rdws-test.stack.yml

# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: Apache-2.0
AWSTemplateFormatVersion: 2010-09-09
Description: CloudFormation template that represents a request driven web service on AWS App Runner.
Metadata:
  Version: v1.29.0
Parameters:
  AppName:
    Type: String
  EnvName:
    Type: String
  WorkloadName:
    Type: String
  ContainerImage:
    Type: String
  ContainerPort:
    Type: Number
  ImageRepositoryType:
    Type: String
  InstanceCPU:
    Type: String
  InstanceMemory:
    Type: String
  HealthCheckPath:
    Type: String
    Default: ''
  HealthCheckInterval:
    Type: String
    Default: ''
  HealthCheckTimeout:
    Type: String
    Default: ''
  HealthCheckHealthyThreshold:
    Type: String
    Default: ''
  HealthCheckUnhealthyThreshold:
    Type: String
    Default: ''
  AddonsTemplateURL:
    Description: 'URL of the addons nested stack template within the S3 bucket.'
    Type: String
    Default: ''
  ArtifactKeyARN:
    Type: String
    Description: 'KMS Key used for encrypting artifacts'

Conditions:
  # App Runner will not accept an AccessRole for ImageRepositoryTypes other than ECR.
  # In this scenario the request will fail.
  NeedsAccessRole:
    !Equals [!Ref ImageRepositoryType, 'ECR']
  HasHealthCheckPath:
    !Not [!Equals [!Ref HealthCheckPath, '']]
  HasHealthCheckInterval:
    !Not [!Equals [!Ref HealthCheckInterval, '']]
  HasHealthCheckTimeout:
    !Not [!Equals [!Ref HealthCheckTimeout, '']]
  HasHealthCheckHealthyThreshold:
    !Not [!Equals [!Ref HealthCheckHealthyThreshold, '']]
  HasHealthCheckUnhealthyThreshold:
    !Not [!Equals [!Ref HealthCheckUnhealthyThreshold, '']]
  HasAddons: # If a bucket URL is specified, that means the template exists.
    !Not [!Equals [!Ref AddonsTemplateURL, '']]

Resources:
  AccessRole:
    Metadata:
      'aws:copilot:description': 'An IAM Role for App Runner to use on your behalf to pull your image from ECR'
    Type: AWS::IAM::Role
    Condition: NeedsAccessRole
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - build.apprunner.amazonaws.com
            Action: sts:AssumeRole
  
      ManagedPolicyArns:
        - !Sub arn:${AWS::Partition}:iam::aws:policy/service-role/AWSAppRunnerServicePolicyForECRAccess
  
