rubycfn 0.5.0 → 0.5.5

data/Gemfile.lock

@@ -1,35 +1,35 @@
 PATH
   remote: .
   specs:
-    rubycfn (0.5.0)
+    rubycfn (0.5.5)
       activesupport (~> 5.1.5)
       dotenv (~> 2.4.0)
-      json (~> 2.1.0)
+      json (~> 2.3.0)
       neatjson (~> 0.8.4)
       tty-prompt (~> 0.16.0)
 
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (5.1.7)
+    activesupport (6.0.3.1)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 0.7, < 2)
       minitest (~> 5.1)
       tzinfo (~> 1.1)
-    addressable (2.7.0)
+    addressable (2.8.0)
       public_suffix (>= 2.0.2, < 5.0)
-    awesome_print (1.8.0)
-    coderay (1.1.2)
-    concurrent-ruby (1.1.6)
-    diff-lcs (1.3)
-    docile (1.3.2)
+    awesome_print (1.9.2)
+    coderay (1.1.3)
+    concurrent-ruby (1.1.9)
+    diff-lcs (1.4.4)
+    docile (1.4.0)
     dotenv (2.4.0)
-    equatable (0.6.1)
-    ffi (1.12.2)
-    formatador (0.2.5)
-    given_core (3.8.0)
+    equatable (0.7.0)
+    ffi (1.15.3)
+    formatador (0.3.0)
+    given_core (3.8.2)
       sorcerer (>= 0.3.7)
-    guard (2.16.1)
+    guard (2.17.0)
       formatador (>= 0.2.4)
       listen (>= 2.7, < 4.0)
       lumberjack (>= 1.0.12, < 2.0)
@@ -43,65 +43,67 @@ GEM
       guard (~> 2.1)
       guard-compat (~> 1.1)
       rspec (>= 2.99.0, < 4.0)
-    i18n (1.8.2)
+    i18n (1.8.10)
       concurrent-ruby (~> 1.0)
-    json (2.1.0)
+    json (2.3.1)
     launchy (2.5.0)
       addressable (~> 2.7)
-    listen (3.2.1)
+    listen (3.5.1)
       rb-fsevent (~> 0.10, >= 0.10.3)
       rb-inotify (~> 0.9, >= 0.9.10)
-    lumberjack (1.2.4)
-    method_source (0.9.2)
-    minitest (5.14.0)
+    lumberjack (1.2.8)
+    method_source (1.0.0)
+    minitest (5.14.4)
     neatjson (0.8.4)
     necromancer (0.4.0)
     nenv (0.3.0)
     notiffany (0.1.3)
       nenv (~> 0.1)
       shellany (~> 0.0)
-    pastel (0.7.3)
+    pastel (0.7.4)
       equatable (~> 0.6)
       tty-color (~> 0.5)
-    pry (0.12.2)
-      coderay (~> 1.1.0)
-      method_source (~> 0.9.0)
-    public_suffix (4.0.3)
-    rake (13.0.1)
-    rb-fsevent (0.10.3)
+    pry (0.14.1)
+      coderay (~> 1.1)
+      method_source (~> 1.0)
+    public_suffix (4.0.6)
+    rake (13.0.4)
+    rb-fsevent (0.11.0)
     rb-inotify (0.10.1)
       ffi (~> 1.0)
-    rspec (3.9.0)
-      rspec-core (~> 3.9.0)
-      rspec-expectations (~> 3.9.0)
-      rspec-mocks (~> 3.9.0)
-    rspec-core (3.9.1)
-      rspec-support (~> 3.9.1)
-    rspec-expectations (3.9.0)
+    rspec (3.10.0)
+      rspec-core (~> 3.10.0)
+      rspec-expectations (~> 3.10.0)
+      rspec-mocks (~> 3.10.0)
+    rspec-core (3.10.1)
+      rspec-support (~> 3.10.0)
+    rspec-expectations (3.10.1)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.9.0)
-    rspec-given (3.8.0)
-      given_core (= 3.8.0)
+      rspec-support (~> 3.10.0)
+    rspec-given (3.8.2)
+      given_core (= 3.8.2)
       rspec (>= 2.14.0)
     rspec-its (1.3.0)
       rspec-core (>= 3.0.0)
       rspec-expectations (>= 3.0.0)
-    rspec-mocks (3.9.1)
+    rspec-mocks (3.10.2)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.9.0)
-    rspec-support (3.9.2)
+      rspec-support (~> 3.10.0)
+    rspec-support (3.10.2)
     rspec_junit_formatter (0.4.1)
       rspec-core (>= 2, < 4, != 2.12.0)
     shellany (0.0.1)
-    simplecov (0.18.5)
+    simplecov (0.21.2)
       docile (~> 1.1)
       simplecov-html (~> 0.11)
-    simplecov-html (0.12.2)
+      simplecov_json_formatter (~> 0.1)
+    simplecov-html (0.12.3)
+    simplecov_json_formatter (0.1.3)
     sorcerer (2.0.1)
-    thor (1.0.1)
+    thor (1.1.0)
     thread_safe (0.3.6)
-    timers (4.3.0)
-    tty-color (0.5.1)
+    timers (4.3.3)
+    tty-color (0.6.0)
     tty-cursor (0.5.0)
     tty-prompt (0.16.1)
       necromancer (~> 0.4.0)
@@ -114,9 +116,10 @@ GEM
       tty-screen (~> 0.6.4)
       wisper (~> 2.0.0)
     tty-screen (0.6.5)
-    tzinfo (1.2.6)
+    tzinfo (1.2.9)
       thread_safe (~> 0.1)
     wisper (2.0.1)
+    zeitwerk (2.3.0)
 
