rg_main_stack.yml

AWSTemplateFormatVersion: "2010-09-09"
Description: Creates the Role, InstanceProfile and EC2Instance for Research Gateway
Parameters:
  AdminPassword:
    Description: Admin password for MongoDB for this instance of Research Gateway
    NoEcho: "true"
    Type: String
    Default: ""
    ConstraintDescription: Admin password
  UserPassword:
    Description: User password for RG App to connect to MongoDB
    NoEcho: "true"
    Type: String
    Default: ""
    ConstraintDescription: User password
  AccessFromCidr:
    Description: Lockdown SSH and HTTPS access (default can be accessed from anywhere)
    Type: String
    Default: 0.0.0.0/0
    MinLength: "9"
    MaxLength: "18"
    AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})
    ConstraintDescription: must be a valid CIDR range of the form x.x.x.x/x.
  RGUrl:
    Description: URL at which this instance of Research Gateway can be reached. e.g. myrg.example.com
    Type: String
    ConstraintDescription: RG URL
  CFTBucketName:
    Description: Bucket that is created to hold CFT templates used by Research Gateway
    Type: String
    Default: ""
    ConstraintDescription: Bucket Name
  VPC:
    Description: The VPC in which the EC2 instance will reside
    Type: AWS::EC2::VPC::Id
  Subnet1:
    Description: The VPC subnet in which the EC2 instance
    Type: AWS::EC2::Subnet::Id
  KeyName1:
    Description: Keypair name for SSH access
    Type: AWS::EC2::KeyPair::KeyName
  TGARN:
    Description: Target Group ARN to which the RG Portal EC2 Instance is registered.
    Type: String
    ConstraintDescription: Target Group
  DatabaseType:
    Description: Choose between AWS DocumentDB (recommended) and a local MongoDB instance (not recommended for production)
    Type: String
    Default: DocumentDB
    AllowedValues:
      - DocumentDB
      - MongoDB
  DocumentDBInstanceURL:
    Description: URL to connect to the DocumentDB (if DocumentDB chosen as the database type)
    Type: String
  Environment:
    Description: Choose between DEV QA STAGE or PROD
    Type: String
    Default: PROD
    AllowedValues:
      - DEV
      - QA
      - STAGE
      - PROD
  BaseAccountPolicyName:
    Description: Name for RG Portal Base Account Policy
    Type: String
Conditions:
  DocumentDBSelected:
    Fn::Equals:
      - Ref: DatabaseType
      - DocumentDB
  DocumentDBURLProvided:
    Fn::Not:
      - Fn::Equals:
          - Ref: DocumentDBInstanceURL
          - ""
  UseDocumentDB:
    Fn::And:
      - Condition: DocumentDBSelected
      - Condition: DocumentDBURLProvided
  UseLocalMongoDB:
    Fn::Not:
      - Condition: UseDocumentDB
Resources:
  RGPortalRole:
    Type: AWS::IAM::Role
    Properties:
      Description: The role used by the EC2 Instance running the portal
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonS3FullAccess
        - arn:aws:iam::aws:policy/AmazonCognitoPowerUser
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
        - arn:aws:iam::aws:policy/service-role/AWSAppRunnerServicePolicyForECRAccess
        - arn:aws:iam::aws:policy/IAMReadOnlyAccess
        - arn:aws:iam::aws:policy/AmazonRoute53FullAccess
        - arn:aws:iam::aws:policy/SecretsManagerReadWrite
        - Ref: ResearchGatewayRolePolicy
      Path: /
  ResearchGatewayInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - Ref: RGPortalRole
  ResearchGatewayRolePolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: !Ref BaseAccountPolicyName
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: "InstancePermissions"
            Effect: Allow
            Action:
              - ec2:DescribeImages
              - ec2:CopyImage
              - ec2:ModifyImageAttribute
              - ec2:CreateNetworkInterface
              - elasticloadbalancing:RegisterTargets
              - sts:AssumeRole
              - kms:Decrypt
            Resource: "*"
          - Sid: "RoleRelatedPermissions"
            Effect: Allow
            Action:
              - iam:AttachRolePolicy
              - iam:CreateRole
