main.yml

AWSTemplateFormatVersion: '2010-09-09'

Description: >
  AWS CloudFormation template to create a new ECS Cluster, Services and Tasks
  for OMERO

Parameters:

  KeyName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: >
      Specifies the name of an existing Amazon EC2 key pair
      to enable SSH access to the EC2 instances in your cluster.

  Tag:
    Type: String
    Description: Optional - A tag for billing/identification purposes
    Default: ''

  VpcId:
    Type: AWS::EC2::VPC::Id
    Description: >
      Specifies the ID of an existing VPC in which to launch
      your container instances.

  SubnetIds:
    Type: List<AWS::EC2::Subnet::Id>
    Description: >
      Specifies the list of existing VPC Subnet Ids where ECS instances will
      run. Please specify exactly two.

  SecurityGroupId:
    Type: String
    Description: >
      Optional - Specifies the Security Group Id of an existing Security
      Group. Leave blank to have a new Security Group created
    Default: ''

  EcsInstanceType:
    Type: String
    Description: >
      Specifies the EC2 instance type for your container instances.
      Defaults to t2.large
    AllowedValues: [t2.micro, t2.small, t2.medium, t2.large, m3.medium, m3.large,
      m3.xlarge, m3.2xlarge, m4.large, m4.xlarge, m4.2xlarge, m4.4xlarge, m4.10xlarge,
      c4.large, c4.xlarge, c4.2xlarge, c4.4xlarge, c4.8xlarge, c3.large, c3.xlarge,
      c3.2xlarge, c3.4xlarge, c3.8xlarge, r3.large, r3.xlarge, r3.2xlarge, r3.4xlarge,
      r3.8xlarge, i2.xlarge, i2.2xlarge, i2.4xlarge, i2.8xlarge]
    Default: t2.large
    ConstraintDescription: Must be a valid EC2 instance type.

  AsgMaxSize:
    Type: Number
    Description: >
      Specifies the number of instances to launch and register to the cluster.
      Defaults to 3.
    Default: 3

  SecurityIngressFromPort:
    Type: Number
    Description: >
      Optional - Specifies the Start of Security Group port to open on
      ECS instances - defaults to port 0
    Default: 0

  SecurityIngressToPort:
    Type: Number
    Description: >
      Optional - Specifies the End of Security Group port to open on ECS
      instances - defaults to port 65535
    Default: 65535

  SecurityIngressCidrIp:
    Type: String
    Description: >
      Optional - Specifies the CIDR/IP range for Security Ports - defaults
      to 0.0.0.0/0
    Default: 0.0.0.0/0

  EcsEndpoint:
    Type: String
    Description: >
      Optional - Specifies the ECS Endpoint for the ECS Agent to connect to
    Default: ''

  VpcAvailabilityZones:
    Type: CommaDelimitedList
    Description: >
      Specifies a comma-separated list of 3 VPC Availability Zones for
      the creation of new subnets. These zones must have the available status.
    Default: ''

  EBSVolumeSizeForECS:
    Type: Number
    Description: >
      Optional - Specifies the Size in GBs, of the newly created Amazon
      Elastic Block Store (Amazon EBS) volume for ECS container storage
    Default: 0

  EBSVolumeTypeForECS:
    Type: String
    Description: Specifies the Type of (Amazon EBS) volume for ECS container storage. Ignored if not using an EBS ECS volume.
    Default: 'gp2'
    AllowedValues:
      - standard
      - io1
      - gp2
      - sc1
      - st1
    ConstraintDescription: Must be a valid EC2 volume type.

  EBSVolumeSizeForData:
    Type: Number
    Description: >
      Optional - Specifies the Size in GBs, of the newly created Amazon
      Elastic Block Store (Amazon EBS) volume for data storage
    Default: 0

  EBSVolumeTypeForData:
    Type: String
    Description: Specifies the Type of (Amazon EBS) volume for data storage. Ignored if not using an EBS data volume.
    Default: 'gp2'
    AllowedValues:
      - standard
      - io1
      - gp2
      - sc1
      - st1
    ConstraintDescription: Must be a valid EC2 volume type.

