<commit_before>AWSTemplateFormatVersion: 2010-09-09
Description: ECS Service and Task definition
Parameters:
  cluster:
    Description: ECS service resources.
    Type: String
  env:
    Description: ECS Cluster name i.e. deva.
    Type: String
  listenerarn:
    Description: Arn of ELB listener to attach service to
    Type: String
  name:
    Description: Service Name i.e. jobmanager
    Type: String
  priority:
    Description: ALB priority
    Type: Number
  region:
    Description: AWS region i.e. us-east-1
    Type: String
  vpcid:
    Description: ID of the VPC for the service
    Type: String
  version:
    Description: Semantic version of service
    Type: String
  namespace:
    Description: Docker namespace
    Type: String

Resources:
  CustomResource:
    Type: Custom::CustomResource
    DependsOn:  ListenerRule
    Properties:
      ServiceToken:
        Fn::ImportValue:
          !Sub ${env}-LambdaStringFunctionArn
      ALBArn: !GetAtt TargetGroup.LoadBalancerArns
      TGTArn: !Ref TargetGroup

  EcsService:
    Type: "AWS::ECS::Service"
    Properties:
      Cluster:  !Ref cluster
      DesiredCount: 1
      LoadBalancers:
        -
          TargetGroupArn: !Ref TargetGroup
          ContainerName:  !Ref name
          ContainerPort: 8080
      Role: !Sub ecsServiceRole-${cluster}
      TaskDefinition:  !Ref EcsTask

  EcsTask:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        -
          Environment:
            -
              Name: ENVIRONMENT_NAME
              Value: !Ref env
            -
              Name: ENVIRONMENT_REGION
              Value: !Ref region
            -
              Name: SERVICE_NAME
              Value: !Ref name
            -
              Name: MONGOHOST
              Value:
                Fn::Join:
                  - ""
                  - - mongodb.
                    - Fn::ImportValue: !Sub ${env}-PrivateDomain
          Essential: true
          Image: !Sub 639193537090.dkr.ecr.us-east-1.amazonaws.com/${namespace}/go-mongo-backup:${version}
          Memory: 1024
          MemoryReservation: 300
          PortMappings:
            -
              HostPort: 0
              ContainerPort: 8080
              Protocol: tcp
          Name: !Ref name
      TaskRoleArn : !GetAtt Role.Arn

  TargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckPath: !Sub /${name}/
      Matcher:
       HttpCode: '200-299'
      Port: 80
      Protocol: HTTP
      Tags:
        - Key: ServiceName
          Value: !Ref name
        - Key: ClusterName
          Value: !Ref cluster
      TargetGroupAttributes:
        - Key: deregistration_delay.timeout_seconds
          Value: '0'
      VpcId:  !Ref vpcid

  HealthAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      ActionsEnabled: true
      AlarmActions:
        - Fn::ImportValue: !Sub ${env}-ServiceHealthTopic
      AlarmDescription: Notify SNS if there are no healthy hosts
      ComparisonOperator: LessThanOrEqualToThreshold
      Dimensions:
        -
          Name: TargetGroup
          Value:  !GetAtt CustomResource.TGTId
        -
          Name: LoadBalancer
          Value:  !GetAtt CustomResource.ALBId

      EvaluationPeriods: 1
      MetricName: HealthyHostCount
      Namespace: AWS/ApplicationELB
      Period: 60
      Statistic: Maximum
      Threshold: 0.0

  ListenerRule:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      Actions:
        - Type: forward
          TargetGroupArn: !Ref TargetGroup
      Conditions:
        - Field: path-pattern
          Values:
            - !Sub /${name}/*
      ListenerArn: !Ref listenerarn
      Priority: !Ref priority

  Role:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          -
            Action: "sts:AssumeRole"
            Effect: "Allow"
            Principal:
              Service: "ecs-tasks.amazonaws.com"
      Path: "/"
      Policies:
        -
          PolicyName: ecs-service
          PolicyDocument:
            Statement:
                Effect: Allow
                Action:
                  - elasticloadbalancing:Describe*
                  - elasticloadbalancing:DeregisterInstancesFromLoadBalancer
                  - elasticloadbalancing:RegisterInstancesWithLoadBalancer
                  - ec2:Describe*
                  - ec2:AuthorizeSecurityGroupIngress
                Resource: "*"
        -
          PolicyName: cloudwatch-basic
          PolicyDocument:
            Version: 2012-10-17
            Statement:
                Effect: Allow
                Action:
                  - cloudwatch:EnableAlarmActions
                  - cloudwatch:PutMetricData
                  - cloudwatch:PutMetricAlarm
                  - logs:*
                Resource: "*"
        -
          PolicyName: mongo-snapshots
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              -
                Resource:
                  - !Sub arn:aws:s3:::net-platform-mongodb-snapshots-${env}
                Action:
                  - s3:ListBucket
                Effect: Allow
              -
                Resource:
                  - !Sub arn:aws:s3:::net-platform-mongodb-snapshots-${env}/*
                Action:
                  - s3:GetObject
                  - s3:PutObject
                  - s3:ListBucketMultipartUploads
                  - s3:ListMultipartUploadParts
                Effect: Allow