              - iam:DetachRolePolicy
            Resource: 
              - !Sub "arn:aws:iam::${AWS::AccountId}:role/${BaseAccountPolicyName}"
          - Sid: "PolicyRelatedPermissions"
            Effect: Allow
            Action:
              - iam:CreatePolicy
              - iam:CreatePolicyVersion
              - iam:DeletePolicy
              - iam:DeletePolicyVersion
              - iam:UpdateAssumeRolePolicy
            Resource: 
              - "arn:aws:iam::*:policy/RG-Cross-Account-Policy*"
  RGPortalSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security Group for RGPortal instances
      VpcId:
        Ref: VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: "80"
          ToPort: "80"
          CidrIp:
            Ref: AccessFromCidr
        - IpProtocol: tcp
          FromPort: "443"
          ToPort: "443"            
          CidrIp:
            Ref: AccessFromCidr
      SecurityGroupEgress:  # Adding egress rule
        - IpProtocol: "-1"  # Allow all protocols
          CidrIp: 0.0.0.0/0  # Allow all outbound traffic to all destinations             
      Tags:
        - Key: Name
          Value:
            Fn::Sub: ${AWS::StackName}-SecurityGroup
  IMDSv2LaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    Properties:
        LaunchTemplateName: IMDSV2
        LaunchTemplateData:
          DisableApiTermination: true
          MetadataOptions: 
            HttpTokens: required
            HttpPutResponseHopLimit: 2
  RGEC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: ami-0fb3fe843311c4412
      InstanceType: t3.large
      Monitoring: "true"
      DisableApiTermination: "false"
      IamInstanceProfile:
        Ref: ResearchGatewayInstanceProfile
      KeyName:
        Ref: KeyName1
      BlockDeviceMappings:
        - DeviceName: /dev/sda1
          Ebs:
            VolumeType: gp2
            VolumeSize: "80"
            DeleteOnTermination: "true"
            Encrypted: "true"
      SubnetId:
        Ref: Subnet1
      SecurityGroupIds:
        - Ref: RGPortalSG
      UserData:
        Fn::Base64:
          Fn::If:
            - UseLocalMongoDB
            - !Sub |
              #!/bin/bash
              exec > >(tee /var/log/user-data.log|logger -t user-data -s 2>/dev/console) 2>&1
              export RG_HOME=/opt/deploy/sp2
              export RG_ENV=${Environment}
              export RG_SRC=/home/ubuntu
              export S3_SOURCE="${CFTBucketName}"
              aws s3 cp s3://${CFTBucketName}/updatescripts.sh /home/ubuntu
              aws s3 cp s3://${CFTBucketName}/config.tar.gz /home/ubuntu               
              chmod +x /home/ubuntu/updatescripts.sh
              /home/ubuntu/updatescripts.sh
              fixmongo.sh ${Environment}-cc ${AdminPassword} rguser '${UserPassword}' ${RGUrl}
              fixconfigs.sh
              start_server.sh ${RGUrl} ${TGARN}
              /opt/aws/bin/cfn-signal -e 0 --stack ${AWS::StackName} --resource RGEC2Instance --region ${AWS::Region}
            - !Sub |
              #!/bin/bash
              exec > >(tee /var/log/user-data.log|logger -t user-data -s 2>/dev/console) 2>&1
              export RG_HOME=/opt/deploy/sp2
              export RG_ENV=${Environment}
              export RG_SRC=/home/ubuntu
              export S3_SOURCE="${CFTBucketName}"
              aws s3 cp s3://${CFTBucketName}/updatescripts.sh /home/ubuntu
              aws s3 cp s3://${CFTBucketName}/config.tar.gz /home/ubuntu               
              chmod +x /home/ubuntu/updatescripts.sh
              /home/ubuntu/updatescripts.sh
              fixconfigs.sh
              fixdocdb.sh ${DocumentDBInstanceURL} ${Environment}-cc rguser '${UserPassword}' ${RGUrl}
              start_server.sh ${RGUrl} ${TGARN}
              /opt/aws/bin/cfn-signal -e 0 --stack ${AWS::StackName} --resource RGEC2Instance --region ${AWS::Region}
    CreationPolicy:
      ResourceSignal:
        Timeout: PT9M
Outputs:
  RGAccessURL:
    Description: URL to access Research Gateway
    Value: !Ref RGUrl