4-Base-Renewer.yml

---
AWSTemplateFormatVersion: "2010-09-09"
Description: Renewer

Parameters:

  Environment:
    Type: String
    Description: Name of the environment to bring up.

  # Optional
  UbuntuAMI:
    Type: String
    Description: AMI
    Default: ""

  InstanceType:
    Type: String
    Description: Instance Type
    Default: t3.micro

Conditions:

  OverrideAMI: !Not [!Equals [!Ref UbuntuAMI, ""]]

Mappings:

  RegionMap:
    us-east-1:
      AMI: ami-0b93ce03dcbcb10f6
      InstanceType: t3.small
      EbsOptimized: true
    us-east-2:
      AMI: ami-0cbea92f2377277a4
      InstanceType: t3.small
      EbsOptimized: true
    us-west-1:
      AMI: ami-0d4360d9166cfc9cb
      InstanceType: t3.small
      EbsOptimized: true
    us-west-2:
      AMI: ami-0d31d7c9fc9503726
      InstanceType: t3.small
      EbsOptimized: true
    ap-south-1:
      AMI: ami-0ef82eeba2c7a0eeb
      InstanceType: t2.small
      EbsOptimized: false
    ap-northeast-2:
      AMI: ami-003bb1772f36a39a3
      InstanceType: t2.small
      EbsOptimized: false
    ap-southeast-1:
      AMI: ami-09f03fa5572692399
      InstanceType: t3.small
      EbsOptimized: true
    ap-southeast-2:
      AMI: ami-06139e5e22cc2f7b1
      InstanceType: t2.small
      EbsOptimized: false
    ap-northeast-1:
      AMI: ami-0c7cb70d3eb61492b
      InstanceType: t3.small
      EbsOptimized: true
    ca-central-1:
      AMI: ami-07a69147786eb0731
      InstanceType: t3.small
      EbsOptimized: true
    eu-central-1:
      AMI: ami-0b81e95bb0a06ea8c
      InstanceType: t3.small
      EbsOptimized: true
    eu-west-1:
      AMI: ami-029cfca952b331b52
      InstanceType: t3.small
      EbsOptimized: true
    eu-west-2:
      AMI: ami-035469b606478d63d
      InstanceType: t3.small
      EbsOptimized: true
    eu-west-3:
      AMI: ami-01952eddad7516aa7
      InstanceType: t2.small
      EbsOptimized: false
    sa-east-1:
      AMI: ami-055ecc74f0a802e8f
      InstanceType: t2.small
      EbsOptimized: false

Resources:

  # ==================================================
  # =================== SECURITY GROUPS ==============
  # ==================================================

  RenewerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      VpcId:
        Fn::ImportValue:
           !Join [ '-', [ !Ref Environment, VPCId ] ]
      GroupDescription: No access
      Tags:
        - Key: Name
          Value: Renewer
        - Key: Environment
          Value: !Ref Environment

  RenewerDatabaseSecurityGroupIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      IpProtocol: tcp
      FromPort: 5432
      ToPort: 5432
      Description: Allow Postgres from Renewer to Database
      SourceSecurityGroupId: !Ref RenewerSecurityGroup
      GroupId:
        Fn::ImportValue:
          !Join [ '-', [ !Ref Environment, DatabaseSecurityGroupId ] ]

  # ==================================================
  # ================== CODEPIPELINE ==================
  # ==================================================

  RenewerCodeBuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: !Join [ '-', [ !Ref Environment, Renewer ] ]
      ServiceRole:
        Fn::ImportValue:
           !Join [ '-', [ !Ref Environment, CodeBuildRoleArn ] ]
      Artifacts:
        Type: CODEPIPELINE
      BadgeEnabled: false
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        EnvironmentVariables:
          - Name: ENVIRONMENT
            Type: PLAINTEXT
            Value: !Ref Environment
          - Name: CURRENT_SOURCE_ID
            Type: PLAINTEXT
            Value: localsource
          - Name: PG_ADMIN_PASSWORD
            Type: PLAINTEXT
            Value: admin_pw
          - Name: AWS_REGION
            Type: PLAINTEXT
            Value: !Ref AWS::Region
          - Name: GIT_BRANCH
            Type: PLAINTEXT
            Value:
              Fn::ImportValue:
                !Join [ '-', [ !Ref Environment, GitBranch ] ]
          - Name: NODE_TLS_REJECT_UNAUTHORIZED
            Type: PLAINTEXT
            Value: 0
        Type: LINUX_CONTAINER
        Image: aws/codebuild/standard:6.0
      Source:
        Type: CODEPIPELINE
      TimeoutInMinutes: 15
      VpcConfig:
        SecurityGroupIds:
          - Fn::ImportValue:
              !Join [ '-', [ !Ref Environment, TestCodeBuildSecurityGroupId ] ]
        Subnets:
          - Fn::ImportValue:
              !Join [ '-', [ !Ref Environment, TestPrivateSubnet ] ]
          - Fn::ImportValue:
              !Join [ '-', [ !Ref Environment, TestPrivateSubnet2 ] ]
        VpcId:
          Fn::ImportValue:
            !Join [ '-', [ !Ref Environment, TestVPCId ] ]
      Tags:
        - Key: Environment
          Value: !Ref Environment

  RenewerCodePipeline:
    Type: AWS::CodePipeline::Pipeline
    DependsOn:
      - RenewerDeploymentGroup
      - RenewerCodeBuildProject
    Properties:
      ArtifactStore:
        EncryptionKey:
          Id:
            Fn::ImportValue:
              !Join [ '-', [ !Ref Environment, CodePipelineKeyId ] ]
          Type: KMS
        Location:
          Fn::ImportValue:
            !Join [ '-', [ !Ref Environment, ArtifactBucket ] ]
        Type: S3
      Name: !Join [ '-', [ !Ref Environment, Renewer ] ]
      RoleArn:
        Fn::ImportValue:
           !Join [ '-', [ !Ref Environment, CodePipelineRoleArn ] ]
      Stages:
        - Name: CodeCommit
          Actions:
            - Name: RenewerCodeCommit
              RunOrder: 1
              ActionTypeId:
                Category: Source
                Owner: AWS
                Provider: CodeCommit
                Version: 1
              Configuration:
                RepositoryName: !Sub ${Environment}-Renewer
                BranchName:
                  Fn::ImportValue:
                    !Join [ '-', [ !Ref Environment, GitBranch ] ]
              OutputArtifacts:
                - Name: CodeCommitArtifact
        - Name: CodeBuild
          Actions:
            - Name: RenewerCodeBuild
              RunOrder: 2
              ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: 1
              Configuration:
                ProjectName: !Ref RenewerCodeBuildProject
              InputArtifacts:
                - Name: CodeCommitArtifact
              OutputArtifacts:
                - Name: CodeBuildArtifact
        - Name: CodeDeploy
          Actions:
            - Name: RenewerCodeDeploy
              RunOrder: 3
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CodeDeploy
                Version: 1
              Configuration:
                ApplicationName: !Ref RenewerApplication
                DeploymentGroupName: !Ref RenewerDeploymentGroup
              InputArtifacts:
                - Name: CodeBuildArtifact

  RenewerApplication:
    Type: AWS::CodeDeploy::Application
    Properties:
      ApplicationName: !Join [ '-', [ !Ref Environment, Renewer ] ]

  RenewerDeploymentGroup:
    Type: AWS::CodeDeploy::DeploymentGroup
    Properties:
      ApplicationName: !Ref RenewerApplication
      DeploymentConfigName: CodeDeployDefault.OneAtATime
      Ec2TagFilters:
        - Key: Name
          Value: !Join [ '-', [ !Ref Environment, Renewer ] ]
          Type: KEY_AND_VALUE
      ServiceRoleArn:
        Fn::ImportValue:
           !Join [ '-', [ !Ref Environment, CodeDeployRoleArn ] ]

  # ==================================================
  # ============= Instance Role ======================
  # ==================================================

  RenewerRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
          - Fn::ImportValue:
              !Join [ '-', [ !Ref Environment, SSMManagedPolicy ] ]
      Policies:
        - PolicyName: !Sub ${Environment}-Renewer
          PolicyDocument:
            Version: 2012-10-17
            Statement:
            - Effect: Allow
              Action:
                - ssm:GetParametersByPath
              Resource:
                - !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${Environment}/COMMON
                - !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${Environment}/RENEWER
            - Effect: Allow
              Action:
                - logs:CreateLogStream
                - logs:PutLogEvents
              Resource:
                - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${Environment}-Renewer
                - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${Environment}-Renewer:log-stream:*
                - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${Environment}-Renewer-Node
                - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${Environment}-Renewer-Node:log-stream:*
            - Effect: Allow
              Action:
                - ses:SendEmail
                - ses:SendRawEmail
              Resource: "*"

  RenewerInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - !Ref RenewerRole

  # ==================================================
  # ==================== RENEWER =====================
  # ==================================================

  RenewerInstance:
    Type: AWS::EC2::Instance
    DependsOn:
      - RenewerCodePipeline
    CreationPolicy:
      ResourceSignal:
        Count: 1
        Timeout: PT20M
    Properties:
      DisableApiTermination: false
      InstanceInitiatedShutdownBehavior: stop
      BlockDeviceMappings:
        - DeviceName: /dev/sda1
          Ebs:
            DeleteOnTermination: true
            VolumeSize: 40
            VolumeType: gp2
      CreditSpecification:
        CPUCredits: unlimited
      IamInstanceProfile: !Ref RenewerInstanceProfile
      ImageId: !If [OverrideAMI, !Ref UbuntuAMI, !FindInMap [RegionMap, !Ref "AWS::Region", AMI]]
      InstanceType: !Ref InstanceType
      EbsOptimized: true
      Monitoring: true
      Tags:
      - Key: Name
        Value: !Join [ '-', [ !Ref Environment, Renewer ] ]
      - Key: Environment
        Value: !Ref Environment
      NetworkInterfaces:
      - DeleteOnTermination: true
        Description: Primary network interface
        DeviceIndex: 0
        SubnetId:
          Fn::ImportValue:
             !Join [ '-', [ !Ref Environment, SubnetId ] ]
        GroupSet:
        - Ref: RenewerSecurityGroup
      UserData:
        "Fn::Base64":
          !Sub |
            #!/bin/bash -ex
            # Install Updates and Python3
            export DEBIAN_FRONTEND=noninteractive
            apt-get update && apt-get dist-upgrade -yq
            apt-get -yq install python3.8-distutils python3-pip python3 python3-setuptools
            # Install CloudFormation Bootstrap
            wget https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-latest.tar.gz
            tar -xvzf aws-cfn-bootstrap-py3-latest.tar.gz
            cd aws-cfn-bootstrap-2.0
            python3 setup.py install
            # Run CloudFormation Init
            cfn-init -c default --stack ${AWS::StackName} --resource RenewerInstance --region ${AWS::Region}
            # Signal success to CloudFormation on reboot
            echo "@reboot root /usr/local/bin/cfn-signal --success true --stack ${AWS::StackName} --resource RenewerInstance --region ${AWS::Region} 2>&1 | /usr/bin/logger -t cfn_success" >> /etc/cron.d/success_on_reboot
            echo "@reboot root /home/ubuntu/install-codedeploy.sh 2>&1 | /usr/bin/logger -t install_codedeploy" >> /etc/cron.d/install_codedeploy_on_reboot
            # Reboot to pick up latest patches
            reboot;
    Metadata:
      AWS::CloudFormation::Init:
        configSets:
          default:
            - "unattended-upgrades"
            - "enable-swap"
            - "install-pip-and-curl-and-ruby"
            - "set-region-and-environment"
            - "install-aws-cloudwatch-and-cli"
            - "install-node"
            - "forward-node-port-on-reboot"
            - "install-pm2"
            - "install-codedeploy"
        unattended-upgrades:
          files:
            '/etc/apt/apt.conf.d/10periodic':
              content: |
                APT::Periodic::Update-Package-Lists "1";
                APT::Periodic::Download-Upgradeable-Packages "1";
                APT::Periodic::AutocleanInterval "7";
                APT::Periodic::Unattended-Upgrade "1";
              mode: '000644'
              owner: root
              group: root
            '/etc/apt/apt.conf.d/50unattended-upgrades':
              content: |
                Unattended-Upgrade::Allowed-Origins {
                  "${distro_id}:${distro_codename}";
                  "${distro_id}:${distro_codename}-security";
                  "${distro_id}ESM:${distro_codename}";
                };
              mode: '000644'
              owner: root
              group: root
        enable-swap:
          commands:
            0_enable_swap:
              command: |
                dd if=/dev/zero of=/var/spool/swap bs=1M count=1k
                mkswap /var/spool/swap
                chmod 0600 /var/spool/swap
                swapon /var/spool/swap
            1_persist_on_reboot:
              command: |
                echo "/var/spool/swap swap swap defaults 0 0" >> /etc/fstab
        forward-node-port-on-reboot:
          commands:
            0_net_tools:
              command: apt install net-tools
            1_forward:
              command: |
                ETHDEVICE=$(ifconfig -s | grep BMRU | head -n 1 | cut -d" " -f1)
                echo "@reboot root /sbin/iptables -A PREROUTING -t nat -i $ETHDEVICE -p tcp --dport 80 -j REDIRECT --to-port 3000 2>&1 | /usr/bin/logger -t forward_node_port_on_reboot" > /etc/cron.d/forward_node_port_on_reboot
