ end }}
            {{ index $code "body" }}
          ] ] }
        }
      }
    },
  {{ end }}
  {{ range .App.Agents .Manifest }}
    "{{ .ShortName }}Rule": {
      "Type": "AWS::Events::Rule",
      "Properties": {
        "Name": "{{ .LongName }}-change",
        "EventPattern": {
          "source": [
            "aws.ecs"
          ],
          "detail-type": [
            "ECS Container Instance State Change",
            "ECS Task State Change"
          ],
          "detail": {
            "clusterArn": [
              { "Fn::Join": [ "", [
                "arn:aws:ecs:",
                { "Ref": "AWS::Region" },
                ":",
                { "Ref": "AWS::AccountId" },
                ":cluster/",
                { "Ref": "Cluster" }
              ] ] }
            ]
          }
        },
        "Targets": [{
          "Arn": { "Fn::GetAtt": [ "AgentFunction", "Arn" ] },
          "Id": "{{ .LongName }}Target"
        }]
      }
    },
    "{{ .ShortName }}LambdaPermission": {
      "Type" : "AWS::Lambda::Permission",
      "Properties" : {
        "Action" : "lambda:InvokeFunction",
        "FunctionName" : { "Fn::GetAtt": [ "AgentFunction", "Arn" ] },
        "Principal" : "events.amazonaws.com",
        "SourceArn" : { "Fn::GetAtt": [ "{{ .ShortName }}Rule", "Arn" ] }
      }
    },
  {{ end }}
{{ end }}

{{ define "registry-resources" }}
  "RegistryRepository": {
    "Type": "Custom::ECRRepository",
    "Version": "1.0",
    "Properties": {
      "ServiceToken": { "Fn::GetAtt": [ "CustomTopic", "Arn" ] },
      "RepositoryName": { "Ref": "AWS::StackName" }
    }
  },
{{ end }}

{{ define "registry-outputs" }}
  "RegistryId": {
    "Value": { "Ref": "AWS::AccountId" }
  },
  "RegistryRepository": {
    "Value": { "Fn::GetAtt": [ "RegistryRepository", "RepositoryName" ] }
  },
{{ end }}

{{ define "security" }}
  "ServiceRole": {
    "Type": "AWS::IAM::Role",
    "Properties": {
      "AssumeRolePolicyDocument": {
        "Statement": [
          {
            "Action": [
              "sts:AssumeRole"
            ],
            "Effect": "Allow",
            "Principal": {
              "Service": [
                "ecs.amazonaws.com"
              ]
            }
          }
        ],
        "Version": "2012-10-17"
      },
      "Path": "/convox/",
      "Policies": [
        {
          "PolicyName": "ServiceRole",
          "PolicyDocument": {
            "Statement": [
              {
                "Effect": "Allow",
                "Action": [
                  "elasticloadbalancing:Describe*",
                  "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
                  "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
                  "ec2:Describe*",
                  "ec2:AuthorizeSecurityGroupIngress"
                ],
                "Resource": [
                  "*"
                ]
              }
            ]
          }
        }
      ]
    }
  },
{{ end }}

{{ define "state" }}
  "Settings": {
    "Type": "AWS::S3::Bucket",
    "DeletionPolicy": "Retain",
    "Properties": {
      "AccessControl": "Private",
      "Tags": [
        { "Key": "system", "Value": "convox" },
        { "Key": "app", "Value": { "Ref": "AWS::StackName" } }
      ]
    }
  }
{{ end }}