hindsight.yaml

Parameters:
  DbUsername:
    Type: String
    NoEcho: true
    MinLength: 1
    Default: postgres
  DbPassword:
    Type: String
    NoEcho: true
    MinLength: 8
    MaxLength: 128
    Default: 5bcfd3fb5cba35da5f1be3c347bc
  DataBucketPrefix:
    Description: Bucket name prefix, this will be suffixed with -EnvironmentName.
    Type: String
    MinLength: 1
  EnvironmentName:
    Description: The name of the environment
    Type: String
    Default: dev
  GrafanaPassword:
    Type: String
    NoEcho: true
    MinLength: 8
    MaxLength: 128
    Default: 70ff9f8573535f9866d745c24303
  FlowLogRetention:
    Description: The log retention in days for vpc flow logs
    Type: Number
    Default: 30
Resources:
  EksServiceRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub
        - 'hindsight-service-role-${EnvironmentName}'
        - EnvironmentName: !Ref EnvironmentName
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - eks.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/AmazonEKSServicePolicy'
        - 'arn:aws:iam::aws:policy/AmazonEKSClusterPolicy'
  EksUserRole:
    Type: 'AWS::IAM::Role'
    Properties:
      Path: '/'
      RoleName: !Sub
        - 'hindsight-user-role-${EnvironmentName}'
        - EnvironmentName: !Ref EnvironmentName
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Join
                - ''
                - - 'arn:aws:iam::'
                  - !Ref 'AWS::AccountId'
                  - ':root'
            Action: 'sts:AssumeRole'
  EksCluster:
    Type: 'AWS::EKS::Cluster'
    Properties:
      Name: !Sub
        - 'hindsight-kubernetes-${EnvironmentName}'
        - EnvironmentName: !Ref EnvironmentName
      ResourcesVpcConfig:
        SecurityGroupIds:
          - !Ref EksControlPlaneSg
        SubnetIds:
          - !Ref VpcSubnet1
          - !Ref VpcSubnet2
      RoleArn: !GetAtt
        - EksServiceRole
        - Arn
      Version: 1.14
  EksWorkerRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub
        - 'hindsight-worker-role-${EnvironmentName}'
        - EnvironmentName: !Ref EnvironmentName
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy'
        - 'arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly'
        - 'arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy'
        - 'arn:aws:iam::aws:policy/AmazonS3FullAccess'
  EksWorkerGroup:
    Type: 'AWS::EKS::Nodegroup'
    Properties:
      ClusterName: !Sub
        - 'hindsight-kubernetes-${EnvironmentName}'
        - EnvironmentName: !Ref EnvironmentName
      InstanceTypes:
        - t2.xlarge
      NodegroupName: !Sub
        - 'hindsight-worker-group-${EnvironmentName}'
        - EnvironmentName: !Ref EnvironmentName
      NodeRole: !GetAtt
        - EksWorkerRole
        - Arn
      ScalingConfig:
        DesiredSize: 3
        MinSize: 2
        MaxSize: 5
      Subnets:
        - !Ref VpcSubnet1
        - !Ref VpcSubnet2
    DependsOn: EksCluster
  VpcRouteTable:
    Type: 'AWS::EC2::RouteTable'
    Properties:
      VpcId: !Ref Vpc
      Tags:
        - Key: Name
          Value: Public Subnets
        - Key: Network
          Value: Public
  VpcGatewayRoute:
    DependsOn: VpcGatewayAttachment
    Type: 'AWS::EC2::Route'
    Properties:
      RouteTableId: !Ref VpcRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref VpcGateway
  VpcSubnet1Rta:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      SubnetId: !Ref VpcSubnet1
      RouteTableId: !Ref VpcRouteTable