Outputs:
  ALBId:
    Description: ALBId
    Value:
      Fn::GetAtt:
      - CustomResource
      - ALBId
  TGTId:
    Description: TGTId
    Value:
      Fn::GetAtt:
      - CustomResource
      - TGTId<commit_msg>add lambda<commit_after>AWSTemplateFormatVersion: 2010-09-09
Description: ECS Service and Task definition
Parameters:
  cluster:
    Description: ECS service resources.
    Type: String
  env:
    Description: ECS Cluster name i.e. deva.
    Type: String
  listenerarn:
    Description: Arn of ELB listener to attach service to
    Type: String
  name:
    Description: Service Name i.e. jobmanager
    Type: String
  priority:
    Description: ALB priority
    Type: Number
  region:
    Description: AWS region i.e. us-east-1
    Type: String
  vpcid:
    Description: ID of the VPC for the service
    Type: String
  version:
    Description: Semantic version of service
    Type: String
  namespace:
    Description: Docker namespace
    Type: String
  mongoSnapshotBucket:
    Description: S3 bucket where Mongo snapshots will be stored
    Type: String

Resources:
  CustomResource:
    Type: Custom::CustomResource
    DependsOn:  ListenerRule
    Properties:
      ServiceToken:
        Fn::ImportValue:
          !Sub ${env}-LambdaStringFunctionArn
      ALBArn: !GetAtt TargetGroup.LoadBalancerArns
      TGTArn: !Ref TargetGroup

  EcsService:
    Type: "AWS::ECS::Service"
    Properties:
      Cluster:  !Ref cluster
      DesiredCount: 1
      LoadBalancers:
        -
          TargetGroupArn: !Ref TargetGroup
          ContainerName:  !Ref name
          ContainerPort: 8080
      Role: !Sub ecsServiceRole-${cluster}
      TaskDefinition:  !Ref EcsTask

  EcsTask:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        -
          Environment:
            -
              Name: ENVIRONMENT_NAME
              Value: !Ref env
            -
              Name: ENVIRONMENT_REGION
              Value: !Ref region
            -
              Name: SERVICE_NAME
              Value: !Ref name
            -
              Name: MONGOHOST
              Value:
                Fn::Join:
                  - ""
                  - - mongodb.
                    - Fn::ImportValue: !Sub ${env}-PrivateDomain
          Essential: true
          Image: !Sub 639193537090.dkr.ecr.us-east-1.amazonaws.com/${namespace}/go-mongo-backup:${version}
          Memory: 1024
          MemoryReservation: 300
          PortMappings:
            -
              HostPort: 0
              ContainerPort: 8080
              Protocol: tcp
          Name: !Ref name
      TaskRoleArn : !GetAtt Role.Arn

  TargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckPath: !Sub /${name}/
      Matcher:
       HttpCode: '200-299'
      Port: 80
      Protocol: HTTP
      Tags:
        - Key: ServiceName
          Value: !Ref name
        - Key: ClusterName
          Value: !Ref cluster
      TargetGroupAttributes:
        - Key: deregistration_delay.timeout_seconds
          Value: '0'
      VpcId:  !Ref vpcid

  HealthAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      ActionsEnabled: true
      AlarmActions:
        - Fn::ImportValue: !Sub ${env}-ServiceHealthTopic
      AlarmDescription: Notify SNS if there are no healthy hosts
      ComparisonOperator: LessThanOrEqualToThreshold
      Dimensions:
        -
          Name: TargetGroup
          Value:  !GetAtt CustomResource.TGTId
        -
          Name: LoadBalancer
          Value:  !GetAtt CustomResource.ALBId

      EvaluationPeriods: 1
      MetricName: HealthyHostCount
      Namespace: AWS/ApplicationELB
      Period: 60
      Statistic: Maximum
      Threshold: 0.0

  ListenerRule:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      Actions:
        - Type: forward
          TargetGroupArn: !Ref TargetGroup
      Conditions:
        - Field: path-pattern
          Values:
            - !Sub /${name}/*
      ListenerArn: !Ref listenerarn
      Priority: !Ref priority

