kong-elb-postgres.yml

AWSTemplateFormatVersion: '2010-09-09'
Description: Kong CloudFormation template. Creates load balanced Kong instances (cluster)
  with Postgres RDS instance in an existing VPC
Parameters:
  # Kong Instance Config
  KongVersion:
    Description: Kong version (Only 0.9.x and above supported)
    Type: String
    Default: 0.10.3
    AllowedValues:
    - 0.10.3
    - 0.10.2
    - 0.10.1
    - 0.10.0
    - 0.9.9
    - 0.9.8
    - 0.9.7
    - 0.9.6
    - 0.9.5
    - 0.9.4
    - 0.9.3
    - 0.9.2
    - 0.9.1
    - 0.9.0
  KongKeyName:
    Description: Required - Name of an existing EC2 KeyPair to enable SSH access to
      the instances for Kong
    Type: AWS::EC2::KeyPair::KeyName
    Default: ''
  KongInstanceType:
    Description: 'Kong EC2 instance type'
    Type: String
    Default: m3.medium
    AllowedValues:
    - t2.small
    - t2.micro
    - t2.medium
    - t2.large
    - m3.medium
    - m3.large
    - m3.xlarge
    - m3.2xlarge
    - m4.large
    - m4.xlarge
    - m4.2xlarge
    - m4.4xlarge
    - m4.10xlarge
    - c3.large
    - c3.xlarge
    - c3.2xlarge
    - c3.4xlarge
    - c3.8xlarge
    - c4.large
    - c4.xlarge
    - c4.xlarge
    - c4.2xlarge
    - c4.4xlarge
    - c4.8xlarge
    - r3.large
    - r3.xlarge
    - r3.2xlarge
    - r3.4xlarge
    - r3.8xlarge
    ConstraintDescription: must be a valid EC2 instance type.
  SubnetIds:
    Type: List<AWS::EC2::Subnet::Id>
    Description: Required - Existing VPC Subnets where EC2 instances and RDS instances will run. (private)
    Default: ''
  SecurityGroupForSSH:
    Description: Optional - Security group which is allowed SSH access to Kong instances
    Type: AWS::EC2::SecurityGroup::Id
  
  # Kong Fleet Config  
  KongFleetMinSize:
    Description: Min Number of Kong instances
    Type: Number
    Default: '1'
    MinValue: '1'
  KongFleetMaxSize:
    Description: Max Number of Kong instances
    Type: Number
    Default: '3'
    MinValue: '1'
  KongFleetDesiredSize:
    Description: Desired Number of Kong instances
    Type: Number
    Default: '2'
    MinValue: '1'
    
  # Kong Database Config
  DBHost:
    Description: Optional - The database host dns, leave blank to start a new RDS instance
    Type: String
  DBPort:
    Default: '5432'
    Description: Conditional - required if DBHost provided. The database port
    Type: String
    AllowedPattern: '[0-9]+'
    ConstraintDescription: must be a valid port number
  DBName:
    Default: kong
    Description: Required - The database name
    Type: String
    MinLength: '1'
    AllowedPattern: '[a-zA-Z][a-zA-Z0-9]*'
    ConstraintDescription: must begin with a letter and contain only alphanumeric
      characters.
  DBUsername:
    Default: kong
    Description: Required - The database admin account username
    Type: String
    MinLength: '1'
    AllowedPattern: '[a-zA-Z][a-zA-Z0-9]*'
    ConstraintDescription: must begin with a letter and contain only alphanumeric
      characters.
  DBPassword:
    Default: changeit
    NoEcho: 'true'
    Description: Required - The database admin account password
    Type: String
    MinLength: '8'
  DBClass:
    Default: db.m1.small
    Description: Database instance class
    Type: String
    AllowedValues:
    - db.t2.micro
    - db.t2.small
    - db.t2.medium
    - db.t2.large
    - db.m1.small
    - db.m1.large
    - db.m1.xlarge
    - db.m2.xlarge
    - db.m4.large
    - db.m4.xlarge
    - db.m4.2xlarge
    - db.m4.4xlarge
    - db.m4.10xlarge
    - db.m3.medium
    - db.m3.large
    - db.m3.xlarge
    - db.m3.2xlarge
    - db.r3.large
    - db.r3.xlarge
    - db.r3.2xlarge
    - db.r3.4xlarge
    - db.r3.8xlarge
    ConstraintDescription: must select a valid database instance type.
  DBVersion:
    Description: Postgres version
    Type: String
    Default: 9.4.7
    AllowedValues:
    - 9.5.2
    - 9.4.7
    - 9.4.5
    - 9.4.4
    - 9.4.1
  DBMultiAZ:
    Default: false
    Description: 'Allow MultiAZ database deployment '
    Type: String
    AllowedValues:
    - true
    - false
  DBSnapshotIdentifier:
    Description: Optional - The RDS snapshot name to restore to the new DB instance.
    Type: String
    Default: ''
  DBStorageType:
    Description: Storage Type for RDS volume
    Type: String
    Default: gp2
    AllowedValues:
    - gp2
    - standard
  DBAllocatedStorage:
    Default: '5'
    Description: The size of the database (Gb)
    Type: Number
    MinValue: '5'
    MaxValue: '6144'
    ConstraintDescription: must be between 5+
  DBStorageEncrypted:
    Default: false
    Description: Specifies whether the DB instance is encrypted
    Type: String
    AllowedValues:
    - true
    - false
    