                chmod 0644 /etc/cron.d/forward_node_port_on_reboot
                iptables -A PREROUTING -t nat -i $ETHDEVICE -p tcp --dport 80 -j REDIRECT --to-port 3000
        install-pip-and-curl-and-ruby:
          packages:
            apt:
              curl: []
              python3-pip: []
              ruby: []
        set-region-and-environment:
          commands:
            0_set_environment:
              command: !Sub echo ENVIRONMENT=${Environment} >> /etc/environment
            1_set_region:
              command: !Sub echo AWS_DEFAULT_REGION=${AWS::Region} >> /etc/environment
            2_set_region_node:
              command: !Sub echo AWS_REGION=${AWS::Region} >> /etc/environment
            3_set_git_branch:
              command: !Sub
                - echo GIT_BRANCH=${Branch} >> /etc/environment
                - Branch:
                    Fn::ImportValue:
                      !Join [ '-', [ !Ref Environment, GitBranch ] ]
        install-aws-cloudwatch-and-cli:
          packages:
            apt:
              awscli: []
          files:
            '/home/ubuntu/cloudwatch.config':
              content: !Sub |
                {
                  "logs": {
                    "logs_collected": {
                      "files": {
                        "collect_list": [
                          {
                            "file_path": "/home/node/logs/app.log",
                            "log_group_name": "${Environment}-Renewer-Node",
                            "log_stream_name": "{instance_id}-node-log"
                          },
                          {
                            "file_path": "/var/log/cloud-init.log",
                            "log_group_name": "${Environment}-Renewer-Node",
                            "log_stream_name": "{instance_id}-cloud-init-placeholder"
                          },
                          {
                            "file_path": "/opt/aws/amazon-cloudwatch-agent/logs/amazon-cloudwatch-agent.log",
                            "log_group_name": "${Environment}-Renewer",
                            "log_stream_name": "{instance_id}-cloudwatch-logs"
                          },
                          {
                            "file_path": "/var/log/amazon/ssm/amazon-ssm-agent.log",
                            "log_group_name": "${Environment}-Renewer",
                            "log_stream_name": "{instance_id}-aws-ssm"
                          },
                          {
                            "file_path": "/var/log/cfn-init.log",
                            "log_group_name": "${Environment}-Renewer",
                            "log_stream_name": "{instance_id}-cfn-init"
                          },
                          {
                            "file_path": "/var/log/cfn-init-cmd.log",
                            "log_group_name": "${Environment}-Renewer",
                            "log_stream_name": "{instance_id}-cfn-init-cmd"
                          },
                          {
                            "file_path": "/var/log/cloud-init.log",
                            "log_group_name": "${Environment}-Renewer",
                            "log_stream_name": "{instance_id}-cloud-init"
                          },
                          {
                            "file_path": "/var/log/cloud-init-output.log",
                            "log_group_name": "${Environment}-Renewer",
                            "log_stream_name": "{instance_id}-cloud-init-output"
                          },
                          {
                            "file_path": "/var/log/aws/codedeploy-agent/codedeploy-agent.log",
                            "log_group_name": "${Environment}-Renewer",
                            "log_stream_name": "{instance_id}-aws-codedeploy-agent"
                          },
                          {
                            "file_path": "/opt/codedeploy-agent/deployment-root/deployment-logs/codedeploy-agent-deployments.log",
                            "log_group_name": "${Environment}-Renewer",
                            "log_stream_name": "{instance_id}-aws-codedeploy-deployments"
                          },
                          {
                            "file_path": "/var/log/syslog",
                            "log_group_name": "${Environment}-Renewer",
                            "log_stream_name": "{instance_id}-syslog"
                          },
                          {
                            "file_path": "/var/log/unattended-upgrades/unattended-upgrades.log",
                            "log_group_name": "${Environment}-Renewer",
                            "log_stream_name": "{instance_id}-unattended-upgrades"
                          },