 PLATFORMS
   ruby
@@ -137,4 +140,4 @@ DEPENDENCIES
   simplecov (~> 0.9)
 
 BUNDLED WITH
-   2.1.4
+   2.2.22

data/README.md

@@ -61,7 +61,7 @@ __________ ____ __________________.___._________ _____________________
  |       _/    |   /|    |  _//   |   |/    \  \/ |    __)   |    |  _/
  |    |   \    |  / |    |   \\____   |\     \____|     \    |    |   \
  |____|_  /______/  |______  // ______| \______  /\___  /    |______  /
-        \/                 \/ \/               \/     \/            \/ [v0.5.0]
+        \/                 \/ \/               \/     \/            \/ [v0.5.5]
 Project name? example
 Account ID? 1234567890
 Select region EU (Frankfurt)
@@ -159,12 +159,11 @@ You can reuse these environment variables in your project code.
 The `.env.rspec` is used when running unit tests. It contains mock variables
 so that you can test the resulting CloudFormation templates properly.
 
-#### The missing .env.private file
+#### The .env.private file
 
-There is one file that is not generated by default but does need mentioning:
-the `.env.private` file. This is a special file that allows you to override
-environment variables. An environment variable set in .env.private always takes
-precedence over environment variables set in other .env files.
+This is a special file that allows you to override environment variables.
+An environment variable set in .env.private always takes precedence over
+environment variables set in other .env files.
 
 #### .rubocop.yml
 

data/lib/rubycfn/version.rb

@@ -1,4 +1,4 @@
 # Rubycfn version
 module Rubycfn
-  VERSION = "0.5.0".freeze
+  VERSION = "0.5.5".freeze
 end

data/rubycfn.gemspec

@@ -19,7 +19,7 @@ Gem::Specification.new do |spec|
   spec.require_paths = ["lib"]
 
   spec.add_runtime_dependency "neatjson", "~> 0.8.4"
-  spec.add_runtime_dependency "json", "~> 2.1.0"
+  spec.add_runtime_dependency "json", "~> 2.3.0"
   spec.add_runtime_dependency "activesupport", "~> 5.1.5"
   spec.add_runtime_dependency "tty-prompt", "~> 0.16.0"
   spec.add_runtime_dependency "dotenv", "~> 2.4.0"

data/templates/.gitignore

@@ -83,5 +83,9 @@ attic/
 /venv
 /Gemfile.lock
 .env.dependencies
+.env.dependencies.development
+.env.dependencies.test
+.env.dependencies.acceptance
+.env.dependencies.production
 CloudFormationResourceSpecification.json
 config.json

data/templates/.rubocop.yml

@@ -102,3 +102,6 @@ Metrics/PerceivedComplexity:
 