  EFSOn:
    Type: String
    Description: >
      Switches on EFS use in place of EBS for OMERO storage. Will override
      an EBS Volume for Data, if also set.
    Default: 'EFS Off'
    AllowedValues:
      - 'EFS On'
      - 'EFS Off'
    ConstraintDescription: Must be On or Off.

  DeviceNameForData:
    Type: String
    Description: Specifies the device mapping for the Volume for data storage. Ignored if not using an EBS data volume.
    Default: '/dev/sdm'

  S3Bucket:
    Type: String
    Description: Optional - S3 Bucket from which to hydrate an archive
    Default: ''

Mappings:
  AWSRegionToAMI:
    us-east-1:
      AMIID: ami-275ffe31
    us-east-2:
      AMIID: ami-62745007
    us-west-1:
      AMIID: ami-689bc208
    us-west-2:
      AMIID: ami-62d35c02
    eu-west-1:
      AMIID: ami-95f8d2f3
    eu-west-2:
      AMIID: ami-bf9481db
    eu-central-1:
      AMIID: ami-085e8a67
    ap-northeast-1:
      AMIID: ami-f63f6f91
    ap-southeast-1:
      AMIID: ami-b4ae1dd7
    ap-southeast-2:
      AMIID: ami-fbe9eb98
    ca-central-1:
      AMIID: ami-ee58e58a

Conditions:
  CreateEC2LCWithKeyPair:
    !Not [!Equals [!Ref KeyName, '']]
  LinkTag:
    !Not [!Equals [!Ref Tag, '']]
  SetEndpointToECSAgent:
    !Not [!Equals [!Ref EcsEndpoint, '']]
  CreateNewSecurityGroup:
    !Equals [!Ref SecurityGroupId, '']
  CreateEBSVolumeForECS: !And
    - !Not [!Equals [!Ref EBSVolumeSizeForECS, '0']]
    - !Not [!Equals [!Ref EBSVolumeTypeForECS, '']]
  SetDataFSToEFS:
    !Equals [!Ref EFSOn, 'EFS On']
  CreateEBSVolumeForData: !And
    - !Not [!Equals [!Ref EBSVolumeSizeForData, '0']]
    - !Not [!Equals [!Ref EBSVolumeTypeForData, '']]
    - !Not [!Equals [!Ref DeviceNameForData, '']]
    - !Not [ Condition: SetDataFSToEFS ]
  CreateEBSVolumes: !Or
    - Condition: CreateEBSVolumeForECS
    - Condition: CreateEBSVolumeForData

Resources:

  IamRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
              - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role'

  IamRoleInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: '/'
      Roles:
        - !Ref IamRole

  EcsSecurityGroup:
    Condition: CreateNewSecurityGroup
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: ECS Allowed Ports
      VpcId: !Ref VpcId
      SecurityGroupIngress:
        IpProtocol: tcp
        FromPort: !Ref SecurityIngressFromPort
        ToPort: !Ref SecurityIngressToPort
        CidrIp: !Ref SecurityIngressCidrIp

  OMEROEFS:
    Type: AWS::EFS::FileSystem
    Condition: SetDataFSToEFS
    Properties:
      FileSystemTags:
        - !If
          - LinkTag
          - Key: project
            Value: !Ref Tag
          - !Ref AWS::NoValue

  OMEROEFSMountTarget0:
    Type: AWS::EFS::MountTarget
    Condition: SetDataFSToEFS
    Properties:
      FileSystemId: !Ref OMEROEFS
      SubnetId: !Select [ 0, !Ref SubnetIds ]
      SecurityGroups:
        - !If [ CreateNewSecurityGroup, !Ref EcsSecurityGroup, !Ref SecurityGroupId ]

  OMEROEFSMountTarget1:
    Type: AWS::EFS::MountTarget
    Condition: SetDataFSToEFS
    Properties:
      FileSystemId: !Ref OMEROEFS
      SubnetId: !Select [ 1, !Ref SubnetIds ]
      SecurityGroups:
        - !If [ CreateNewSecurityGroup, !Ref EcsSecurityGroup, !Ref SecurityGroupId ]