  # Load Balancer Config
  ELBSubnetIds:
    Type: List<AWS::EC2::Subnet::Id>
    Description: Required - Existing Subnets in which ELB instances will run. (public)
    Default: ''
  KongProxyAccess:
    Description: The IP address range that can be used to access the Kong proxy
    Type: String
    MinLength: '9'
    MaxLength: '18'
    Default: 0.0.0.0/0
    AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})
    ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x.
  KongAdminAccessEnabled:
      Default: 'no'
      Description: Allow public access to Kong Admin
      Type: String
      AllowedValues:
      - 'yes'
      - 'no'  
  KongAdminPort:
    Description: The port at which to expose the Kong Admin dashboard
    Type: String
    Default: '8080'
    MinLength: '2'
    MaxLength: '6'
    AllowedPattern: (\d{2,6})
    ConstraintDescription: must be a valid port  
  KongAdminAccess:
    Description: The IP address range that can be used to access the Kong Admin port
    Type: String
    MinLength: '9'
    MaxLength: '18'
    Default: 0.0.0.0/0
    AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})
    ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x.
  KinesisStackName:
    Type: String
    Description: Optional - Name of the CF stack used to create the Kinesis stream. Leave blank to skip filter creation.
  CloudFormationLogGroup:
    Description: Name of CloudFormation log group. All cloud-init based logs will be sent here
    Type: String
    Default: 'CloudFormation'
  VpcId:
    Type: AWS::EC2::VPC::Id
    Description: Required - VPC Id of existing VPC

Metadata: 
  AWS::CloudFormation::Interface: 
    ParameterGroups: 
      - Label: 
          default: "Kong Instance Configuration"
        Parameters: 
          - KongVersion
          - KongKeyName
          - KongInstanceType
          - SubnetIds
          - SecurityGroupForSSH
      - Label: 
          default: "Kong Fleet Configuration"
        Parameters: 
          - KongFleetMinSize
          - KongFleetMaxSize
          - KongFleetDesiredSize
      - Label: 
          default: "Kong Postgres Configuration"
        Parameters: 
          - DBHost
          - DBPort
          - DBName
          - DBUsername
          - DBPassword
          - DBClass
          - DBVersion
          - DBMultiAZ
          - DBSnapshotIdentifier
          - DBStorageType
          - DBAllocatedStorage
          - DBStorageEncrypted
      - Label: 
          default: "Load Balancer Configuration"
        Parameters: 
          - ELBSubnetIds
          - KongProxyAccess
          - KongAdminAccessEnabled
          - KongAdminPort
          - KongAdminAccess
      - Label: 
          default: "Logging"
        Parameters: 
          - KinesisStackName
          - CloudFormationLogGroup
      - Label: 
          default: "Network Configuration"
        Parameters: 
          - VpcId
      