 Style/EvalWithLocation:
   Enabled: false
+
+Style/PerlBackrefs:
+  Enabled: false

data/templates/README.md

@@ -16,11 +16,12 @@ __________ ____ __________________.___._________ _____________________
 
 ## Rake commands
 
-`rake` - Compile the code into CloudFormation templates and run unit tests
+`rake` - Retrieve required outputs from DependencyStack, Compile the code into CloudFormation templates and run unit tests
 `rake init` - Deploy the DependencyStack in the AWS account
 `rake compile` - Compile the code into CloudFormation templates
 `rake spec` - Run unit tests
 `rake upload` - Upload the CloudFormation templates to s3
+`rake update` - Save required outputs from DependencyStack to .env.dependencies.<ENVIRONMENT>
 `rake apply` - Deploy the CloudFormation templates
 
 ## Stack configuration

data/templates/Rakefile

@@ -36,7 +36,7 @@ task :clean do
   end
 end
 
-desc "Store dependencies of DependencyStack in .env.dependencies"
+desc "Store dependencies of DependencyStack in .env.dependencies.<ENVIRONMENT>"
 task :dependencies do
   require_relative "lib/core/dependencies.rb"
 end

data/templates/config.yaml

@@ -52,6 +52,9 @@ applications:
     env:
       SOME_ENV_VAR: Exposed
       SOME_OTHER_VAR: desopxE
+      # SOME_REFFED_VAR: :foobar.ef
+      # SOME_OTHER_STACK_VAR: :vpc_stack.ref("Outputs.VpcId")
+      # SOME_ENV_VAR: ${MY_ENV_VAR}
   hello-world2:
     image: tutum/hello-world
     container_port: 80

data/templates/lib/aws_helper/compiler.rb

@@ -2,7 +2,7 @@ require "git-revision"
 
 def update_references(contents, environment, _artifact_bucket)
   Dotenv.load(".env.private")
-  Dotenv.load(".env.dependencies")
+  Dotenv.load(".env.dependencies.#{ENV["ENVIRONMENT"]}")
   contents["Resources"].map do |resource|
     resource_name = resource.shift
     resource_values = resource.shift

data/templates/lib/aws_helper/dependencies.rb

@@ -1,25 +1,35 @@
+def infra_config
+  config = YAML.safe_load(File.read("config.yaml"), [Symbol])
+  config["applications"] ||= {}
+  config["environments"] ||= {}
+  config["subnets"] ||= {}
+  config
+end
+
 def load_env_vars
   Dotenv.load(".env.private")
-  Dotenv.load(".env.dependencies")
+  Dotenv.load(".env.dependencies.#{ENV["ENVIRONMENT"]}")
   Dotenv.load(".env")
   Dotenv.load(".env.#{ENV["ENVIRONMENT"]}")
 
   check_dependencies
   {
+    artifact_bucket: ENV["ARTIFACTBUCKET"],
     aws_region: ENV["AWS_REGION"],
     aws_access_key_id: ENV["AWS_ACCESS_KEY_ID"],
     aws_secret_access_key: ENV["AWS_SECRET_ACCESS_KEY"],
-    artifact_bucket: ENV["ARTIFACTBUCKET"],
+    cloudformation_bucket: ENV["CLOUDFORMATIONBUCKET"],
     environment: ENV["ENVIRONMENT"],
-    stack_name: ENV["STACK_NAME"]
+    stack_name: infra_config["environments"][ENV["ENVIRONMENT"]]["stack_name"]
   }
 end
 
