OMERO-cloudformation-templates/OMEROonECS_RW_S3FG.yml [129:520]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Mappings:
  AWSRegionToAMI:
    us-east-1:
      AMIID: ami-01783fbb0757adced
    us-east-2:
      AMIID: ami-0adc4758ea76442e2
    us-west-1:
      AMIID: ami-00becdb34b62bf459
    us-west-2:
      AMIID: ami-09f043c293281ecd4
    ap-northeast-1:
      AMIID: ami-04bbc04d168366d27
    ap-northeast-2:
      AMIID: ami-0273b23020d7a59de
    ap-south-1:
      AMIID: ami-000e4b3f0c9f06ffb
    ap-southeast-1:
      AMIID: ami-071fbc655b2398016
    ap-southeast-2:
      AMIID: ami-032edebfa34883542
    ca-central-1:
      AMIID: ami-092b596d9b942c4f8
    eu-central-1:
      AMIID: ami-097b8c9927f9a27bc
    eu-north-1:
      AMIID: ami-09666749b685f34d5
    eu-west-1:
      AMIID: ami-015b1508a2ff2c65a
    eu-west-2:
      AMIID: ami-0141564f07476504d
    eu-west-3:
      AMIID: ami-04cb3664fdfc392bd
    sa-east-1:
      AMIID: ami-003a04511c336560c

  RegionELBAccountIdMap:
    us-east-1:
      AccountId: '127311923021'
    us-west-1:
      AccountId: '027434742980'
    us-west-2:
      AccountId: '797873946194'
    eu-west-1:
      AccountId: '156460612806'
    ap-northeast-1:
      AccountId: '582318560864'
    ap-northeast-2:
      AccountId: '600734575887'
    ap-southeast-1:
      AccountId: '114774131450'
    ap-southeast-2:
      AccountId: '783225319266'
    ap-south-1:
      AccountId: '718504428378'
    us-east-2:
      AccountId: '033677994240'
    sa-east-1:
      AccountId: '507241528517'
    cn-north-1:
      AccountId: '638102146993'
    eu-central-1:
      AccountId: '054676820928'
      
Resources:
  CloudMap:
    Type: AWS::ServiceDiscovery::PrivateDnsNamespace
    Properties:
      Description: Service Map for OMERO ECS deployment
      Name: !Sub ${AWS::StackName}.ecscloudmap.org
      Vpc: !Ref VPCID
  OmerowebServiceDiscoveryEntry:
    Type: AWS::ServiceDiscovery::Service
    Properties:
      Description: '"omeroweb" service discovery entry in Cloud Map'
      DnsConfig:
        DnsRecords:
          - TTL: 60
            Type: A
        RoutingPolicy: MULTIVALUE
      Name: omeroweb
      NamespaceId: !Ref 'CloudMap'
  OmeroserverServiceDiscoveryEntry:
    Type: AWS::ServiceDiscovery::Service
    Properties:
      Description: '"omeroserver" service discovery entry in Cloud Map'
      DnsConfig:
        DnsRecords:
          - TTL: 60
            Type: A
        RoutingPolicy: MULTIVALUE
      Name: omeroserver
      NamespaceId: !Ref 'CloudMap'
  
  RDSDatabaseSecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: !Sub ${AWS::StackName}-RDSDatabaseSecret
      Description: !Join ['', ['RDS Database Master User Secret ', 'for CloudFormation Stack ', !Ref 'AWS::StackName']]
      Tags:
        - Key: project
          Value: omero-on-aws
      GenerateSecretString:
        SecretStringTemplate: !Join ['', ['{"username": "', !Ref DBUser, '"}']]
        GenerateStringKey: "password"
        ExcludeCharacters: '"@/\'
        PasswordLength: 16
  SMSecretRDSDBAttachment:
    Type: AWS::SecretsManager::SecretTargetAttachment
    Properties:
      SecretId: !Ref RDSDatabaseSecret
      TargetId: !Ref RDSInstance
      TargetType: AWS::RDS::DBInstance
  LBSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Load Balancer Security Group
      GroupName: !Sub ${AWS::StackName}-LBSecurityGroup
      SecurityGroupIngress:
        - CidrIp: !Ref CIDRblock4OMEROSecurityGroup
          Description: omeroweb:4080/tcp
          FromPort: 80
          IpProtocol: TCP
          ToPort: 80
        - CidrIp: !Ref CIDRblock4OMEROSecurityGroup
          Description: omeroweb:443/https
          FromPort: 443
          IpProtocol: TCP
          ToPort: 443
      Tags:
        - Key: project
          Value: omero-on-aws
        - Key: network
          Value: loadbalancer
      VpcId: !Ref VPCID
  OmeroSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: OMERO Security Group
      GroupName: !Sub ${AWS::StackName}-OmeroSecurityGroup
      SecurityGroupIngress:
        - CidrIp: !Ref CIDRblock4OMEROSecurityGroup
          Description: omeroserver:4063/tcp
          FromPort: 4063
          IpProtocol: TCP
          ToPort: 4063
        - CidrIp: !Ref CIDRblock4OMEROSecurityGroup
          Description: omeroserver:4064/tcp
          FromPort: 4064
          IpProtocol: TCP
          ToPort: 4064
        - CidrIp: !Ref CIDRblock4OMEROSecurityGroup
          Description: omeroserver:14064/tcp
          FromPort: 14064
          IpProtocol: TCP
          ToPort: 14064
        - CidrIp: !Ref CIDRblock4OMEROSecurityGroup
          Description: ssh
          FromPort: 22
          IpProtocol: TCP
          ToPort: 22
        - SourceSecurityGroupId: !Ref LBSecurityGroup
          Description: omeroweb:4080/tcp
          FromPort: 4080
          IpProtocol: TCP
          ToPort: 4080
      Tags:
        - Key: project
          Value: omero-on-aws
        - Key: network
          Value: omero
      VpcId: !Ref VPCID
  OmeroSecurityGroupIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      Description: Allow communication within omero network
      GroupId: !Ref OmeroSecurityGroup
      IpProtocol: '-1'
      SourceSecurityGroupId: !Ref OmeroSecurityGroup
  RDSSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: RDS Security Group
      GroupName: !Sub ${AWS::StackName}-RDSSecurityGroup
      SecurityGroupIngress:
        - SourceSecurityGroupId: !Ref OmeroSecurityGroup
          Description: postgres:5432/tcp
          FromPort: 5432
          IpProtocol: TCP
          ToPort: 5432
      Tags:
        - Key: project
          Value: omero-on-aws
        - Key: network
          Value: rds
      VpcId: !Ref VPCID
  
  DBSubnetGroup:
    Type: AWS::RDS::DBSubnetGroup
    Properties:
      DBSubnetGroupDescription: DBSubnetGroup for RDS instances
      SubnetIds:
        - !Ref PrivateSubnet1Id
        - !Ref PrivateSubnet2Id
  RDSInstance:
    Type: AWS::RDS::DBInstance
    DeletionPolicy: Retain        ## or Delete/Snapshot
    Properties:
      DBInstanceIdentifier: !Sub ${AWS::StackName}-omero-instance
      DBName: omero
      DBInstanceClass: !Ref RDSDBInstanceClass
      StorageType: !Ref RDSDBStorageType
      StorageEncrypted: True
      AllocatedStorage: !Ref RDSDBAllocatedStorage
      Engine: postgres
      EngineVersion: 11
      MasterUsername: !Ref DBUser
      MasterUserPassword: !Join ['', ['{{resolve:secretsmanager:', !Ref RDSDatabaseSecret, ':SecretString:password}}' ]]
      PubliclyAccessible: False
      MultiAZ: !Ref IsDBMultiAZ
      Tags:
        - Key: project
          Value: omero-on-aws
      VPCSecurityGroups: 
        - !Ref RDSSecurityGroup
      DBSubnetGroupName: !Ref DBSubnetGroup
      BackupRetentionPeriod: !Ref RDSDBBackupRetentionDays
      Tags:
        - Key: project
          Value: omero-on-aws


