rubycfn 0.5.0 → 0.5.5

data/templates/lib/core/dependencies.rb

@@ -10,11 +10,18 @@ ENV["AWS_DEFAULT_REGION"] ||= "eu-west-1"
 ENV["AWS_REGION"] ||= ENV["AWS_DEFAULT_REGION"]
 
 client = Aws::CloudFormation::Client.new(region: ENV["AWS_REGION"])
-res = client.describe_stacks(
-  stack_name: "DependencyStack"
-)
 
-dep_file = File.open(".env.dependencies", "w")
+begin
+  res = client.describe_stacks(
+    stack_name: "<%= project_name %>#{ENV["ENVIRONMENT"].capitalize}DependencyStack"
+  )
+rescue Aws::CloudFormation::Errors::InvalidClientTokenId, Aws::CloudFormation::Errors::ValidationError => e
+  puts "E: #{e.class}"
+  raise "ERROR: Your AWS credentials are not set or invalid." if e.class == Aws::CloudFormation::Errors::InvalidClientTokenId
+  raise "ERROR: <%= project_name %>#{ENV["ENVIRONMENT"].capitalize}DependencyStack does not exist. Run `rake init` first!" if e.class == Aws::CloudFormation::Errors::ValidationError
+end
+
+dep_file = File.open(".env.dependencies.#{ENV["ENVIRONMENT"]}", "w")
 res[:stacks].each do |stack|
   stack[:outputs].each do |output|
     dep_file.puts "#{output[:output_key].upcase}=#{output[:output_value]}"

data/templates/lib/core/deploy.rb

@@ -7,8 +7,8 @@ require "aws-sdk"
 require_relative "../aws_helper/main"
 
 Dotenv.load(".env.private")
-Dotenv.load(".env.dependencies")
-raise "CLOUDFORMATIONBUCKET not found in DependencyStack outputs" unless ENV["CLOUDFORMATIONBUCKET"]
+Dotenv.load(".env.dependencies.#{ENV["ENVIRONMENT"]}")
+raise "CLOUDFORMATIONBUCKET not set. Run `rake init` and `rake update` first!" unless ENV["CLOUDFORMATIONBUCKET"]
 
 env_vars = load_env_vars
 
@@ -26,7 +26,7 @@ s3_filename = get_parent_stack_s3_location(
 client = Aws::CloudFormation::Client.new
 
 parent_parameters = []
-File.open(".env.dependencies").read.each_line do |line|
+File.open(".env.dependencies.#{ENV["ENVIRONMENT"]}").read.each_line do |line|
   line.strip!
   param, value = line.split("=")
   parent_parameters.push(

data/templates/lib/core/init.rb

@@ -30,7 +30,7 @@ def inject_dummy_resource(stack)
 end
 
 def read_domain_name
-  config = YAML.safe_load(File.read("config.yaml"))
+  config = YAML.safe_load(File.read("config.yaml"), [Symbol])
   config["applications"] ||= {}
   config["environments"] ||= {}
   config["subnets"] ||= {}
@@ -60,16 +60,64 @@ subdomain, domain_name = read_domain_name
 raise "ENVIRONMENT not set" unless ENV["ENVIRONMENT"]
 warn "WARNING: domain_name not set in config.yaml... Route53 Hosted Zone will not be created" if domain_name.empty?
 
-module DependencyStack
+module Project<%= project_name %>DependencyStack
   extend ActiveSupport::Concern
   include Rubycfn
 