 def check_dependencies
   ENV["AWS_REGION"] ||= ENV["AWS_DEFAULT_REGION"]
-  raise "AWS_REGION not set" unless ENV["AWS_REGION"]
-  raise "ARTIFACTBUCKET not set" unless ENV["ARTIFACTBUCKET"]
-  raise "ENVIRONMENT not set" unless ENV["ENVIRONMENT"]
-  raise "STACK_NAME not set" unless ENV["STACK_NAME"]
+  raise "AWS_REGION not set." unless ENV["AWS_REGION"]
+  raise "CLOUDFORMATIONBUCKET not set. Run `rake init` and `rake update` first!" unless ENV["CLOUDFORMATIONBUCKET"]
+  raise "ARTIFACTBUCKET not set. Run `rake init` and `rake update` first!" unless ENV["ARTIFACTBUCKET"]
+  raise "ENVIRONMENT not set." unless ENV["ENVIRONMENT"]
+  raise "`stack_name` not configured in config.yaml" unless infra_config["environments"][ENV["ENVIRONMENT"]]["stack_name"]
   raise "AWS CREDENTIALS NOT SET" unless ENV["AWS_ACCESS_KEY_ID"] && ENV["AWS_SECRET_ACCESS_KEY"]
 end

data/templates/lib/aws_helper/deploy.rb

@@ -45,7 +45,6 @@ def get_parent_stack_s3_location(bucket, environment)
     JSON.parse(stack)["Resources"].each do |_resource, payload|
       if payload["Type"] == "AWS::CloudFormation::Stack"
         parent_stack = stack_name
-        json_file = "build/#{environment}-#{stack_name.downcase}.json"
         file_hash = git_revision
         break
       end

data/templates/lib/aws_helper/upload_stack.rb

@@ -2,7 +2,7 @@ require_relative "../core/git"
 
 def upload_stacks
   Dotenv.load(".env.private")
-  Dotenv.load(".env.dependencies")
+  Dotenv.load(".env.dependencies.#{ENV["ENVIRONMENT"]}")
   env_vars = load_env_vars
 
   set_aws_credentials(
@@ -11,17 +11,10 @@ def upload_stacks
     env_vars[:aws_secret_access_key]
   )
 
-  begin
-    s3 = create_bucket_if_not_exists(
-      env_vars[:aws_region],
-      env_vars[:artifact_bucket]
-    )
-  rescue => e
-    puts "Exception create_bucket_if_not_exists #{e}"
-  end
+  s3 = Aws::S3::Resource.new(region: env_vars[:aws_region])
 
   stacks = compile_stacks(true)
-  raise "CLOUDFORMATIONBUCKET not found in DependencyStack outputs" unless ENV["CLOUDFORMATIONBUCKET"]
+  raise "CLOUDFORMATIONBUCKET not found in <%= project_name %>#{ENV["ENVIRONMENT"].capitalize}DependencyStack outputs" unless ENV["CLOUDFORMATIONBUCKET"]
   stacks.each do |stack_name, stack|
     next if JSON.parse(stack)["Resources"].nil?
     hash = @stack_hashes[stack_name.to_sym]

