rg_main_stack.json

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Creates the Role, InstanceProfile and EC2Instance for Research Gateway",
  "Parameters": {
    "AdminPassword": {
      "Description": "Admin password for MongoDB for this instance of Research Gateway",
      "NoEcho": "true",
      "Type": "String",
      "Default": "",
      "ConstraintDescription": "Admin password"
    },
    "UserPassword": {
      "Description": "User password for RG App to connect to MongoDB",
      "NoEcho": "true",
      "Type": "String",
      "Default": "",
      "ConstraintDescription": "User password"
    },
    "AccessFromCidr": {
      "Description": "Lockdown SSH and HTTPS access (default can be accessed from anywhere)",
      "Type": "String",
      "Default": "0.0.0.0/0",
      "MinLength": "9",
      "MaxLength": "18",
      "AllowedPattern": "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})",
      "ConstraintDescription": "must be a valid CIDR range of the form x.x.x.x/x."
    },
    "RGUrl": {
      "Description": "URL at which this instance of Research Gateway can be reached. e.g. myrg.example.com",
      "Type": "String",
      "ConstraintDescription": "RG URL"
    },
    "UserPoolId": {
      "Description": "UserPoolId of the Cognito UserPool created for this instance of Research Gateway",
      "Type": "String",
      "Default": "",
      "ConstraintDescription": "User Pool Id"
    },
    "ClientId": {
      "Description": "ClientId of the Cognito UserPool created for this instance of Research Gateway",
      "Type": "String",
      "Default": "",
      "ConstraintDescription": "ClientId"
    },
    "CFTBucketName": {
      "Description": "Bucket that is created to hold CFT templates used by Research Gateway",
      "Type": "String",
      "Default": "",
      "ConstraintDescription": "Bucket Name"
    },
    "VPC": {
      "Description": "The VPC in which the EC2 instance will reside",
      "Type": "AWS::EC2::VPC::Id"
    },
    "Subnet1": {
      "Description": "The VPC subnet in which the EC2 instance",
      "Type": "AWS::EC2::Subnet::Id"
    },
    "KeyName1": {
      "Description": "Keypair name for SSH access",
      "Type": "AWS::EC2::KeyPair::KeyName"
    },
    "TGARN": {
      "Description": "Target Group ARN to which the RG Portal EC2 Instance is registered.",
      "Type": "String",
      "ConstraintDescription": "Target Group"
    },
    "DatabaseType": {
      "Description": "Choose between AWS DocumentDB (recommended) and a local MongoDB instance (not recommended for production)",
      "Type": "String",
      "Default": "DocumentDB",
      "AllowedValues": [
        "DocumentDB",
        "MongoDB"
      ]
    },
    "DocumentDBInstanceURL": {
      "Description": "URL to connect to the DocumentDB (if DocumentDB chosen as the database type)",
      "Type": "String"
    },
    "Environment": {
      "Description": "Choose between DEV QA STAGE or PROD",
      "Type": "String",
      "Default": "PROD",
      "AllowedValues": [
        "DEV",
        "QA",
        "STAGE",
        "PROD"
      ]
    },
    "BaseAccountPolicyName": {
      "Description": "Name for RG Portal Base Account Policy",
      "Type": "String"
    },
    "SourceBucketName": {
      "Description": "Source Bucket to download artefacts from",
      "Type": "String",
      "Default": "",
      "ConstraintDescription": "Bucket Name"
    }
  },
  "Conditions": {
    "DocumentDBSelected": {
      "Fn::Equals": [
        {
          "Ref": "DatabaseType"
        },
        "DocumentDB"
      ]
    },
    "DocumentDBURLProvided": {
      "Fn::Not": [
        {
          "Fn::Equals": [
            {
              "Ref": "DocumentDBInstanceURL"
            },
            ""
          ]
        }
      ]
    },
    "UseDocumentDB": {
      "Fn::And": [
        {
          "Condition": "DocumentDBSelected"
        },
        {
          "Condition": "DocumentDBURLProvided"
        }
      ]
    },
    "UseLocalMongoDB": {
      "Fn::Not": [
        {
          "Condition": "DocumentDBSelected"
        }
      ]
    }
  },
  "Resources": {
    "RGPortalRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "Description": "The role used by the EC2 Instance running the portal",
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": [
                  "ec2.amazonaws.com"
                ]
              },
              "Action": [
                "sts:AssumeRole"
              ]
            }
          ]
        },
        "ManagedPolicyArns": [
          "arn:aws:iam::aws:policy/AmazonS3FullAccess",
          "arn:aws:iam::aws:policy/AmazonCognitoPowerUser",
          "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
          "arn:aws:iam::aws:policy/service-role/AWSAppRunnerServicePolicyForECRAccess",