   included do
-    self.class_eval(File.open("bootstrap/dependency_stack.rb").read)
+    description "<%= project_name %>#{ENV["ENVIRONMENT"].capitalize}Dependency Stack"
+
+    parameter :environment,
+              description: "Environment name",
+              type: "String"
+
+    parameter :domain_name,
+              description: "Domain name",
+              type: "String"
+
+    condition :has_environment,
+              [["", :environment.ref].fnequals].fnnot
+
+    condition :has_domain_name,
+              [["", :domain_name.ref].fnequals].fnnot
+
+    %i(
+      artifact_bucket
+      cloudformation_bucket
+      lambda_bucket
+      logging_bucket
+    ).each do |bucket|
+      resource bucket,
+               deletion_policy: "Retain",
+               update_replace_policy: "Retain",
+               type: "AWS::S3::Bucket"
+
+      output bucket,
+             value: bucket.ref
+    end
+
+    resource :hosted_zone,
+             condition: "HasDomainName",
+             type: "AWS::Route53::HostedZone" do |r|
+      r.property(:hosted_zone_config) do
+        {
+          "Comment": ["Hosted zone for ", ["HasEnvironment", [:environment.ref, "."].fnjoin, ""].fnif, :domain_name.ref].fnjoin
+        }
+      end
+      r.property(:name) { [["HasEnvironment", [:environment.ref, "."].fnjoin, ""].fnif, :domain_name.ref].fnjoin }
+    end
+
+    output :hosted_zone_id,
+           condition: "HasDomainName",
+           value: :hosted_zone.ref
+
+    output :hosted_zone_name,
+           condition: "HasDomainName",
+           value: [["HasEnvironment", [:environment.ref, "."].fnjoin, ""].fnif, :domain_name.ref].fnjoin
   end
 end
 
-stack = include DependencyStack # rubocop:disable Style/MixinUsage
+stack = include Project<%= project_name %>DependencyStack # rubocop:disable Style/MixinUsage
 template = stack.render_template
 
 client = Aws::CloudFormation::Client.new
@@ -77,7 +125,7 @@ client = Aws::CloudFormation::Client.new
 stack_exists = false
 previous_statuses = []
 80.times do
-  previous_events = get_prior_events(client, "DependencyStack")
+  previous_events = get_prior_events(client, "<%= project_name %>#{ENV["ENVIRONMENT"].capitalize}DependencyStack")
   previous_statuses = previous_events.map(&:event_id)
   stack_exists = previous_events.size.to_i.positive? ? true : false
   break unless stack_exists
@@ -85,8 +133,8 @@ previous_statuses = []
   events_last_deploy = get_events_last_deploy(previous_events)
   last_event = events_last_deploy.shift
   break if last_event \
-    && (last_event.logical_resource_id == "DependencyStack") \
-    && (last_event.stack_name == "DependencyStack") \
+    && (last_event.logical_resource_id == "<%= project_name %>#{ENV["ENVIRONMENT"].capitalize}DependencyStack") \
+    && (last_event.stack_name == "<%= project_name %>#{ENV["ENVIRONMENT"].capitalize}DependencyStack") \
     && (DEPLOYABLE_STATES.include? last_event.resource_status)
   puts "Stack is currently in #{last_event.resource_status} mode. Waiting for it to finish..." if last_event
   sleep 15
@@ -107,7 +155,7 @@ parameters = [
 
 if stack_exists
   client.update_stack(
-    stack_name: "DependencyStack",
+    stack_name: "<%= project_name %>#{ENV["ENVIRONMENT"].capitalize}DependencyStack",
     template_body: template,
     capabilities: %w(CAPABILITY_IAM CAPABILITY_NAMED_IAM),
     parameters: parameters,
@@ -120,7 +168,7 @@ if stack_exists
   )
 else
   client.create_stack(
-    stack_name: "DependencyStack",
+    stack_name: "<%= project_name %>#{ENV["ENVIRONMENT"].capitalize}DependencyStack",
     template_body: template,
     timeout_in_minutes: 60,
     capabilities: %w(CAPABILITY_IAM CAPABILITY_NAMED_IAM),
@@ -140,7 +188,7 @@ shown_log_lines = {}
 
 360.times do
   resp = client.describe_stack_events(
-    stack_name: "DependencyStack"
+    stack_name: "<%= project_name %>#{ENV["ENVIRONMENT"].capitalize}DependencyStack"
   )
   resp.stack_events.to_a.reverse.each_with_index do |event, index|
     next if previous_statuses.include? event.event_id
@@ -155,8 +203,8 @@ shown_log_lines = {}
                "#{@resource_status.white} #{@resource_status_reason.to_s.red}"
     puts log_line unless shown_log_lines[log_line]
     shown_log_lines[log_line] = true
-    if (@stack_name == "DependencyStack") \
-      && (@logical_resource_id == "DependencyStack") \
+    if (@stack_name == "<%= project_name %>#{ENV["ENVIRONMENT"].capitalize}DependencyStack") \
+      && (@logical_resource_id == "<%= project_name %>#{ENV["ENVIRONMENT"].capitalize}DependencyStack") \
       && (END_STATES.include? @resource_status) \
       && (index + 1 == resp.stack_events.to_a.size)
       @completed = true

data/templates/lib/main.rb

@@ -3,7 +3,7 @@ require "dotenv"
 require_relative "core/classes"
 
