cloudmason 0.0.1

package/commands/helpers/stacks/asg.yaml

@@ -0,0 +1,224 @@
+AWSTemplateFormatVersion: '2010-09-09'
+Description: ASG Cloudformation Template
+
+
+Parameters:
+  InstanceRootDomain:
+    Type: AWS::Route53::HostedZone::Id
+    Description: Hosted Zone
+  InstanceDomain:
+    Type: String
+    Description: Full domain/subdomain name to associate with the ALB
+  ACMDomainCert:
+    Type: String
+    Description: ARN of AWS ACM Certificate
+  VpcId:
+    Type: AWS::EC2::VPC::Id
+    Description: Org VPC
+  InstanceSubnets:
+    Type: List<AWS::EC2::Subnet::Id>
+    Description: Subnets to deploy in
+  MaxEc2Instances:
+    Type: Number
+    Description: Max number of Ec2 instances
+  AmiId:
+    Type: AWS::EC2::Image::Id
+    Description: Max number of Ec2 instances
+  
+
+Resources:
+# ALB
+  AppALB:
+    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
+    Properties:
+      Scheme: internet-facing
+      Type: application
+      IpAddressType: ipv4
+      SecurityGroups: 
+        - !GetAtt AppALBSecurityGroup.GroupId
+      Subnets: !Ref InstanceSubnets
+  AppALBHTTPSListener:
+    Type: AWS::ElasticLoadBalancingV2::Listener
+    Properties:
+      Certificates:
+        - CertificateArn: !Ref ACMDomainCert
+      DefaultActions:
+        - Type: forward
+          ForwardConfig:
+            TargetGroups:
+              - TargetGroupArn: !Ref AppALBTargetGroup
+                Weight: 999
+            TargetGroupStickinessConfig:
+              DurationSeconds: 900
+              Enabled: false
+      LoadBalancerArn: !Ref AppALB
+      Port: 443
+      Protocol: HTTPS
+  AppALBHTTPRedirectListener:
+    Type: AWS::ElasticLoadBalancingV2::Listener
+    Properties:
+      DefaultActions:
+        - RedirectConfig:
+            Port: "443"
+            Protocol: HTTPS
+            StatusCode: HTTP_301
+          Type: redirect
+      LoadBalancerArn: !Ref AppALB
+      Port: 80
+      Protocol: HTTP
+  AppALBSecurityGroup:
+    Type: AWS::EC2::SecurityGroup
+    Properties:
+      VpcId: !Ref VpcId
+      GroupDescription: Allow http to client host
+      SecurityGroupIngress:
+        - IpProtocol: tcp
+          FromPort: 80
+          ToPort: 80
+          CidrIp: 0.0.0.0/0
+        - IpProtocol: tcp
+          FromPort: 443
+          ToPort: 443
+          CidrIp: 0.0.0.0/0
+  AppALBSecurityGroupEgress:
+    Type: AWS::EC2::SecurityGroupEgress
+    Properties:
+      GroupId: !Ref AppALBSecurityGroup
+      Description: Allow ALB to communicate with Ec2
+      IpProtocol: tcp
+      FromPort: 8080
+      ToPort: 8080
+      DestinationSecurityGroupId: !Ref AppEc2SecurityGroup
+  AppALBRouteRecord:
+    Type: AWS::Route53::RecordSet
+    Properties:
+      Type: A
+      Name: !Ref InstanceDomain
+      AliasTarget:
+        DNSName: !GetAtt AppALB.DNSName
+        EvaluateTargetHealth: true
+        HostedZoneId: !GetAtt AppALB.CanonicalHostedZoneID
+      HostedZoneId: !Ref InstanceRootDomain 
+      Region: !Ref AWS::Region
+      SetIdentifier: !Ref AWS::Region
+# Autoscaling Group
+  AppASG:
+    Type: AWS::AutoScaling::AutoScalingGroup
+    Properties:
+      AvailabilityZones:
+        Fn::GetAZs: ""
+      DesiredCapacity: '1'
+      MinSize: '1'
+      MaxSize: !Ref MaxEc2Instances
+      TargetGroupARNs: 
+        - !Ref AppALBTargetGroup
+      LaunchTemplate:
+        LaunchTemplateId: !Ref AppEc2LaunchTemplate
+        Version: !GetAtt AppEc2LaunchTemplate.LatestVersionNumber
+  AppALBTargetGroup:
+    Type: AWS::ElasticLoadBalancingV2::TargetGroup
+    Properties:
+      HealthCheckIntervalSeconds: 30
+      HealthCheckPath: /
+      HealthCheckTimeoutSeconds: 5
+      HealthyThresholdCount: 3
+      Matcher:
+        HttpCode: 200,300,302
+      Port: 8080
+      Protocol: HTTP
+      TargetType: instance
+      UnhealthyThresholdCount: 2
+      VpcId: !Ref VpcId
+  ASGCPUPolicy:
