monitoring/cf-service-grafana.yml

  AWSTemplateFormatVersion: '2010-09-09'
  Description: Deploy a Grafana service into an ECS cluster behind a public load balancer.
  Parameters:
    GrafanaServiceName:
        Type: String
        Default: gerrit-grafana
    PrometheusStackName:
        Type: String
        Default: gerrit-prometheus
    PrimaryStackName:
        Type: String
        Default: gerrit-primary
    ReplicaStackName:
        Type: String
        Default: gerrit-replica
    ClusterStackName:
        Description: Stack name of the ECS cluster to deploy the serivces
        Type: String
        Default: gerrit-cluster
    EnvironmentName:
        Description: An environment name that will be prefixed to the resource names
        Type: String
        Default: test
    DockerImage:
          Description: Grafana official Docker image
          Type: String
          Default: aws-gerrit/grafana:latest
    DockerRegistryUrl:
          Description: Docker registry URL
          Type: String
    DesiredCount:
          Description: How many instances of this task should we run across our cluster?
          Type: Number
          Default: 1
    HTTPPort:
          Description: Grafana HTTP port
          Type: Number
          Default: 3000
    HTTPSPort:
          Description: Grafana HTTPS port
          Type: Number
          Default: 443
    CertificateArn:
          Description: SSL Certificates ARN
          Type: String
    HostedZoneName:
          Description: The route53 HostedZoneName.
          Type: String
    Subdomain:
          Description: The subdomain of the Monitoring service
          Type: String
          Default: gerrit-grafana

  Resources:
      Service:
          Type: AWS::ECS::Service
          DependsOn:
            - HTTPListener
          Properties:
              Cluster:
                Fn::ImportValue:
                    !Join [':', [!Ref 'ClusterStackName', 'ClusterName']]
              DesiredCount: !Ref DesiredCount
              TaskDefinition: !Ref TaskDefinition
              LoadBalancers:
                  - ContainerName: !Ref GrafanaServiceName
                    ContainerPort: !Ref HTTPPort
                    TargetGroupArn: !Ref HTTPTargetGroup

      TaskDefinition:
          Type: AWS::ECS::TaskDefinition
          Properties:
              Family: !Join ['', [!Ref GrafanaServiceName, TaskDefinition]]
              TaskRoleArn: !Ref ECSTaskExecutionRole
              ExecutionRoleArn: !Ref ECSTaskExecutionRole
              NetworkMode: bridge
              ContainerDefinitions:
                  - Name: !Ref GrafanaServiceName
                    Essential: true
                    Image: !Sub '${DockerRegistryUrl}/${DockerImage}'
                    Environment:
                      - Name: AWS_REGION
                        Value: !Ref AWS::Region
                      - Name: GRAFANA_DOMAIN
                        Value: !Sub '${Subdomain}.${HostedZoneName}'
                      - Name: PRIMARY_URL
                        Value:
                          !Join
                            - '.'
                            - - Fn::ImportValue: !Join [':', [!Ref 'PrimaryStackName', 'Subdomain']]
                              - Fn::ImportValue: !Join [':', [!Ref 'PrimaryStackName', 'HostedZoneName']]
                      - Name: REPLICA_URL
                        Value:
                          !Join
                            - '.'
                            - - Fn::ImportValue: !Join [':', [!Ref 'ReplicaStackName', 'Subdomain']]
                              - Fn::ImportValue: !Join [':', [!Ref 'ReplicaStackName', 'HostedZoneName']]
                      - Name: PROMETHEUS_URL
                        Value:
                          Fn::ImportValue:
                              !Join [':', [!Ref 'PrometheusStackName', 'CanonicalWebUrl']]
                    Cpu: 1024
                    Memory: 2048
                    PortMappings:
                      - ContainerPort: !Ref HTTPPort
                        HostPort: !Ref HTTPPort
                        Protocol: tcp
                    LogConfiguration:
                      LogDriver: awslogs
                      Options:
                          awslogs-group: !Ref ClusterStackName
                          awslogs-region: !Ref AWS::Region
                          awslogs-stream-prefix: !Ref EnvironmentName

