templates/clickhouse.arm.template.yaml [412:574]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Conditions:
  UseIops: 
    Fn::Equals: [!Ref VolumeType,"io1"]
  2NodesCondition: !Or 
    - !Equals [!Ref 'ClickHouseNodeCount', '2'] 
    - !Equals [!Ref 'ClickHouseNodeCount', '4'] 
    - !Equals [!Ref 'ClickHouseNodeCount', '6'] 
    - !Equals [!Ref 'ClickHouseNodeCount', '8']
  4NodesCondition: !Or  
    - !Equals [!Ref 'ClickHouseNodeCount', '4'] 
    - !Equals [!Ref 'ClickHouseNodeCount', '6'] 
    - !Equals [!Ref 'ClickHouseNodeCount', '8']
  6NodesCondition: !Or 
    - !Equals [!Ref 'ClickHouseNodeCount', '6'] 
    - !Equals [!Ref 'ClickHouseNodeCount', '8']
  8NodesCondition: !Equals [!Ref 'ClickHouseNodeCount', '8']
Resources: 
  ClickHouseMainLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: "ClickHouseLogGroup"
      RetentionInDays: 180
  ClickHouseInstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - !Sub ec2.${AWS::URLSuffix}
          Action:
          - sts:AssumeRole
      Path: /
      Policies:
      - PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            - logs:DescribeLogStreams
            Resource: !Sub arn:${InstanceRoleArn}:logs:${AWS::Region}:${AWS::AccountId}:log-group:${ClickHouseMainLogGroup}:*
          - Effect: Allow
            Action: 
            - s3:PutObjectAcl
            - s3:GetObjectAcl
            - s3:PutObject
            - s3:GetObject
            - s3:DeleteObject
            - s3:RestoreObject
            - s3:GetObjectVersion
            - s3:DeleteObjectVersion
            - s3:GetObjectRetention
            - s3:PutObjectRetention
            - s3:GetObjectVersionAcl
            - s3:PutObjectVersionAcl
            - s3:CreateBucket
            - s3:ListAllMyBuckets
            - s3:ListBucket
            - s3:PutBucketVersioning
            - s3:ListBucketVersions
            - s3:PutBucketLogging
            - s3:PutBucketAcl
            - s3:GetBucketAcl
            - s3:PutBucketPolicy
            - s3:GetBucketPolicy
            - s3:GetBucketLocation
            - s3:PutEncryptionConfiguration
            - s3:GetEncryptionConfiguration
            - s3:GetBucketVersioning
            - s3:GetLifecycleConfiguration     
            - s3:GetIntelligentTieringConfiguration
            - s3:PutIntelligentTieringConfiguration
            - s3:PutLifecycleConfiguration
            Resource: !Sub arn:${InstanceRoleArn}:s3:::*/*
          - Effect: Allow
            Action:
            - ec2:CreateTags
            - ec2:DeleteTags
            Resource: !Sub arn:${InstanceRoleArn}:ec2:*:${AWS::AccountId}:instance/*
          - Effect: Allow
            Action:
              - ec2:DescribeTags
            Resource: '*'
          - Effect: Allow
            Action:
              - cloudwatch:PutDashboard
              - cloudwatch:DeleteAlarms
              - cloudwatch:DeleteInsightRules
              - cloudwatch:StartMetricStreams
              - cloudwatch:UntagResource
              - cloudwatch:ListTagsForResource
              - cloudwatch:GetDashboard
              - cloudwatch:GetInsightRuleReport
              - cloudwatch:DisableInsightRules
              - cloudwatch:DescribeAlarms
              - cloudwatch:GetMetricStream
              - cloudwatch:DeleteDashboards
              - cloudwatch:DescribeAlarmHistory
              - cloudwatch:StopMetricStreams
              - cloudwatch:DisableAlarmActions
              - cloudwatch:DeleteMetricStream
              - cloudwatch:SetAlarmState
              - cloudwatch:EnableInsightRules
              - cloudwatch:PutCompositeAlarm
              - cloudwatch:PutMetricStream
              - cloudwatch:PutInsightRule
              - cloudwatch:TagResource
              - cloudwatch:PutMetricAlarm
              - cloudwatch:EnableAlarmActions
            Resource: 
              - !Sub arn:${InstanceRoleArn}:cloudwatch::${AWS::AccountId}:dashboard/*
