OMERO-cloudformation-templates/OMEROonECS_ALBNLBwithTLS_RW.yaml [425:631]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  OmeroserverTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        - Environment:
            - Name: CONFIG_omero_db_host
              Value: !Ref RDSEndpointAddress
            - Name: CONFIG_omero_db_user
              Value: !Ref DBUser
            - Name: CONFIG_omero_db_pass
              Value: !Join ['', ['{{resolve:secretsmanager:', !Ref RDSDatabaseSecret, ':SecretString:password}}' ]]
            - Name: CONFIG_omero_db_name
              Value: omero
            - Name: LOCALDOMAIN
              Value: !Join
                - ''
                - - !Ref 'AWS::Region'
                  - .compute.internal
                  - 'omero.local'
            - Name: ROOTPASS
              Value: omero
          Essential: true
          Image: !Ref OMEROServerContainerImage
          LinuxParameters: { initProcessEnabled: true }
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: !Ref 'LogGroup'
              awslogs-region: !Ref 'AWS::Region'
              awslogs-stream-prefix: omeroserver
          Name: omeroserver
          MountPoints:
            - ContainerPath: /OMERO
              SourceVolume: my-efs
          PortMappings:
            - ContainerPort: 4063
              HostPort: 4063
              Protocol: tcp
            - ContainerPort: 4064
              HostPort: 4064
              Protocol: tcp
      Volumes:
        - name: my-efs
          EFSVolumeConfiguration: 
            FilesystemId: !Ref EFSFileSystem
            TransitEncryption: ENABLED
            AuthorizationConfig: 
              AccessPointId: !Ref NFSAccessPoint
              IAM: ENABLED
      Cpu: !Ref OMEROServerContainerCPU
      Memory: !Ref OMEROServerContainerMemory
      ExecutionRoleArn: !Ref 'OmeroserverTaskExecutionRole'
      TaskRoleArn: !Ref 'OmeroserverTaskRole'
      Family: omero-server
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - !If
          - runContainerOnEC2
          - 'EC2'
          - 'FARGATE'
  OmeroserverTaskExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
        Version: '2012-10-17'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
        - arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly
      Tags:
      - Key: project
        Value: omero-on-aws
      - Key: service
        Value: omeroserver
  OmeroserverTaskRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
        Version: '2012-10-17'
      Policies:
        - PolicyName: OmeroserverOmeroVolumeMountPolicy
          PolicyDocument:
            Statement:
              - Action:
                  - elasticfilesystem:ClientMount
                  - elasticfilesystem:ClientWrite
                  - elasticfilesystem:ClientRootAccess
                Condition:
                  StringEquals:
                    elasticfilesystem:AccessPointArn: !Ref NFSAccessPoint
                Effect: Allow
                Principal: {} 
                Resource:
                  - !Join
                    - ''
                    - - 'arn:aws:elasticfilesystem:'
                      - !Ref 'AWS::Region'
                      - ':'
                      - !Ref 'AWS::AccountId'
                      - ':file-system/'
                      - !Ref EFSFileSystem
        - PolicyName: OmeroserverSSMPolicy
          PolicyDocument:
            Statement:
              - Action:
                  - ssmmessages:CreateControlChannel
                  - ssmmessages:CreateDataChannel
                  - ssmmessages:OpenControlChannel
                  - ssmmessages:OpenDataChannel
                Effect: Allow
                Resource: "*"
      Tags:
      - Key: project
        Value: omero-on-aws
      - Key: service
        Value: omeroserver
  ECSAutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Condition: runContainerOnEC2
    DependsOn:
      - MountTarget
    Properties:
      VPCZoneIdentifier:
        - !Ref PrivateSubnet1Id
        - !Ref PrivateSubnet2Id
      LaunchConfigurationName: !Ref 'ContainerInstances'
      MinSize: '1'
      MaxSize: '4'