 Dotenv.load(".env.private")
-Dotenv.load(".env.dependencies")
+Dotenv.load(".env.dependencies.#{ENV["ENVIRONMENT"]}")
 Dotenv.load(".env")
 Dotenv.load(".env.#{ENV["ENVIRONMENT"]}")
 

data/templates/lib/shared_concerns/global_variables.rb

@@ -6,7 +6,7 @@ module Concerns
 
     included do
       def load_config(_val)
-        config = YAML.safe_load(File.read("config.yaml"))
+        config = YAML.safe_load(File.read("config.yaml"), [Symbol])
         config["applications"] ||= {}
         config["environments"] ||= {}
         config["subnets"] ||= {}

data/templates/lib/shared_concerns/shared_methods.rb

@@ -35,7 +35,9 @@ module Concerns
       end
 
       def generate_bootstrap_parameters
-        File.open(".env.dependencies#{environment == "rspec" && ".rspec" || ""}").read.each_line do |line|
+        warn "WARNING: .env.dependencies.#{ENV["ENVIRONMENT"]} does not exist. Run `rake dependencies` first!" unless File.file?(".env.dependencies.#{ENV["ENVIRONMENT"]}")
+        filename = File.file?(".env.dependencies.#{ENV["ENVIRONMENT"]}") && ".env.dependencies#{environment == "rspec" && ".rspec" || ".#{ENV["ENVIRONMENT"]}"}" || ".env.dependencies.rspec"
+        File.open(filename).read.each_line do |line|
           line.strip!
           param, _value = line.split("=")
           parameter param.to_sym,

data/templates/lib/stacks/ecs_stack/ecs_cluster.rb

@@ -22,323 +22,323 @@ module EcsStack
       resource :ecs_cluster,
                type: "AWS::ECS::Cluster"
 
-      resource :ecs_auto_scaling_group,
-               type: "AWS::AutoScaling::AutoScalingGroup" do |r|
-        r.property(:vpc_zone_identifier) { :subnets.ref.fnsplit(",") }
-        r.property(:launch_configuration_name) { :ecs_launch_configuration.ref }
-        r.property(:min_size) { cluster_size.to_i }
-        r.property(:max_size) { cluster_size.to_i }
-        r.property(:desired_capacity) { cluster_size.to_i }
-        r.property(:tags) do
-          [
-            {
-              "Key": "Name",
-              "Value": "#{environment} ECS host",
-              "PropagateAtLaunch": true
-            }
-          ]
+      unless infra_config["environments"][environment]["cluster_size"].nil? || infra_config["environments"][environment]["cluster_size"].to_i.zero?
+        resource :ecs_auto_scaling_group,
+                 type: "AWS::AutoScaling::AutoScalingGroup" do |r|
+          r.property(:vpc_zone_identifier) { :subnets.ref.fnsplit(",") }
+          r.property(:launch_configuration_name) { :ecs_launch_configuration.ref }
+          r.property(:min_size) { cluster_size.to_i }
+          r.property(:max_size) { cluster_size.to_i + 1 }
+          r.property(:desired_capacity) { cluster_size.to_i }
+          r.property(:tags) do
+            [
+              {
+                "Key": "Name",
+                "Value": "#{environment} ECS host",
+                "PropagateAtLaunch": true
+              }
+            ]
+          end
         end
-      end
 