data/templates/lib/core/applications.rb

@@ -1,44 +1,120 @@
+def to_bool(val)
+  return false unless val.nil? || val.empty?
+  return false unless val != "true"
+  true
+end
+
+def env_vars_to_array(val)
+  if val.nil? || val.empty?
+    return [
+      {
+        Name: "WITHOUT_ENV",
+        Value: "true"
+      }
+    ]
+  end
+  vars = []
+
+  # Create an array of variables to pass to this application.
+  # Resolve any references to its intrinsic function.
+  val.keys.each_with_index do |object, index|
+    value = val.values[index].class == Symbol && Kernel.class_eval(":#{val.values[index]}") || val.values[index]
+
+    # Support ${ENV_VAR} in config_yaml
+    if value =~ /\$\{([^\}]*)\}/
+      capture = $1
+      value = ENV[capture]
+    end
+
+    vars.push(
+      Name: object,
+      Value: value
+    )
+  end
+  vars
+end
+
+@ignore_params = {}
+
+# Return the mandatory Stack parameters and add all defined ENV vars from config.yaml
+def parent_parameters(env_vars, simple_name)
+  params = {
+    "Vpc": :vpc_stack.ref("Outputs.Vpc"),
+    "Cluster": :ecs_stack.ref("Outputs.EcsCluster"),
+    "Listener": :ecs_stack.ref("Outputs.EcsLoadBalancerListener"),
+    "EcsServiceAutoScalingRoleArn": :ecs_stack.ref("Outputs.EcsAutoScalingRoleArn"),
+    "HostedZoneId": "HOSTEDZONEID".ref,
+    "HostedZoneName": "HOSTEDZONENAME".ref,
+    "LoadBalancerDnsName": :ecs_stack.ref("Outputs.EcsLoadBalancerUrl"),
+    "CanonicalHostedZoneId": :ecs_stack.ref("Outputs.EcsLoadBalancerHostedZoneId"),
+    "CertificateProviderFunctionArn": :acm_stack.ref("Outputs.CertificateProviderFunctionArn"),
+    "ApplicationDeploymentFailureRollbackFunctionArn": :ecs_stack.ref("Outputs.ApplicationDeploymentFailureRollbackFunctionArn")
+  }
+
+  env_vars.each do |var|
+    TOPLEVEL_BINDING.eval("@ignore_params[:#{simple_name}] ||= []")
+    if var[:Value].class == Hash && var[:Value].keys[0] == :Ref
+      TOPLEVEL_BINDING.eval("@ignore_params[:#{simple_name}].push(\"#{var[:Name]}\")")
+      next
+    end
+    params[var[:Name].cfnize] = var[:Value]
+  end
+  params
+end
+
+def application_parameters(env_vars)
+  vars = []
+
+  env_vars.each do |var|
+    if var[:Value].class == Hash && var[:Value].keys[0] == :Ref
+      vars.push(
+        Name: var[:Name],
+        Value: var[:Value]
+      )
+    else
+      vars.push(
+        Name: var[:Name],
+        Value: var[:Name].cfnize.ref
+      )
+    end
+  end
+  vars
+end
+
 # Generate nested stacks for each defined application, and create module dynamically.
 def create_applications
+  return if infra_config["environments"][environment]["cluster_size"].nil? || infra_config["environments"][environment]["cluster_size"].to_i.zero?
   resource :applications_stack,
            amount: infra_config["applications"].count,
            type: "AWS::CloudFormation::Stack" do |r, index|
+    env_vars = env_vars_to_array(infra_config["applications"].values[index]["env"])
+    application_vars = application_parameters(env_vars) # rubocop:disable Lint/UselessAssignment
     name = infra_config["applications"].keys[index]
     resource_name = name.tr("-", "_").cfnize
     simple_name = resource_name.downcase
     app_config = infra_config["applications"].values[index]
-    warn "App config is empty" unless app_config # Rubocop didn't understand that the variable is actually used.
-    #       request_certificate("Gateway", gateway_domains[environment], :asellion_com_hosted_zone_id.ref, "us-east-1")
+    is_essential = to_bool(app_config["essential"].to_s)
 
