template.yaml

---
AWSTemplateFormatVersion: '2010-09-09'
Description: 'AWS in Action: chapter 11'
Parameters:
  KeyName:
    Description: 'Key Pair name'
    Type: 'AWS::EC2::KeyPair::KeyName'
    Default: mykey
  BlogTitle:
    Description: 'The title of the blog.'
    Type: String
    Default: 'Amazon Web Services in Action - Example'
  AdminUsername:
    Description: 'A username for admin.'
    Type: String
    Default: admin
  AdminPassword:
    Description: 'A password for admin'
    Type: String
    NoEcho: true
  AdminEMail:
    Description: 'The email address of the administrator.'
    Type: String
Mappings:
  RegionMap:
    'ap-south-1':
      AMI: 'ami-2ed19c41'
    'eu-west-3':
      AMI: 'ami-c8a017b5'
    'eu-west-2':
      AMI: 'ami-e3051987'
    'eu-west-1':
      AMI: 'ami-760aaa0f'
    'ap-northeast-2':
      AMI: 'ami-fc862292'
    'ap-northeast-1':
      AMI: 'ami-2803ac4e'
    'sa-east-1':
      AMI: 'ami-1678037a'
    'ca-central-1':
      AMI: 'ami-ef3b838b'
    'ap-southeast-1':
      AMI: 'ami-dd7935be'
    'ap-southeast-2':
      AMI: 'ami-1a668878'
    'eu-central-1':
      AMI: 'ami-e28d098d'
    'us-east-1':
      AMI: 'ami-6057e21a'
    'us-east-2':
      AMI: 'ami-aa1b34cf'
    'us-west-1':
      AMI: 'ami-1a033c7a'
    'us-west-2':
      AMI: 'ami-32d8124a'
Resources:
  VPC:
    Type: 'AWS::EC2::VPC'
    Properties:
      CidrBlock: '172.31.0.0/16'
      EnableDnsHostnames: true
  InternetGateway:
    Type: 'AWS::EC2::InternetGateway'
    Properties: {}
  VPCGatewayAttachment:
    Type: 'AWS::EC2::VPCGatewayAttachment'
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway
  SubnetA:
    Type: 'AWS::EC2::Subnet'
    Properties:
      AvailabilityZone: !Select [0, !GetAZs '']
      CidrBlock: '172.31.38.0/24'
      VpcId: !Ref VPC
  SubnetB:
    Type: 'AWS::EC2::Subnet'
    Properties:
      AvailabilityZone: !Select [1, !GetAZs '']
      CidrBlock: '172.31.37.0/24'
      VpcId: !Ref VPC
  RouteTable:
    Type: 'AWS::EC2::RouteTable'
    Properties:
      VpcId: !Ref VPC
  RouteTableAssociationA:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      SubnetId: !Ref SubnetA
      RouteTableId: !Ref RouteTable
  RouteTableAssociationB:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      SubnetId: !Ref SubnetB
      RouteTableId: !Ref RouteTable
  RoutePublicNATToInternet:
    Type: 'AWS::EC2::Route'
    Properties:
      RouteTableId: !Ref RouteTable
      DestinationCidrBlock: '0.0.0.0/0'
      GatewayId: !Ref InternetGateway
    DependsOn: VPCGatewayAttachment
  NetworkAcl:
    Type: 'AWS::EC2::NetworkAcl'
    Properties:
      VpcId: !Ref VPC
  SubnetNetworkAclAssociationA:
    Type: 'AWS::EC2::SubnetNetworkAclAssociation'
    Properties:
      SubnetId: !Ref SubnetA
      NetworkAclId: !Ref NetworkAcl
  SubnetNetworkAclAssociationB:
    Type: 'AWS::EC2::SubnetNetworkAclAssociation'
    Properties:
      SubnetId: !Ref SubnetB
      NetworkAclId: !Ref NetworkAcl
  NetworkAclEntryIngress:
    Type: 'AWS::EC2::NetworkAclEntry'
    Properties:
      NetworkAclId: !Ref NetworkAcl
      RuleNumber: 100
      Protocol: -1
      RuleAction: allow
      Egress: false
      CidrBlock: '0.0.0.0/0'
  NetworkAclEntryEgress:
    Type: 'AWS::EC2::NetworkAclEntry'
    Properties:
      NetworkAclId: !Ref NetworkAcl
      RuleNumber: 100
      Protocol: -1
      RuleAction: allow
      Egress: true
      CidrBlock: '0.0.0.0/0'
  LoadBalancer:
    Type: 'AWS::ElasticLoadBalancingV2::LoadBalancer'
    Properties:
      Subnets:
      - Ref: SubnetA
      - Ref: SubnetB
      SecurityGroups:
      - !Ref LoadBalancerSecurityGroup
      Scheme: 'internet-facing'
    DependsOn: VPCGatewayAttachment
  LoadBalancerListener:
    Type: 'AWS::ElasticLoadBalancingV2::Listener'
    Properties:
      DefaultActions:
      - Type: forward
        TargetGroupArn: !Ref LoadBalancerTargetGroup
      LoadBalancerArn: !Ref LoadBalancer
      Port: 80
      Protocol: HTTP
  LoadBalancerTargetGroup:
    Type: 'AWS::ElasticLoadBalancingV2::TargetGroup'
    Properties:
      HealthCheckIntervalSeconds: 5
      HealthCheckPath: '/'
      HealthCheckPort: '80'
      HealthCheckProtocol: HTTP
      HealthCheckTimeoutSeconds: 3
      HealthyThresholdCount: 2
      UnhealthyThresholdCount: 2
      Matcher:
        HttpCode: '200,302'
      Port: 80
      Protocol: HTTP
      VpcId: !Ref VPC
  LoadBalancerSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: 'awsinaction-elb-sg'
      VpcId: !Ref VPC
      SecurityGroupIngress:
      - CidrIp: '0.0.0.0/0'
        FromPort: 80
        IpProtocol: tcp
        ToPort: 80
  WebServerSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: 'awsinaction-sg'
      VpcId: !Ref VPC
      SecurityGroupIngress:
      - CidrIp: '0.0.0.0/0'
        FromPort: 22
        IpProtocol: tcp
        ToPort: 22
      - FromPort: 80
        IpProtocol: tcp
        SourceSecurityGroupId: !Ref LoadBalancerSecurityGroup
        ToPort: 80
  DatabaseSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: 'awsinaction-db-sg'
      VpcId: !Ref VPC
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 3306
        ToPort: 3306
        SourceSecurityGroupId: !Ref WebServerSecurityGroup
  Database:
    Type: 'AWS::RDS::DBInstance'
    DeletionPolicy: Delete # For AWS::RDS::DBInstance resources that don't specify the DBClusterIdentifier property, the default policy is Snapshot which can cause unwanted costs. However, for production setups, we highly recommend to stay with the default to avoid data loss.
    Properties:
      AllocatedStorage: '5'
      BackupRetentionPeriod: 0
      DBInstanceClass: 'db.t2.micro'
      DBName: wordpress
      Engine: MySQL
      MasterUsername: wordpress
      MasterUserPassword: wordpress
      VPCSecurityGroups:
      - !Sub ${DatabaseSecurityGroup.GroupId}
      DBSubnetGroupName: !Ref DBSubnetGroup
    DependsOn: VPCGatewayAttachment
  DBSubnetGroup:
    Type: 'AWS::RDS::DBSubnetGroup'
    Properties:
      DBSubnetGroupDescription: DB subnet group
      SubnetIds:
      - Ref: SubnetA
      - Ref: SubnetB
  EFSFileSystem:
    Type: 'AWS::EFS::FileSystem'
    Properties:
      FileSystemTags:
      - Key: Name
        Value: 'wordpress-efs'
  EFSMountTargetA:
    Type: 'AWS::EFS::MountTarget'
    Properties:
      FileSystemId: !Ref EFSFileSystem
      SubnetId: !Ref SubnetA
      SecurityGroups:
      - !Ref EFSSecurityGroup
  EFSMountTargetB:
    Type: 'AWS::EFS::MountTarget'
    Properties:
      FileSystemId: !Ref EFSFileSystem
      SubnetId: !Ref SubnetB
      SecurityGroups:
      - !Ref EFSSecurityGroup
  EFSSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: 'Allowing access to EFS'
      VpcId: !Ref VPC
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 2049
        ToPort: 2049
        SourceSecurityGroupId: !Ref WebServerSecurityGroup
  LaunchConfiguration:
    Type: 'AWS::AutoScaling::LaunchConfiguration'
    Metadata:
      'AWS::CloudFormation::Init':
        configSets:
          default: [config]
        config:
          packages:
            yum:
              php70: []
              php70-opcache: []
              php70-mysqlnd: []
              mysql56: []