    ParameterLabels: 
      VpcId: 
        default: "Which VPC should this be deployed to?"
      KongAdminAccessEnabled:
        default: "Enable public access to Kong Admin port?"
Mappings:
  RegionKongAmiMap:
    us-east-1:
      HVM: ami-1ecae776
    us-west-1:
      HVM: ami-d114f295
    us-west-2:
      HVM: ami-e7527ed7
    eu-west-1:
      HVM: ami-a10897d6
    ap-northeast-1:
      HVM: ami-cbf90ecb
    ap-southeast-1:
      HVM: ami-68d8e93a
    ap-southeast-2:
      HVM: ami-fd9cecc7
    sa-east-1:
      HVM: ami-b52890a8
Conditions:
  CreateRDS: !Equals [!Ref 'DBHost', '']
  UseDbSnapshot: !Not [!Equals [!Ref 'DBSnapshotIdentifier', '']]
  CreateAdminIngress: !Equals [!Ref 'KongAdminAccessEnabled', 'yes']
  CreateSubscriptionFilter: !Not [!Equals [!Ref 'KinesisStackName', '']]
  AllowSSHAccess: !Not [!Equals [!Ref 'SecurityGroupForSSH', '']] 
Resources:
  LogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      RetentionInDays: 14
      LogGroupName: !Ref 'AWS::StackName'
  SubscriptionFilter:
    Type: AWS::Logs::SubscriptionFilter
    Condition: CreateSubscriptionFilter
    DependsOn:
    - LogGroup
    Properties:
      RoleArn: !ImportValue
        Fn::Sub: ${KinesisStackName}-Role-Arn
      LogGroupName: !Ref 'LogGroup'
      FilterPattern: ''
      DestinationArn: !ImportValue
        Fn::Sub: ${KinesisStackName}-Stream-Arn
  KongRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - ec2.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: /
      Policies:
      - PolicyName: root
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            - logs:DescribeLogStreams
            Resource:
            - arn:aws:logs:*:*:*
  KongInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
      - !Ref 'KongRole'
  KongLoadBalancer:
    Type: AWS::ElasticLoadBalancing::LoadBalancer
    Properties:
      SecurityGroups:
      - !Ref 'LoadBalancerSecurityGroup'
      Subnets: !Ref 'ELBSubnetIds'
      CrossZone: 'true'
      Listeners:
      - LoadBalancerPort: '443'
        InstancePort: '8443'
        Protocol: TCP
      - LoadBalancerPort: !Ref 'KongAdminPort'
        InstancePort: '8001'
        Protocol: HTTP
      HealthCheck:
        Target: TCP:8443
        HealthyThreshold: '3'
        UnhealthyThreshold: '5'
        Interval: '90'
        Timeout: '60'
  LoadBalancerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Enable HTTPS access to Kong Proxy
      VpcId: !Ref 'VpcId'
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: '443'
        ToPort: '443'
        CidrIp: !Ref 'KongProxyAccess'
  KongAdminIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Condition: CreateAdminIngress
    Properties:
      GroupId: !GetAtt LoadBalancerSecurityGroup.GroupId
      IpProtocol: tcp
      FromPort: !Ref 'KongAdminPort'
      ToPort: !Ref 'KongAdminPort'
      CidrIp: !Ref 'KongAdminAccess'
  KongAutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    CreationPolicy:
      ResourceSignal:
        Count: !Ref 'KongFleetDesiredSize'
        Timeout: PT30M
    Properties:
      VPCZoneIdentifier: !Ref 'SubnetIds'
      LaunchConfigurationName: !Ref 'KongLaunchConfig'
      MinSize: !Ref 'KongFleetMinSize'
      MaxSize: !Ref 'KongFleetMaxSize'
      DesiredCapacity: !Ref 'KongFleetDesiredSize'
      LoadBalancerNames:
      - !Ref 'KongLoadBalancer'
      Tags:
      - Key: Name
        Value: !Sub '${AWS::StackName} - Instance'
        PropagateAtLaunch: 'true'
    UpdatePolicy:
      AutoScalingScheduledAction:
        IgnoreUnmodifiedGroupSizeProperties: 'true'
      AutoScalingRollingUpdate:
        MaxBatchSize: 2
        MinInstancesInService: 2
        PauseTime: PT5M
  ApiGatewayScaleUpPolicy:
    Type: AWS::AutoScaling::ScalingPolicy
    Properties:
      AdjustmentType: ChangeInCapacity
      PolicyType: SimpleScaling
      Cooldown: '300'
      AutoScalingGroupName: !Ref 'KongAutoScalingGroup'
      ScalingAdjustment: 2
  ApiGatewayScaleDownPolicy:
    Type: AWS::AutoScaling::ScalingPolicy
    Properties:
      AdjustmentType: ChangeInCapacity
      PolicyType: SimpleScaling
      Cooldown: '300'
      AutoScalingGroupName: !Ref 'KongAutoScalingGroup'
      ScalingAdjustment: -1
  KongLaunchConfig:
    DependsOn:
    - PostgresDB
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      IamInstanceProfile: !Ref 'KongInstanceProfile'
      AssociatePublicIpAddress: false
      ImageId: !FindInMap [RegionKongAmiMap, !Ref 'AWS::Region', HVM]
      InstanceType: !Ref 'KongInstanceType'
      KeyName: !Ref 'KongKeyName'
      SecurityGroups:
      - !Ref 'KongSecurityGroup'
      UserData:
        "Fn::Base64": !Sub |
          #!/bin/bash
          yum install -y aws-cfn-bootstrap jq
          /opt/aws/bin/cfn-init -v --region ${AWS::Region} --stack ${AWS::StackName} --resource KongLaunchConfig --configsets full_install
          /opt/aws/bin/cfn-signal -e $? --region ${AWS::Region} --stack ${AWS::StackName} --resource KongAutoScalingGroup
    Metadata:
      AWS::CloudFormation::Init:
        configSets:
          full_install:
          - install_cfn_hooks
          - install_logging
          - install_kong
        install_cfn_hooks:
          files:
            "/etc/cfn/cfn-hup.conf":
              content: !Sub |
                [main]
                stack=${AWS::StackId}
                region=${AWS::Region}
              mode: '000400'
              owner: root
              group: root
            "/etc/cfn/hooks.d/cfn-auto-reloader.conf":
              content: !Sub |
                [cfn-auto-reloader-hook]
                triggers=post.update
                path=Resources.KongLaunchConfig.Metadata.AWS::CloudFormation::Init
                action=/opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource KongLaunchConfig --configsets full_install
          services:
            sysvinit:
              cfn-hup:
                enabled: 'true'
                ensureRunning: 'true'
                files:
                - /etc/cfn/cfn-hup.conf
                - /etc/cfn/hooks.d/cfn-auto-reloader.conf
        install_logging:
          # Set up AWS logging for Kong and log any cloud formation events to the CloudFormation log group
          packages:
            yum :
              awslogs: []
          files:
            "/etc/awslogs/awslogs.conf":
              mode: '000444'
              owner: root
              group: root
              content: !Sub |
                [general]
                state_file = /var/awslogs/state/agent-state
                use_gzip_http_content_encoding = true
                
