template.yaml

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: >
  serverless-batch-job-workflow

Resources:
  GenerateBatchJobMap:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: functions/random-generator/
      Handler: app.lambdaHandler
      Runtime: nodejs14.x
      Architectures:
        - arm64

  BatchJobFanOutStateMachine:
    Type: AWS::Serverless::StateMachine
    Properties:
      DefinitionUri: statemachine/batch_fan_out.asl.json
      Role: !GetAtt BatchJobFanOutExecutionRole.Arn
      DefinitionSubstitutions:
        JobQueueArn: !Ref BatchJobQueue
        JobDefinitionArn: !Ref BatchJobDefinition
        GenerateBatchJobArn: !GetAtt GenerateBatchJobMap.Arn

  BatchJobFanOutExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: states.amazonaws.com
            Action: "sts:AssumeRole"
      Path: "/"
      Policies:
        - PolicyName: BatchJobFanOutAccessPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - batch:SubmitJob
                Resource:
                  - !Ref BatchJobDefinition
                  - !Ref BatchJobQueue
              - Effect: Allow
                Action:
                  - events:PutTargets
                  - events:PutRule
                  - events:DescribeRule
                Resource: 
                  - !Sub "arn:${AWS::Partition}:events:${AWS::Region}:${AWS::AccountId}:rule/StepFunctionsGetEventsForBatchJobsRule"
        - PolicyName: InvokeGenerateBatchJobMapLambdaPolicy
          PolicyDocument:
            Statement:
              - Action:
                  - lambda:InvokeFunction
                Resource: 
                  - !GetAtt GenerateBatchJobMap.Arn
                Effect: Allow

  BatchVPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16

  BatchInternetGateway:
    Type: AWS::EC2::InternetGateway
    DependsOn: BatchVPC

  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    DependsOn:
    - BatchVPC
    - BatchVPCGatewayAttachment
    Properties:
      VpcId: !Ref BatchVPC

  BatchVPCGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    DependsOn:
    - BatchVPC
    - BatchInternetGateway
    Properties:
      VpcId: !Ref BatchVPC
      InternetGatewayId: !Ref BatchInternetGateway

  BatchSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: A security group for region-agnostic Batch resources
      VpcId: !Ref BatchVPC

  BatchSubnet:
    Type: AWS::EC2::Subnet
    DependsOn: BatchVPCGatewayAttachment
    Properties:
      CidrBlock: 10.0.0.0/24
      VpcId: !Ref BatchVPC
      MapPublicIpOnLaunch: 'True'

  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn:
    - PublicRouteTable
    - BatchVPCGatewayAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref BatchInternetGateway

  BatchSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref BatchSubnet

  BatchAWSBatchServiceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: batch.amazonaws.com
          Action: sts:AssumeRole
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AWSBatchServiceRole

  BatchIamInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
      - !Ref BatchEcsInstanceRole

  BatchEcsInstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2008-10-17'
        Statement:
        - Sid: ''
          Effect: Allow
          Principal:
            Service: ec2.amazonaws.com
          Action: sts:AssumeRole
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role

  BatchJobDefinition:
    Type: AWS::Batch::JobDefinition
    Properties:
      Type: container
      ContainerProperties:
        Image: !Sub "137112412989.dkr.ecr.${AWS::Region}.amazonaws.com/amazonlinux:latest"
        Vcpus: 2
        Memory: 2000
        Command:
        - echo
        - Hello world
      RetryStrategy:
        Attempts: 1

  BatchJobQueue:
    Type: AWS::Batch::JobQueue
    DependsOn:
    - BatchComputeEnvironment
    Properties:
      Priority: 1
      ComputeEnvironmentOrder:
      - Order: 1
        ComputeEnvironment: !Ref BatchComputeEnvironment

  BatchComputeEnvironment:
    Type: AWS::Batch::ComputeEnvironment
    DependsOn:
    - BatchSubnet
    - BatchSecurityGroup
    - BatchIamInstanceProfile
    - BatchAWSBatchServiceRole
    Properties:
      Type: MANAGED
      ComputeResources:
        Type: EC2
        MinvCpus: 0
        DesiredvCpus: 0
        MaxvCpus: 64
        InstanceTypes:
        - optimal
        Subnets:
        - !Ref BatchSubnet
        SecurityGroupIds:
        - !Ref BatchSecurityGroup
        InstanceRole: !Ref BatchIamInstanceProfile
      ServiceRole: !Ref BatchAWSBatchServiceRole

Outputs:
  StateMachineArn:
    Value: !Ref BatchJobFanOutStateMachine