  InstanceRole:
    Metadata:
      'aws:copilot:description': 'An IAM role to control permissions for the containers in your service'
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - tasks.apprunner.amazonaws.com
            Action: 'sts:AssumeRole'
      Policies:
        - PolicyName: 'DenyIAM'
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: 'Deny'
                Action: 'iam:*'
                Resource: '*'
        - PolicyName: 'AccessCopilotTaggedSecrets'
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: 'Allow'
                Action:
                  - 'ssm:GetParameters'
                Resource:
                  - !Sub 'arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/*'
                Condition:
                  StringEquals:
                    'ssm:ResourceTag/copilot-application': !Sub '${AppName}'
                    'ssm:ResourceTag/copilot-environment': !Sub '${EnvName}'
              - Effect: 'Allow'
                Action:
                  - 'secretsmanager:GetSecretValue'
                Resource:
                  - !Sub 'arn:${AWS::Partition}:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:*'
                Condition:
                  StringEquals:
                    'secretsmanager:ResourceTag/copilot-application': !Sub '${AppName}'
                    'secretsmanager:ResourceTag/copilot-environment': !Sub '${EnvName}'
              - Effect: 'Allow'
                Action:
                  - 'kms:Decrypt'
                Resource:
                  - !Ref ArtifactKeyARN
              - Sid: DecryptTaggedKMSKey
                Effect: 'Allow'
                Action:
                  - 'kms:Decrypt'
                Resource:
                  - !Sub 'arn:${AWS::Partition}:kms:${AWS::Region}:${AWS::AccountId}:key/*'
                Condition:
                  StringEquals:
                    'aws:ResourceTag/copilot-application': !Sub '${AppName}'
                    'aws:ResourceTag/copilot-environment': !Sub '${EnvName}'
        - PolicyName: 'Publish2SNS'
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: 'Allow'
                Action: 'sns:Publish'
                Resource:
                - !Ref customersSNSTopic
                - !Ref mytopicfifoSNSTopic
  Service:
    Metadata:
      'aws:copilot:description': 'An App Runner service to run and manage your containers'
    Type: AWS::AppRunner::Service
    Properties:
      ServiceName: !Sub '${AppName}-${EnvName}-${WorkloadName}'
      SourceConfiguration:
        AuthenticationConfiguration: !If
          - NeedsAccessRole
          - AccessRoleArn: !GetAtt AccessRole.Arn
          - !Ref AWS::NoValue
        AutoDeploymentsEnabled: false
        ImageRepository:
          ImageIdentifier: !Ref ContainerImage
          ImageRepositoryType: !Ref ImageRepositoryType
          ImageConfiguration:
            Port: !Ref ContainerPort
            RuntimeEnvironmentSecrets:
              - Name: MY_FROM_CFN_SECRET
                Value:
                  Fn::ImportValue: 'my-other-stack-exported-secret'
              - Name: MY_SECRETS_MANAGER_SECRET
                Value:  !Sub 'arn:${AWS::Partition}:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:mysecretsmanagername'
              - Name: my-ssm-secret
                Value:  arn:aws:ssm:us-east-1:123456789123:parameter/jan11ssm
            RuntimeEnvironmentVariables:
              - Name: COPILOT_APPLICATION_NAME
                Value: !Ref AppName
              - Name: COPILOT_ENVIRONMENT_NAME
                Value: !Ref EnvName
              - Name: COPILOT_SERVICE_NAME
                Value: !Ref WorkloadName
              - Name: COPILOT_SERVICE_DISCOVERY_ENDPOINT
                Value: 
              - Name: COPILOT_SNS_TOPIC_ARNS
                Value: '{"customers":"arn:aws:sns:us-west-2:123456789123:my-app-test-frontend-customers","mytopic.fifo":"arn:aws:sns:us-west-2:123456789123:my-app-test-frontend-mytopic.fifo"}'
              - Name: DB_NAME
                Value:
                  Fn::ImportValue: "test-UserDB"
              - Name: LOG_LEVEL
                Value: "debug"
            StartCommand: crazy diamond
      InstanceConfiguration:
        Cpu: !Ref InstanceCPU
        Memory: !Ref InstanceMemory
        InstanceRoleArn: !GetAtt InstanceRole.Arn
      NetworkConfiguration:
        EgressConfiguration:
          EgressType: VPC
          VpcConnectorArn: !Ref VpcConnector
      AutoScalingConfigurationArn: 'arn:${AWS::Partition}:apprunner:${AWS::Region}:${AWS::AccountId}:autoscalingconfiguration/high-availability/3'    
      Tags:
        - Key: copilot-application
          Value: !Ref AppName
        - Key: copilot-environment
          Value: !Ref EnvName
        - Key: copilot-service
          Value: !Ref WorkloadName

  AddonsStack:
    Metadata:
      'aws:copilot:description': 'An Addons CloudFormation Stack for your additional AWS resources'
    Type: AWS::CloudFormation::Stack # Needed for #1848
    DependsOn: EnvControllerAction
    Condition: HasAddons
    Properties:
      Parameters:
        App: !Ref AppName
        Env: !Ref EnvName
        Name: !Ref WorkloadName
      TemplateURL:
        !Ref AddonsTemplateURL

  
  customersSNSTopic:
    Metadata:
      'aws:copilot:description': 'A SNS topic to broadcast customers events'
    Type: AWS::SNS::Topic
    Properties:
      TopicName: !Sub '${AWS::StackName}-customers'
      KmsMasterKeyId: 'alias/aws/sns'
  
  customersSNSTopicPolicy:
    Type: AWS::SNS::TopicPolicy
    DependsOn: customersSNSTopic
    Properties:
      Topics:
        - !Ref customersSNSTopic
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub 'arn:${AWS::Partition}:iam::${AWS::AccountId}:root'
            Action:
              - sns:Subscribe
            Resource: !Ref customersSNSTopic
            Condition:
              StringEquals:
                "sns:Protocol": "sqs"
  mytopicfifoSNSTopic:
    Metadata:
      'aws:copilot:description': 'A SNS FIFO topic to broadcast mytopic.fifo events'
    Type: AWS::SNS::Topic
    Properties:
      TopicName: !Sub '${AWS::StackName}-mytopic.fifo'
      FifoTopic: true
      KmsMasterKeyId: 'alias/aws/sns'