                [kong-admin-acc-log]
                file = /usr/local/kong/logs/admin_access.log
                log_group_name = ${AWS::StackName}
                log_stream_name = {instance_id}
                datetime_format = %Y-%m-%dT%H:%M:%SZ
                
                [kong-acc-log]
                file = /usr/local/kong/logs/access.log
                log_group_name = ${AWS::StackName}
                log_stream_name = {instance_id}
                datetime_format = %Y-%m-%dT%H:%M:%SZ
                
                [kong-error-log]
                file = /usr/local/kong/logs/error.log
                log_group_name = ${AWS::StackName}
                log_stream_name = {instance_id}
                datetime_format = %Y-%m-%dT%H:%M:%SZ
                
                [kong-service-log]
                file = /var/log/kong.log
                log_group_name = ${AWS::StackName}
                log_stream_name = {instance_id}/kong.log
                datetime_format =
                              
                [/var/log/cloud-init.log]
                file = /var/log/cloud-init.log
                log_group_name = ${CloudFormationLogGroup}
                log_stream_name = {instance_id}/cloud-init.log
                datetime_format = 
                
                [/var/log/cloud-init-output.log]
                file = /var/log/cloud-init-output.log
                log_group_name = ${CloudFormationLogGroup}
                log_stream_name = {instance_id}/cloud-init-output.log
                datetime_format = 
                
                [/var/log/cfn-init.log]
                file = /var/log/cfn-init.log
                log_group_name = ${CloudFormationLogGroup}
                log_stream_name = {instance_id}/cfn-init.log
                datetime_format = 
                
                [/var/log/cfn-hup.log]
                file = /var/log/cfn-hup.log
                log_group_name = ${CloudFormationLogGroup}
                log_stream_name = {instance_id}/cfn-hup.log
                datetime_format = 
                