     r._id("#{resource_name}Stack")
     r.property(:template_url) { "#{simple_name}stack" }
-    r.property(:parameters) do
-      {
-        "Vpc": :vpc_stack.ref("Outputs.SfsVpc"),
-        "Cluster": :ecs_stack.ref("Outputs.SfsEcsCluster"),
-        "Listener": :ecs_stack.ref("Outputs.EcsLoadBalancerListener"),
-        "EcsServiceAutoScalingRoleArn": :ecs_stack.ref("Outputs.SfsEcsAutoScalingRoleArn"),
-        "HostedZoneId": :route53_stack.ref("Outputs.HostedZoneId"),
-        "HostedZoneName": :route53_stack.ref("Outputs.HostedZoneName"),
-        "LoadBalancerDnsName": :ecs_stack.ref("Outputs.EcsLoadBalancerUrl"),
-        "CanonicalHostedZoneId": :ecs_stack.ref("Outputs.EcsLoadBalancerHostedZoneId"),
-        "CertificateProviderFunctionArn": :acm_stack.ref("Outputs.CertificateProviderFunctionArn")
-      }
-    end
+    r.property(:parameters) { parent_parameters(env_vars, simple_name) }
     Object.const_set("#{resource_name}Stack", Module.new).class_eval <<-RUBY
       extend ActiveSupport::Concern
       include Rubycfn
 
       included do
-        def env_vars_to_array(val)
-          vars = []
-          val.keys.each_with_index do |object, index|
-            vars.push(
-              Name: object,
-              Value: val.values[index]
-            )
-          end
-          vars
+
+        def get_aliases(val)
+          aliases = []
+          return aliases if val["aliases"].nil?
+          return aliases if val["aliases"][environment].nil?
+          val["aliases"][environment]
+        end
+
+        ignore_params = TOPLEVEL_BINDING.eval("@ignore_params[:#{simple_name}]")
+        application_vars.each do |var|
+          next if ignore_params.include? var[:Name]
+          Object.class_eval("parameter var[:Name].to_sym, description: 'Value for ENV var \#{var[:Name]}'")
         end
 
         parameter :vpc,
@@ -77,17 +153,34 @@ def create_applications
                   description: "ARN of certificate provider",
                   type: "String"
 
+        parameter :application_deployment_failure_rollback_function_arn,
+                  description: "ARN of ECS deployment failure Lambda",
+                  type: "String"
+
+        variable :aliases,
+                 value: app_config,
+                 filter: :get_aliases
+
+        variable :min_override,
+                 value: app_config[environment].nil? ? "" : app_config[environment]["min"].to_s
+
         variable :min,
-                 value: app_config["min"].to_s
+                 value: min_override.empty? ? app_config["min"].to_s : min_override
+
+        variable :max_override,
+                 value: app_config[environment].nil? ? "" : app_config[environment]["max"].to_s
 
         variable :max,
-                 value: app_config["max"].to_s
+                 value: max_override.empty? ? app_config["max"].to_s : max_override
 
         variable :container_port,
                  value: app_config["container_port"].to_s
 
+        variable :memory_override,
+                 value: app_config[environment].nil? ? "" : app_config[environment]["mem"].to_s
+
         variable :memory,
-                 value: app_config["mem"].to_s
+                 value: memory_override.empty? ? app_config["mem"].to_s : memory_override
 
         variable :image,
                  value: app_config["image"]
@@ -101,11 +194,14 @@ def create_applications
 
 
         description generate_stack_description("#{resource_name}Stack")
+
         resource :service,
+                 amount: max.to_i.positive? ? 1 : 0,
                  type: "AWS::ECS::Service" do |r|
-
+          r.property(:service_name) { "#{environment}-<%= project_name %>-#{simple_name}" }
           r.property(:cluster) { :cluster.ref }
           r.property(:role) { :service_role.ref }
+          r.property(:health_check_grace_period_seconds) { 120 }
           r.property(:desired_count) { min.to_i }
           r.property(:task_definition) { :task_definition.ref }
           r.property(:load_balancers) do
@@ -117,17 +213,27 @@ def create_applications
           end
         end
 