                          {
                            "file_path": "/var/log/unattended-upgrades/unattended-upgrades-dpkg.log",
                            "log_group_name": "${Environment}-Renewer",
                            "log_stream_name": "{instance_id}-unattended-upgrades-dpkg"
                          },
                          {
                            "file_path": "/var/run/reboot-required.pkgs",
                            "log_group_name": "${Environment}-Renewer",
                            "log_stream_name": "{instance_id}-reboot-required"
                          },
                          {
                            "file_path": "/tmp/CURRENT_NODE_VERSION",
                            "log_group_name": "${Environment}-Renewer",
                            "log_stream_name": "{instance_id}-current-node-version"
                          }
                        ]
                      }
                    }
                  },
                  "metrics": {
                    "append_dimensions": {
                      "InstanceId": "${!aws:InstanceId}"
                    },
                    "metrics_collected": {
                      "cpu": {
                        "measurement": [
                          "cpu_usage_active",
                          "cpu_usage_iowait",
                          "cpu_usage_user",
                          "cpu_usage_system"
                        ],
                        "metrics_collection_interval": 60,
                        "totalcpu": true
                      },
                      "disk": {
                        "measurement": [
                          "used_percent",
                          "inodes_free"
                        ],
                        "metrics_collection_interval": 60,
                        "resources": [
                          "/"
                        ]
                      },
                      "diskio": {
                        "measurement": [
                          "io_time"
                        ],
                        "metrics_collection_interval": 60,
                        "resources": [
                          "/"
                        ]
                      },
                      "mem": {
                        "measurement": [
                          "mem_used_percent"
                        ],
                        "metrics_collection_interval": 60
                      },
                      "swap": {
                        "measurement": [
                          "swap_used_percent"
                        ],
                        "metrics_collection_interval": 60
                      }
                    }
                  }
                }
              mode: '000644'
              owner: root
              group: root
          commands:
            0_install_cloudwatch:
              command: |
                apt-get -yq install unzip
                wget -q https://s3.amazonaws.com/amazoncloudwatch-agent/linux/amd64/latest/AmazonCloudWatchAgent.zip -P /tmp
                unzip /tmp/AmazonCloudWatchAgent.zip -d /home/ubuntu/cloudwatch_agent
                cd /home/ubuntu/cloudwatch_agent
                ./install.sh
                /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -c file:/home/ubuntu/cloudwatch.config -s
        install-node:
          commands:
            0_create_user:
              command: |
                      adduser \
                        --system \
                        --shell /bin/bash \
                        --gecos 'Node user' \
                        --group \
                        --disabled-password \
                        --home /home/node \
                        node
            1_setup:
              command: curl -sL https://deb.nodesource.com/setup_16.x | bash -
            2_install:
              command: apt-get install -yq nodejs
            3_update_npm:
              command: npm install -g npm@8
            4_install_n:
              command: npm install -g n
        install-pm2:
          commands:
            0_install:
              command: npm install pm2 -g
            1_restart_on_reboot:
              command: env PATH=$PATH:/usr/local/bin /usr/lib/node_modules/pm2/bin/pm2 startup systemd -u node --hp /home/node
        install-codedeploy:
          files:
            '/home/ubuntu/install-codedeploy.sh':
              content: !Sub |
                export PATH=$PATH:/usr/local/sbin:/usr/sbin:/sbin
                wget -nv "https://aws-codedeploy-${AWS::Region}.s3.amazonaws.com/latest/install" -O /tmp/install
                /bin/chmod +x /tmp/install && /tmp/install auto
              mode: '000544'
              owner: root
              group: root