                [/var/log/cfn-wire.log]
                file = /var/log/cfn-wire.log
                log_group_name = ${CloudFormationLogGroup}
                log_stream_name = {instance_id}/cfn-wire.log
                datetime_format = 
                
            "/etc/awslogs/awscli.conf":
              mode: '000444'
              owner: root
              group: root            
              content: !Sub |
                [plugins]
                cwlogs = cwlogs
                
                [default]
                region = ${AWS::Region}
                
          commands:      
            01_create_state_directory:
              command: |
                #!/bin/bash
                
                mkdir -p /var/awslogs/state
                touch /usr/local/kong/logs/error.log
                touch /usr/local/kong/logs/admin-access.log
                touch /usr/local/kong/logs/access.log
                touch /var/log/kong.log
                
          services:
            sysvinit:
              awslogs:
                enabled: 'true'
                ensureRunning: 'true'
                files:
                - /etc/awslogs/awslogs.conf
        install_kong:
          packages:
            yum:
              epel-release: []
          files:
            "/etc/init.d/kong":
              mode: '000755'
              owner: root
              group: root
              content: !Sub |
                #!/bin/sh
                #
                # Kong               Start/Stop the Kong
                #
                # chkconfig: 2345 95 25
                # description:      This script is responsible for running Kong
                #
                #
                ### BEGIN INIT INFO
                # Provides:          kong
                # Required-Start:    networking
                # Required-Stop:     networking
                # Default-Start:
                # Default-Stop:      0 1 2 3 4 5 6
                # Short-Description: Kong service
                # Description:       This script is responsible for running Kong
                
                ### END INIT INFO
                
                # Version: 1.1.2-rpm
                
                NICELEVEL=+4
                
                export HOME
                
                # Source function library.
                . /etc/rc.d/init.d/functions
                
                prog=kong
                exec="/usr/local/bin/kong"
                
                start() {
                    if [ $UID -ne 0 ] ; then
                        echo "Use has insufficient privilege."
                        exit 4
                    fi
                    [ -x $exec ] || exit 5
                    echo -n $"Starting $prog: "
                    
                    echo -n $"Waiting with random delay before starting node"
                    sleep `echo $(( RANDOM % ( 120 - 30 + 1 ) + 30 ))`
                                      
                    COUNTER=0
                    
                    while [ $COUNTER -lt 4 ]; do
                        $exec health >> /var/log/kong.log
                        if [[ $? -ne 0 ]]; then
                            echo "trying to start kong.."
                            $exec start >> /var/log/kong.log
                            let COUNTER=COUNTER+1
                            sleep `echo $(( RANDOM % ( 120 - 30 + 1 ) + 30 ))`
                        else
                            break 
                        fi
                    done
                    
                    if ! $exec health; then
                        echo -n $"failed to start kong, exiting..."
                        exit 1;
                    fi
                    
                    retval=$?
                    return $retval
                }
                
                stop() {
                    if [ $UID -ne 0 ] ; then
                        echo "User has insufficient privilege."
                        exit 4
                    fi
                    echo -n $"Stopping $prog: "
                    su -s /bin/sh -c "$exec stop" ec2-user >> /var/log/kong.log
                    retval=$?
                    return $retval
                }
                
                restart() {
                    stop
                    start
                }
                
                rh_status() {
                    $exec health
                    retval=$?
                    return $retval
                }
                
                case "$1" in
                
                    start)
                        $1
                        ;;
                    stop)
                        $1
                        ;;
                    restart)
                        $1
                        ;;
                    status)
                        rh_status
                        ;;
                    *)
                        echo "Usage: $0 {start|stop|status|restart}"
                        exit 2
                        ;;
                esac
                exit $?
            "/etc/kong.conf":
              mode: '000644'
              owner: root
              group: root
              content: !Sub
                - |
                  # Database
                  database = postgres
                  pg_host = ${PGHost}
                  pg_port = ${PGPort}
                  pg_database = ${PGDatabase}
                  pg_user = ${PGUser}
                  pg_password = ${PGPassword}
                  
