ECS_Schedule_Example.yaml

AWSTemplateFormatVersion: "2010-09-09"

Description: Amazon ECS Time and Event-Based Task Scheduling with CloudFormation. This will let you run tasks on a regular, scheduled basis and in response to CloudWatch Events. It easier to launch and stop container services that you need to run only at certain times. For example a backup/cleanup task.

Parameters:
  KeyName:
    Description: Name of an existing EC2 KeyPair to enable SSH access to the ECS instances.
    Type: AWS::EC2::KeyPair::KeyName

  VpcId:
    Description: Select a VPC that allows instances to access the Internet.
    Type: AWS::EC2::VPC::Id

  SubnetId:
    Description: Select at two subnets in your selected VPC.
    Type: List<AWS::EC2::Subnet::Id>

  DesiredCapacity:
    Description: Number of instances to launch in your ECS cluster.
    Type: Number
    Default: 1

  MaxSize:
    Description: Maximum number of instances that can be launched in your ECS cluster.
    Type: Number
    Default: 1

  SchedulerTasksCount:
    Description: Maximum number of Tasks that you want to the Scheduler to run
    Type: Number
    Default: 1

  CronOrRate:
    Description: Choose to use a cron expression or a rate expression you want to use.
    Type: String
    AllowedValues:
      - cron
      - rate
    Default: cron

  CronSchedule:
    Description: This defines the Schedule at which to run the. Cron Expressions - http://docs.aws.amazon.com/AmazonCloudWatch/latest/events/ScheduledEvents.html#CronExpressions
    Type: String
    Default: cron(00 11 ? * * *)

  RateSchedule:
    Description: This defines the Schedule at which to run the. Rate Expressions - http://docs.aws.amazon.com/AmazonCloudWatch/latest/events/ScheduledEvents.html#RateExpressions
    Type: String
    Default: rate(1 day)

  InstanceType:
    Description: EC2 instance type
    Type: String
    AllowedValues:
      - t2.micro
      - t2.small
      - t2.medium
      - t2.large
      - m3.medium
      - m3.large
      - m3.xlarge
      - m3.2xlarge
      - m4.large
      - m4.xlarge
      - m4.2xlarge
      - m4.4xlarge
      - m4.10xlarge
      - c4.large
      - c4.xlarge
      - c4.2xlarge
      - c4.4xlarge
      - c4.8xlarge
      - c3.large
      - c3.xlarge
      - c3.2xlarge
      - c3.4xlarge
      - c3.8xlarge
      - r3.large
      - r3.xlarge
      - r3.2xlarge
      - r3.4xlarge
      - r3.8xlarge
      - i2.xlarge
      - i2.2xlarge
      - i2.4xlarge
      - i2.8xlarge
    Default: t2.micro
    ConstraintDescription: Please choose a valid instance type.

  LatestAmiId:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2

  KmsKeyArn:
    Description: Used to encrypt logs
    Type: String

Conditions:
  CronRate: !Equals
    - !Ref CronOrRate
    - cron

Resources:
  ECSCluster:
    Type: AWS::ECS::Cluster

  EcsSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: ECS Security Group
      VpcId: !Ref VpcId

  EcsSecurityGroupHTTPinbound:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref EcsSecurityGroup
      IpProtocol: tcp
      FromPort: "80"
      ToPort: "80"
      CidrIp: 0.0.0.0/0

  EcsSecurityGroupSSHinbound:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref EcsSecurityGroup
      IpProtocol: tcp
      FromPort: "22"
      ToPort: "22"
      CidrIp: 192.168.1.0/0

  EcsSecurityGroupALBports:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref EcsSecurityGroup
      IpProtocol: tcp
      FromPort: "31000"
      ToPort: "61000"
      SourceSecurityGroupId: !Ref EcsSecurityGroup

  CloudwatchLogsGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Join
        - '-'
        - - ECSLogGroup
          - !Ref AWS::StackName
      RetentionInDays: 14
      KmsKeyId: !Ref KmsKeyArn

  TaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: !Join
        - ""
        - - !Ref AWS::StackName
          - -ecs-demo-app
      ContainerDefinitions:
        - Name: simple-app
          Cpu: "10"
          Essential: "true"
          Image: httpd:2.4
          Memory: "300"
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: !Ref CloudwatchLogsGroup
              awslogs-region: !Ref AWS::Region
              awslogs-stream-prefix: ecs-demo-app
          MountPoints:
            - ContainerPath: /usr/local/apache2/htdocs
              SourceVolume: my-vol
          PortMappings:
            - ContainerPort: 80
        - Name: busybox
          Cpu: 10
          Command:
            - '/bin/sh -c "while true; do echo ''<html> <head> <title>Amazon ECS Sample App</title> <style>body {margin-top: 40px; background-color: #333;} </style> </head><body> <div style=color:white;text-align:center> <h1>Amazon ECS Sample App</h1> <h2>Congratulations!</h2> <p>Your application is now running on a container in Amazon ECS.</p>'' > top; /bin/date > date ; echo ''</div></body></html>'' > bottom; cat top date bottom > /usr/local/apache2/htdocs/index.html ; sleep 1; done"'
          EntryPoint:
            - sh
            - -c
          Essential: false
          Image: busybox
          Memory: 200
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: !Ref CloudwatchLogsGroup
              awslogs-region: !Ref AWS::Region
              awslogs-stream-prefix: ecs-demo-app
          VolumesFrom:
            - SourceContainer: simple-app
      Volumes:
        - Name: my-vol

  ECSALB:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Name: ECSALB
      Scheme: internet-facing
      LoadBalancerAttributes:
        - Key: idle_timeout.timeout_seconds
          Value: "30"
      Subnets: !Ref SubnetId
      SecurityGroups:
        - !Ref EcsSecurityGroup

  ALBListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    DependsOn: ECSServiceRole
    Properties:
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref ECSTG
      LoadBalancerArn: !Ref ECSALB
      Port: "80"
      Protocol: HTTP

  ECSALBListenerRule:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    DependsOn: ALBListener
    Properties:
      Actions:
        - Type: forward
          TargetGroupArn: !Ref ECSTG
      Conditions:
        - Field: path-pattern
          Values:
            - /
      ListenerArn: !Ref ALBListener
      Priority: 1

  ECSTG:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    DependsOn: ECSALB
    Properties:
      HealthCheckIntervalSeconds: 10
      HealthCheckPath: /
      HealthCheckProtocol: HTTP
      HealthCheckTimeoutSeconds: 5
      HealthyThresholdCount: 2
      Name: ECSTG
      Port: 80
      Protocol: HTTP
      UnhealthyThresholdCount: 2
      VpcId: !Ref VpcId

  ECSAutoScalingGroup:
    CreationPolicy:
      ResourceSignal:
        Timeout: PT15M
    UpdatePolicy:
      AutoScalingReplacingUpdate:
        WillReplace: true
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      VPCZoneIdentifier: !Ref SubnetId
      LaunchConfigurationName: !Ref ContainerInstances
      MinSize: "1"
      MaxSize: !Ref MaxSize
      DesiredCapacity: !Ref DesiredCapacity

  ContainerInstances:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      ImageId: !Ref LatestAmiId
      SecurityGroups:
        - !Ref EcsSecurityGroup
      InstanceType: !Ref InstanceType
      IamInstanceProfile: !Ref EC2InstanceProfile
      KeyName: !Ref KeyName
      UserData: !Base64
        Fn::Sub: |
          #!/bin/bash -xe
          echo ECS_CLUSTER=${ECSCluster} >> /etc/ecs/ecs.config
          yum install -y aws-cfn-bootstrap
          /opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} \
              --resource ECSAutoScalingGroup \
              --region ${AWS::Region}