  # ==================================================
  # ============ APPLICATION ERROR ALERTS ============
  # ==================================================

  RenewerNodeEmailerSubscriptionFilter:
    Type: AWS::Logs::SubscriptionFilter
    DependsOn:
      - RenewerInstance
    Properties:
      DestinationArn:
        Fn::ImportValue:
          !Join [ '-', [ !Ref Environment, ErrorEmailerFunctionArn ] ]
      FilterPattern: '{ $.level = "error" }'
      LogGroupName: !Join [ '-', [ !Ref Environment, Renewer-Node] ]

  RenewerCodePipelineAlert:
    Type: AWS::Events::Rule
    Properties:
      Description: Alert when CodePipeline Fails
      EventPattern:
        source:
          - "aws.codepipeline"
        detail-type:
          - "CodePipeline Pipeline Execution State Change"
        detail:
          state:
            - "FAILED"
          pipeline:
            - !Ref RenewerCodePipeline
      State: ENABLED
      Targets:
        - Arn:
            Fn::ImportValue:
              !Join [ '-', [ !Ref Environment, CloudWatchAlarmEmailerTopic ] ]
          Id: !Join [ '-', [ !Ref Environment, Renewer-CodePipeline-Alert ] ]

  # ==================================================
  # ================= CLOUDWATCH ALARMS ==============
  # ==================================================

  CpuAlarm:
    Type: AWS::CloudWatch::Alarm
    DependsOn:
      - RenewerInstance
    Properties:
     ActionsEnabled: true
     AlarmActions:
       - Fn::ImportValue:
           !Join [ '-', [ !Ref Environment, CloudWatchAlarmEmailerTopic ] ]
     AlarmDescription: !Sub ${Environment} | Renewer CPU
     MetricName: CPUUtilization
     Namespace: AWS/EC2
     Statistic: Average
     Period: '60'
     EvaluationPeriods: '2'
     Threshold: '60'
     ComparisonOperator: GreaterThanOrEqualToThreshold
     TreatMissingData: breaching
     Dimensions:
     - Name: InstanceId
       Value: !Ref RenewerInstance

  LowMemoryAlarm:
    Type: AWS::CloudWatch::Alarm
    DependsOn:
      - RenewerInstance
    Properties:
      ActionsEnabled: true
      AlarmActions:
        - Fn::ImportValue:
            !Join [ '-', [ !Ref Environment, CloudWatchAlarmEmailerTopic ] ]
      AlarmDescription: !Sub ${Environment} | Renewer Low Memory
      MetricName: "mem_used_percent"
      Namespace: CWAgent
      Statistic: Maximum
      Period: '300'
      EvaluationPeriods: '1'
      Threshold: '80'
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: breaching
      Dimensions:
      - Name: InstanceId
        Value: !Ref RenewerInstance

  SwapUsageAlarm:
    Type: AWS::CloudWatch::Alarm
    DependsOn:
      - RenewerInstance
      - LowMemoryAlarm
    Properties:
      ActionsEnabled: true
      AlarmActions:
        - Fn::ImportValue:
            !Join [ '-', [ !Ref Environment, CloudWatchAlarmEmailerTopic ] ]
      AlarmDescription: !Sub ${Environment} | Renewer Swap Usage
      MetricName: "swap_used_percent"
      Namespace: CWAgent
      Statistic: Maximum
      Period: '300'
      EvaluationPeriods: '1'
      Threshold: '15'
      ComparisonOperator: GreaterThanThreshold
      TreatMissingData: breaching
      Dimensions:
      - Name: InstanceId
        Value: !Ref RenewerInstance

  DiskUsageAlarm:
    Type: AWS::CloudWatch::Alarm
    DependsOn:
      - RenewerInstance
      - SwapUsageAlarm
    Properties:
      ActionsEnabled: true
      AlarmActions:
        - Fn::ImportValue:
            !Join [ '-', [ !Ref Environment, CloudWatchAlarmEmailerTopic ] ]
      AlarmDescription: !Sub ${Environment} | Renewer Disk Usage
      MetricName: "disk_used_percent"
      Namespace: CWAgent
      Statistic: Maximum
      Period: '300'
      EvaluationPeriods: '1'
      Threshold: '75'
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: breaching
      Dimensions:
      - Name: InstanceId
        Value: !Ref RenewerInstance
      - Name: device
        Value: nvme0n1p1
      - Name: fstype
        Value: ext4
      - Name: path
        Value: /