+    Type: AWS::AutoScaling::ScalingPolicy
+    Properties:
+      AutoScalingGroupName: !Ref AppASG
+      PolicyType: TargetTrackingScaling
+      TargetTrackingConfiguration:
+        PredefinedMetricSpecification:
+          PredefinedMetricType: ASGAverageCPUUtilization
+        TargetValue: '70'
+  AppEc2LaunchTemplate:
+    Type: AWS::EC2::LaunchTemplate
+    Properties:
+      LaunchTemplateName: !Sub '${AWS::StackName}_LaunchTemplate'
+      LaunchTemplateData:
+        IamInstanceProfile:
+          Name:
+            Ref: AppEc2Profile
+        UserData: {{user_data}}
+        ImageId: !Ref AmiId
+        DisableApiTermination: "true"
+        InstanceType: t2.small
+        SecurityGroupIds: 
+          - !Ref AppEc2SecurityGroup
+  AppEc2SecurityGroup:
+    Type: AWS::EC2::SecurityGroup
+    Properties:
+      VpcId: !Ref VpcId
+      GroupDescription: Allow http to client host
+      SecurityGroupEgress:
+        - IpProtocol: "-1"
+          CidrIp: 0.0.0.0/0
+  AppEc2SecurityGroupIngress:
+    Type: AWS::EC2::SecurityGroupIngress
+    Properties:
+      GroupId: !Ref AppEc2SecurityGroup
+      Description: Allow 8080 from ALB
+      IpProtocol: "-1"
+      SourceSecurityGroupId: !Ref AppALBSecurityGroup
+# S3 App Bucket
+  AppBucket:
+    Type: AWS::S3::Bucket
+    Properties:
+      BucketName: !Ref InstanceDomain
+      VersioningConfiguration:
+        Status: Enabled
+  AppBucketPolicy:
+    Type: AWS::S3::BucketPolicy
+    Properties: 
+      Bucket: !Ref AppBucket
+      PolicyDocument:
+        Version: '2012-10-17'
+        Statement:
+          - Effect: Allow
+            Principal:
+              AWS:
+                - !GetAtt AppEc2Role.Arn
+            Action:
+              - 's3:GetObject'
+            Resource: 
+              - !Sub arn:aws:s3:::${AppBucket}
+              - !Sub arn:aws:s3:::${AppBucket}/*
+# IAM
+  AppEc2Role:
+    Type: 'AWS::IAM::Role'
+    Properties:
+      AssumeRolePolicyDocument:
+        Version: "2012-10-17"
+        Statement:
+          - Effect: Allow
+            Principal:
+              Service:
+                - ec2.amazonaws.com
+            Action:
+              - 'sts:AssumeRole'
+      Path: !Sub '/apps/${AWS::StackName}/'
+      Policies:
+        - PolicyName: root
+          PolicyDocument:
+            Version: "2012-10-17"
+            Statement:
+              - Effect: Allow
+                Action:
+                  - s3:GetObject
+                  - s3:ListBucket
+                Resource:
+                  - !Sub arn:aws:s3:::${AppBucket}
+                  - !Sub arn:aws:s3:::${AppBucket}/*
+  AppEc2Profile:
+    Type: AWS::IAM::InstanceProfile
+    Properties:
+      Path: !Sub '/apps/${AWS::StackName}/'
+      Roles: 
+        - !Ref AppEc2Role

package/commands/helpers/stacks/asg_draft.json

@@ -0,0 +1,321 @@
+{
+  "AWSTemplateFormatVersion": "2010-09-09",
+  "Description": "ASG Cloudformation Template",
+  "Parameters": {
+    "AppName": {
+      "Type": "String",
+      "Description": "Application Name"
+    },
+    "InstanceName": {
+      "Type": "String",
+      "Description": "Application Name"
+    },
+    "InstanceRootDomain": {
+      "Type": "AWS::Route53::HostedZone::Id",
+      "Description": "Hosted Zone"
+    },
+    "InstanceDomain": {
+      "Type": "String",
+      "Description": "Full domain/subdomain name to associate with the ALB"
+    },
+    "ACMDomainCert": {
+      "Type": "String",
+      "Description": "ARN of AWS ACM Certificate"
+    },
+    "VpcId": {
+      "Type": "AWS::EC2::VPC::Id",
+      "Description": "Org VPC"
+    },
+    "InstanceSubnets": {
+      "Type": "List<AWS::EC2::Subnet::Id>",
+      "Description": "Subnets to deploy in"
+    },
+    "MinEc2Instances": {
+      "Type": "Number",
+      "Description": "Minimum number of Ec2 instances"
+    },
+    "MaxEc2Instances": {
+      "Type": "Number",
