# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: MIT-0
AWSTemplateFormatVersion: 2010-09-09
Description: CloudFormation template that represents a load balanced web service on Amazon ECS.
Metadata:
  Version: v1.29.0
Parameters:
  AppName:
    Type: String
  EnvName:
    Type: String
  WorkloadName:
    Type: String
  ContainerImage:
    Type: String
  ContainerPort:
    Type: Number
  TaskCPU:
    Type: String
  TaskMemory:
    Type: String
  TaskCount:
    Type: Number
  DNSDelegated:
    Type: String
    AllowedValues: [true, false]
  LogRetention:
    Type: Number
  AddonsTemplateURL:
    Description: 'URL of the addons nested stack template within the S3 bucket.'
    Type: String
    Default: ""
  EnvFileARN:
    Description: 'URL of the environment file.'
    Type: String
    Default: ""
  NLBAliases:
    Type: String
    Default: ""
  NLBPort:
    Type: String
  TargetContainer:
    Type: String
  TargetPort:
    Type: Number
  HTTPSEnabled:
    Type: String
    AllowedValues: [true, false]
  RulePath:
    Type: String
Conditions:
  IsGovCloud: !Equals [!Ref "AWS::Partition", "aws-us-gov"]
  HasAssociatedDomain: !Equals [!Ref DNSDelegated, true]
  HasAddons: !Not [!Equals [!Ref AddonsTemplateURL, ""]]
  HasEnvFile: !Not [!Equals [!Ref EnvFileARN, ""]]
Resources: # If a bucket URL is specified, that means the template exists.
  LogGroup:
    Metadata:
      'aws:copilot:description': 'A CloudWatch log group to hold your service logs'
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Join ['', [/copilot/, !Ref AppName, '-', !Ref EnvName, '-', !Ref WorkloadName]]
      RetentionInDays: !Ref LogRetention
  TaskDefinition:
    Metadata:
      'aws:copilot:description': 'An ECS task definition to group your containers and run them on ECS'
    Type: AWS::ECS::TaskDefinition
    DependsOn: LogGroup
    Properties:
      Family: !Join ['', [!Ref AppName, '-', !Ref EnvName, '-', !Ref WorkloadName]]
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      Cpu: !Ref TaskCPU
      Memory: !Ref TaskMemory
      ExecutionRoleArn: !GetAtt ExecutionRole.Arn
      TaskRoleArn: !GetAtt TaskRole.Arn
      ContainerDefinitions:
        - Name: !Ref WorkloadName
          Image: !Ref ContainerImage
          Environment:
            - Name: COPILOT_APPLICATION_NAME
              Value: !Sub '${AppName}'
            - Name: COPILOT_SERVICE_DISCOVERY_ENDPOINT
              Value: dev.my-app.local
            - Name: COPILOT_ENVIRONMENT_NAME
              Value: !Sub '${EnvName}'
            - Name: COPILOT_SERVICE_NAME
              Value: !Sub '${WorkloadName}'
            - Name: COPILOT_LB_DNS
              Value: !GetAtt EnvControllerAction.PublicLoadBalancerDNSName
            - Name: LOG_LEVEL
              Value: "info"
          EnvironmentFiles:
            - !If
              - HasEnvFile
              - Type: s3
                Value: !Ref EnvFileARN
              - !Ref AWS::NoValue
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region: !Ref AWS::Region
              awslogs-group: !Ref LogGroup
              awslogs-stream-prefix: copilot
          PortMappings:
            - ContainerPort: 80
              Protocol: tcp
              Name: target
            - ContainerPort: 81
              Protocol: tcp
            - ContainerPort: 8085
              Protocol: tcp
  ExecutionRole:
    Metadata:
      'aws:copilot:description': 'An IAM Role for the Fargate agent to make AWS API calls on your behalf'
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action: 'sts:AssumeRole'
      Policies:
        - PolicyName: !Join ['', [!Ref AppName, '-', !Ref EnvName, '-', !Ref WorkloadName, SecretsPolicy]]
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: 'Allow'
                Action:
                  - 'ssm:GetParameters'
                Resource:
                  - !Sub 'arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/*'
                Condition:
                  StringEquals:
                    'ssm:ResourceTag/copilot-application': !Sub '${AppName}'
                    'ssm:ResourceTag/copilot-environment': !Sub '${EnvName}'
              - Effect: 'Allow'
                Action:
                  - 'secretsmanager:GetSecretValue'
                Resource:
                  - !Sub 'arn:${AWS::Partition}:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:*'
                Condition:
                  StringEquals:
                    'secretsmanager:ResourceTag/copilot-application': !Sub '${AppName}'
                    'secretsmanager:ResourceTag/copilot-environment': !Sub '${EnvName}'
              - Effect: 'Allow'
                Action:
                  - 'kms:Decrypt'
                Resource:
                  - !Sub 'arn:${AWS::Partition}:kms:${AWS::Region}:${AWS::AccountId}:key/*'
        - !If
          # Optional IAM permission required by ECS task def env file
          # https://docs.aws.amazon.com/AmazonECS/latest/developerguide/taskdef-envfiles.html#taskdef-envfiles-iam
          # Example EnvFileARN: arn:aws:s3:::stackset-demo-infrastruc-pipelinebuiltartifactbuc-11dj7ctf52wyf/manual/1638391936/env
          - HasEnvFile
          - PolicyName: !Join ['', [!Ref AppName, '-', !Ref EnvName, '-', !Ref WorkloadName, GetEnvFilePolicy]]
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: 'Allow'
                  Action:
                    - 's3:GetObject'
                  Resource:
                    - !Ref EnvFileARN
                - Effect: 'Allow'
                  Action:
                    - 's3:GetBucketLocation'
                  Resource:
                    - !Join
                      - ''
                      - - 'arn:'
                        - !Ref AWS::Partition
                        - ':s3:::'
                        - !Select [0, !Split ['/', !Select [5, !Split [':', !Ref EnvFileARN]]]]
          - !Ref AWS::NoValue
      ManagedPolicyArns:
        - !Sub 'arn:${AWS::Partition}:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy'
  TaskRole:
    Metadata:
      'aws:copilot:description': 'An IAM role to control permissions for the containers in your tasks'
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action: 'sts:AssumeRole'
      Policies:
        - PolicyName: 'DenyIAMExceptTaggedRoles'
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: 'Deny'
                Action: 'iam:*'
                Resource: '*'
              - Effect: 'Allow'
                Action: 'sts:AssumeRole'
                Resource:
                  - !Sub 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/*'
                Condition:
                  StringEquals:
                    'iam:ResourceTag/copilot-application': !Sub '${AppName}'
                    'iam:ResourceTag/copilot-environment': !Sub '${EnvName}'
  DiscoveryService:
    Metadata:
      'aws:copilot:description': 'Service discovery for your services to communicate within the VPC'
    Type: AWS::ServiceDiscovery::Service
    Properties:
      Description: Discovery Service for the Copilot services
      DnsConfig:
        RoutingPolicy: MULTIVALUE
        DnsRecords:
          - TTL: 10
            Type: A
          - TTL: 10
            Type: SRV
      HealthCheckCustomConfig:
        FailureThreshold: 1
      Name: !Ref WorkloadName
      NamespaceId:
        Fn::ImportValue: !Sub '${AppName}-${EnvName}-ServiceDiscoveryNamespaceID'
  EnvControllerAction:
    Metadata:
      'aws:copilot:description': "Update your environment's shared resources"
    Type: Custom::EnvControllerFunction
    Properties:
      ServiceToken: !GetAtt EnvControllerFunction.Arn
      Workload: !Ref WorkloadName
      EnvStack: !Sub '${AppName}-${EnvName}'
      Parameters: [ALBWorkloads, Aliases]
      EnvVersion: v1.42.0
  EnvControllerFunction:
    Type: AWS::Lambda::Function
    Properties:
      Handler: "index.handler"
      Timeout: 900
      MemorySize: 512
      Role: !GetAtt 'EnvControllerRole.Arn'
      Runtime: nodejs16.x
  EnvControllerRole:
    Metadata:
      'aws:copilot:description': "An IAM role to update your environment stack"
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: "EnvControllerStackUpdate"
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - cloudformation:DescribeStacks
                  - cloudformation:UpdateStack
                Resource: !Sub 'arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${AppName}-${EnvName}/*'
                Condition:
                  StringEquals:
                    'cloudformation:ResourceTag/copilot-application': !Sub '${AppName}'