-      resource :ecs_launch_configuration,
-               metadata: {
-                 "AWS::CloudFormation::Init": {
-                   "config": {
-                     "packages": {
-                       "yum": {
-                         "collectd": []
-                       }
-                     },
-                     "commands": {
-                       "01_add_instance_to_cluster": {
-                         "command": "echo ECS_CLUSTER=${SfsEcsCluster} >> /etc/ecs/ecs.config".fnsub
+        resource :ecs_launch_configuration,
+                 metadata: {
+                   "AWS::CloudFormation::Init": {
+                     "config": {
+                       "packages": {
+                         "yum": {
+                           "collectd": []
+                         }
                        },
-                       "02_enable_cloudwatch_agent": {
-                         "command": "/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -c ssm:${EcsCloudWatchParameter} -s".fnsub
-                       }
-                     },
-                     "files": {
-                       "/etc/cfn/cfn-hup.conf": {
-                         "mode": 256,
-                         "owner": "root",
-                         "group": "root",
-                         "content": "[main]\nstack=${AWS::StackId}\nregion=${AWS::Region}\n".fnsub
+                       "commands": {
+                         "01_add_instance_to_cluster": {
+                           "command": "echo ECS_CLUSTER=${EcsCluster} >> /etc/ecs/ecs.config".fnsub
+                         },
+                         "02_enable_cloudwatch_agent": {
+                           "command": "/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -c ssm:${EcsCloudWatchParameter} -s".fnsub
+                         }
                        },
-                       "/etc/cfn/hooks.d/cfn-auto-reloader.conf": {
-                         "content": "[cfn-auto-reloader-hook]\ntriggers=post.update\npath=Resources.EcsLaunchConfiguration.Metadata.AWS::CloudFormation::Init\naction=/opt/aws/bin/cfn-init -v --region ${AWS::Region} --stack ${AWS::StackName} --resource EcsLaunchConfiguration\n".fnsub
-                       }
-                     },
-                     "services": {
-                       "sysvinit": {
-                         "cfn-hup": {
-                           "enabled": true,
-                           "ensureRunning": true,
-                           "files": [
-                             "/etc/cfn/cfn-hup.conf",
-                             "/etc/cfn/hooks.d/cfn-auto-reloader.conf"
-                           ]
+                       "files": {
+                         "/etc/cfn/cfn-hup.conf": {
+                           "mode": 256,
+                           "owner": "root",
+                           "group": "root",
+                           "content": "[main]\nstack=${AWS::StackId}\nregion=${AWS::Region}\n".fnsub
+                         },
+                         "/etc/cfn/hooks.d/cfn-auto-reloader.conf": {
+                           "content": "[cfn-auto-reloader-hook]\ntriggers=post.update\npath=Resources.EcsLaunchConfiguration.Metadata.AWS::CloudFormation::Init\naction=/opt/aws/bin/cfn-init -v --region ${AWS::Region} --stack ${AWS::StackName} --resource EcsLaunchConfiguration\n".fnsub
+                         }
+                       },
+                       "services": {
+                         "sysvinit": {
+                           "cfn-hup": {
+                             "enabled": true,
+                             "ensureRunning": true,
+                             "files": [
+                               "/etc/cfn/cfn-hup.conf",
+                               "/etc/cfn/hooks.d/cfn-auto-reloader.conf"
+                             ]
+                           }
                          }
                        }
                      }
                    }
-                 }
-               },
-               type: "AWS::AutoScaling::LaunchConfiguration" do |r|
-        r.property(:image_id) { :ecs_ami.ref }
-        r.property(:key_name) { "sfs-keypair-#{environment}" }
-        r.property(:instance_type) { cluster_instance_type }
-        r.property(:security_groups) do
-          [
-            :ecs_host_security_group.ref,
-            :load_balancer_security_group.ref # Not sure if necessary
-          ]
+                 },
+                 type: "AWS::AutoScaling::LaunchConfiguration" do |r|
+          r.property(:image_id) { :ecs_ami.ref }
+          r.property(:instance_type) { cluster_instance_type }
+          r.property(:security_groups) do
+            [
+              :ecs_host_security_group.ref,
+              :load_balancer_security_group.ref # Not sure if necessary
+            ]
+          end
+          r.property(:iam_instance_profile) { :ecs_instance_profile.ref }
+          r.property(:user_data) { "#!/bin/bash\nyum install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm\nyum install -y https://s3.amazonaws.com/amazoncloudwatch-agent/amazon_linux/amd64/latest/amazon-cloudwatch-agent.rpm\nyum install -y aws-cfn-bootstrap hibagent \n/opt/aws/bin/cfn-init -v --region ${AWS::Region} --stack ${AWS::StackName} --resource EcsLaunchConfiguration\n/opt/aws/bin/cfn-signal -e $? --region ${AWS::Region} --stack ${AWS::StackName} --resource EcsAutoScalingGroup\n/usr/bin/enable-ec2-spot-hibernation\n".fnsub.fnbase64 }
         end
-        r.property(:iam_instance_profile) { :ecs_instance_profile.ref }
-        r.property(:user_data) { "#!/bin/bash\nyum install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm\nyum install -y https://s3.amazonaws.com/amazoncloudwatch-agent/amazon_linux/amd64/latest/amazon-cloudwatch-agent.rpm\nyum install -y aws-cfn-bootstrap hibagent \n/opt/aws/bin/cfn-init -v --region ${AWS::Region} --stack ${AWS::StackName} --resource EcsLaunchConfiguration\n/opt/aws/bin/cfn-signal -e $? --region ${AWS::Region} --stack ${AWS::StackName} --resource EcsAutoScalingGroup\n/usr/bin/enable-ec2-spot-hibernation\n".fnsub.fnbase64 }
-      end
 