+        resource :application_deployment_health,
+                 amount: max.to_i.positive? ? 1 : 0,
+                 type: "Custom::EcsDeploymentCheck" do |r|
+          r.property(:service_token) { :application_deployment_failure_rollback_function_arn.ref }
+          r.property("AWSRegion") { "${AWS::Region}".fnsub }
+          r.property(:service) { "#{environment}-<%= project_name %>-#{simple_name}" }
+          r.property(:cluster) { :cluster.ref }
+        end
+
         resource :task_definition,
+                 amount: max.to_i.positive? ? 1 : 0,
                  type: "AWS::ECS::TaskDefinition" do |r|
           r.property(:family) { "#{simple_name}-service" }
           r.property(:container_definitions) do
             [
               {
                 "Name": "#{simple_name}-service",
-                "Essential": true,
+                "Essential": #{is_essential},
                 "Image": image,
                 "Memory": memory.to_i,
-                "Environment": env_vars,
+                "Environment": application_vars,
                 "PortMappings": [
                   {
                     "ContainerPort": container_port.to_i
@@ -146,12 +252,14 @@ def create_applications
         end
 
         resource :cloud_watch_logs_group,
+                 amount: max.to_i.positive? ? 1 : 0,
                  type: "AWS::Logs::LogGroup" do |r|
           r.property(:log_group_name) { ["AWS::StackName".ref, "-#{simple_name}"].fnjoin }
           r.property(:retention_in_days) { 30 }
         end
 
         resource :target_group,
+                 amount: max.to_i.positive? ? 1 : 0,
                  type: "AWS::ElasticLoadBalancingV2::TargetGroup" do |r|
           r.property(:vpc_id) { :vpc.ref }
           r.property(:port) { container_port.to_i }
@@ -169,6 +277,7 @@ def create_applications
         end
 
         resource :listener_rule,
+                 amount: max.to_i.positive? ? 1 : 0,
                  type: "AWS::ElasticLoadBalancingV2::ListenerRule" do |r|
           r.property(:listener_arn) { :listener.ref }
           r.property(:priority) { priority.to_i }
@@ -179,7 +288,7 @@ def create_applications
                 "Values": [
                   ["origin", name.tr("_", "-"), :hosted_zone_name.ref].fnjoin("."),
                   [name.tr("_", "-"), :hosted_zone_name.ref].fnjoin(".")
-                ]
+                ] + aliases
               }
             ]
           end
@@ -210,6 +319,7 @@ def create_applications
         }
 
         resource :service_role,
+                 amount: max.to_i.positive? ? 1 : 0,
                  type: "AWS::IAM::Role" do |r|
           r.property(:role_name) { "ecs-service-${AWS::StackName}".fnsub }
           r.property(:path) { "/" }
@@ -235,6 +345,27 @@ def create_applications
                         "elasticloadbalancing:RegisterTargets"
                       ],
                       "Resource": "*"
+                    },
+                    {
+                      "Effect": "Allow",
+                      "Action": [
+                        "ec2:DescribeTags",
+                        "ecs:CreateCluster",
+                        "ecs:DeregisterContainerInstance",
+                        "ecs:DiscoverPollEndpoint",
+                        "ecs:Poll",
+                        "ecs:RegisterContainerInstance",
+                        "ecs:StartTelemetrySession",
+                        "ecs:UpdateContainerInstancesState",
+                        "ecs:Submit*",
+                        "ecr:GetAuthorizationToken",
+                        "ecr:BatchCheckLayerAvailability",
+                        "ecr:GetDownloadUrlForLayer",
+                        "ecr:BatchGetImage",
+                        "logs:CreateLogStream",
+                        "logs:PutLogEvents"
+                      ],
+                      "Resource": "*"
                     }
                   ]
                 }
@@ -244,6 +375,7 @@ def create_applications
         end
 
         resource :application_load_balancer_record,
+                 amount: max.to_i.positive? ? 1 : 0,
                  type: "AWS::Route53::RecordSet" do |r|
           r.property(:type) { "A" }
           r.property(:name) { ["origin", name.tr("_", "-"), :hosted_zone_name.ref].fnjoin(".") }
@@ -258,6 +390,7 @@ def create_applications
         end
 