  OMEROECSCluster:
    Type: AWS::ECS::Cluster
    Properties:
      ClusterName: !Sub ${AWS::StackName}-OMEROECSCluster
      ClusterSettings:
        - Name: containerInsights
          Value:  enabled
      Tags:
        - Key: project
          Value: omero-on-aws
  OMEROLoadBalancer:
    DependsOn:
      - LBAccessLogBucket
      - LBAccessLogBucketPolicy
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      LoadBalancerAttributes:
        - Key: load_balancing.cross_zone.enabled
          Value: "true"
      Scheme: internet-facing
      Subnets:
        - !Ref 'PublicSubnet1Id'
        - !Ref 'PublicSubnet2Id'
      SecurityGroups:
        - !Ref LBSecurityGroup
      Tags:
        - Key: project
          Value: omero-on-aws
      Type: application
      LoadBalancerAttributes:
        - Key: access_logs.s3.enabled
          Value: true
        - Key: access_logs.s3.bucket
          Value: !Join
            - '-'
            - - !Ref LBAccessLogBucketName
              - !Ref Namespace
              - !Ref AWS::AccountId
  LBAccessLogBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Join
            - '-'
            - - !Ref LBAccessLogBucketName
              - !Ref Namespace
              - !Ref AWS::AccountId
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
  LBAccessLogBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties: 
      Bucket: !Ref LBAccessLogBucket
      PolicyDocument:
        Statement:
          - Action:
              - 's3:PutObject'
            Effect: Allow
            Resource: 
              - !Sub '${LBAccessLogBucket.Arn}/*'
            Principal: 
              AWS: !FindInMap [RegionELBAccountIdMap, !Ref 'AWS::Region', AccountId]
          - Action:
              - 's3:PutObject'
            Effect: Allow
            Resource: 
              - !Sub '${LBAccessLogBucket.Arn}/*'
            Principal: 
              Service: delivery.logs.amazonaws.com
            Condition:
              StringEquals:
                s3:x-amz-acl: bucket-owner-full-control
          - Action:
              - 's3:GetBucketAcl'
            Effect: Allow
            Resource: 
              - !Sub ${LBAccessLogBucket.Arn}
            Principal: 
              Service: delivery.logs.amazonaws.com
  LogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub /ecs/omero/${AWS::StackName}

  OmeroserverService:
    Type: AWS::ECS::Service
    DependsOn:
      - OmeroserverTaskDefinition
    Properties:
      Cluster: !Ref 'OMEROECSCluster'
      DeploymentConfiguration:
        MaximumPercent: 200
        MinimumHealthyPercent: 100
      DeploymentController:
        Type: ECS
      DesiredCount: 1
      LaunchType: 'EC2'
      EnableExecuteCommand: true
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: DISABLED
          SecurityGroups:
            - !Ref OmeroSecurityGroup
          Subnets:
            - !Ref 'PrivateSubnet1Id'
      PropagateTags: SERVICE
      SchedulingStrategy: REPLICA
      ServiceRegistries:
        - RegistryArn: !GetAtt 'OmeroserverServiceDiscoveryEntry.Arn'
      Tags:
        - Key: project
          Value: omero-on-aws
        - Key: service
          Value: omeroserver
      TaskDefinition: !Ref 'OmeroserverTaskDefinition'
  
  OmeroserverTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        - Environment:
            - Name: CONFIG_omero_db_host
              Value: !GetAtt 'RDSInstance.Endpoint.Address'
            - Name: CONFIG_omero_db_user
              Value: !Ref DBUser
            - Name: CONFIG_omero_db_pass
              Value: !Join ['', ['{{resolve:secretsmanager:', !Ref RDSDatabaseSecret, ':SecretString:password}}' ]]
            - Name: CONFIG_omero_db_name
              Value: omero
            - Name: LOCALDOMAIN
              Value: !Join
                - ''
                - - !Ref 'AWS::Region'
                  - .compute.internal
                  - 'omero.local'
            - Name: ROOTPASS
              Value: omero
          Essential: true
          Image: !Ref OMEROServerContainerImage
          LinuxParameters: { InitProcessEnabled: true }
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: !Ref 'LogGroup'
              awslogs-region: !Ref 'AWS::Region'
              awslogs-stream-prefix: omeroserver
          Name: omeroserver
          MountPoints:
            - ContainerPath: /OMERO
              SourceVolume: my-fg
          PortMappings:
            - ContainerPort: 4063
              HostPort: 4063
              Protocol: tcp
            - ContainerPort: 4064
              HostPort: 4064
              Protocol: tcp
      Volumes:
        - Name: my-fg
          Host: 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