  # OMEROEFSMountTarget2:
  #   Type: AWS::EFS::MountTarget
  #   Condition: SetDataFSToEFS
  #   Properties:
  #     FileSystemId: !Ref OMEROEFS
  #     SubnetId: !Select [ 2, !Ref SubnetIds ]
  #     SecurityGroups:
  #       - !If [ CreateNewSecurityGroup, !Ref EcsSecurityGroup, !Ref SecurityGroupId ]
  #
  # OMEROEFSMountTarget3:
  #   Type: AWS::EFS::MountTarget
  #   Condition: SetDataFSToEFS
  #   Properties:
  #     FileSystemId: !Ref OMEROEFS
  #     SubnetId: !Select [ 3, !Ref SubnetIds ]
  #     SecurityGroups:
  #       - !If [ CreateNewSecurityGroup, !Ref EcsSecurityGroup, !Ref SecurityGroupId ]

  ECSCluster:
    Type: AWS::ECS::Cluster

  CloudwatchLogsGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub ECSLogGroup-${AWS::StackName}
      RetentionInDays: 14

  # START Postgres
  PostgresECSLoadBalancer:
    Type: AWS::ElasticLoadBalancing::LoadBalancer
    Properties:
      Subnets: !Ref SubnetIds
      Scheme: internet-facing
      SecurityGroups:
        - !If [ CreateNewSecurityGroup, !Ref EcsSecurityGroup, !Ref SecurityGroupId ]
      Listeners:
        - LoadBalancerPort: 5432
          InstancePort: 5432
          Protocol: TCP
      HealthCheck:
        Target: TCP:5432
        HealthyThreshold: 3
        UnhealthyThreshold: 5
        Interval: 30
        Timeout: 5
      # AccessLoggingPolicy:
      #   S3BucketName:
      #     Ref: S3LoggingBucket
      #   S3BucketPrefix: Logs
      #   Enabled: 'true'
      #   EmitInterval: '60'
    # DependsOn: S3LoggingBucketPolicy

  PostgresTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: !Sub ${AWS::StackName}-postgres
      ContainerDefinitions:
        - Name: postgres
          Cpu: 500
          Essential: true
          Image: postgres:9.4
          Memory: 500
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: !Ref CloudwatchLogsGroup
              awslogs-region: !Ref AWS::Region
              awslogs-stream-prefix: postgres
          PortMappings:
            - ContainerPort: 5432
              HostPort: 5432
          Environment:
            - Name: POSTGRES_PASSWORD
              Value: postgres

  PostgresService:
    Type: AWS::ECS::Service
    Properties:
      Cluster: !Ref ECSCluster
      DesiredCount: 1
      LoadBalancers:
        - ContainerName: postgres
          ContainerPort: 5432
          LoadBalancerName: !Ref PostgresECSLoadBalancer
      Role: !Ref ECSServiceRole
      TaskDefinition: !Ref PostgresTaskDefinition
  # END Postgres

  # START Redis
  RedisECSLoadBalancer:
    Type: AWS::ElasticLoadBalancing::LoadBalancer
    Properties:
      Subnets: !Ref SubnetIds
      Scheme: internet-facing
      SecurityGroups:
        - !If [ CreateNewSecurityGroup, !Ref EcsSecurityGroup, !Ref SecurityGroupId ]
      Listeners:
        - LoadBalancerPort: 6379
          InstancePort: 6379
          Protocol: TCP
      HealthCheck:
        Target: TCP:6379
        HealthyThreshold: 3
        UnhealthyThreshold: 5
        Interval: 30
        Timeout: 5
      # AccessLoggingPolicy:
      #   S3BucketName:
      #     Ref: S3LoggingBucket
      #   S3BucketPrefix: Logs
      #   Enabled: 'true'
      #   EmitInterval: '60'
    # DependsOn: S3LoggingBucketPolicy

  RedisTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: !Sub ${AWS::StackName}-redis
      ContainerDefinitions:
        - Name: redis
          Cpu: 200
          Essential: true
          Image: sorgerlab/omero-redis
          Memory: 200
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: !Ref CloudwatchLogsGroup
              awslogs-region: !Ref AWS::Region
              awslogs-stream-prefix: redis
          PortMappings:
            - ContainerPort: 6379
              HostPort: 6379
          Environment:
            - Name: REDIS_PASSWORD
              Value: redis

  RedisService:
    Type: AWS::ECS::Service
    Properties:
      Cluster: !Ref ECSCluster
      DesiredCount: 1
      LoadBalancers:
        - ContainerName: redis
          ContainerPort: 6379
          LoadBalancerName: !Ref RedisECSLoadBalancer
      Role: !Ref ECSServiceRole
      TaskDefinition: !Ref RedisTaskDefinition
  # END Redis

  # START OMERO-Master
  OmeroECSLoadBalancer:
    Type: AWS::ElasticLoadBalancing::LoadBalancer
    Properties:
      Subnets: !Ref SubnetIds
      Scheme: internet-facing
      SecurityGroups:
        - !If [ CreateNewSecurityGroup, !Ref EcsSecurityGroup, !Ref SecurityGroupId ]
      Listeners:
        - LoadBalancerPort: 4064
          InstancePort: 4064
          Protocol: TCP
        - LoadBalancerPort: 4063
          InstancePort: 4063
          Protocol: TCP
      HealthCheck:
        Target: TCP:4064
        HealthyThreshold: 3
        UnhealthyThreshold: 5
        Interval: 30
        Timeout: 5
      # AccessLoggingPolicy:
      #   S3BucketName:
      #     Ref: S3LoggingBucket
      #   S3BucketPrefix: Logs
      #   Enabled: 'true'
      #   EmitInterval: '60'
    # DependsOn: S3LoggingBucketPolicy

  OmeroTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: !Sub ${AWS::StackName}-omero-master
      Volumes:
        - Name: OMERO_DATA
          Host:
            SourcePath: /mnt/OMERO_DATA
      ContainerDefinitions:
        - Name: omero-master
          Cpu: 1000
          Essential: true
          Image: sorgerlab/omero.cloudarchive
          Memory: 4000
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: !Ref CloudwatchLogsGroup
              awslogs-region: !Ref AWS::Region
              awslogs-stream-prefix: omero-master
          MountPoints:
            - ContainerPath: /OMERO
              SourceVolume: OMERO_DATA
          PortMappings:
            - ContainerPort: 4063
              HostPort: 4063
            - ContainerPort: 4064
              HostPort: 4064
          Environment:
            - Name: CONFIG_omero_db_name
              Value: postgres
            - Name: CONFIG_omero_db_pass
              Value: postgres
            - Name: CONFIG_omero_db_user
              Value: postgres
            - Name: CONFIG_omero_web_public_enabled
              Value: true
            - Name: ROOTPASS
              Value: omero
            - Name: S3_BUCKET
              Value: !Ref S3Bucket
            - Name: CONFIG_omero_db_host
              Value: !GetAtt PostgresECSLoadBalancer.DNSName

  OmeroService:
    Type: AWS::ECS::Service
    Properties:
      Cluster: !Ref ECSCluster
      DesiredCount: 1
      LoadBalancers:
        - ContainerName: omero-master
          ContainerPort: 4064
          LoadBalancerName: !Ref OmeroECSLoadBalancer
      Role: !Ref ECSServiceRole
      TaskDefinition: !Ref OmeroTaskDefinition
  # END OMERO-Master

  # START OMERO-RO

  # OMEROROStack:
  #   Type: AWS::CloudFormation::Stack
  #   DependsOn:
  #     - ECSServiceRole
  #     - PostgresStack
  #     - OMEROMasterStack
  #   Properties:
  #     Parameters:
  #       MasterStackName: !Ref AWS::StackName
  #       VpcId: !Ref VpcId
  #       SubnetIds: !Join
  #         - ', '
  #         - !Ref SubnetIds
  #       SecurityGroupId: !If
  #         - CreateNewSecurityGroup
  #         - !Ref EcsSecurityGroup
  #         - !Ref SecurityGroupId
  #       ECSServiceRole: !Ref ECSServiceRole
  #       ECSCluster: !Ref ECSCluster
  #       CloudwatchLogsGroup: !Ref CloudwatchLogsGroup
  #       PostgresConnection: !GetAtt PostgresStack.Outputs.DNSName
  #     TemplateURL: !Ref OMEROROStackTemplate
  #     TimeoutInMinutes: 15

