AWSTemplateFormatVersion: 2010-09-09
Description: Creating ECS service
Parameters:
  AppName:
    Type: String
    Description: Name of app requiring ELB exposure
    Default: simple-app
  AppContainerPort:
    Type: Number
    Description: Container port of app requiring ELB exposure
    Default: "80"
  AppHostPort:
    Type: Number
    Description: Host port of app requiring ELB exposure
    Default: "80"
  ServiceName:
    Type: String
    Default: "MiggeTest"
  LoadBalancerName:
    Type: String
    Default: MiggeTestLoadBalancer
  HealthCheckGracePeriodSeconds:
    Type: String
    Default: "30"
  DockerImageTimerService:
    Description: Docker image for EC2Instance1
    Type: String
    Default: gitlab.my-company.com:4567/platform/dummy-service/master:latest@sha256:fda95bc8fb7be463c1e704981ef40a00fb32d5032962325a7cd6881833611ace
  DockerImageExternalAPIService:
    Description: Docker image for the External API Service
    Type: String
    Default: gitlab.my-company.com:4567/platform/api-service/master:ffba5a5116adece9fcf72315da31967dc6c85f44

Resources:
  cluster:
    Type: AWS::ECS::Cluster

  DockerUsername:
    Type: AWS::SSM::Parameter
    Properties:
      Name: docker-username
      Description: gitlab user
      Tier: Intelligent-Tiering
      Value: my-user
      Type: String

  DockerPassword:
    Type: AWS::SSM::Parameter
    Properties:
      Name: docker-password
      Description: gitlab user
      Tier: Intelligent-Tiering
      Value: my-password
      Type: String

  DockerCredentialsSecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: DockerCredentials
      Description: Secret for storing Docker credentials
      SecretString:
        Fn::Sub: '{"username": "${DockerUsername}", "password": "${DockerPassword}"}'

  taskdefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ExecutionRoleArn: !GetAtt TaskRole.Arn
      ContainerDefinitions:
        - Name: !Ref AppName
          MountPoints:
            - SourceVolume: my-vol
              ContainerPath: /var/www/my-vol
          Image: !Ref DockerImageTimerService
          RepositoryCredentials:
            CredentialsParameter: !Ref DockerCredentialsSecret
          Cpu: "10"
          PortMappings:
            - ContainerPort: !Ref AppContainerPort
              HostPort: !Ref AppHostPort
          EntryPoint:
            - /usr/sbin/apache2
            - "-D"
            - FOREGROUND
          Memory: "500"
          Essential: true
        - Name: api-service
          Image: !Ref DockerImageExternalAPIService
          RepositoryCredentials:
            CredentialsParameter: !Ref DockerCredentialsSecret
          Cpu: "10"
          EntryPoint:
            - sh
            - "-c"
          Memory: "500"
          Command:
            - >-
              /bin/sh -c "while true; do /bin/date > /var/www/my-vol/date; sleep
              1; done"
          Essential: false
          VolumesFrom:
            - SourceContainer: !Ref AppName
      Volumes:
        - Host:
            SourcePath: /var/lib/docker/vfs/dir/
          Name: my-vol

  TaskRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action: sts:AssumeRole
  service:
    Type: AWS::ECS::Service
    Properties:
      Cluster: !Ref cluster
      DeploymentConfiguration:
        MaximumPercent: 200
        MinimumHealthyPercent: 100
      DesiredCount: 1
      HealthCheckGracePeriodSeconds: !Ref HealthCheckGracePeriodSeconds
      LoadBalancers:
        - ContainerName: !Ref AppName
          ContainerPort: !Ref AppContainerPort
          LoadBalancerName: !Ref elb
      PlacementStrategies:
        - Type: binpack
          Field: memory
        - Type: spread
          Field: host
      PlacementConstraints:
        - Type: memberOf
          Expression: "attribute:ecs.availability-zone != us-east-1d"
        - Type: distinctInstance
      TaskDefinition: !Ref taskdefinition
      ServiceName: !Ref ServiceName
      Role: !Ref Role

  elb:
    Type: AWS::ElasticLoadBalancing::LoadBalancer
    Properties:
      LoadBalancerName: !Ref LoadBalancerName
      Listeners:
        - InstancePort: !Ref AppHostPort
          LoadBalancerPort: "80"
          Protocol: HTTP
      Subnets:
        - !Ref Subnet1
    DependsOn: GatewayAttachment
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/24
  Subnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.0.0/25
  InternetGateway:
    Type: AWS::EC2::InternetGateway
  GatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref VPC
  Role:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2008-10-17
        Statement:
          - Sid: ""
            Effect: Allow
            Principal:
              Service: ecs.amazonaws.com
            Action: "sts:AssumeRole"
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole"
Outputs:
  Cluster:
    Value: !Ref cluster