-      ecs_ssm_parameter_value = {
-        "logs": {
-          "force_flush_interval": 5,
-          "logs_collected": {
-            "files": {
-              "collect_list": [
-                {
-                  "file_path": "/var/log/messages",
-                  "log_group_name": "${SfsEcsCluster}-/var/log/messages",
-                  "log_stream_name": "{instance_id}",
-                  "timestamp_format": "%b %d %H:%M:%S"
-                },
-                {
-                  "file_path": "/var/log/dmesg",
-                  "log_group_name": "${SfsEcsCluster}-/var/log/dmesg",
-                  "log_stream_name": "{instance_id}"
-                },
-                {
-                  "file_path": "/var/log/docker",
-                  "log_group_name": "${SfsEcsCluster}-/var/log/docker",
-                  "log_stream_name": "{instance_id}",
-                  "timestamp_format": "%Y-%m-%dT%H:%M:%S.%f"
-                },
-                {
-                  "file_path": "/var/log/ecs/ecs-init.log",
-                  "log_group_name": "${SfsEcsCluster}-/var/log/ecs/ecs-init.log",
-                  "log_stream_name": "{instance_id}",
-                  "timestamp_format": "%Y-%m-%dT%H:%M:%SZ"
-                },
-                {
-                  "file_path": "/var/log/ecs/ecs-agent.log.*",
-                  "log_group_name": "${SfsEcsCluster}-/var/log/ecs/ecs-agent.log",
-                  "log_stream_name": "{instance_id}",
-                  "timestamp_format": "%Y-%m-%dT%H:%M:%SZ"
-                },
-                {
-                  "file_path": "/var/log/ecs/audit.log",
-                  "log_group_name": "${SfsEcsCluster}-/var/log/ecs/audit.log",
-                  "log_stream_name": "{instance_id}",
-                  "timestamp_format": "%Y-%m-%dT%H:%M:%SZ"
-                }
-              ]
+        ecs_ssm_parameter_value = {
+          "logs": {
+            "force_flush_interval": 5,
+            "logs_collected": {
+              "files": {
+                "collect_list": [
+                  {
+                    "file_path": "/var/log/messages",
+                    "log_group_name": "${EcsCluster}-/var/log/messages",
+                    "log_stream_name": "{instance_id}",
+                    "timestamp_format": "%b %d %H:%M:%S"
+                  },
+                  {
+                    "file_path": "/var/log/dmesg",
+                    "log_group_name": "${EcsCluster}-/var/log/dmesg",
+                    "log_stream_name": "{instance_id}"
+                  },
+                  {
+                    "file_path": "/var/log/docker",
+                    "log_group_name": "${EcsCluster}-/var/log/docker",
+                    "log_stream_name": "{instance_id}",
+                    "timestamp_format": "%Y-%m-%dT%H:%M:%S.%f"
+                  },
+                  {
+                    "file_path": "/var/log/ecs/ecs-init.log",
+                    "log_group_name": "${EcsCluster}-/var/log/ecs/ecs-init.log",
+                    "log_stream_name": "{instance_id}",
+                    "timestamp_format": "%Y-%m-%dT%H:%M:%SZ"
+                  },
+                  {
+                    "file_path": "/var/log/ecs/ecs-agent.log.*",
+                    "log_group_name": "${EcsCluster}-/var/log/ecs/ecs-agent.log",
+                    "log_stream_name": "{instance_id}",
+                    "timestamp_format": "%Y-%m-%dT%H:%M:%SZ"
+                  },
+                  {
+                    "file_path": "/var/log/ecs/audit.log",
+                    "log_group_name": "${EcsCluster}-/var/log/ecs/audit.log",
+                    "log_stream_name": "{instance_id}",
+                    "timestamp_format": "%Y-%m-%dT%H:%M:%SZ"
+                  }
+                ]
+              }
             }
-          }
-        },
-        "metrics": {
-          "append_dimensions": {
-            "AutoScalingGroupName": "${!aws:AutoScalingGroupName}",
-            "InstanceId": "${!aws:InstanceId}",
-            "InstanceType": "${!aws:InstanceType}"
           },
-          "metrics_collected": {
-            "collectd": {
-              "metrics_aggregation_interval": 60
+          "metrics": {
+            "append_dimensions": {
+              "AutoScalingGroupName": "${!aws:AutoScalingGroupName}",
+              "InstanceId": "${!aws:InstanceId}",
+              "InstanceType": "${!aws:InstanceType}"
             },
-            "disk": {
-              "measurement": [
-                "used_percent"
-              ],
-              "metrics_collection_interval": 60,
-              "resources": [
-                "/"
-              ]
-            },
-            "mem": {
-              "measurement": [
-                "mem_used_percent"
-              ],
-              "metrics_collection_interval": 60
-            },
-            "statsd": {
-              "metrics_aggregation_interval": 60,
-              "metrics_collection_interval": 10,
-              "service_address": ":8125"
+            "metrics_collected": {
+              "collectd": {
+                "metrics_aggregation_interval": 60
+              },
+              "disk": {
+                "measurement": [
+                  "used_percent"
+                ],
+                "metrics_collection_interval": 60,
+                "resources": [
+                  "/"
+                ]
+              },
+              "mem": {
+                "measurement": [
+                  "mem_used_percent"
+                ],
+                "metrics_collection_interval": 60
+              },
+              "statsd": {
+                "metrics_aggregation_interval": 60,
+                "metrics_collection_interval": 10,
+                "service_address": ":8125"
+              }
             }
           }
         }
-      }
 