  # END OMERO-RO

  # START OMERO.web/nginx
  WebECSALB:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Scheme: internet-facing
      LoadBalancerAttributes:
        - Key: idle_timeout.timeout_seconds
          Value: 30
      Subnets: !Ref SubnetIds
      SecurityGroups:
        - !If [ CreateNewSecurityGroup, !Ref EcsSecurityGroup, !Ref SecurityGroupId ]

  WebALBListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref WebTargetGroup
      LoadBalancerArn: !Ref WebECSALB
      Port: 80
      Protocol: HTTP

  # TODO Rely on DefaultAction in Listener instead for this catch all?
  # WebALBListenerRuleNginx:
  #   Type: AWS::ElasticLoadBalancingV2::ListenerRule
  #   DependsOn: WebALBListener
  #   Properties:
  #     Actions:
  #       - Type: forward
  #         TargetGroupArn: !Ref WebTargetGroup
  #     Conditions:
  #       - Field: path-pattern
  #         Values:
  #           - /
  #     ListenerArn: !Ref WebALBListener
  #     Priority: 2

  WebTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    DependsOn: WebECSALB
    Properties:
      HealthCheckIntervalSeconds: 60
      HealthCheckProtocol: HTTP
      HealthCheckTimeoutSeconds: 5
      HealthyThresholdCount: 2
      UnhealthyThresholdCount: 2
      # TODO A static resource instead?
      HealthCheckPath: /webclient/login/
      Matcher:
        HttpCode: 200
      Port: 80
      Protocol: HTTP
      VpcId: !Ref VpcId

  WebTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: !Sub ${AWS::StackName}-omero-nginx
      ContainerDefinitions:
        - Name: web
          Cpu: 500
          Essential: true
          Image: dpwrussell/omero-web-extended
          Memory: 500
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: !Ref CloudwatchLogsGroup
              awslogs-region: !Ref AWS::Region
              awslogs-stream-prefix: omero-web
          PortMappings:
            - ContainerPort: 4080
          #     HostPort: 4080
          Environment:
            - Name: CONFIG_omero_web_session__engine
              Value: django.contrib.sessions.backends.cache
            - Name: CONFIG_omero_web_caches
              Value: !Sub '{"default": {"BACKEND": "django_redis.cache.RedisCache", "LOCATION": "redis://:redis@${RedisECSLoadBalancer.DNSName}:6379/0"}}'
            - Name: CONFIG_omero_web_public_enabled
              Value: "true"
            - Name: CONFIG_omero_web_public_user
              Value: public-user
            - Name: CONFIG_omero_web_public_password
              Value: omero
            - Name: CONFIG_omero_web_public_url__filter
              Value: "^/(?!webadmin|webclient/(action|logout|annotate_(file|tags|comment|rating|map)|script_ui|ome_tiff|figure_script)|webgateway/(archived_files|download_as))"
            - Name: OMEROHOST
              Value: !GetAtt OmeroECSLoadBalancer.DNSName
        - Name: nginx
          Cpu: 250
          Essential: true
          Image: sorgerlab/omero-nginx
          Memory: 250
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: !Ref CloudwatchLogsGroup
              awslogs-region: !Ref AWS::Region
              awslogs-stream-prefix: omero-nginx
          PortMappings:
            - ContainerPort: 80
          #     HostPort: 80
            # - ContainerPort: 8443
            #   HostPort: 443
          Links:
            - web

  WebService:
    Type: AWS::ECS::Service
    DependsOn:
      - WebALBListener
    Properties:
      Cluster: !Ref ECSCluster
      DesiredCount: 1
      LoadBalancers:
        - ContainerName: nginx
          ContainerPort: 80
          TargetGroupArn: !Ref WebTargetGroup
      Role: !Ref ECSServiceRole
      TaskDefinition: !Ref WebTaskDefinition
  # END OMERO.web/nginx