  Service:
    Type: AWS::ECS::Service
    DependsOn: ALBListener
    Properties:
      Cluster: !Ref ECSCluster
      DesiredCount: "1"
      LoadBalancers:
        - ContainerName: simple-app
          ContainerPort: "80"
          TargetGroupArn: !Ref ECSTG
      Role: !Ref ECSServiceRole
      TaskDefinition: !Ref TaskDefinition

  ECSScheduledTask:
    Type: AWS::Events::Rule
    DependsOn: ECSEventRole
    Properties:
      Description: Creating a Schedule with CloudFormation as an example
      ScheduleExpression: !If
        - CronRate
        - !Ref CronSchedule
        - !Ref RateSchedule
      State: ENABLED
      Targets:
        - Arn: !GetAtt ECSCluster.Arn
          Id: Target1
          RoleArn: !GetAtt ECSEventRole.Arn
          EcsParameters:
            TaskCount: !Ref SchedulerTasksCount
            TaskDefinitionArn: !Ref TaskDefinition

  ECSEventRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - events.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: ecs-service
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - ecs:RunTask
                Resource: '*'

  ECSServiceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ecs.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: ecs-service
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - elasticloadbalancing:DeregisterInstancesFromLoadBalancer
                  - elasticloadbalancing:DeregisterTargets
                  - elasticloadbalancing:Describe*
                  - elasticloadbalancing:RegisterInstancesWithLoadBalancer
                  - elasticloadbalancing:RegisterTargets
                  - ec2:Describe*
                  - ec2:AuthorizeSecurityGroupIngress
                Resource: '*'

  ServiceScalingTarget:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    DependsOn: Service
    Properties:
      MaxCapacity: 2
      MinCapacity: 1
      ResourceId: !Join
        - ""
        - - service/
          - !Ref ECSCluster
          - /
          - !GetAtt Service.Name
      RoleARN: !GetAtt AutoscalingRole.Arn
      ScalableDimension: ecs:service:DesiredCount
      ServiceNamespace: ecs

  ServiceScalingPolicy:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName: AStepPolicy
      PolicyType: StepScaling
      ScalingTargetId: !Ref ServiceScalingTarget
      StepScalingPolicyConfiguration:
        AdjustmentType: PercentChangeInCapacity
        Cooldown: 60
        MetricAggregationType: Average
        StepAdjustments:
          - MetricIntervalLowerBound: 0
            ScalingAdjustment: 200

  ALB500sAlarmScaleUp:
    Type: AWS::CloudWatch::Alarm
    Properties:
      EvaluationPeriods: "1"
      Statistic: Average
      Threshold: "10"
      AlarmDescription: Alarm if our ALB generates too many HTTP 500s.
      Period: "60"
      AlarmActions:
        - !Ref ServiceScalingPolicy
      Namespace: AWS/ApplicationELB
      Dimensions:
        - Name: ECSService
          Value: !Ref Service
      ComparisonOperator: GreaterThanThreshold
      MetricName: HTTPCode_ELB_5XX_Count

  EC2Role:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: ecs-service
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - ecs:CreateCluster
                  - ecs:DeregisterContainerInstance
                  - ecs:DiscoverPollEndpoint
                  - ecs:Poll
                  - ecs:RegisterContainerInstance
                  - ecs:StartTelemetrySession
                  - ecs:Submit*
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: '*'

  AutoscalingRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - application-autoscaling.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: service-autoscaling
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - application-autoscaling:*
                  - cloudwatch:DescribeAlarms
                  - cloudwatch:PutMetricAlarm
                  - ecs:DescribeServices
                  - ecs:UpdateService
                Resource: '*'

  EC2InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - !Ref EC2Role

Outputs:
  EcsService:
    Value: !Ref Service

  EcsCluster:
    Value: !Ref ECSCluster

  EcsTaskDef:
    Value: !Ref TaskDefinition

  ECSALB:
    Description: Your ALB DNS URL
    Value: !Join
      - ""
      - - !GetAtt ECSALB.DNSName