          "arn:aws:iam::aws:policy/IAMReadOnlyAccess",
          "arn:aws:iam::aws:policy/AmazonRoute53FullAccess",
          {
            "Ref": "ResearchGatewayRolePolicy"
          }
        ],
        "Path": "/"
      }
    },
    "ResearchGatewayInstanceProfile": {
      "Type": "AWS::IAM::InstanceProfile",
      "Properties": {
        "Path": "/",
        "Roles": [
          {
            "Ref": "RGPortalRole"
          }
        ]
      }
    },
    "ResearchGatewayRolePolicy": {
      "Type": "AWS::IAM::ManagedPolicy",
      "Properties": {
        "ManagedPolicyName": "BaseAccountPolicyName",
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "config:*",
                "ec2:DescribeImages",
                "ec2:CopyImage",
                "ec2:ModifyImageAttribute",
                "ec2:ModifyInstanceMetadataOptions",
                "iam:attachRolePolicy",
                "iam:createPolicy",
                "iam:createPolicyVersion",
                "iam:createRole",
                "iam:deletePolicy",
                "iam:deletePolicyVersion",
                "iam:detachRolePolicy",
                "iam:updateAssumeRolePolicy",
                "elasticloadbalancing:RegisterTargets",
                "ses:*",
                "sns:*",
                "sts:AssumeRole",
                "cloudformation:*"
              ],
              "Resource": "*"
            }
          ]
        }
      }
    },
    "RGPortalSG": {
      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "GroupDescription": "Security Group for RGPortal instances",
        "VpcId": {
          "Ref": "VPC"
        },
        "SecurityGroupIngress": [
          {
            "IpProtocol": "tcp",
            "FromPort": "80",
            "ToPort": "80",
            "CidrIp": {
              "Ref": "AccessFromCidr"
            }
          },
          {
            "IpProtocol": "tcp",
            "FromPort": "22",
            "ToPort": "22",
            "CidrIp": {
              "Ref": "AccessFromCidr"
            }
          }
        ],
        "Tags": [
          {
            "Key": "Name",
            "Value": {
              "Fn::Sub": "${AWS::StackName}-SecurityGroup"
            }
          }
        ]
      }
    },
    "RGEC2Instance": {
      "Type": "AWS::EC2::Instance",
      "Properties": {
        "ImageId": "ami-0fb3fe843311c4412",
        "InstanceType": "t3.large",
        "Monitoring": "true",
        "DisableApiTermination": "false",
        "IamInstanceProfile": {
          "Ref": "ResearchGatewayInstanceProfile"
        },
        "KeyName": {
          "Ref": "KeyName1"
        },
        "BlockDeviceMappings": [
          {
            "DeviceName": "/dev/xvda",
            "Ebs": {
              "VolumeType": "gp2",
              "VolumeSize": "30",
              "DeleteOnTermination": "true",
              "Encrypted": "true"
            }
          }
        ],
        "SubnetId": {
          "Ref": "Subnet1"
        },
        "SecurityGroupIds": [
          {
            "Ref": "RGPortalSG"
          }
        ],
        "UserData": {
          "Fn::Base64": {
            "Fn::If": [
              "UseLocalMongoDB",
              "#!/bin/bash\nexec > >(tee /var/log/user-data.log|logger -t user-data -s 2>/dev/console) 2>&1\nexport RG_HOME=/opt/deploy/sp2\nexport RG_ENV=${Environment}\nexport RG_SRC=/home/ubuntu\naws s3 cp s3://${SourceBucketName}/updatescripts.sh /home/ubuntu\nchmod +x /home/ubuntu/updatescripts.sh\n/home/ubuntu/updatescripts.sh\nfixmongo.sh ${Environment}-cc ${AdminPassword} rguser ${UserPassword} ${RGUrl}\nfixconfigs.sh ${UserPoolId} ${ClientId} ${CFTBucketName} rguser ${UserPassword} ${RGUrl}\nstart_server.sh ${RGUrl} ${TGARN}\n/opt/aws/bin/cfn-signal -e 0 --stack ${AWS::StackName} --resource RGEC2Instance --region ${AWS::Region}\n",
              "#!/bin/bash\nexec > >(tee /var/log/user-data.log|logger -t user-data -s 2>/dev/console) 2>&1\nexport RG_HOME=/opt/deploy/sp2\nexport RG_ENV=${Environment}\nexport RG_SRC=/home/ubuntu\naws s3 cp s3://${SourceBucketName}/updatescripts.sh /home/ubuntu\nchmod +x /home/ubuntu/updatescripts.sh\n/home/ubuntu/updatescripts.sh\nfixconfigs.sh ${UserPoolId} ${ClientId} ${CFTBucketName} rguser ${UserPassword} ${RGUrl}\nfixdocdb.sh ${DocumentDBInstanceURL} ${Environment}-cc rguser ${UserPassword} ${RGUrl}\nstart_server.sh ${RGUrl} ${TGARN}\n/opt/aws/bin/cfn-signal -e 0 --stack ${AWS::StackName} --resource RGEC2Instance --region ${AWS::Region}            \n"
            ]
          }
        }
      },
      "CreationPolicy": {
        "ResourceSignal": {
          "Timeout": "PT9M"
        }
      }
    }
  },
  "Outputs": {
    "RGAccessURL": {
      "Description": "URL to access Research Gateway",
      "Value": "RGUrl"
    }
  }
}