-
Notifications
You must be signed in to change notification settings - Fork 0
/
module.yml
124 lines (124 loc) · 4.29 KB
/
module.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
---
# Copyright 2018 widdix GmbH
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
AWSTemplateFormatVersion: '2010-09-09'
Description: 'cfn-modules: ECS NLB listener and target'
# cfn-modules:implements(Target)
Parameters:
NlbModule:
Description: 'Stack name of nlb module.'
Type: String
VpcModule:
Description: 'Stack name of vpc module.'
Type: String
Port:
Description: 'The port on which the listener listens for requests.'
Type: Number
Default: 80
CertificateArn:
Description: 'Optional Amazon Resource Name (ARN) of the certificate to associate with the listener.'
Type: String
Default: ''
ClientSgModule:
Description: 'Optional stack name of client-sg module (requires NLB Scheme := internal).'
Type: String
Default: ''
DeregistrationDelayInSeconds:
Description: 'The amount of time, in seconds, for Elastic Load Balancing to wait before changing the state of a deregistering target from draining to unused.'
Type: Number
Default: 60
ConstraintDescription: 'Must be in the range [0-3600]'
MinValue: 0
MaxValue: 3600
Protocol:
Description: 'The protocol for connections from clients to the load balancer.'
Type: String
Default: TCP
AllowedValues: [TCP, UDP, TCP_UDP]
Conditions:
HasCertificateArn: !Not [!Equals [!Ref CertificateArn, '']]
HasClientSgModule: !Not [!Equals [!Ref ClientSgModule, '']]
HasNotClientSgModule: !Not [!Condition HasClientSgModule]
Resources:
TargetGroup:
Type: 'AWS::ElasticLoadBalancingV2::TargetGroup'
Properties:
HealthCheckIntervalSeconds: 30 # NLB only supports 30
HealthCheckProtocol: TCP
HealthCheckTimeoutSeconds: 10 # NLB only support 10 seconds for TCP protocol
HealthyThresholdCount: 2
UnhealthyThresholdCount: 2 # NLB only supports the same number as HealthyThresholdCount
Port: 8080 # overriden when containers are attached
Protocol: !Ref Protocol
TargetType: ip
TargetGroupAttributes:
- Key: 'deregistration_delay.timeout_seconds'
Value: !Ref DeregistrationDelayInSeconds
VpcId: {'Fn::ImportValue': !Sub '${VpcModule}-Id'}
Listener:
Type: 'AWS::ElasticLoadBalancingV2::Listener'
Properties:
Certificates: !If [HasCertificateArn, [{CertificateArn: !Ref CertificateArn}], !Ref 'AWS::NoValue']
DefaultActions:
- TargetGroupArn: !Ref TargetGroup
Type: forward
LoadBalancerArn: {'Fn::ImportValue': !Sub '${NlbModule}-Arn'}
Port: !Ref Port
Protocol: !If [HasCertificateArn, TLS, !Ref Protocol]
SecurityGroup:
Type: 'AWS::EC2::SecurityGroup'
Properties:
GroupDescription: !Ref 'AWS::StackName'
VpcId: {'Fn::ImportValue': !Sub '${VpcModule}-Id'}
SecurityGroupInWorld:
Type: 'AWS::EC2::SecurityGroupIngress'
Condition: HasNotClientSgModule
Properties:
GroupId: !Ref SecurityGroup
IpProtocol: tcp
FromPort: !Ref Port
ToPort: !Ref Port
CidrIp: '0.0.0.0/0'
SecurityGroupInClientSg:
Type: 'AWS::EC2::SecurityGroupIngress'
Condition: HasClientSgModule
Properties:
GroupId: !Ref SecurityGroup
IpProtocol: tcp
FromPort: !Ref Port
ToPort: !Ref Port
SourceSecurityGroupId: {'Fn::ImportValue': !Sub '${ClientSgModule}-SecurityGroupId'}
Outputs:
ModuleId:
Value: 'ecs-nlb-listener-and-target'
ModuleVersion:
Value: '1.4.0'
StackName:
Value: !Ref 'AWS::StackName'
Arn:
Value: !Ref TargetGroup
Export:
Name: !Sub '${AWS::StackName}-Arn'
Name:
Value: !GetAtt 'TargetGroup.TargetGroupName'
Export:
Name: !Sub '${AWS::StackName}-Name'
FullName:
Value: !GetAtt 'TargetGroup.TargetGroupFullName'
Export:
Name: !Sub '${AWS::StackName}-FullName'
SecurityGroupId:
Value: !Ref SecurityGroup
Export:
Name: !Sub '${AWS::StackName}-SecurityGroupId'