+      "Description": "Max number of Ec2 instances"
+    }
+  },
+  "Resources": {
+    "AppALB": {
+      "Type": "AWS::ElasticLoadBalancingV2::LoadBalancer",
+      "Properties": {
+        "Name": "${AppName}-${InstanceName}",
+        "Scheme": "internet-facing",
+        "Type": "application",
+        "IpAddressType": "ipv4",
+        "SecurityGroups": "AppALBSecurityGroup",
+        "Subnets": "InstanceSubnets"
+      }
+    },
+    "AppALBHTTPSListener": {
+      "Type": "AWS::ElasticLoadBalancingV2::Listener",
+      "Properties": {
+        "Certificates": [
+          {
+            "CertificateArn": "ACMDomainCert"
+          }
+        ],
+        "DefaultActions": [
+          {
+            "Type": "forward",
+            "ForwardConfig": {
+              "TargetGroups": [
+                {
+                  "TargetGroupArn": "AppALBTargetGroup",
+                  "Weight": 999
+                }
+              ],
+              "TargetGroupStickinessConfig": {
+                "DurationSeconds": 900,
+                "Enabled": false
+              }
+            }
+          }
+        ],
+        "LoadBalancerArn": "AppALB",
+        "Port": 443,
+        "Protocol": "HTTPS"
+      }
+    },
+    "AppALBHTTPRedirectListener": {
+      "Type": "AWS::ElasticLoadBalancingV2::Listener",
+      "Properties": {
+        "DefaultActions": [
+          {
+            "RedirectConfig": {
+              "Port": "443",
+              "Protocol": "HTTPS",
+              "StatusCode": "HTTP_301"
+            },
+            "Type": "redirect"
+          }
+        ],
+        "LoadBalancerArn": "AppALB",
+        "Port": 80,
+        "Protocol": "HTTP"
+      }
+    },
+    "AppALBSecurityGroup": {
+      "Type": "AWS::EC2::SecurityGroup",
+      "Properties": {
+        "VpcId": "VpcId",
+        "GroupName": "AppALBSecurityGroup",
+        "GroupDescription": "Allow http to client host",
+        "SecurityGroupIngress": [
+          {
+            "IpProtocol": "tcp",
+            "FromPort": 80,
+            "ToPort": 80,
+            "CidrIp": "0.0.0.0/0"
+          },
+          {
+            "IpProtocol": "tcp",
+            "FromPort": 443,
+            "ToPort": 443,
+            "CidrIp": "0.0.0.0/0"
+          }
+        ]
+      }
+    },
+    "AppALBSecurityGroupEgress": {
+      "Type": "AWS::EC2::SecurityGroupEgress",
+      "Properties": {
+        "GroupId": "AppALBSecurityGroup",
+        "Description": "Allow ALB to communicate with Ec2",
+        "IpProtocol": "tcp",
+        "FromPort": 8080,
+        "ToPort": 8080,
+        "DestinationSecurityGroupId": "AppEc2SecurityGroup"
+      }
+    },
+    "AppALBRouteRecord": {
+      "Type": "AWS::Route53::RecordSet",
+      "Properties": {
+        "Type": "A",
+        "Name": "InstanceDomain",
+        "AliasTarget": {
+          "DNSName": "AppALB.DNSName",
+          "EvaluateTargetHealth": true,
+          "HostedZoneId": "AppALB.CanonicalHostedZoneID"
+        },
+        "HostedZoneName": "${InstanceRootDomain}.",
+        "Region": "AWS::Region",
+        "SetIdentifier": "AWS::Region"
+      }
+    },
+    "AppASG": {
+      "Type": "AWS::AutoScaling::AutoScalingGroup",
+      "Properties": {
+        "AutoScalingGroupName": "AppASG",
+        "AvailabilityZones": {
+          "Fn::GetAZs": ""
+        },
+        "DesiredCapacity": "MinEc2Instances",
+        "MinSize": "MinEc2Instances",
+        "MaxSize": "MaxEc2Instances",
+        "TargetGroupARNs": "AppALBTargetGroup",
+        "LaunchTemplate": {
+          "LaunchTemplateId": "AppEc2LaunchTemplate",
+          "Version": "AppEc2LaunchTemplate.LatestVersionNumber"
+        }
+      },
+      "UpdatePolicy": {
+        "AutoScalingRollingUpdate": {
+          "MinInstancesInService": "1",
+          "MaxBatchSize": "1",
+          "PauseTime": "PT15M",
+          "WaitOnResourceSignals": "true"