OMERO-cloudformation-templates/OMEROonECS_RW_TLS_S3FG.yml [176:567]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Mappings:
  AWSRegionToAMI:
    us-east-1:
      AMIID: ami-01783fbb0757adced
    us-east-2:
      AMIID: ami-0adc4758ea76442e2
    us-west-1:
      AMIID: ami-00becdb34b62bf459
    us-west-2:
      AMIID: ami-09f043c293281ecd4
    ap-northeast-1:
      AMIID: ami-04bbc04d168366d27
    ap-northeast-2:
      AMIID: ami-0273b23020d7a59de
    ap-south-1:
      AMIID: ami-000e4b3f0c9f06ffb
    ap-southeast-1:
      AMIID: ami-071fbc655b2398016
    ap-southeast-2:
      AMIID: ami-032edebfa34883542
    ca-central-1:
      AMIID: ami-092b596d9b942c4f8
    eu-central-1:
      AMIID: ami-097b8c9927f9a27bc
    eu-north-1:
      AMIID: ami-09666749b685f34d5
    eu-west-1:
      AMIID: ami-015b1508a2ff2c65a
    eu-west-2:
      AMIID: ami-0141564f07476504d
    eu-west-3:
      AMIID: ami-04cb3664fdfc392bd
    sa-east-1:
      AMIID: ami-003a04511c336560c

  RegionELBAccountIdMap:
    us-east-1:
      AccountId: '127311923021'
    us-west-1:
      AccountId: '027434742980'
    us-west-2:
      AccountId: '797873946194'
    eu-west-1:
      AccountId: '156460612806'
    ap-northeast-1:
      AccountId: '582318560864'
    ap-northeast-2:
      AccountId: '600734575887'
    ap-southeast-1:
      AccountId: '114774131450'
    ap-southeast-2:
      AccountId: '783225319266'
    ap-south-1:
      AccountId: '718504428378'
    us-east-2:
      AccountId: '033677994240'
    sa-east-1:
      AccountId: '507241528517'
    cn-north-1:
      AccountId: '638102146993'
    eu-central-1:
      AccountId: '054676820928'
      
Resources:
  CloudMap:
    Type: AWS::ServiceDiscovery::PrivateDnsNamespace
    Properties:
      Description: Service Map for OMERO ECS deployment
      Name: !Sub ${AWS::StackName}.ecscloudmap.org
      Vpc: !Ref VPCID
  OmerowebServiceDiscoveryEntry:
    Type: AWS::ServiceDiscovery::Service
    Properties:
      Description: '"omeroweb" service discovery entry in Cloud Map'
      DnsConfig:
        DnsRecords:
          - TTL: 60
            Type: A
        RoutingPolicy: MULTIVALUE
      Name: omeroweb
      NamespaceId: !Ref 'CloudMap'
  OmeroserverServiceDiscoveryEntry:
    Type: AWS::ServiceDiscovery::Service
    Properties:
      Description: '"omeroserver" service discovery entry in Cloud Map'
      DnsConfig:
        DnsRecords:
          - TTL: 60
            Type: A
        RoutingPolicy: MULTIVALUE
      Name: omeroserver
      NamespaceId: !Ref 'CloudMap'
  
  RDSDatabaseSecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: !Sub ${AWS::StackName}-RDSDatabaseSecret
      Description: !Join ['', ['RDS Database Master User Secret ', 'for CloudFormation Stack ', !Ref 'AWS::StackName']]
      Tags:
        - Key: project
          Value: omero-on-aws
      GenerateSecretString:
        SecretStringTemplate: !Join ['', ['{"username": "', !Ref DBUser, '"}']]
        GenerateStringKey: "password"
        ExcludeCharacters: '"@/\'
        PasswordLength: 16
  SMSecretRDSDBAttachment:
    Type: AWS::SecretsManager::SecretTargetAttachment
    Properties:
      SecretId: !Ref RDSDatabaseSecret
      TargetId: !Ref RDSInstance
      TargetType: AWS::RDS::DBInstance
  LBSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Load Balancer Security Group
      GroupName: !Sub ${AWS::StackName}-LBSecurityGroup
      SecurityGroupIngress:
        - CidrIp: !Ref CIDRblock4OMEROSecurityGroup
          Description: omeroweb:4080/tcp
          FromPort: 80
          IpProtocol: TCP
          ToPort: 80
        - CidrIp: !Ref CIDRblock4OMEROSecurityGroup
          Description: omeroweb:443/https
          FromPort: 443
          IpProtocol: TCP
          ToPort: 443
      Tags:
        - Key: project
          Value: omero-on-aws
        - Key: network
          Value: loadbalancer
      VpcId: !Ref VPCID
  OmeroSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: OMERO Security Group
      GroupName: !Sub ${AWS::StackName}-OmeroSecurityGroup
      SecurityGroupIngress:
        - CidrIp: !Ref CIDRblock4OMEROSecurityGroup
          Description: omeroserver:4063/tcp
          FromPort: 4063
          IpProtocol: TCP
          ToPort: 4063
        - CidrIp: !Ref CIDRblock4OMEROSecurityGroup
          Description: omeroserver:4064/tcp
          FromPort: 4064
          IpProtocol: TCP
          ToPort: 4064
        - CidrIp: !Ref CIDRblock4OMEROSecurityGroup
          Description: omeroserver:14064/tcp
          FromPort: 14064
          IpProtocol: TCP
          ToPort: 14064
        - CidrIp: !Ref CIDRblock4OMEROSecurityGroup
          Description: ssh
          FromPort: 22
          IpProtocol: TCP
          ToPort: 22
        - SourceSecurityGroupId: !Ref LBSecurityGroup
          Description: omeroweb:4080/tcp
          FromPort: 4080
          IpProtocol: TCP
          ToPort: 4080
      Tags:
        - Key: project
          Value: omero-on-aws
        - Key: network
          Value: omero
      VpcId: !Ref VPCID
  OmeroSecurityGroupIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      Description: Allow communication within omero network
      GroupId: !Ref OmeroSecurityGroup
      IpProtocol: '-1'
      SourceSecurityGroupId: !Ref OmeroSecurityGroup
  RDSSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: RDS Security Group
      GroupName: !Sub ${AWS::StackName}-RDSSecurityGroup
      SecurityGroupIngress:
        - SourceSecurityGroupId: !Ref OmeroSecurityGroup
          Description: postgres:5432/tcp
          FromPort: 5432
          IpProtocol: TCP
          ToPort: 5432
      Tags:
        - Key: project
          Value: omero-on-aws
        - Key: network
          Value: rds
      VpcId: !Ref VPCID
  
  DBSubnetGroup:
    Type: AWS::RDS::DBSubnetGroup
    Properties:
      DBSubnetGroupDescription: DBSubnetGroup for RDS instances
      SubnetIds:
        - !Ref PrivateSubnet1Id
        - !Ref PrivateSubnet2Id
  RDSInstance:
    Type: AWS::RDS::DBInstance
    DeletionPolicy: Retain        ## or Delete/Snapshot
    Properties:
      DBInstanceIdentifier: !Sub ${AWS::StackName}-omero-instance
      DBName: omero
      DBInstanceClass: !Ref RDSDBInstanceClass
      StorageType: !Ref RDSDBStorageType
      StorageEncrypted: True
      AllocatedStorage: !Ref RDSDBAllocatedStorage
      Engine: postgres
      EngineVersion: 11
      MasterUsername: !Ref DBUser
      MasterUserPassword: !Join ['', ['{{resolve:secretsmanager:', !Ref RDSDatabaseSecret, ':SecretString:password}}' ]]
      PubliclyAccessible: False
      MultiAZ: !Ref IsDBMultiAZ
      Tags:
        - Key: project
          Value: omero-on-aws
      VPCSecurityGroups: 
        - !Ref RDSSecurityGroup
      DBSubnetGroupName: !Ref DBSubnetGroup
      BackupRetentionPeriod: !Ref RDSDBBackupRetentionDays
      Tags:
        - Key: project
          Value: omero-on-aws