              - !Sub arn:${InstanceRoleArn}:cloudwatch:*:${AWS::AccountId}:alarm:*
              - !Sub arn:${InstanceRoleArn}:cloudwatch:*:${AWS::AccountId}:insight-rule/*
              - !Sub arn:${InstanceRoleArn}:cloudwatch:*:${AWS::AccountId}:metric-stream/*
          - Effect: Allow
            Action:
              - cloudwatch:DescribeInsightRules
              - cloudwatch:PutMetricData
              - cloudwatch:GetMetricData
              - cloudwatch:ListMetricStreams
              - cloudwatch:DescribeAlarmsForMetric
              - cloudwatch:ListDashboards
              - cloudwatch:PutAnomalyDetector
              - cloudwatch:GetMetricStatistics
              - cloudwatch:GetMetricWidgetImage
              - cloudwatch:DeleteAnomalyDetector
              - cloudwatch:ListMetrics
              - cloudwatch:DescribeAnomalyDetectors
            Resource: '*'
          - Effect: Allow
            Action:
              - secretsmanager:CreateSecret
              - secretsmanager:GetSecretValue
            Resource: !Sub arn:${InstanceRoleArn}:secretsmanager:*:${AWS::AccountId}:secret:*
        PolicyName: ClickHouse-Instance-Role
  ClickHouseInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
      - !Ref ClickHouseInstanceRole
  AdminAutoScalingGroup:
    Condition: 2NodesCondition
    Type: 'AWS::AutoScaling::AutoScalingGroup'
    Properties:
      LaunchConfigurationName: !Ref AdminLaunchConfiguration
      VPCZoneIdentifier:
        - !Ref PrivateSubnetID1
        - !Ref PrivateSubnetID2
      MinSize: '1'
      MaxSize: '1'
      Cooldown: '900'
      DesiredCapacity: '1'
      Tags:
        - Key: Name
          Value: 'ClickHouseAdminClient'
          PropagateAtLaunch: true
    CreationPolicy:
      ResourceSignal:
        Count: 1
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



templates/clickhouse.template.yaml [384:546]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Conditions:
  UseIops: 
    Fn::Equals: [!Ref VolumeType,"io1"]
  2NodesCondition: !Or 
    - !Equals [!Ref 'ClickHouseNodeCount', '2'] 
    - !Equals [!Ref 'ClickHouseNodeCount', '4'] 
    - !Equals [!Ref 'ClickHouseNodeCount', '6'] 
    - !Equals [!Ref 'ClickHouseNodeCount', '8']
  4NodesCondition: !Or  
    - !Equals [!Ref 'ClickHouseNodeCount', '4'] 
    - !Equals [!Ref 'ClickHouseNodeCount', '6'] 
    - !Equals [!Ref 'ClickHouseNodeCount', '8']
  6NodesCondition: !Or 
    - !Equals [!Ref 'ClickHouseNodeCount', '6'] 
    - !Equals [!Ref 'ClickHouseNodeCount', '8']
  8NodesCondition: !Equals [!Ref 'ClickHouseNodeCount', '8']
Resources: 
  ClickHouseMainLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: "ClickHouseLogGroup"
      RetentionInDays: 180
  ClickHouseInstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - !Sub ec2.${AWS::URLSuffix}
          Action:
          - sts:AssumeRole
      Path: /
      Policies:
      - PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
              - logs:CreateLogGroup
              - logs:CreateLogStream
              - logs:PutLogEvents
              - logs:DescribeLogStreams
            Resource: !Sub arn:${InstanceRoleArn}:logs:${AWS::Region}:${AWS::AccountId}:log-group:${ClickHouseMainLogGroup}:*
          - Effect: Allow
            Action: 
              - s3:PutObjectAcl
              - s3:GetObjectAcl
              - s3:PutObject
              - s3:GetObject
              - s3:DeleteObject
              - s3:RestoreObject
              - s3:GetObjectVersion
              - s3:DeleteObjectVersion
              - s3:GetObjectRetention
              - s3:PutObjectRetention
              - s3:GetObjectVersionAcl
              - s3:PutObjectVersionAcl
              - s3:CreateBucket
              - s3:ListAllMyBuckets
              - s3:ListBucket
              - s3:PutBucketVersioning
              - s3:ListBucketVersions
              - s3:PutBucketLogging