      DesiredCapacity: !Ref NumberofEC2Instances
    CreationPolicy:
      ResourceSignal:
        Timeout: PT15M
    UpdatePolicy:
      AutoScalingReplacingUpdate:
        WillReplace: 'true'
  ContainerInstances:
    Type: AWS::AutoScaling::LaunchConfiguration
    Condition: runContainerOnEC2
    Properties:
      ImageId: !FindInMap [AWSRegionToAMI, !Ref 'AWS::Region', AMIID]
      SecurityGroups:
        - !Ref OmeroSecurityGroup
      InstanceType: !Ref 'InstanceType'
      IamInstanceProfile: !Ref 'EC2InstanceProfile'
      KeyName: !If
        - runContainerOnEC2
        - !Ref 'KeyName'
        - !Ref 'AWS::NoValue'
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash -xe
          echo ECS_CLUSTER=${OMEROECSCluster} >> /etc/ecs/ecs.config
          yum install -y aws-cfn-bootstrap bzip2 unzip
          /opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource ECSAutoScalingGroup --region ${AWS::Region}
          curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"  
          unzip awscliv2.zip  
          ./aws/install
          yum install java-11-amazon-corretto-headless -y
          curl -LO https://anaconda.org/anaconda-adam/adam-installer/4.4.0/download/adam-installer-4.4.0-Linux-x86_64.sh  
          bash adam-installer-4.4.0-Linux-x86_64.sh -b -p /opt/adam  
          echo -e '\n# Anaconda Adam\nexport PATH=/opt/adam/bin:$PATH' >> /etc/bashrc 
          source /etc/bashrc  
          conda install -c anaconda libstdcxx-ng -y 
          conda install -c anaconda libgcc-ng -y  
  EC2Role:
    Type: AWS::IAM::Role
    Condition: runContainerOnEC2
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
        - arn:aws:iam::aws:policy/AmazonS3FullAccess
      Tags:
      - Key: project
        Value: omero-on-aws
      - Key: service
        Value: omeroserver
  EC2InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Condition: runContainerOnEC2
    Properties:
      Path: /
      Roles: [!Ref 'EC2Role']

  OmerowebService:
    Type: AWS::ECS::Service
    DependsOn:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



OMERO-cloudformation-templates/OMEROonECS_ALBwithTLS_RW.yaml [347:553]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  OmeroserverTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        - Environment:
            - Name: CONFIG_omero_db_host
              Value: !Ref RDSEndpointAddress
            - Name: CONFIG_omero_db_user
              Value: !Ref DBUser
            - Name: CONFIG_omero_db_pass
              Value: !Join ['', ['{{resolve:secretsmanager:', !Ref RDSDatabaseSecret, ':SecretString:password}}' ]]
            - Name: CONFIG_omero_db_name
              Value: omero
            - Name: LOCALDOMAIN
              Value: !Join
                - ''
                - - !Ref 'AWS::Region'
                  - .compute.internal
                  - 'omero.local'
            - Name: ROOTPASS
              Value: omero
          Essential: true
          Image: !Ref OMEROServerContainerImage
          LinuxParameters: { initProcessEnabled: true }
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: !Ref 'LogGroup'
              awslogs-region: !Ref 'AWS::Region'
              awslogs-stream-prefix: omeroserver
          Name: omeroserver
          MountPoints:
            - ContainerPath: /OMERO
              SourceVolume: my-efs
          PortMappings:
            - ContainerPort: 4063
              HostPort: 4063
              Protocol: tcp
            - ContainerPort: 4064
              HostPort: 4064
              Protocol: tcp
      Volumes:
        - name: my-efs
          EFSVolumeConfiguration: 
            FilesystemId: !Ref EFSFileSystem
            TransitEncryption: ENABLED
            AuthorizationConfig: 
              AccessPointId: !Ref NFSAccessPoint
              IAM: ENABLED
      Cpu: !Ref OMEROServerContainerCPU
      Memory: !Ref OMEROServerContainerMemory
      ExecutionRoleArn: !Ref 'OmeroserverTaskExecutionRole'
      TaskRoleArn: !Ref 'OmeroserverTaskRole'
      Family: omero-server
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - !If
          - runContainerOnEC2
          - 'EC2'
          - 'FARGATE'
  OmeroserverTaskExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
        Version: '2012-10-17'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
        - arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly
      Tags:
      - Key: project
        Value: omero-on-aws
      - Key: service
        Value: omeroserver
  OmeroserverTaskRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
        Version: '2012-10-17'
      Policies:
        - PolicyName: OmeroserverOmeroVolumeMountPolicy
          PolicyDocument:
            Statement:
              - Action:
                  - elasticfilesystem:ClientMount
                  - elasticfilesystem:ClientWrite
                  - elasticfilesystem:ClientRootAccess
                Condition:
                  StringEquals:
                    elasticfilesystem:AccessPointArn: !Ref NFSAccessPoint
                Effect: Allow
                Principal: {} 
                Resource:
                  - !Join
                    - ''
                    - - 'arn:aws:elasticfilesystem:'
                      - !Ref 'AWS::Region'
                      - ':'
                      - !Ref 'AWS::AccountId'
                      - ':file-system/'
                      - !Ref EFSFileSystem
        - PolicyName: OmeroserverSSMPolicy
          PolicyDocument:
            Statement:
              - Action:
                  - ssmmessages:CreateControlChannel
                  - ssmmessages:CreateDataChannel
                  - ssmmessages:OpenControlChannel
                  - ssmmessages:OpenDataChannel
                Effect: Allow
                Resource: "*"
      Tags:
      - Key: project
        Value: omero-on-aws
      - Key: service
        Value: omeroserver
  ECSAutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Condition: runContainerOnEC2
    DependsOn:
      - MountTarget
    Properties:
      VPCZoneIdentifier:
        - !Ref PrivateSubnet1Id
        - !Ref PrivateSubnet2Id
      LaunchConfigurationName: !Ref 'ContainerInstances'
      MinSize: '1'
      MaxSize: '4'
      DesiredCapacity: !Ref NumberofEC2Instances
    CreationPolicy:
      ResourceSignal:
        Timeout: PT15M
    UpdatePolicy:
      AutoScalingReplacingUpdate:
        WillReplace: 'true'
  ContainerInstances:
    Type: AWS::AutoScaling::LaunchConfiguration
    Condition: runContainerOnEC2
    Properties:
      ImageId: !FindInMap [AWSRegionToAMI, !Ref 'AWS::Region', AMIID]
      SecurityGroups:
        - !Ref OmeroSecurityGroup
      InstanceType: !Ref 'InstanceType'
      IamInstanceProfile: !Ref 'EC2InstanceProfile'
      KeyName: !If
        - runContainerOnEC2
        - !Ref 'KeyName'
        - !Ref 'AWS::NoValue'
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash -xe
          echo ECS_CLUSTER=${OMEROECSCluster} >> /etc/ecs/ecs.config
          yum install -y aws-cfn-bootstrap bzip2 unzip
          /opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource ECSAutoScalingGroup --region ${AWS::Region}
          curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"  
          unzip awscliv2.zip  
          ./aws/install
          yum install java-11-amazon-corretto-headless -y
          curl -LO https://anaconda.org/anaconda-adam/adam-installer/4.4.0/download/adam-installer-4.4.0-Linux-x86_64.sh  
          bash adam-installer-4.4.0-Linux-x86_64.sh -b -p /opt/adam  
          echo -e '\n# Anaconda Adam\nexport PATH=/opt/adam/bin:$PATH' >> /etc/bashrc 
          source /etc/bashrc  
          conda install -c anaconda libstdcxx-ng -y 
          conda install -c anaconda libgcc-ng -y  
  EC2Role:
    Type: AWS::IAM::Role
    Condition: runContainerOnEC2
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
        - arn:aws:iam::aws:policy/AmazonS3FullAccess
      Tags:
      - Key: project
        Value: omero-on-aws
      - Key: service
        Value: omeroserver
  EC2InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Condition: runContainerOnEC2
    Properties:
      Path: /
      Roles: [!Ref 'EC2Role']

  OmerowebService:
    Type: AWS::ECS::Service
    DependsOn:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



