templates/bbb-on-aws-bbbappscalable.template.yaml [252:340]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              - Effect: Allow
                Action:
                  - ssm:GetParameter
                Resource:
                  - !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/turnhostname"
              - Effect: Allow
                Action:
                  - logs:PutLogEvents
                  - logs:CreateLogStream
                  - logs:DescribeLogStreams
                  - logs:CreateLogGroup
                Resource:
                  - !Ref BBBSystemLogsGroupArn
                  - !Ref BBBApplicationLogsGroupArn
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore

  BBBApplicationEC2InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - !Ref BBBApplicationEC2Role

  BBBApplicationInstanceLaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    Properties:
      LaunchTemplateData:
        BlockDeviceMappings:
          - DeviceName: /dev/sda1
            Ebs:
              VolumeType: gp2
              VolumeSize: !Ref BBBApplicationRootVolumeSize
              Encrypted: true
          - DeviceName: /dev/sdf
            Ebs:
              VolumeSize: !Ref BBBApplicationDataVolumeSize
              VolumeType: gp2
              Encrypted: true
        EbsOptimized: true
        IamInstanceProfile:
          Arn: !GetAtt BBBApplicationEC2InstanceProfile.Arn
        ImageId: !Ref BBBLatestApplicationAmiId
        InstanceType: !Ref BBBApplicationInstanceType
        Monitoring:
          Enabled: true
        NetworkInterfaces:
          - AssociatePublicIpAddress: true
            DeviceIndex: 0
            Groups:
              - !Ref BBBApplicationSecurityGroup
        UserData:
          Fn::Base64: !Sub |
            #!/bin/bash -xe
            apt update -y

            while fuser /var/{lib/{dpkg,apt/lists},cache/apt/archives}/lock >/dev/null 2>&1; do sleep 1; done

            DEBIAN_FRONTEND='noninteractive' apt -y -o Dpkg::Options::='--force-confdef' -o Dpkg::Options::='--force-confold' full-upgrade

            apt autoremove -y
            apt autoclean

            while fuser /var/{lib/{dpkg,apt/lists},cache/apt/archives}/lock >/dev/null 2>&1; do sleep 1; done

            apt install -y git binutils python3-pip build-essential python-dev python-setuptools jq
            pip3 install -U awscli

            while fuser /var/lib/dpkg/lock-frontend >/dev/null 2>&1; do sleep 1; done

            wget https://s3.amazonaws.com/amazoncloudwatch-agent/ubuntu/amd64/latest/amazon-cloudwatch-agent.deb
            dpkg -i -E ./amazon-cloudwatch-agent.deb

            # Adding cwagent user to all required groups
            useradd mongodb
            usermod -a -G adm cwagent
            usermod -a -G mongodb cwagent
            usermod -a -G mongodb mongodb
            mkdir /var/log/mongodb
            touch /var/log/mongodb/mongod.log
            chown -R mongodb:mongodb /var/log/mongodb
            chmod g+r /var/log/mongodb/mongod.log

            aws s3 cp s3://${BBBStackBucketStack}/bbb-cwagent-config.json /tmp/bbb-cwagent-config.json
            sed -i "s|SYSTEMLOGS_PLACEHOLDER|${BBBSystemLogsGroup}|g" /tmp/bbb-cwagent-config.json
            sed -i "s|APPLICATIONLOGS_PLACEHOLDER|${BBBSystemLogsGroup}|g" /tmp/bbb-cwagent-config.json
            sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -s -c file:/tmp/bbb-cwagent-config.json

            pip3 install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-latest.tar.gz
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



templates/bbb-on-aws-bbbappsingle.template.yaml [216:304]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              - Effect: Allow
                Action:
                  - ssm:GetParameter
                Resource:
                  - !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/turnhostname"
              - Effect: Allow
                Action:
                  - logs:PutLogEvents
                  - logs:CreateLogStream
                  - logs:DescribeLogStreams
                  - logs:CreateLogGroup
                Resource:
                  - !Ref BBBSystemLogsGroupArn
                  - !Ref BBBApplicationLogsGroupArn
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore

  BBBApplicationEC2InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - !Ref BBBApplicationEC2Role

  BBBApplicationInstanceLaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    Properties:
      LaunchTemplateData:
        BlockDeviceMappings:
          - DeviceName: /dev/sda1
            Ebs:
              VolumeType: gp2
              VolumeSize: !Ref BBBApplicationRootVolumeSize
              Encrypted: true
          - DeviceName: /dev/sdf
            Ebs:
              VolumeSize: !Ref BBBApplicationDataVolumeSize
              VolumeType: gp2
              Encrypted: true
        EbsOptimized: true
        IamInstanceProfile:
          Arn: !GetAtt BBBApplicationEC2InstanceProfile.Arn
        ImageId: !Ref BBBLatestApplicationAmiId
        InstanceType: !Ref BBBApplicationInstanceType
        Monitoring:
          Enabled: true
        NetworkInterfaces:
          - AssociatePublicIpAddress: true
            DeviceIndex: 0
            Groups:
              - !Ref BBBApplicationSecurityGroup
        UserData:
          Fn::Base64: !Sub |
            #!/bin/bash -xe
            apt update -y

            while fuser /var/{lib/{dpkg,apt/lists},cache/apt/archives}/lock >/dev/null 2>&1; do sleep 1; done

            DEBIAN_FRONTEND='noninteractive' apt -y -o Dpkg::Options::='--force-confdef' -o Dpkg::Options::='--force-confold' full-upgrade

            apt autoremove -y
            apt autoclean

            while fuser /var/{lib/{dpkg,apt/lists},cache/apt/archives}/lock >/dev/null 2>&1; do sleep 1; done

            apt install -y git binutils python3-pip build-essential python-dev python-setuptools jq
            pip3 install -U awscli

            while fuser /var/lib/dpkg/lock-frontend >/dev/null 2>&1; do sleep 1; done

            wget https://s3.amazonaws.com/amazoncloudwatch-agent/ubuntu/amd64/latest/amazon-cloudwatch-agent.deb
            dpkg -i -E ./amazon-cloudwatch-agent.deb

            # Adding cwagent user to all required groups
            useradd mongodb
            usermod -a -G adm cwagent
            usermod -a -G mongodb cwagent
            usermod -a -G mongodb mongodb
            mkdir /var/log/mongodb
            touch /var/log/mongodb/mongod.log
            chown -R mongodb:mongodb /var/log/mongodb
            chmod g+r /var/log/mongodb/mongod.log

            aws s3 cp s3://${BBBStackBucketStack}/bbb-cwagent-config.json /tmp/bbb-cwagent-config.json
            sed -i "s|SYSTEMLOGS_PLACEHOLDER|${BBBSystemLogsGroup}|g" /tmp/bbb-cwagent-config.json
            sed -i "s|APPLICATIONLOGS_PLACEHOLDER|${BBBSystemLogsGroup}|g" /tmp/bbb-cwagent-config.json
            sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -s -c file:/tmp/bbb-cwagent-config.json

            pip3 install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-latest.tar.gz
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



