template.yaml

---
Description: Autoscaling Lambda for elastic-ci stack Buildkite Agents
Transform: AWS::Serverless-2016-10-31

Parameters:
  BuildkiteAgentTokenParameter:
    Description: Buildkite agent token parameter
    Type: AWS::SSM::Parameter::Name

  BuildkiteAgentTokenParameterStoreKMSKey:
    Description: AWS KMS Key ID used to encrypt the SSM parameter (if encrypted)
    Type: String
    Default: ""

  BuildkiteQueue:
    Description: Queue name that agents will use, targeted in pipeline steps using "queue={value}"
    Type: String
    Default: default
    MinLength: 1

  AgentAutoScaleGroup:
    Description: The name of the autoscale group to autoscale.
    Type: String
    Default: default

  AutoscalingLambdaExecutionRole:
    Description: IAM Role ARN
    Type: String
    Default: ''

  AgentsPerInstance:
    Description: ""
    Type: Number

  MinSize:
    Description: ""
    Type: String

  MaxSize:
    Description: ""
    Type: String

  ScaleOutFactor:
    Description: ""
    Type: Number

  ScaleOutForWaitingJobs:
    Description: ""
    Type: String
    AllowedValues:
      - "true"
      - "false"
    Default: "false"

Conditions:
  CreateRole:
    !Equals [ !Ref AutoscalingLambdaExecutionRole, '' ]
  UseKmsKeyForParameterStore:
    !Not [ !Equals [ !Ref BuildkiteAgentTokenParameterStoreKMSKey, "" ] ]

Mappings:
  LambdaBucket:
    us-east-1: { Bucket: "buildkite-lambdas" }
    us-east-2: { Bucket: "buildkite-lambdas-us-east-2" }
    us-west-1: { Bucket: "buildkite-lambdas-us-west-1" }
    us-west-2: { Bucket: "buildkite-lambdas-us-west-2" }
    af-south-1: { Bucket: "buildkite-lambdas-af-south-1" }
    ap-east-1: { Bucket: "buildkite-lambdas-ap-east-1" }
    ap-south-1: { Bucket: "buildkite-lambdas-ap-south-1" }
    ap-northeast-2: { Bucket: "buildkite-lambdas-ap-northeast-2" }
    ap-northeast-1: { Bucket: "buildkite-lambdas-ap-northeast-1" }
    ap-southeast-2: { Bucket: "buildkite-lambdas-ap-southeast-2" }
    ap-southeast-1: { Bucket: "buildkite-lambdas-ap-southeast-1" }
    ca-central-1: { Bucket: "buildkite-lambdas-ca-central-1" }
    eu-central-1: { Bucket: "buildkite-lambdas-eu-central-1" }
    eu-west-1: { Bucket: "buildkite-lambdas-eu-west-1" }
    eu-west-2: { Bucket: "buildkite-lambdas-eu-west-2" }
    eu-south-1: { Bucket: "buildkite-lambdas-eu-south-1" }
    eu-west-3: { Bucket: "buildkite-lambdas-eu-west-3" }
    eu-north-1: { Bucket: "buildkite-lambdas-eu-north-1" }
    me-south-1: { Bucket: "buildkite-lambdas-me-south-1" }
    sa-east-1: { Bucket: "buildkite-lambdas-sa-east-1" }

Resources:
  ExecutionRole:
    Type: AWS::IAM::Role
    Condition: CreateRole
    Properties:
      Path: "/"
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
          Action:
          - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: AutoScalingGroups
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - autoscaling:DescribeAutoScalingGroups
                  # *
                  - autoscaling:SetDesiredCapacity
                  # # arn:aws:autoscaling:$region:$account:autoScalingGroup:$uuid:autoScalingGroupName/$name
                Resource: '*'
        - PolicyName: WriteCloudwatchMetrics
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: cloudwatch:PutMetricData
                Resource: '*'
        - PolicyName: ReadAgentToken
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: ssm:GetParameter
                Resource: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter${BuildkiteAgentTokenParameter}
        - !If
          - UseKmsKeyForParameterStore
          - PolicyName: DecryptAgentToken
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action: kms:Decrypt
                  Resource: !Sub arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/${BuildkiteAgentTokenParameterStoreKMSKey}
          - !Ref 'AWS::NoValue'

  AutoscalingFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: handler.zip
      Role: !If [ CreateRole, !GetAtt ExecutionRole.Arn, !Ref AutoscalingLambdaExecutionRole ]
      Timeout: 120
      Handler: handler
      Runtime: go1.x
      MemorySize: 128
      Environment:
        Variables:
          BUILDKITE_AGENT_TOKEN_SSM_KEY: !Ref BuildkiteAgentTokenParameter
          BUILDKITE_QUEUE:               !Ref BuildkiteQueue
          AGENTS_PER_INSTANCE:           !Ref AgentsPerInstance
          CLOUDWATCH_METRICS:            "1"
          DISABLE_SCALE_IN:              "1"
          ASG_NAME:                      !Ref AgentAutoScaleGroup
          MIN_SIZE:                      !Ref MinSize
          MAX_SIZE:                      !Ref MaxSize
          SCALE_OUT_FACTOR:              !Ref ScaleOutFactor
          INCLUDE_WAITING:               !Ref ScaleOutForWaitingJobs
          LAMBDA_TIMEOUT:                "50s"
          LAMBDA_INTERVAL:               "10s"
      Events:
        Timer:
          Type: Schedule
          Properties:
            Schedule: "rate(1 minute)"

  # This mirrors the group that would be created by the lambda, but enforces
  # a retention period and also ensures it's removed when the stack is removed
  LogGroup:
    Type: "AWS::Logs::LogGroup"
    Properties:
      LogGroupName: !Sub "/aws/lambda/${AutoscalingFunction}"
      RetentionInDays: 1

Outputs:
  ExecutionRoleName:
    Description: Name of the Lambda IAM execution role.
    Value: !If [ CreateRole, !Ref ExecutionRole, '' ]