-      resource :ecs_cloud_watch_parameter,
-               type: "AWS::SSM::Parameter" do |r|
-        r.property(:description) { "ECS" }
-        r.property(:name) { "AmazonCloudWatch-${SfsEcsCluster}-ECS".fnsub }
-        r.property(:type) { "String" }
-        r.property(:value) { JSON.pretty_generate(ecs_ssm_parameter_value).fnsub }
-      end
-
-      resource :ecs_host_security_group,
-               type: "AWS::EC2::SecurityGroup" do |r|
-        r.property(:vpc_id) { :vpc.ref }
-        r.property(:group_description) { "Access to the ECS hosts and the tasks/containers that run on them" }
-        r.property(:security_group_ingress) do
-          [
-            {
-              "SourceSecurityGroupId": :load_balancer_security_group.ref,
-              "IpProtocol": -1
-            }
-          ]
+        resource :ecs_cloud_watch_parameter,
+                 type: "AWS::SSM::Parameter" do |r|
+          r.property(:description) { "ECS" }
+          r.property(:name) { "AmazonCloudWatch-${EcsCluster}-ECS".fnsub }
+          r.property(:type) { "String" }
+          r.property(:value) { JSON.pretty_generate(ecs_ssm_parameter_value).fnsub }
         end
-        r.property(:tags) do
-          [
-            {
-              "Key": "Name",
-              "Value": "#{environment}-ECS-Hosts"
-            }
-          ]
+
+        resource :ecs_host_security_group,
+                 type: "AWS::EC2::SecurityGroup" do |r|
+          r.property(:vpc_id) { :vpc.ref }
+          r.property(:group_description) { "Access to the ECS hosts and the tasks/containers that run on them" }
+          r.property(:security_group_ingress) do
+            [
+              {
+                "SourceSecurityGroupId": :load_balancer_security_group.ref,
+                "IpProtocol": -1
+              }
+            ]
+          end
+          r.property(:tags) do
+            [
+              {
+                "Key": "Name",
+                "Value": "#{environment}-ECS-Hosts"
+              }
+            ]
+          end
         end
-      end
 