  # TODO Make microservices optional
  # START omero-ms-thumbnail
  # TODO what to use for healthcheck
  WebALBListenerRuleMSThumbnail:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      Actions:
        - Type: forward
          TargetGroupArn: !Ref MSThumbnailTargetGroup
      Conditions:
        - Field: path-pattern
          Values:
            - /*/render_thumbnail/*
      ListenerArn: !Ref WebALBListener
      Priority: 1

  MSThumbnailTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckIntervalSeconds: 60
      HealthCheckProtocol: HTTP
      HealthCheckTimeoutSeconds: 5
      HealthyThresholdCount: 2
      UnhealthyThresholdCount: 2
      HealthCheckPath: /webclient/render_thumbnail/1
      Matcher:
        HttpCode: 200,302,404,401,402,403
      Port: 8080
      Protocol: HTTP
      VpcId: !Ref VpcId

  MSThumbnailTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: !Sub ${AWS::StackName}-omero-ms-thumbnail
      ContainerDefinitions:
        - Name: ms-thumbnail
          Cpu: 500
          Essential: true
          Image: sorgerlab/omero-ms-thumbnail
          Memory: 500
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: !Ref CloudwatchLogsGroup
              awslogs-region: !Ref AWS::Region
              awslogs-stream-prefix: omero-ms-thumbnail
          PortMappings:
            - ContainerPort: 8080
              # HostPort: 8080
          Environment:
            - Name: OMEROHOST
              Value: !GetAtt OmeroECSLoadBalancer.DNSName
            - Name: REDISHOST
              Value: !GetAtt RedisECSLoadBalancer.DNSName
            - Name: REDIS_PASSWORD
              Value: redis

  MSThumbnailService:
    Type: AWS::ECS::Service
    DependsOn:
      - WebALBListener
      - WebALBListenerRuleMSThumbnail
    Properties:
      Cluster: !Ref ECSCluster
      DesiredCount: 1
      LoadBalancers:
        - ContainerName: ms-thumbnail
          ContainerPort: 8080
          TargetGroupArn: !Ref MSThumbnailTargetGroup
      Role: !Ref ECSServiceRole
      TaskDefinition: !Ref MSThumbnailTaskDefinition
  # END omero-ms-thumbnail

  # START omero-ms-image-region
  # TODO what to use for healthcheck
  WebALBListenerRuleMSImageRegion:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      Actions:
        - Type: forward
          TargetGroupArn: !Ref MSImageRegionTargetGroup
      Conditions:
        - Field: path-pattern
          Values:
            - /*/render_image_region/*
      ListenerArn: !Ref WebALBListener
      Priority: 2

  MSImageRegionTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckIntervalSeconds: 60
      HealthCheckProtocol: HTTP
      HealthCheckTimeoutSeconds: 5
      HealthyThresholdCount: 2
      UnhealthyThresholdCount: 2
      HealthCheckPath: /webclient/render_image_region/1/
      Matcher:
        HttpCode: 200,302,404,401,402,403
      Port: 8080
      Protocol: HTTP
      VpcId: !Ref VpcId

  MSImageRegionTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: !Sub ${AWS::StackName}-omero-ms-image-region
      ContainerDefinitions:
        - Name: ms-image-region
          Cpu: 500
          Essential: true
          Image: sorgerlab/omero-ms-image-region
          Memory: 500
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: !Ref CloudwatchLogsGroup
              awslogs-region: !Ref AWS::Region
              awslogs-stream-prefix: omero-ms-image-region
          PortMappings:
            - ContainerPort: 8080
              # HostPort: 8080
          Environment:
            - Name: OMEROHOST
              Value: !GetAtt OmeroECSLoadBalancer.DNSName
            - Name: REDISHOST
              Value: !GetAtt RedisECSLoadBalancer.DNSName
            - Name: REDIS_PASSWORD
              Value: redis