  SuccessRenewalCheckAlarm:
    Type: AWS::CloudWatch::Alarm
    DependsOn:
      - RenewerInstance
      - DiskUsageAlarm
    Properties:
      ActionsEnabled: true
      AlarmActions:
        - Fn::ImportValue:
            !Join [ '-', [ !Ref Environment, CloudWatchAlarmEmailerTopic ] ]
      AlarmDescription: !Sub ${Environment} | Renewer Successful Daily Check
      MetricName: "Successful Subscription Updates"
      Namespace: CVPN/Renewer
      Statistic: Maximum
      Period: '86400'
      EvaluationPeriods: '1'
      Threshold: '1'
      ComparisonOperator: LessThanOrEqualToThreshold
      TreatMissingData: breaching
      Dimensions:
      - Name: Environment
        Value: !Ref Environment

  UpgradeCheckAlarm:
    Type: AWS::CloudWatch::Alarm
    DependsOn:
      - RenewerInstance
      - SuccessRenewalCheckAlarm
    Properties:
      ActionsEnabled: true
      AlarmActions:
        - Fn::ImportValue:
            !Join [ '-', [ !Ref Environment, CloudWatchAlarmEmailerTopic ] ]
      AlarmDescription: !Sub ${Environment} | Renewer Upgrade Check
      MetricName: "Last Upgrade Check Seconds"
      Namespace: CVPN/Shared
      Statistic: Maximum
      Period: '43200'
      EvaluationPeriods: '1'
      Threshold: '172800'
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: breaching
      Dimensions:
      - Name: Environment
        Value: !Ref Environment
      - Name: InstanceId
        Value: !Ref RenewerInstance

  RestartCheckAlarm:
    Type: AWS::CloudWatch::Alarm
    DependsOn:
      - RenewerInstance
      - UpgradeCheckAlarm
    Properties:
      ActionsEnabled: true
      AlarmActions:
        - Fn::ImportValue:
            !Join [ '-', [ !Ref Environment, CloudWatchAlarmEmailerTopic ] ]
      AlarmDescription: !Sub ${Environment} | Renewer Restart Check
      MetricName: "# Packages Require Restart"
      Namespace: CVPN/Shared
      Statistic: Minimum
      Period: '43200'
      EvaluationPeriods: '1'
      Threshold: '1'
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: breaching
      Dimensions:
      - Name: Environment
        Value: !Ref Environment
      - Name: InstanceId
        Value: !Ref RenewerInstance

  SecurityPackagesAlarm:
    Type: AWS::CloudWatch::Alarm
    DependsOn:
      - RenewerInstance
      - RestartCheckAlarm
    Properties:
      ActionsEnabled: true
      AlarmActions:
        - Fn::ImportValue:
            !Join [ '-', [ !Ref Environment, CloudWatchAlarmEmailerTopic ] ]
      AlarmDescription: !Sub ${Environment} | Renewer Security Packages Upgradable
      MetricName: "# Security Packages Upgradable"
      Namespace: CVPN/Shared
      Statistic: Minimum
      Period: '43200'
      EvaluationPeriods: '2'
      Threshold: '1'
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: breaching
      Dimensions:
      - Name: Environment
        Value: !Ref Environment
      - Name: InstanceId
        Value: !Ref RenewerInstance

  NodeUpdateCheckAlarm:
    Type: AWS::CloudWatch::Alarm
    DependsOn:
      - RenewerInstance
      - SecurityPackagesAlarm
    Properties:
      ActionsEnabled: true
      AlarmActions:
        - Fn::ImportValue:
            !Join [ '-', [ !Ref Environment, CloudWatchAlarmEmailerTopic ] ]
      AlarmDescription: !Sub ${Environment} | Renewer Node Update Check
      MetricName: "NodeJS Outdated"
      Namespace: CVPN/Shared
      Statistic: Minimum
      Period: '43200'
      EvaluationPeriods: '1'
      Threshold: '1'
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: breaching
      Dimensions:
      - Name: Environment
        Value: !Ref Environment
      - Name: InstanceId
        Value: !Ref RenewerInstance