      LoadBalancer:
          Type: AWS::ElasticLoadBalancingV2::LoadBalancer
          Properties:
              Type: network
              Scheme: internet-facing
              Subnets:
                - Fn::ImportValue:
                    !Join [':', [!Ref 'ClusterStackName', 'PublicSubnetOne']]
              Tags:
                  - Key: Name
                    Value: !Join ['-', [!Ref 'EnvironmentName', !Ref 'GrafanaServiceName', 'monitoring']]

      HTTPTargetGroup:
          Type: AWS::ElasticLoadBalancingV2::TargetGroup
          DependsOn: LoadBalancer
          Properties:
              VpcId:
                Fn::ImportValue:
                    !Join [':', [!Ref 'ClusterStackName', 'VPCId']]
              Port: !Ref HTTPPort
              Protocol: TCP

      HTTPListener:
          Type: AWS::ElasticLoadBalancingV2::Listener
          DependsOn: LoadBalancer
          Properties:
              Certificates:
                - CertificateArn: !Ref CertificateArn
              DefaultActions:
              - Type: forward
                TargetGroupArn: !Ref HTTPTargetGroup
              LoadBalancerArn: !Ref LoadBalancer
              Port: !Ref HTTPSPort
              Protocol: TLS

      # This is a role which is used by the ECS tasks themselves.
      ECSTaskExecutionRole:
        Type: AWS::IAM::Role
        Properties:
          AssumeRolePolicyDocument:
            Statement:
            - Effect: Allow
              Principal:
                Service: [ecs-tasks.amazonaws.com]
              Action: ['sts:AssumeRole']
          Path: /
          Policies:
            - PolicyName: AmazonECSTaskExecutionRolePolicy
              PolicyDocument:
                Statement:
                - Effect: Allow
                  Action:
                    # Allow the ECS Tasks to download images from ECR
                    - 'ecr:GetAuthorizationToken'
                    - 'ecr:BatchCheckLayerAvailability'
                    - 'ecr:GetDownloadUrlForLayer'
                    - 'ecr:BatchGetImage'
                    # Allow the ECS tasks to upload logs to CloudWatch
                    - 'logs:CreateLogStream'
                    - 'logs:PutLogEvents'
                  Resource: '*'
            - PolicyName: AmazonECSTaskSecretManagerRolePolicy
              PolicyDocument:
                Statement:
                - Effect: Allow
                  Action:
                    # Allow the ECS Tasks to get SSH Keys
                    - 'secretsmanager:GetSecretValue'
                    - 'kms:Decrypt'
                  Resource: '*'
  Outputs:
    PublicLoadBalancerDNSName:
      Description: The DNS name of the external load balancer
      Value: !GetAtt 'LoadBalancer.DNSName'
      Export:
        Name: !Join [ ':', [ !Ref 'AWS::StackName', 'PublicLoadBalancerDNSName' ] ]
    CanonicalHostedZoneID:
      Description: Canonical Hosted Zone ID
      Value: !GetAtt 'LoadBalancer.CanonicalHostedZoneID'
      Export:
        Name: !Join [ ':', [ !Ref 'AWS::StackName', 'CanonicalHostedZoneID' ] ]
    PublicLoadBalancerUrl:
      Description: The url of the external load balancer
      Value: !Join ['', ['http://', !GetAtt 'LoadBalancer.DNSName']]
      Export:
        Name: !Join [ ':', [ !Ref 'AWS::StackName', 'PublicLoadBalancerUrl' ] ]
    HostedZoneName:
      Description: Route53 Hosted Zone name
      Value: !Ref HostedZoneName
      Export:
        Name: !Join [ ':', [ !Ref 'AWS::StackName', 'HostedZoneName' ] ]
    Subdomain:
      Description: Service DNS subdomain
      Value: !Ref Subdomain
      Export:
        Name: !Join [ ':', [ !Ref 'AWS::StackName', 'Subdomain' ] ]
    CanonicalWebUrl:
      Description: Canonical Web URL
      Value: !Sub 'https://${Subdomain}.${HostedZoneName}'
      Export:
        Name: !Join [ ':', [ !Ref 'AWS::StackName', 'CanonicalWebUrl' ] ]