                    'cloudformation:ResourceTag/copilot-environment': !Sub '${EnvName}'
        - PolicyName: "EnvControllerRolePass"
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - iam:PassRole
                Resource: !Sub 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${AppName}-${EnvName}-CFNExecutionRole'
                Condition:
                  StringEquals:
                    'iam:ResourceTag/copilot-application': !Sub '${AppName}'
                    'iam:ResourceTag/copilot-environment': !Sub '${EnvName}'
      ManagedPolicyArns:
        - !Sub arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
  Service:
    Metadata:
      'aws:copilot:description': 'An ECS service to run and maintain your tasks in the environment cluster'
    Type: AWS::ECS::Service
    DependsOn:
      - HTTPListenerRuleWithDomain
      - HTTPSListenerRule
      - NLBListener
      - NLBListener1
    Properties:
      PlatformVersion: LATEST
      Cluster:
        Fn::ImportValue: !Sub '${AppName}-${EnvName}-ClusterId'
      TaskDefinition: !Ref TaskDefinition
      DesiredCount: !Ref TaskCount
      DeploymentConfiguration:
        DeploymentCircuitBreaker:
          Enable: true
          Rollback: true
        MinimumHealthyPercent: 100
        MaximumPercent: 200
        Alarms:
          !If
          - IsGovCloud
          - !Ref AWS::NoValue
          - Enable: false
            AlarmNames: []
            Rollback: true
      PropagateTags: SERVICE
      ServiceConnectConfiguration: !If
        - IsGovCloud
        - !Ref AWS::NoValue
        - Enabled: False
      CapacityProviderStrategy:
        - CapacityProvider: FARGATE_SPOT
          Weight: 1
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: ENABLED
          Subnets:
            Fn::Split:
              - ','
              - Fn::ImportValue: !Sub '${AppName}-${EnvName}-PublicSubnets'
          SecurityGroups:
            - Fn::ImportValue: !Sub '${AppName}-${EnvName}-EnvironmentSecurityGroup'
            - !Ref NLBSecurityGroup
      # This may need to be adjusted if the container takes a while to start up
      HealthCheckGracePeriodSeconds: 60
      LoadBalancers:
        - ContainerName: fe
          ContainerPort: 80
          TargetGroupArn: !Ref TargetGroup
        - ContainerName: fe
          ContainerPort: 81
          TargetGroupArn: !Ref NLBTargetGroup
        - ContainerName: fe
          ContainerPort: 8085
          TargetGroupArn: !Ref NLBTargetGroup1
      ServiceRegistries:
        - RegistryArn: !GetAtt DiscoveryService.Arn
          Port: !Ref TargetPort
  TargetGroup:
    Metadata:
      'aws:copilot:description': 'A target group to connect the load balancer to your service on port 80'
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckPath: / # Default is '/'.
      Port: 80
      Protocol: HTTP
      TargetGroupAttributes:
        - Key: deregistration_delay.timeout_seconds
          Value: 30 # ECS Default is 300; Copilot default is 60.
        - Key: stickiness.enabled
          Value: false
      TargetType: ip
      VpcId:
        Fn::ImportValue: !Sub "${AppName}-${EnvName}-VpcId"
  RulePriorityFunction:
    Type: AWS::Lambda::Function
    Properties:
      Handler: "index.nextAvailableRulePriorityHandler"
      Timeout: 600
      MemorySize: 512
      Role: !GetAtt 'RulePriorityFunctionRole.Arn'
      Runtime: nodejs16.x
  RulePriorityFunctionRole:
    Metadata:
      'aws:copilot:description': "An IAM Role to describe load balancer rules for assigning a priority"
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      ManagedPolicyArns:
        - !Sub arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: "RulePriorityGeneratorAccess"
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - elasticloadbalancing:DescribeRules
                Resource: "*"
  LoadBalancerDNSAlias:
    Metadata:
      'aws:copilot:description': 'The default alias record for the application load balancer'
    Type: AWS::Route53::RecordSetGroup
    Properties:
      HostedZoneId:
        Fn::ImportValue: !Sub "${AppName}-${EnvName}-HostedZone"
      Comment: !Sub "LoadBalancer alias for service ${WorkloadName}"
      RecordSets:
        - Name: !Join
            - '.'