-      resource :load_balancer_security_group,
-               type: "AWS::EC2::SecurityGroup" do |r|
-        r.property(:vpc_id) { :vpc.ref }
-        r.property(:group_description) { "Access to the load balancer that sits in front of ECS" }
-        r.property(:security_group_ingress) do
-          [
-            {
-              "CidrIp": "0.0.0.0/0",
-              "IpProtocol": -1
-            }
-          ]
+        resource :load_balancer_security_group,
+                 type: "AWS::EC2::SecurityGroup" do |r|
+          r.property(:vpc_id) { :vpc.ref }
+          r.property(:group_description) { "Access to the load balancer that sits in front of ECS" }
+          r.property(:security_group_ingress) do
+            [
+              {
+                "CidrIp": "0.0.0.0/0",
+                "IpProtocol": -1
+              }
+            ]
+          end
+          r.property(:tags) do
+            [
+              {
+                "Key": "Name",
+                "Value": "#{environment}-ECS-LoadBalancers"
+              }
+            ]
+          end
         end
-        r.property(:tags) do
-          [
+
+        ecs_role_assume_role_policy_document = {
+          "Statement": [
             {
-              "Key": "Name",
-              "Value": "#{environment}-ECS-LoadBalancers"
+              "Action": "sts:AssumeRole",
+              "Effect": "Allow",
+              "Principal": {
+                "Service": "ec2.amazonaws.com"
+              }
             }
           ]
-        end
-      end
+        }
 
-      ecs_role_assume_role_policy_document = {
-        "Statement": [
-          {
-            "Action": "sts:AssumeRole",
+        ecs_role_policy_document = {
+          "Statement": [{
             "Effect": "Allow",
-            "Principal": {
-              "Service": "ec2.amazonaws.com"
-            }
-          }
-        ]
-      }
-
-      ecs_role_policy_document = {
-        "Statement": [{
-          "Effect": "Allow",
-          "Action": [
-            "ecs:CreateCluster",
-            "ecs:DeregisterContainerInstance",
-            "ecs:DiscoverPollEndpoint",
-            "ecs:Poll",
-            "ecs:RegisterContainerInstance",
-            "ecs:StartTelemetrySession",
-            "ecs:Submit*",
-            "ecr:BatchCheckLayerAvailability",
-            "ecr:BatchGetImage",
-            "ecr:GetDownloadUrlForLayer",
-            "ecr:GetAuthorizationToken"
-          ],
-          "Resource": "*"
-        }]
-      }
+            "Action": [
+              "ecs:CreateCluster",
+              "ecs:DeregisterContainerInstance",
+              "ecs:DiscoverPollEndpoint",
+              "ecs:Poll",
+              "ecs:RegisterContainerInstance",
+              "ecs:StartTelemetrySession",
+              "ecs:Submit*",
+              "ecr:BatchCheckLayerAvailability",
+              "ecr:BatchGetImage",
+              "ecr:GetDownloadUrlForLayer",
+              "ecr:GetAuthorizationToken"
+            ],
+            "Resource": "*"
+          }]
+        }
 