  OMEROECSCluster:
    Type: AWS::ECS::Cluster
    Properties:
      ClusterName: !Sub ${AWS::StackName}-OMEROECSCluster
      ClusterSettings:
        - Name: containerInsights
          Value:  enabled
      Tags:
        - Key: project
          Value: omero-on-aws
  OMEROLoadBalancer:
    DependsOn:
      - LBAccessLogBucket
      - LBAccessLogBucketPolicy
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      LoadBalancerAttributes:
        - Key: load_balancing.cross_zone.enabled
          Value: "true"
      Scheme: internet-facing
      Subnets:
        - !Ref 'PublicSubnet1Id'
        - !Ref 'PublicSubnet2Id'
      SecurityGroups:
        - !Ref LBSecurityGroup
      Tags:
        - Key: project
          Value: omero-on-aws
      Type: application
      LoadBalancerAttributes:
        - Key: access_logs.s3.enabled
          Value: true
        - Key: access_logs.s3.bucket
          Value: !Join
            - '-'
            - - !Ref LBAccessLogBucketName
              - !Ref Namespace
              - !Ref AWS::AccountId
  LBAccessLogBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Join
            - '-'
            - - !Ref LBAccessLogBucketName
              - !Ref Namespace
              - !Ref AWS::AccountId
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
  LBAccessLogBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties: 
      Bucket: !Ref LBAccessLogBucket
      PolicyDocument:
        Statement:
          - Action:
              - 's3:PutObject'
            Effect: Allow
            Resource: 
              - !Sub '${LBAccessLogBucket.Arn}/*'
            Principal: 
              AWS: !FindInMap [RegionELBAccountIdMap, !Ref 'AWS::Region', AccountId]
          - Action:
              - 's3:PutObject'
            Effect: Allow
            Resource: 
              - !Sub '${LBAccessLogBucket.Arn}/*'
            Principal: 
              Service: delivery.logs.amazonaws.com
            Condition:
              StringEquals:
                s3:x-amz-acl: bucket-owner-full-control
          - Action:
              - 's3:GetBucketAcl'
            Effect: Allow
            Resource: 
              - !Sub ${LBAccessLogBucket.Arn}
            Principal: 
              Service: delivery.logs.amazonaws.com
  LogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub /ecs/omero/${AWS::StackName}

  OmeroserverService:
    Type: AWS::ECS::Service
    DependsOn:
      - OmeroserverTaskDefinition
    Properties:
      Cluster: !Ref 'OMEROECSCluster'
      DeploymentConfiguration:
        MaximumPercent: 200
        MinimumHealthyPercent: 100
      DeploymentController:
        Type: ECS
      DesiredCount: 1
      LaunchType: 'EC2'
      EnableExecuteCommand: true
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: DISABLED
          SecurityGroups:
            - !Ref OmeroSecurityGroup
          Subnets:
            - !Ref 'PrivateSubnet1Id'
      PropagateTags: SERVICE
      SchedulingStrategy: REPLICA
      ServiceRegistries:
        - RegistryArn: !GetAtt 'OmeroserverServiceDiscoveryEntry.Arn'
      Tags:
        - Key: project
          Value: omero-on-aws
        - Key: service
          Value: omeroserver
      TaskDefinition: !Ref 'OmeroserverTaskDefinition'
  
  OmeroserverTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        - Environment:
            - Name: CONFIG_omero_db_host
              Value: !GetAtt 'RDSInstance.Endpoint.Address'
            - Name: CONFIG_omero_db_user
              Value: !Ref DBUser
            - Name: CONFIG_omero_db_pass
              Value: !Join ['', ['{{resolve:secretsmanager:', !Ref RDSDatabaseSecret, ':SecretString:password}}' ]]
            - Name: CONFIG_omero_db_name
              Value: omero
            - Name: LOCALDOMAIN
              Value: !Join
                - ''
                - - !Ref 'AWS::Region'
                  - .compute.internal
                  - 'omero.local'
            - Name: ROOTPASS
              Value: omero
          Essential: true
          Image: !Ref OMEROServerContainerImage
          LinuxParameters: { InitProcessEnabled: true }
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: !Ref 'LogGroup'
              awslogs-region: !Ref 'AWS::Region'
              awslogs-stream-prefix: omeroserver
          Name: omeroserver
          MountPoints:
            - ContainerPath: /OMERO
              SourceVolume: my-fg
          PortMappings:
            - ContainerPort: 4063
              HostPort: 4063
              Protocol: tcp
            - ContainerPort: 4064
              HostPort: 4064
              Protocol: tcp
      Volumes:
        - Name: my-fg
          Host: 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