              httpd24: []
          files:
            '/etc/httpd/conf.d/wordpress.conf':
              content: |
                <Directory "/var/www/html">
                Options Indexes FollowSymLinks
                AllowOverride All
                Require all granted
                </Directory>
              mode: 000500
              owner: root
              group: root
            '/root/wordpress.sh':
              content: !Sub |
                #!/bin/bash -ex
                sed -i 's/;opcache.revalidate_freq=2/opcache.revalidate_freq=300/g' /etc/php-7.0.d/10-opcache.ini
                # ensure than only one machine installs wp
                if mkdir /var/www/lock; then
                  cd /var/www/html
                  wget -q -T 60 https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar
                  if ! php wp-cli.phar core is-installed --allow-root; then
                    php wp-cli.phar core download --allow-root --version=4.8
                    php wp-cli.phar core config --dbname='wordpress' --dbuser='wordpress' --dbpass='wordpress' --dbhost='${Database.Endpoint.Address}' --allow-root
                    php wp-cli.phar core install --url='http://${LoadBalancer.DNSName}' --title='${BlogTitle}' --admin_user='${AdminUsername}' --admin_password='${AdminPassword}' --admin_email='${AdminEMail}' --skip-email --allow-root
                  fi
                  chown -R apache:apache /var/www/html
                  chmod u+wrx /var/www/html/wp-content/*
                  rm wp-cli.phar
                fi
              mode: 000500
              owner: root
              group: root
          commands:
            01_wordpress:
              command: '/root/wordpress.sh'
              cwd: '/var/www/html'
          services:
            sysvinit:
              httpd:
                enabled: true
                ensureRunning: true
    Properties:
      AssociatePublicIpAddress: true
      ImageId: !FindInMap [RegionMap, !Ref 'AWS::Region', AMI]
      InstanceMonitoring: false
      InstanceType: 't2.micro'
      SecurityGroups:
      - !Ref WebServerSecurityGroup
      KeyName: !Ref KeyName
      UserData:
        'Fn::Base64': !Sub |
          #!/bin/bash -x
          bash -ex << "TRY"
            while ! nc -z ${EFSFileSystem}.efs.${AWS::Region}.amazonaws.com 2049; do sleep 1; done
            mkdir /var/www
            mount -t nfs4 -o nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2 "${EFSFileSystem}.efs.${AWS::Region}.amazonaws.com:/" /var/www/
            /opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource LaunchConfiguration --region ${AWS::Region}
          TRY
          /opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource AutoScalingGroup --region ${AWS::Region}
  AutoScalingGroup:
    Type: 'AWS::AutoScaling::AutoScalingGroup'
    DependsOn:
    - EFSMountTargetA
    - EFSMountTargetB
    Properties:
      TargetGroupARNs:
      - !Ref LoadBalancerTargetGroup
      LaunchConfigurationName: !Ref LaunchConfiguration
      MinSize: '2'
      MaxSize: '4'
      Cooldown: '60'
      HealthCheckGracePeriod: 300
      HealthCheckType: ELB
      VPCZoneIdentifier:
      - !Ref SubnetA
      - !Ref SubnetB
      Tags:
      - PropagateAtLaunch: true
        Value: wordpress
        Key: Name
    CreationPolicy:
      ResourceSignal:
        Timeout: PT10M
    UpdatePolicy:
      AutoScalingRollingUpdate:
        PauseTime: PT10M
        WaitOnResourceSignals: true
Outputs:
  URL:
    Value: !Sub 'http://${LoadBalancer.DNSName}'
    Description: 'Wordpress URL'