-      resource :ecs_role,
-               type: "AWS::IAM::Role" do |r|
-        r.property(:path) { "/" }
-        r.property(:role_name) { "#{environment}-ECSRole-${AWS::Region}".fnsub }
-        r.property(:assume_role_policy_document) { JSON.pretty_generate(ecs_role_assume_role_policy_document) }
-        r.property(:managed_policy_arns) do
-          [
-            "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM",
-            "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy",
-            "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role"
-          ]
-        end
-        r.property(:policies) do
-          [
-            {
-              "PolicyName": "ecs-service",
-              "PolicyDocument": JSON.pretty_generate(ecs_role_policy_document)
-            }
-          ]
+        resource :ecs_role,
+                 type: "AWS::IAM::Role" do |r|
+          r.property(:path) { "/" }
+          r.property(:role_name) { "#{environment}-ECSRole-${AWS::Region}".fnsub }
+          r.property(:assume_role_policy_document) { JSON.pretty_generate(ecs_role_assume_role_policy_document) }
+          r.property(:managed_policy_arns) do
+            [
+              "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM",
+              "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy",
+              "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role"
+            ]
+          end
+          r.property(:policies) do
+            [
+              {
+                "PolicyName": "ecs-service",
+                "PolicyDocument": JSON.pretty_generate(ecs_role_policy_document)
+              }
+            ]
+          end
         end
-      end
 
-      resource :ecs_instance_profile,
-               type: "AWS::IAM::InstanceProfile" do |r|
-        r.property(:path) { "/" }
-        r.property(:roles) do
-          [
-            :ecs_role.ref
-          ]
+        resource :ecs_instance_profile,
+                 type: "AWS::IAM::InstanceProfile" do |r|
+          r.property(:path) { "/" }
+          r.property(:roles) do
+            [
+              :ecs_role.ref
+            ]
+          end
         end
-      end
 
-      resource :ecs_service_auto_scaling_role,
-               type: "AWS::IAM::Role" do |r|
-        r.property(:assume_role_policy_document) do
-          {
-            "Version": "2012-10-17",
-            "Statement": {
-              "Action": [
-                "sts:AssumeRole"
-              ],
-              "Effect": "Allow",
-              "Principal": {
-                "Service": [
-                  "application-autoscaling.amazonaws.com"
-                ]
-              }
-            }
-          }
-        end
-        r.property(:path) { "/" }
-        r.property(:policies) do
-          [
+        resource :ecs_service_auto_scaling_role,
+                 type: "AWS::IAM::Role" do |r|
+          r.property(:assume_role_policy_document) do
             {
-              "PolicyName": "ecs-service-autoscaling",
-              "PolicyDocument": {
-                "Statement": {
-                  "Effect": "Allow",
-                  "Action": [
-                    "application-autoscaling:*",
-                    "cloudwatch:DescribeAlarms",
-                    "cloudwatch:PutMetricAlarm",
-                    "ecs:DescribeServices",
-                    "ecs:UpdateService"
-                  ],
-                  "Resource": "*"
+              "Version": "2012-10-17",
+              "Statement": {
+                "Action": [
+                  "sts:AssumeRole"
+                ],
+                "Effect": "Allow",
+                "Principal": {
+                  "Service": [
+                    "application-autoscaling.amazonaws.com"
+                  ]
                 }
               }
             }
-          ]
+          end
+          r.property(:path) { "/" }
+          r.property(:policies) do
+            [
+              {
+                "PolicyName": "ecs-service-autoscaling",
+                "PolicyDocument": {
+                  "Statement": {
+                    "Effect": "Allow",
+                    "Action": [
+                      "application-autoscaling:*",
+                      "cloudwatch:DescribeAlarms",
+                      "cloudwatch:PutMetricAlarm",
+                      "ecs:DescribeServices",
+                      "ecs:UpdateService"
+                    ],
+                    "Resource": "*"
+                  }
+                }
+              }
+            ]
+          end
         end
+        output :ecs_auto_scaling_role_arn,
+               value: :ecs_service_auto_scaling_role.ref(:arn)
       end
-
       output :ecs_cluster,
              value: :ecs_cluster.ref
       output :ecs_cluster_arn,
              value: :ecs_cluster.ref(:arn)
-      output :ecs_auto_scaling_role_arn,
-             value: :ecs_service_auto_scaling_role.ref(:arn)
     end
   end
 end