  Role:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          -
            Action: "sts:AssumeRole"
            Effect: "Allow"
            Principal:
              Service: "ecs-tasks.amazonaws.com"
      Path: "/"
      Policies:
        -
          PolicyName: ecs-service
          PolicyDocument:
            Statement:
                Effect: Allow
                Action:
                  - elasticloadbalancing:Describe*
                  - elasticloadbalancing:DeregisterInstancesFromLoadBalancer
                  - elasticloadbalancing:RegisterInstancesWithLoadBalancer
                  - ec2:Describe*
                  - ec2:AuthorizeSecurityGroupIngress
                Resource: "*"
        -
          PolicyName: cloudwatch-basic
          PolicyDocument:
            Version: 2012-10-17
            Statement:
                Effect: Allow
                Action:
                  - cloudwatch:EnableAlarmActions
                  - cloudwatch:PutMetricData
                  - cloudwatch:PutMetricAlarm
                  - logs:*
                Resource: "*"
        -
          PolicyName: mongo-snapshots
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              -
                Resource:
                  - !Sub arn:aws:s3:::net-platform-mongodb-snapshots-${env}
                Action:
                  - s3:ListBucket
                Effect: Allow
              -
                Resource:
                  - !Sub arn:aws:s3:::net-platform-mongodb-snapshots-${env}/*
                Action:
                  - s3:GetObject
                  - s3:PutObject
                  - s3:ListBucketMultipartUploads
                  - s3:ListMultipartUploadParts
                Effect: Allow
  LambdaRole:
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          -
            Action: "sts:AssumeRole"
            Effect: "Allow"
            Principal:
              Service: "lambda.amazonaws.com"
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
      Path: "/"
    Type: "AWS::IAM::Role"

  LambdaSG:
    Properties:
      GroupDescription: Security Group for mongo-backup Lambda
      Tags:
        - Key: Environment
          Value: !Ref env
        - Key: Name
          Value: !Sub ${env}-mongo-backup-lambda-sg
      VpcId: !Ref vpcid
    Type: "AWS::EC2::SecurityGroup"

  Lambda:
    Properties:
      Code:
        S3Bucket: !Sub net-openwhere-devops-${env}
        S3Key: !Sub lambda/mongo-backup-${version}.zip
      Description: Calls mongo-backup agent to start snapshot
      Environment:
        Variables:
          BUCKET: !Ref mongoSnapshotBucket
          ROOT_PATH: /
          URL:
            Fn::Join:
              - ""
              - - "http://mongodb."
                - Fn::ImportValue: !Sub ${env}-PrivateDomain
                - "/mongo-backup/"
      FunctionName: !Sub ${env}-mongo-backup
      Handler: mongo-snapshot.handler
      Role: !GetAtt LambdaRole.Arn
      Runtime: python2.7
      Timeout: 30
      VpcConfig:
        SecurityGroupIds:
          - !GetAtt LambdaSG.GroupId
        SubnetIds:
          - Fn::ImportValue: !Sub ${env}-PrivateSubnet1Id
          - Fn::ImportValue: !Sub ${env}-PrivateSubnet2Id
          - Fn::ImportValue: !Sub ${env}-PrivateSubnet3Id
    Type: "AWS::Lambda::Function"
  ScheduledEvent:
    Properties:
      Description: Trigger snapshot once a day
      Name: !Sub MongoBackupEvent-${env}
      ScheduleExpression: "cron(30 6 ? * * *)"
      State: ENABLED
      Targets:
        -
          Arn: !GetAtt Lambda.Arn
          Id: !Sub ${env}-MongoBackupLambda
    Type: "AWS::Events::Rule"
  LambdaInvokePermission:
    Properties:
      Action: "lambda:InvokeFunction"
      FunctionName: !Ref Lambda
      Principal: events.amazonaws.com
      SourceArn: !GetAtt ScheduledEvent.Arn
    Type: "AWS::Lambda::Permission"

Outputs:
  ALBId:
    Description: ALBId
    Value:
      Fn::GetAtt:
      - CustomResource
      - ALBId
  TGTId:
    Description: TGTId
    Value:
      Fn::GetAtt:
      - CustomResource
      - TGTId
{'fraction_non_alphanumeric': 0.07950427598202638, 'fraction_numerical': 0.012610523264241195, 'mean_word_length': 1.6045677614194036, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5695559', 'n_tokens_mistral': 4013, 'n_tokens_neox': 3739, 'n_words': 858}