                  # Serf
                  serf_path = /usr/local/bin/serf
                - PGHost:
                    Fn::If:
                    - 'CreateRDS'
                    - !GetAtt PostgresDB.Endpoint.Address
                    - !Ref 'DBHost'
                  PGPort:
                    Fn::If:
                    - 'CreateRDS'
                    - !GetAtt PostgresDB.Endpoint.Port
                    - !Ref 'DBPort'
                  PGDatabase: !Ref 'DBName'
                  PGUser: !Ref 'DBUsername'
                  PGPassword: !Ref 'DBPassword'  
          commands:
            01_file_limits:
              command: |
                #!/bin/bash
                
                # Set higher ulimit
                limit=65535
                limit_file=/etc/security/limits.conf
                
                echo "fs.file-max = $((limit + 1))" >> /etc/sysctl.conf
                sysctl -p
                                
                echo "* soft nproc  $limit" >> $limit_file
                echo "* hard nproc  $limit" >> $limit_file
                echo "* soft nofile $limit" >> $limit_file
                echo "* hard nofile $limit" >> $limit_file
                 
            02_kong:
              command: !Sub |
                #!/bin/bash
                
                kong_version=${KongVersion}
                
                wget -O kong.rpm https://github.com/Mashape/kong/releases/download/$kong_version/kong-$kong_version.aws.rpm
                yum install -y kong.rpm --nogpgcheck
          services:
            sysvinit:
              kong:
                enabled: 'true'
                ensureRunning: 'true'
                files:
                - /etc/kong.conf
                commands:
                - 02_kong
                                
  KongSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Enable SSH access and HTTP access on the inbound port
      VpcId: !Ref 'VpcId'
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: '8000'
        ToPort: '8001'
        SourceSecurityGroupId: !Ref 'LoadBalancerSecurityGroup'
      - IpProtocol: tcp
        FromPort: '8443'
        ToPort: '8443'
        SourceSecurityGroupId: !Ref 'LoadBalancerSecurityGroup'
        
  KongSerfIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !GetAtt KongSecurityGroup.GroupId
      IpProtocol: tcp
      FromPort: '7946'
      ToPort: '7946'
      SourceSecurityGroupId: !GetAtt KongSecurityGroup.GroupId
  
  KongSSHIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Condition: AllowSSHAccess
    Properties:
      GroupId: !GetAtt KongSecurityGroup.GroupId
      IpProtocol: tcp
      FromPort: '22'
      ToPort: '22'
      SourceSecurityGroupId: !Ref 'SecurityGroupForSSH'
      
  DBSubnetGroup:
    Type: AWS::RDS::DBSubnetGroup
    Condition: CreateRDS
    Properties:
      DBSubnetGroupDescription: Subnets available for the RDS DB Instance
      SubnetIds: !Ref 'SubnetIds'
  PostgresDB:
    Type: AWS::RDS::DBInstance
    Condition: CreateRDS
    Properties:
      Engine: postgres
      DBName: !Ref 'DBName'
      MasterUsername: !Ref 'DBUsername'
      DBInstanceClass: !Ref 'DBClass'
      AllocatedStorage: !Ref 'DBAllocatedStorage'
      MasterUserPassword: !Ref 'DBPassword'
      DBSubnetGroupName: !Ref 'DBSubnetGroup'
      PubliclyAccessible: 'false'
      EngineVersion: !Ref 'DBVersion'
      DBSnapshotIdentifier: !If [UseDbSnapshot, !Ref 'DBSnapshotIdentifier', !Ref 'AWS::NoValue']
      MultiAZ: !Ref 'DBMultiAZ'
      StorageEncrypted: !Ref 'DBStorageEncrypted'
      StorageType: !Ref 'DBStorageType'
      VPCSecurityGroups:
      - !Ref 'DBSecurityGroup'
    DeletionPolicy: Snapshot
  DBSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Condition: CreateRDS
    Properties:
      GroupDescription: Database security groups
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 5432
        ToPort: '5432'
        SourceSecurityGroupId: !Ref 'KongSecurityGroup'
      SecurityGroupEgress:
      - IpProtocol: tcp
        FromPort: '1'
        ToPort: '65535'
        CidrIp: 0.0.0.0/0
      VpcId: !Ref 'VpcId'
Outputs:
  ProxyURL:
    Description: Kong Proxy URL
    Value: !Join ['', ['https://', !GetAtt [KongLoadBalancer, DNSName]]]
  AdminURL:
    Description: Kong Admin URL
    Value: !Join ['', ['http://', !GetAtt [KongLoadBalancer, DNSName], ':', !Ref 'KongAdminPort']]