  MSImageRegionService:
    Type: AWS::ECS::Service
    DependsOn:
      - WebALBListener
      - WebALBListenerRuleMSImageRegion
    Properties:
      Cluster: !Ref ECSCluster
      DesiredCount: 1
      LoadBalancers:
        - ContainerName: ms-image-region
          ContainerPort: 8080
          TargetGroupArn: !Ref MSImageRegionTargetGroup
      Role: !Ref ECSServiceRole
      TaskDefinition: !Ref MSImageRegionTaskDefinition
  # END omero-ms-image-region

  # START omero-ms-pixel-buffer
  WebALBListenerRuleMSPixelBuffer:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      Actions:
        - Type: forward
          TargetGroupArn: !Ref MSPixelBufferTargetGroup
      Conditions:
        - Field: path-pattern
          Values:
            - /tile/*
      ListenerArn: !Ref WebALBListener
      Priority: 3

  MSPixelBufferTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckIntervalSeconds: 60
      HealthCheckProtocol: HTTP
      HealthCheckTimeoutSeconds: 5
      HealthyThresholdCount: 2
      UnhealthyThresholdCount: 2
      HealthCheckPath: /tile/1/1/1/1/1/1/1/1
      Matcher:
        HttpCode: 200,302,404,401,402,403
      Port: 8080
      Protocol: HTTP
      VpcId: !Ref VpcId

  MSPixelBufferTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: !Sub ${AWS::StackName}-omero-ms-pixel-buffer
      Volumes:
        - Name: OMERO_DATA
          Host:
            SourcePath: /mnt/OMERO_DATA
      ContainerDefinitions:
        - Name: ms-pixel-buffer
          Cpu: 500
          Essential: true
          Image: sorgerlab/omero-ms-pixel-buffer
          Memory: 500
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: !Ref CloudwatchLogsGroup
              awslogs-region: !Ref AWS::Region
              awslogs-stream-prefix: omero-ms-pixel-buffer
          MountPoints:
            - ContainerPath: /OMERO
              SourceVolume: OMERO_DATA
              # TODO Can this be less permissive?
              ReadOnly: false
          PortMappings:
            - ContainerPort: 8080
              # HostPort: 8080
          Environment:
            - Name: OMEROHOST
              Value: !GetAtt OmeroECSLoadBalancer.DNSName
            - Name: REDISHOST
              Value: !GetAtt RedisECSLoadBalancer.DNSName
            - Name: REDIS_PASSWORD
              Value: redis
            - Name: DBHOST
              Value: !GetAtt PostgresECSLoadBalancer.DNSName
            - Name: DBPASSWORD
              Value: postgres

  MSPixelBufferService:
    Type: AWS::ECS::Service
    DependsOn:
      - WebALBListener
      - WebALBListenerRuleMSPixelBuffer
    Properties:
      Cluster: !Ref ECSCluster
      DesiredCount: 1
      LoadBalancers:
        - ContainerName: ms-pixel-buffer
          ContainerPort: 8080
          TargetGroupArn: !Ref MSPixelBufferTargetGroup
      Role: !Ref ECSServiceRole
      TaskDefinition: !Ref MSPixelBufferTaskDefinition
    # END omero-ms-pixel-buffer-ms

  ECSServiceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ecs.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: !Sub ${AWS::StackName}-ecs-service
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - elasticloadbalancing:DeregisterInstancesFromLoadBalancer
                  - elasticloadbalancing:DeregisterTargets
                  - elasticloadbalancing:Describe*
                  - elasticloadbalancing:RegisterInstancesWithLoadBalancer
                  - elasticloadbalancing:RegisterTargets
                  - ec2:Describe*
                  - ec2:AuthorizeSecurityGroupIngress
                Resource:
                  - '*'