  mytopicfifoSNSTopicPolicy:
    Type: AWS::SNS::TopicPolicy
    DependsOn: mytopicfifoSNSTopic
    Properties:
      Topics:
        - !Ref mytopicfifoSNSTopic
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub 'arn:${AWS::Partition}:iam::${AWS::AccountId}:root'
            Action:
              - sns:Subscribe
            Resource: !Ref mytopicfifoSNSTopic
            Condition:
              StringEquals:
                "sns:Protocol": "sqs"
  EnvControllerAction:
    Metadata:
      'aws:copilot:description': "Update your environment's shared resources"
    Type: Custom::EnvControllerFunction
    Properties:
      ServiceToken: !GetAtt EnvControllerFunction.Arn
      Workload: !Ref WorkloadName
      EnvStack: !Sub '${AppName}-${EnvName}'
      Parameters: [NATWorkloads,]
      EnvVersion: v1.42.0
  
  EnvControllerFunction:
    Type: AWS::Lambda::Function
    Properties:
      Handler: "index.handler"
      Timeout: 900
      MemorySize: 512
      Role: !GetAtt 'EnvControllerRole.Arn'
      Runtime: nodejs22.x
  
  EnvControllerRole:
    Metadata:
      'aws:copilot:description': "An IAM role to update your environment stack"
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: "EnvControllerStackUpdate"
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action:
                - cloudformation:DescribeStacks
                - cloudformation:UpdateStack
              Resource:  !Sub 'arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${AppName}-${EnvName}/*'
              Condition:
                StringEquals:
                  'cloudformation:ResourceTag/copilot-application': !Sub '${AppName}'
                  'cloudformation:ResourceTag/copilot-environment': !Sub '${EnvName}'
        - PolicyName: "EnvControllerRolePass"
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action:
                - iam:PassRole
              Resource:  !Sub 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${AppName}-${EnvName}-CFNExecutionRole'
              Condition:
                StringEquals:
                  'iam:ResourceTag/copilot-application': !Sub '${AppName}'
                  'iam:ResourceTag/copilot-environment': !Sub '${EnvName}'
      ManagedPolicyArns:
        - !Sub arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
  ServiceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Metadata:
      'aws:copilot:description': 'A security group for your addons/ resources to allow ingress from your service'
    Properties:
      GroupDescription: !Join [ '', [ !Ref AppName, '-', !Ref EnvName, !Ref WorkloadName ] ]
      VpcId:
        Fn::ImportValue:
          !Sub '${AppName}-${EnvName}-VpcId'
      Tags:
        - Key: Name
          Value: !Sub 'copilot-${AppName}-${EnvName}-${WorkloadName}'
  
  EnvironmentSecurityGroupIngressFromServiceSecurityGroup:
    Type: AWS::EC2::SecurityGroupIngress
    Metadata:
      'aws:copilot:description': 'Allow ingress from the app runner service to services in your environment'
    Properties:
      GroupId: 
        Fn::ImportValue:
          !Sub '${AppName}-${EnvName}-EnvironmentSecurityGroup'
      IpProtocol: -1
      SourceSecurityGroupId: !Ref ServiceSecurityGroup
  
  VpcConnector:
    Type: AWS::AppRunner::VpcConnector
    DependsOn: EnvControllerAction # Ensure NAT gateways are created before connecting to a VPC.
    Metadata:
      'aws:copilot:description': 'A VPC connector to link your service to subnets in your environment'
    Properties:
      Subnets:
        Fn::Split:
          - ","
          - Fn::ImportValue:
              !Sub '${AppName}-${EnvName}-PrivateSubnets'
      SecurityGroups:
        - !Ref ServiceSecurityGroup
        - Fn::ImportValue: !Sub "${AppName}-${EnvName}-EnvironmentSecurityGroup"
      Tags:
        - Key: copilot-application
          Value: !Ref AppName
        - Key: copilot-environment
          Value: !Ref EnvName
        - Key: copilot-service
          Value: !Ref WorkloadName