            - - !Ref WorkloadName
              - Fn::ImportValue: !Sub "${AppName}-${EnvName}-SubDomain"
              - ""
          Type: A
          AliasTarget:
            HostedZoneId: !GetAtt EnvControllerAction.PublicLoadBalancerHostedZone
            DNSName: !GetAtt EnvControllerAction.PublicLoadBalancerDNSName
  HTTPSRulePriorityAction:
    Metadata:
      'aws:copilot:description': 'A custom resource assigning priority for HTTPS listener rules'
    Type: Custom::RulePriorityFunction
    Properties:
      ServiceToken: !GetAtt RulePriorityFunction.Arn
      RulePath: ["/"]
      ListenerArn: !GetAtt EnvControllerAction.HTTPSListenerArn
  
  HTTPRuleWithDomainPriorityAction:
    Metadata:
      'aws:copilot:description': 'A custom resource assigning priority for HTTP listener rules'
    Type: Custom::RulePriorityFunction
    Properties:
      ServiceToken: !GetAtt RulePriorityFunction.Arn
      RulePath: ["/"]
      ListenerArn: !GetAtt EnvControllerAction.HTTPListenerArn
  
  HTTPListenerRuleWithDomain:
    Metadata:
      'aws:copilot:description': 'An HTTP listener rule for path `/` that redirects HTTP to HTTPS'
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      Actions:
        - Type: redirect
          RedirectConfig:
            Protocol: HTTPS
            Port: 443
            Host: "#{host}"
            Path: "/#{path}"
            Query: "#{query}"
            StatusCode: HTTP_301
      Conditions:
        - Field: 'host-header'
          HostHeaderConfig:
            Values:
              - Fn::Join:
                  - '.'
                  - - !Ref WorkloadName
                    - Fn::ImportValue: !Sub "${AppName}-${EnvName}-SubDomain"
        - Field: 'path-pattern'
          PathPatternConfig:
            Values:
              - "/*"
      ListenerArn: !GetAtt EnvControllerAction.HTTPListenerArn
      Priority: !GetAtt HTTPRuleWithDomainPriorityAction.Priority
  HTTPSListenerRule:
    Metadata:
      'aws:copilot:description': 'An HTTPS listener rule for path `/` that forwards HTTPS traffic to your tasks'
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      Actions:
        - TargetGroupArn: !Ref TargetGroup
          Type: forward
      Conditions:
        - Field: 'host-header'
          HostHeaderConfig:
            Values:
              - Fn::Join:
                  - '.'
                  - - !Ref WorkloadName
                    - Fn::ImportValue: !Sub "${AppName}-${EnvName}-SubDomain"
        - Field: 'path-pattern'
          PathPatternConfig:
            Values:
              - "/*"
      ListenerArn: !GetAtt EnvControllerAction.HTTPSListenerArn
      Priority: !GetAtt HTTPSRulePriorityAction.Priority
  PublicNetworkLoadBalancer:
    Metadata:
      'aws:copilot:description': 'A Network Load Balancer to distribute public traffic to your service'
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Scheme: internet-facing
      Subnets:
        Fn::Split:
          - ","
          - Fn::ImportValue: !Sub '${AppName}-${EnvName}-PublicSubnets'
      Type: network
  NLBListener:
    Metadata:
      'aws:copilot:description': 'A TCP listener on port `81` that forwards traffic to your tasks'
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - TargetGroupArn: !Ref NLBTargetGroup
          Type: forward
      LoadBalancerArn: !Ref PublicNetworkLoadBalancer
      Port: 81
      Protocol: TCP
  NLBListener1:
    Metadata:
      'aws:copilot:description': 'A TCP listener on port `8082` that forwards traffic to your tasks'
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - TargetGroupArn: !Ref NLBTargetGroup1
          Type: forward
      LoadBalancerArn: !Ref PublicNetworkLoadBalancer
      Port: 8082
      Protocol: TCP
  NLBTargetGroup:
    Metadata:
      'aws:copilot:description': 'A target group to connect the network load balancer to your service on port 81'
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Port: 81
      Protocol: TCP
      TargetGroupAttributes:
        - Key: deregistration_delay.timeout_seconds
          Value: 60 # ECS Default is 300; Copilot default is 60.