              - s3:PutBucketAcl
              - s3:GetBucketAcl
              - s3:PutBucketPolicy
              - s3:GetBucketPolicy
              - s3:GetBucketLocation
              - s3:PutEncryptionConfiguration
              - s3:GetEncryptionConfiguration
              - s3:GetBucketVersioning
              - s3:GetLifecycleConfiguration     
              - s3:GetIntelligentTieringConfiguration
              - s3:PutIntelligentTieringConfiguration
              - s3:PutLifecycleConfiguration
            Resource: !Sub arn:${InstanceRoleArn}:s3:::*/*
          - Effect: Allow
            Action:
              - ec2:CreateTags
              - ec2:DeleteTags
            Resource: !Sub arn:${InstanceRoleArn}:ec2:*:${AWS::AccountId}:instance/*
          - Effect: Allow
            Action:
              - ec2:DescribeTags
            Resource: '*'
          - Effect: Allow
            Action:
              - cloudwatch:PutDashboard
              - cloudwatch:DeleteAlarms
              - cloudwatch:DeleteInsightRules
              - cloudwatch:StartMetricStreams
              - cloudwatch:UntagResource
              - cloudwatch:ListTagsForResource
              - cloudwatch:GetDashboard
              - cloudwatch:GetInsightRuleReport
              - cloudwatch:DisableInsightRules
              - cloudwatch:DescribeAlarms
              - cloudwatch:GetMetricStream
              - cloudwatch:DeleteDashboards
              - cloudwatch:DescribeAlarmHistory
              - cloudwatch:StopMetricStreams
              - cloudwatch:DisableAlarmActions
              - cloudwatch:DeleteMetricStream
              - cloudwatch:SetAlarmState
              - cloudwatch:EnableInsightRules
              - cloudwatch:PutCompositeAlarm
              - cloudwatch:PutMetricStream
              - cloudwatch:PutInsightRule
              - cloudwatch:TagResource
              - cloudwatch:PutMetricAlarm
              - cloudwatch:EnableAlarmActions
            Resource: 
              - !Sub arn:${InstanceRoleArn}:cloudwatch::${AWS::AccountId}:dashboard/*
              - !Sub arn:${InstanceRoleArn}:cloudwatch:*:${AWS::AccountId}:alarm:*
              - !Sub arn:${InstanceRoleArn}:cloudwatch:*:${AWS::AccountId}:insight-rule/*
              - !Sub arn:${InstanceRoleArn}:cloudwatch:*:${AWS::AccountId}:metric-stream/*
          - Effect: Allow
            Action:
              - cloudwatch:DescribeInsightRules
              - cloudwatch:PutMetricData
              - cloudwatch:GetMetricData
              - cloudwatch:ListMetricStreams
              - cloudwatch:DescribeAlarmsForMetric
              - cloudwatch:ListDashboards
              - cloudwatch:PutAnomalyDetector
              - cloudwatch:GetMetricStatistics
              - cloudwatch:GetMetricWidgetImage
              - cloudwatch:DeleteAnomalyDetector
              - cloudwatch:ListMetrics
              - cloudwatch:DescribeAnomalyDetectors
            Resource: '*'
          - Effect: Allow
            Action:
              - secretsmanager:CreateSecret
              - secretsmanager:GetSecretValue
            Resource: !Sub arn:${InstanceRoleArn}:secretsmanager:*:${AWS::AccountId}:secret:*
        PolicyName: ClickHouse-Instance-Role
  ClickHouseInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
      - !Ref ClickHouseInstanceRole
  AdminAutoScalingGroup:
    Condition: 2NodesCondition
    Type: 'AWS::AutoScaling::AutoScalingGroup'
    Properties:
      LaunchConfigurationName: !Ref AdminLaunchConfiguration
      VPCZoneIdentifier:
        - !Ref PrivateSubnetID1
        - !Ref PrivateSubnetID2
      MinSize: '1'
      MaxSize: '1'
      Cooldown: '900'
      DesiredCapacity: '1'
      Tags:
        - Key: Name
          Value: 'ClickHouseAdminClient'
          PropagateAtLaunch: true
    CreationPolicy:
      ResourceSignal:
        Count: 1
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