         resource :service_scalable_target,
+                 amount: max.to_i.positive? ? 1 : 0,
                  type: "AWS::ApplicationAutoScaling::ScalableTarget" do |r|
           r.property(:max_capacity) { max.to_i }
           r.property(:min_capacity) { min.to_i }
@@ -268,6 +401,7 @@ def create_applications
         end
 
         resource :service_scale_out_policy,
+                 amount: max.to_i.positive? ? 1 : 0,
                  type: "AWS::ApplicationAutoScaling::ScalingPolicy" do |r|
           r.property(:policy_name) { "ServiceScaleOutPolicy" }
           r.property(:policy_type) { "StepScaling" }
@@ -288,6 +422,7 @@ def create_applications
         end
 
         resource :service_scale_in_policy,
+                 amount: max.to_i.positive? ? 1 : 0,
                  type: "AWS::ApplicationAutoScaling::ScalingPolicy" do |r|
           r.property(:policy_name) { "ServiceScaleInPolicy" }
           r.property(:policy_type) { "StepScaling" }
@@ -308,6 +443,7 @@ def create_applications
         end
 
         resource :cpu_scale_out_alarm,
+                 amount: max.to_i.positive? ? 1 : 0,
                  type: "AWS::CloudWatch::Alarm" do |r|
           r.property(:alarm_name) { "CPU utilization greater than 90% on #{simple_name}-#{environment}" }
           r.property(:alarm_description) { "Alarm if cpu utilization greater than 90% of reserved cpu" }
@@ -334,6 +470,7 @@ def create_applications
         end
 
         resource :cpu_scale_in_alarm,
+                 amount: max.to_i.positive? ? 1 : 0,
                  type: "AWS::CloudWatch::Alarm" do |r|
           r.property(:alarm_name) { "CPU utilization less than 70% on #{simple_name}-#{environment}" }
           r.property(:alarm_description) { "Alarm if cpu utilization greater than 70% of reserved cpu" }
@@ -360,6 +497,7 @@ def create_applications
         end
 
         resource :ecs_application_certificate,
+                 amount: max.to_i.positive? ? 1 : 0,
                  type: "Custom::Certificate" do |r|
           r.property(:service_token) { :certificate_provider_function_arn.ref }
           r.property(:region) { "us-east-1" }
@@ -368,6 +506,7 @@ def create_applications
         end
 
         resource :ecs_application_issued_certificate,
+                 amount: max.to_i.positive? ? 1 : 0,
                  type: "Custom::IssuedCertificate" do |r|
           r.property(:service_token) { :certificate_provider_function_arn.ref }
           r.property(:region) { "us-east-1" }
@@ -375,6 +514,7 @@ def create_applications
         end
 
         resource :ecs_application_dns_record,
+                 amount: max.to_i.positive? ? 1 : 0,
                  type: "Custom::CertificateDNSRecord" do |r|
           r.property(:service_token) { :certificate_provider_function_arn.ref }
           r.property(:region) { "us-east-1" }
@@ -383,6 +523,7 @@ def create_applications
         end
 
         resource :ecs_application_validation_record,
+                 amount: max.to_i.positive? ? 1 : 0,
                  type: "AWS::Route53::RecordSetGroup" do |r|
           r.property(:hosted_zone_id) { :hosted_zone_id.ref }
           r.property(:record_sets) do
@@ -402,7 +543,11 @@ def create_applications
         end
 
         resource :cloudfront_distribution,
-                 depends_on: :ecs_application_issued_certificate,
+                 depends_on: [
+                   :ecs_application_issued_certificate,
+                   :application_deployment_health
+                 ],
+                 amount: max.to_i.positive? ? 1 : 0,
                  type: "AWS::CloudFront::Distribution" do |r|
           r.property(:distribution_config) do
             {
@@ -458,6 +603,7 @@ def create_applications
         end
 
         resource :application_cloudfront_dns_record,
+                 amount: max.to_i.positive? ? 1 : 0,
                  type: "AWS::Route53::RecordSetGroup" do |r|
           r.property(:hosted_zone_id) { :hosted_zone_id.ref }
           r.property(:record_sets) do