+        }
+      }
+    },
+    "AppALBTargetGroup": {
+      "Type": "AWS::ElasticLoadBalancingV2::TargetGroup",
+      "Properties": {
+        "Name": "${AppName}-TargetGroup",
+        "HealthCheckIntervalSeconds": 30,
+        "HealthCheckPath": "/",
+        "HealthCheckTimeoutSeconds": 5,
+        "HealthyThresholdCount": 3,
+        "Matcher": {
+          "HttpCode": "200,300,302"
+        },
+        "Port": 8080,
+        "Protocol": "HTTP",
+        "TargetType": "instance",
+        "UnhealthyThresholdCount": 2,
+        "VpcId": "VpcId"
+      }
+    },
+    "AppEc2LaunchTemplate": {
+      "Type": "AWS::EC2::LaunchTemplate",
+      "Properties": {
+        "LaunchTemplateName": "AppEc2LaunchTemplate",
+        "LaunchTemplateData": {
+          "IamInstanceProfile": {
+            "Name": {
+              "Ref": "AppEc2Profile"
+            }
+          },
+          "UserData": "Y2QgL2hvbWUvZWMyLXVzZXIKbnBtIHJ1biBzdGFydCAu",
+          "ImageId": "ami-0f46d2cab016f434b",
+          "DisableApiTermination": "true",
+          "InstanceType": "t2.small",
+          "SecurityGroupIds": "AppEc2SecurityGroup"
+        }
+      }
+    },
+    "AppEc2SecurityGroup": {
+      "Type": "AWS::EC2::SecurityGroup",
+      "Properties": {
+        "VpcId": "VpcId",
+        "GroupName": "AppEc2SecurityGroup",
+        "GroupDescription": "Allow http to client host",
+        "SecurityGroupEgress": [
+          {
+            "IpProtocol": "-1",
+            "CidrIp": "0.0.0.0/0"
+          }
+        ]
+      }
+    },
+    "AppEc2SecurityGroupIngress": {
+      "Type": "AWS::EC2::SecurityGroupIngress",
+      "Properties": {
+        "GroupId": "AppEc2SecurityGroup",
+        "Description": "Allow 8080 from ALB",
+        "IpProtocol": "-1",
+        "SourceSecurityGroupId": "AppALBSecurityGroup"
+      }
+    },
+    "AppBucket": {
+      "Type": "AWS::S3::Bucket",
+      "Properties": {
+        "BucketName": "InstanceDomain",
+        "VersioningConfiguration": {
+          "Status": "Enabled"
+        }
+      }
+    },
+    "AppBucketPolicy": {
+      "Type": "AWS::S3::BucketPolicy",
+      "Properties": {
+        "Bucket": "AppBucket",
+        "PolicyDocument": {
+          "Version": "2012-10-17",
+          "Statement": [
+            {
+              "Effect": "Allow",
+              "Principal": {
+                "AWS": [
+                  "AppEc2Role.Arn"
+                ]
+              },
+              "Action": [
+                "s3:GetObject"
+              ],
+              "Resource": [
+                "arn:aws:s3:::${AppBucket}",
+                "arn:aws:s3:::${AppBucket}/*"
+              ]
+            }
+          ]
+        }
+      }
+    },
+    "AppEc2Role": {
+      "Type": "AWS::IAM::Role",
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Version": "2012-10-17",
+          "Statement": [
+            {
+              "Effect": "Allow",
+              "Principal": {
+                "Service": [
+                  "ec2.amazonaws.com"
+                ]
+              },
+              "Action": [
+                "sts:AssumeRole"
+              ]
+            }
+          ]
+        },
+        "Path": "/${AppName}",
+        "Policies": [
+          {
+            "PolicyName": "root",
+            "PolicyDocument": {
+              "Version": "2012-10-17",
+              "Statement": [
+                {
+                  "Effect": "Allow",
+                  "Action": [
+                    "s3:GetObject",
+                    "s3:ListBucket"
+                  ],
+                  "Resource": [
+                    "arn:aws:s3:::${AppBucket}",
+                    "arn:aws:s3:::${AppBucket}/*"
+                  ]
+                }
+              ]
+            }
+          }
+        ]
+      }
+    },
+    "AppEc2Profile": {
+      "Type": "AWS::IAM::InstanceProfile",
+      "Properties": {