  VpcSubnet2Rta:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      SubnetId: !Ref VpcSubnet2
      RouteTableId: !Ref VpcRouteTable
  EksControlPlaneSg:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupName: !Sub
        - 'hindsight-control-plane-sg-${EnvironmentName}'
        - EnvironmentName: !Ref EnvironmentName
      GroupDescription: Cluster communication with worker nodes
      VpcId: !Ref Vpc
  Vpc:
    Type: 'AWS::EC2::VPC'
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsSupport: 'true'
      EnableDnsHostnames: 'true'
      Tags:
        - Key: Name
          Value: !Sub
          - 'VPC-${EnvironmentName}'
          - EnvironmentName: !Ref EnvironmentName
  VpcSg:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupName: !Sub
        - 'hindsight-vpc-sg-${EnvironmentName}'
        - EnvironmentName: !Ref EnvironmentName
      GroupDescription: VPCSecured
      VpcId: !Ref Vpc
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 0
          ToPort: 65535
          CidrIp: 0.0.0.0/0
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 0
          ToPort: 65535
          CidrIp: 0.0.0.0/0
  VpcSubnet1:
    Type: 'AWS::EC2::Subnet'
    Properties:
      AvailabilityZone: us-east-2a
      CidrBlock: 10.0.0.0/24
      MapPublicIpOnLaunch: True
      VpcId: !Ref Vpc
  VpcSubnet2:
    Type: 'AWS::EC2::Subnet'
    Properties:
      AvailabilityZone: us-east-2b
      CidrBlock: 10.0.8.0/24
      MapPublicIpOnLaunch: True
      VpcId: !Ref Vpc
  VpcGateway:
    Type: 'AWS::EC2::InternetGateway'
  VpcGatewayAttachment:
    Type: 'AWS::EC2::VPCGatewayAttachment'
    Properties:
      InternetGatewayId: !Ref VpcGateway
      VpcId: !Ref Vpc
  VpcFlowLogRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: 'vpc-flow-logs.amazonaws.com'
          Action: 'sts:AssumeRole'
      Policies:
      - PolicyName: 'flowlogs-policy'
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - 'logs:CreateLogStream'
            - 'logs:PutLogEvents'
            - 'logs:DescribeLogGroups'
            - 'logs:DescribeLogStreams'
            Resource: !GetAtt 'VpcFlowLogGroup.Arn'
  VpcFlowLogGroup:
    Type: 'AWS::Logs::LogGroup'
    Properties:
      LogGroupName: !Sub
        - 'VpcFlowLogGroup-${EnvironmentName}'
        - EnvironmentName: !Ref EnvironmentName
      RetentionInDays: !Ref FlowLogRetention
  VpcFlowLogs:
    Type: AWS::EC2::FlowLog
    Properties:
      DeliverLogsPermissionArn: !GetAtt VpcFlowLogRole.Arn
      LogGroupName: !Ref VpcFlowLogGroup
      ResourceId: !Ref Vpc
      ResourceType: VPC
      TrafficType: ALL
  PostgresInstance:
    Type: 'AWS::RDS::DBInstance'
    Properties:
      AllocatedStorage: 100
      BackupRetentionPeriod: 7
      DBInstanceClass: db.t3.medium
      DBName: metastore
      Engine: postgres
      EngineVersion: 10
      MultiAZ: 'true'
      StorageEncrypted: 'true'
      DBSubnetGroupName: !Ref PostgresSubnetGroup
      DBParameterGroupName: !Ref PostgresParameterGroup
      VPCSecurityGroups:
        - !Ref VpcSg
      MasterUsername: !Ref DbUsername
      MasterUserPassword: !Ref DbPassword
      Port: 5432
      PubliclyAccessible: false
      StorageType: gp2
  PostgresSubnetGroup:
    Type: 'AWS::RDS::DBSubnetGroup'
    Properties:
      DBSubnetGroupDescription: PostgresSubnet
      SubnetIds:
        - !Ref VpcSubnet1
        - !Ref VpcSubnet2
  PostgresParameterGroup:
    Type: 'AWS::RDS::DBParameterGroup'
    Properties:
      Description: Encrypt RDS connections
      Family: postgres10
      Parameters:
        rds.force_ssl: true
  DataBucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      BucketName: !Sub
        - '${BucketPrefix}-${EnvironmentName}'
        - BucketPrefix: !Ref DataBucketPrefix
          EnvironmentName: !Ref EnvironmentName
  DataBucketPolicy:
    Type: 'AWS::S3::BucketPolicy'
    Properties:
      Bucket: !Ref DataBucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Action:
              - 's3:DeleteObject'
              - 's3:DeleteObjectVersion'
              - 's3:GetObject'
              - 's3:GetObjectVersion'
              - 's3:PutObject'
              - 's3:ListBucket'
            Effect: Allow
            Principal:
              AWS:
                - !GetAtt
                  - EksWorkerRole
                  - Arn
            Resource:
              - !Join
                - ''
                - - 'arn:aws:s3:::'
                  - !Ref DataBucket
              - !Join
                - ''
                - - 'arn:aws:s3:::'
                  - !Ref DataBucket
                  - /*
  RedisInstance:
    Type: 'AWS::ElastiCache::CacheCluster'
    Properties:
      Engine: redis
      EngineVersion: 5.0.4
      NumCacheNodes: 1
      CacheNodeType: cache.t3.small
      CacheSubnetGroupName: !Ref RedisSubnetGroup
      Port: 6379
      PreferredAvailabilityZone: us-east-2a
      VpcSecurityGroupIds:
        - !Ref VpcSg
  RedisSubnetGroup:
    Type: 'AWS::ElastiCache::SubnetGroup'
    Properties:
      Description: Subnet for Redis
      CacheSubnetGroupName: !Sub
        - 'RedisSubnetGroup-${EnvironmentName}'
        - EnvironmentName: !Ref EnvironmentName
      SubnetIds:
        - !Ref VpcSubnet1
        - !Ref VpcSubnet2
  MetastoreInfo:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: !Sub
        - 'MetastoreInfo-${EnvironmentName}'
        - EnvironmentName: !Ref EnvironmentName
      Description: !Sub
        - 'Secret for ${EnvironmentName} metastore database'
        - EnvironmentName: !Ref EnvironmentName
      SecretString: !Sub
        - '{"username":"${DbUsername}","password":"${DbPassword}", "endpoint": "${EndpointAddress}", "bucket": "${BucketName}"}'
        - DbUsername: !Ref DbUsername
          DbPassword: !Ref DbPassword
          EndpointAddress: !GetAtt PostgresInstance.Endpoint.Address
          BucketName: !Ref DataBucket
  RedisInfo:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: !Sub
        - 'RedisInfo-${EnvironmentName}'
        - EnvironmentName: !Ref EnvironmentName
      Description: !Sub
        - 'Secret for ${EnvironmentName} Redis'
        - EnvironmentName: !Ref EnvironmentName
      SecretString: !Sub
        - '{"endpoint":"${EndpointAddress}"}'
        - EndpointAddress: !GetAtt RedisInstance.RedisEndpoint.Address
  GrafanaInfo:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: !Sub
        - 'GrafanaInfo-${EnvironmentName}'
        - EnvironmentName: !Ref EnvironmentName
      Description: !Sub
        - 'Secret for ${EnvironmentName} Grafana'
        - EnvironmentName: !Ref EnvironmentName
      SecretString: !Sub
        - '{"password":"${GrafanaPassword}"}'
        - GrafanaPassword: !Ref GrafanaPassword
Outputs:
  Postgres:
    Description: Postgres instance address
    Value: !GetAtt PostgresInstance.Endpoint.Address
  Redis:
    Description: Redis instance address
    Value: !GetAtt RedisInstance.RedisEndpoint.Address
  NodeRole:
    Description: EKS Worker Node Role ARN
    Value: !GetAtt EksWorkerRole.Arn
  UserRole:
    Description: EKS User Role ARN
    Value: !GetAtt EksUserRole.Arn