  EcsInstanceLc:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      ImageId: !FindInMap [AWSRegionToAMI, !Ref 'AWS::Region', AMIID]
      InstanceType: !Ref EcsInstanceType
      AssociatePublicIpAddress: true
      IamInstanceProfile: !Ref IamRoleInstanceProfile
      KeyName: !Ref KeyName
      SecurityGroups:
        - !If [ CreateNewSecurityGroup, !Ref EcsSecurityGroup, !Ref SecurityGroupId ]
      BlockDeviceMappings: !If
        - CreateEBSVolumes
        -
          - !If
            - CreateEBSVolumeForECS
            - DeviceName: /dev/xvdcz
              Ebs:
               VolumeSize: !Ref EBSVolumeSizeForECS
               VolumeType: !Ref EBSVolumeTypeForECS
            - !Ref AWS::NoValue
          - !If
            - CreateEBSVolumeForData
            - DeviceName: !Ref DeviceNameForData
              Ebs:
               VolumeSize: !Ref EBSVolumeSizeForData
               VolumeType: !Ref EBSVolumeTypeForData
            - !Ref AWS::NoValue
        - !Ref AWS::NoValue
      UserData:
        Fn::Base64: !Join
          - ''
          -
            - !Sub |
              #!/bin/bash
              # Install Tools
              yum install -y aws-cfn-bootstrap nfs-utils
              # Mount Volume
              mkdir /mnt/OMERO_DATA
            - !If
              - SetDataFSToEFS
              - !Sub |
                # Mount EFS Volume
                echo "${OMEROEFS}.efs.${AWS::Region}.amazonaws.com:/ /mnt/OMERO_DATA nfs4 nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2 0 2" >> /etc/fstab
                WAIT_TIME=2
                until mount /mnt/OMERO_DATA || [ $WAIT_TIME -eq 512 ]; do
                  echo "sleeping $WAIT_TIME"
                  sleep $WAIT_TIME
                  WAIT_TIME=$[WAIT_TIME*2]
                done
                if [ $WAIT_TIME -eq 512 ]; then
                  echo "Sending failure signal"
                  /opt/aws/bin/cfn-signal -s false --stack ${AWS::StackName} --resource EcsInstanceAsg --region ${AWS::Region}
                  exit 1
                fi
                # Docker must be restarted or it can not see the NFS mount
                service docker restart
              - !Ref AWS::NoValue
            - !If
              - CreateEBSVolumeForData
              - !Sub |
                mkfs -t ext4 ${DeviceNameForData}
                echo "${DeviceNameForData} /mnt/OMERO_DATA ext4 defaults,nofail 0 2" >> /etc/fstab
                mount /mnt/OMERO_DATA
              - !Ref AWS::NoValue
            - !Sub |
              # Configure ECS
              mkdir -p /etc/ecs
              echo ECS_CLUSTER=${ECSCluster} >> /etc/ecs/ecs.config
              /opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource EcsInstanceAsg --region ${AWS::Region}

  EcsInstanceAsg:
    Type: AWS::AutoScaling::AutoScalingGroup
    #DependsOn: !If [ SetDataFSToEFS, OMEROEFSMountTarget, !Ref AWS::NoValue ]
    Properties:
      VPCZoneIdentifier: !Ref SubnetIds
      LaunchConfigurationName: !Ref EcsInstanceLc
      MinSize: 0
      MaxSize: !Ref AsgMaxSize
      DesiredCapacity: !Ref AsgMaxSize
      Tags:
        - Key: Name
          Value: !Sub "Stack - ECS Instance - ${AWS::StackName}"
          PropagateAtLaunch: true
        - !If
          - LinkTag
          - Key: project
            Value: !Ref Tag
            PropagateAtLaunch: true
          - !Ref AWS::NoValue
    CreationPolicy:
      ResourceSignal:
        Timeout: PT15M

Outputs:
  PostgresDNSName:
    Value: !GetAtt PostgresECSLoadBalancer.DNSName
  OmeroDNSName:
    Value: !GetAtt OmeroECSLoadBalancer.DNSName
  RedisDNSName:
    Value: !GetAtt RedisECSLoadBalancer.DNSName
  WebDNSName:
    Value: !GetAtt WebECSALB.DNSName

#   EcsInstanceAsgName:
#     Description: Auto Scaling Group Name for ECS Instances
#     Value: !Ref EcsInstanceAsg
#   taskdef:
#     Value: !Ref TaskDefinition