+        "InstanceProfileName": "AppEc2Profile",
+        "Path": "/${AppName}",
+        "Roles": "AppEc2Role"
+      }
+    }
+  }
+}

package/commands/helpers/stacks/infra.yaml

@@ -0,0 +1,106 @@
+AWSTemplateFormatVersion: '2010-09-09'
+Description: Org Cloudformation Template
+
+Parameters:
+  orgName:
+    Type: String
+    Description: Unique name of organization
+  orgDomain:
+    Type: String
+    Description: Organization domain name
+  VpcId:
+    Type: String
+    Description: Org VPC
+  
+
+Resources:
+# S3 Bucket
+  InfraBucket:
+    Type: AWS::S3::Bucket
+    Properties:
+      BucketName: !Sub 'infra.${orgDomain}'
+      VersioningConfiguration:
+        Status: Enabled
+# IAM Policies for Ec2 Build Access
+  InfraBuildRole:
+    Type: 'AWS::IAM::Role'
+    Properties:
+      AssumeRolePolicyDocument:
+        Version: "2012-10-17"
+        Statement:
+          - Effect: Allow
+            Principal:
+              Service:
+                - ec2.amazonaws.com
+            Action:
+              - 'sts:AssumeRole'
+      Path: /infra/
+      Policies:
+        - PolicyName: root
+          PolicyDocument:
+            Version: "2012-10-17"
+            Statement:
+              - Effect: Allow
+                Action:
+                  - s3:GetObject
+                  - s3:ListBucket
+                Resource:
+                  - !Sub arn:aws:s3:::${InfraBucket}
+                  - !Sub arn:aws:s3:::${InfraBucket}/*
+  InfraInstanceProfile:
+    Type: 'AWS::IAM::InstanceProfile'
+    Properties:
+      Path: /infra/
+      Roles:
+        - !Ref InfraBuildRole
+# Ec2 security group
+  BuildSecGroup:
+    Type: 'AWS::EC2::SecurityGroup'
+    Properties:
+      GroupDescription: Security group for build AMI
+      SecurityGroupEgress:
+        - IpProtocol: '-1'
+          CidrIp: '0.0.0.0/0'
+      VpcId: !Ref VpcId
+# Bucket Policy
+  InfraBucketPolicy:
+    Type: AWS::S3::BucketPolicy
+    Properties: 
+      Bucket: !Ref InfraBucket
+      PolicyDocument:
+        Version: '2012-10-17'
+        Statement:
+          - Effect: Allow
+            Principal:
+              AWS:
+                - !GetAtt InfraBuildRole.Arn
+            Action:
+              - 's3:GetObject'
+            Resource: 
+              - !Sub arn:aws:s3:::${InfraBucket}
+              - !Sub arn:aws:s3:::${InfraBucket}/*
+# Org Params
+  ParamOrgInfo:
+    Type: 'AWS::SSM::Parameter'
+    Properties:
+      Name: '/infra/orgName'
+      Type: 'String'
+      Value: !Ref orgName
+  ParamOrgDomain:
+    Type: 'AWS::SSM::Parameter'
+    Properties:
+      Name: '/infra/orgDomain'
+      Type: 'String'
+      Value: !Ref orgDomain
+  ParamInstanceProfile:
+    Type: 'AWS::SSM::Parameter'
+    Properties:
+      Name: '/infra/buildInstanceProfile'
+      Type: 'String'
+      Value: !GetAtt InfraInstanceProfile.Arn
+  ParamIAM:
+    Type: 'AWS::SSM::Parameter'
+    Properties:
+      Name: '/infra/buildSecGroup'
+      Type: 'String'
+      Value: !GetAtt buildSecGroup.GroupId

package/commands/helpers/stacks.js

@@ -0,0 +1,26 @@
+const path = require('path');
+const fs = require('fs');
+
+const Stacks = {};
+
+exports.get = function(stackType,params){
+    const stackPath = path.resolve(__dirname, 'stacks', `${stackType}.yaml`);
+
+    if (!fs.existsSync(stackPath)){ throw new Error('Invalid stack ' + stackType); }
+    
+    const stackText = fs.readFileSync(stackPath, 'utf-8');
+    return Stacks[stackType](stackText,params)
+}
+
+Stacks.asg = function(stackText,params){
+    let bootScript = `#!/bin/bash -xe\ncd /home/ec2-user/app\n`;
+    if (params.lang == 'py'){
+        bootScript += 'py start .'
+    } else {
+        bootScript += `npm run start .`
+    }
+
+    const b64Script = Buffer.from(bootScript, 'utf8').toString('base64');
+    stackText = stackText.replace(/{{user_data}}/, b64Script);
+    return stackText;
+}