      TargetType: ip
      VpcId:
        Fn::ImportValue: !Sub "${AppName}-${EnvName}-VpcId"
  NLBTargetGroup1:
    Metadata:
      'aws:copilot:description': 'A target group to connect the network load balancer to your service on port 8085'
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Port: 8085
      Protocol: TCP
      TargetGroupAttributes:
        - Key: deregistration_delay.timeout_seconds
          Value: 59 # ECS Default is 300; Copilot default is 60.
      TargetType: ip
      VpcId:
        Fn::ImportValue: !Sub "${AppName}-${EnvName}-VpcId"
  NLBSecurityGroup:
    Metadata:
      'aws:copilot:description': 'A security group for your network load balancer to route traffic to service'
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow access from the network load balancer to service
      SecurityGroupIngress:
        - CidrIp: 10.0.0.0/24
          Description: Ingress to allow access from Network Load Balancer subnet
          FromPort: 81
          IpProtocol: TCP
          ToPort: 81
        - CidrIp: 10.0.0.0/24
          Description: Ingress to allow access from Network Load Balancer subnet
          FromPort: 8085
          IpProtocol: TCP
          ToPort: 8085
        - CidrIp: 10.1.0.0/24
          Description: Ingress to allow access from Network Load Balancer subnet
          FromPort: 81
          IpProtocol: TCP
          ToPort: 81
        - CidrIp: 10.1.0.0/24
          Description: Ingress to allow access from Network Load Balancer subnet
          FromPort: 8085
          IpProtocol: TCP
          ToPort: 8085
      Tags:
        - Key: Name
          Value: !Sub 'copilot-${AppName}-${EnvName}-${WorkloadName}-nlb'
      VpcId:
        Fn::ImportValue: !Sub "${AppName}-${EnvName}-VpcId"
  NLBDNSAlias:
    Metadata:
      'aws:copilot:description': 'The default alias record for the network load balancer'
    Type: AWS::Route53::RecordSetGroup
    Condition: HasAssociatedDomain
    Properties:
      HostedZoneId:
        Fn::ImportValue: !Sub "${AppName}-${EnvName}-HostedZone"
      Comment: !Sub "Default NetworkLoadBalancer alias for service ${WorkloadName}"
      RecordSets:
        - Name: !Join
            - '.'
            - - !Sub "${WorkloadName}-nlb"
              - Fn::ImportValue: !Sub "${AppName}-${EnvName}-SubDomain"
              - ""
          Type: A
          AliasTarget:
            HostedZoneId: !GetAtt PublicNetworkLoadBalancer.CanonicalHostedZoneID
            DNSName: !GetAtt PublicNetworkLoadBalancer.DNSName
  AddonsStack:
    Metadata:
      'aws:copilot:description': 'An Addons CloudFormation Stack for your additional AWS resources'
    Type: AWS::CloudFormation::Stack # Needed for #1848
    DependsOn: EnvControllerAction
    Condition: HasAddons
    Properties:
      Parameters:
        App: !Ref AppName
        Env: !Ref EnvName
        Name: !Ref WorkloadName
      TemplateURL: !Ref AddonsTemplateURL
Outputs:
  DiscoveryServiceARN:
    Description: ARN of the Discovery Service.
    Value: !GetAtt DiscoveryService.Arn
    Export:
      Name: !Sub ${AWS::StackName}-DiscoveryServiceARN
  PublicNetworkLoadBalancerDNSName:
    Value: !GetAtt PublicNetworkLoadBalancer.DNSName
    Export:
      Name: !Sub ${AWS::StackName}-PublicNetworkLoadBalancerDNSName