dcm4chee/dcm4chee-arc-ec2-psql-acmdns.yml [318:567]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  Default8443Ingress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      CidrIp: !Ref SecurityGroupIngressCIDR
      Description: arc:8443/tcp on default network
      FromPort: 8443
      GroupId: !Ref DefaultSecurityGroup
      IpProtocol: TCP
      ToPort: 8443
  Default8787Ingress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      CidrIp: !Ref SecurityGroupIngressCIDR
      Description: arc:8787/tcp on default network
      FromPort: 8787
      GroupId: !Ref DefaultSecurityGroup
      IpProtocol: TCP
      ToPort: 8787
  Default9990Ingress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      CidrIp: !Ref SecurityGroupIngressCIDR
      Description: arc:9990/tcp on default network
      FromPort: 9990
      GroupId: !Ref DefaultSecurityGroup
      IpProtocol: TCP
      ToPort: 9990
  Default9993Ingress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      CidrIp: !Ref SecurityGroupIngressCIDR
      Description: arc:9993/tcp on default network
      FromPort: 9993
      GroupId: !Ref DefaultSecurityGroup
      IpProtocol: TCP
      ToPort: 9993
  Default11112Ingress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      CidrIp: !Ref SecurityGroupIngressCIDR
      Description: arc:11112/tcp on default network
      FromPort: 11112
      GroupId: !Ref DefaultSecurityGroup
      IpProtocol: TCP
      ToPort: 11112
  Default389Ingress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      CidrIp: !Ref SecurityGroupIngressCIDR
      Description: ldap:389/tcp on default network
      FromPort: 389
      GroupId: !Ref DefaultSecurityGroup
      IpProtocol: TCP
      ToPort: 389
  EFSSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: DCM4CHEE EFS Security Group
      VpcId: !Ref 'ParameterVPCId'
      SecurityGroupIngress:
        - SourceSecurityGroupId: !Ref 'DefaultSecurityGroup'
          Description: efs:2049/tcp
          FromPort: 2049
          IpProtocol: TCP
          ToPort: 2049
      Tags:
        - Key: project
          Value: dcm4chee-arc-psql
        - Key: network
          Value: default
  RDSSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: DCM4CHEE RDS Security Group
      VpcId: !Ref 'ParameterVPCId'
      GroupName: RDSSecurityGroup
      SecurityGroupIngress:
        - SourceSecurityGroupId: !Ref 'DefaultSecurityGroup'
          Description: postgres:5432/tcp
          FromPort: 5432
          IpProtocol: TCP
          ToPort: 5432
      Tags:
        - Key: project
          Value: dcm4chee-arc-psql
        - Key: network
          Value: default

  RDSDatabaseSecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: RDSDatabaseSecret
      Description: !Join ['', ['RDS Database Master User Secret ', 'for CloudFormation Stack ', !Ref 'AWS::StackName']]
      Tags:
        - Key: project
          Value: dcm4chee-on-aws
      GenerateSecretString:
        SecretStringTemplate: !Join ['', ['{"username": "', postgres, '"}']]
        GenerateStringKey: "password"
        ExcludeCharacters: '"@/\'
        PasswordLength: 16
  SMSecretRDSDBAttachment:
    Type: AWS::SecretsManager::SecretTargetAttachment
    Properties:
      SecretId: !Ref RDSDatabaseSecret
      TargetId: !Ref RDSInstance
      TargetType: AWS::RDS::DBInstance
  DataBaseSubnetGroup:
    Type: AWS::RDS::DBSubnetGroup
    Properties:
      DBSubnetGroupDescription: DBSubnetGroup for Aurora RDS instances
      SubnetIds:
        - !Ref PrivateSubnet1Id
        - !Ref PrivateSubnet2Id
  RDSInstance:
    Type: AWS::RDS::DBInstance
    DeletionPolicy: Retain        ## or Delete/Snapshot
    Properties:
      DBInstanceIdentifier: dcm4chee-instance
      DBInstanceClass: !Ref RDSDBInstanceClass
      StorageType: !Ref RDSDBStorageType
      StorageEncrypted: True
      AllocatedStorage: !Ref RDSDBAllocatedStorage
      Engine: postgres
      EngineVersion: 11
      DBName: pacsdb
      MasterUsername: !Ref RDSDBUserName
      MasterUserPassword: !Join ['', ['{{resolve:secretsmanager:', !Ref RDSDatabaseSecret, ':SecretString:password}}' ]]
      PubliclyAccessible: False
      MultiAZ: !Ref IsDBMultiAZ
      Tags:
        - Key: project
          Value: dcm4chee-on-aws
      VPCSecurityGroups: 
        - !Ref RDSSecurityGroup
      DBSubnetGroupName: !Ref DataBaseSubnetGroup
      BackupRetentionPeriod: !Ref RDSDBBackupRetentionDays

  FileSystem:
    Type: AWS::EFS::FileSystem
    DeletionPolicy: Retain       ## or Delete/Snapshot
    Properties:
      Encrypted: True
      BackupPolicy: 
        Status: !Ref EnableEFSBackup
      LifecyclePolicies:
        - TransitionToIA: !Ref EFSStorageInfrequentAcessAfter
      FileSystemTags:
        - Key: Name
          Value: !Ref 'EFSNameTag'
  StorageAccessPoint:
    Type: AWS::EFS::AccessPoint
    Properties:
      FileSystemId: !Ref FileSystem
      PosixUser:
        Gid: "0"
        Uid: "0"
      RootDirectory:
        Path: "/"
      AccessPointTags:
        - Key: project
          Value: dcm4chee-arc-psql
        - Key: volume
          Value: storage
        - Key: Name
          Value: dcm4chee-arc-psql_storage
  StorageNFSMountTarget1:
    Type: AWS::EFS::MountTarget
    Properties:
      FileSystemId: !Ref FileSystem
      SecurityGroups:
        - !Ref EFSSecurityGroup
      SubnetId: !Ref PublicSubnet1Id
  StorageNFSMountTarget2:
    Type: AWS::EFS::MountTarget
    Properties:
      FileSystemId: !Ref FileSystem
      SecurityGroups:
        - Ref: EFSSecurityGroup
      SubnetId: !Ref PublicSubnet2Id

  DCM4CHEECluster:
    Type: AWS::ECS::Cluster
    Properties:
      ClusterName: dcm4chee-arc-psql
      Tags:
      - Key: project
        Value: dcm4chee-arc-psql
  LoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      LoadBalancerAttributes:
      - Key: load_balancing.cross_zone.enabled
        Value: "true"
      Scheme: internet-facing
      Subnets:
        - !Ref PublicSubnet1Id
        - !Ref PublicSubnet2Id
      Tags:
      - Key: project
        Value: dcm4chee-arc-psql
      Type: network
      LoadBalancerAttributes:
        - Key: access_logs.s3.enabled
          Value: true
        - Key: access_logs.s3.bucket
          Value: !Join
            - '-'
            - - !Ref LBAccessLogBucketName
              - !Ref AWS::AccountId
              - !Ref AWS::Region
  LBAccessLogBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Join
            - '-'
            - - !Ref LBAccessLogBucketName
              - !Ref AWS::AccountId
              - !Ref AWS::Region
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
  LBAccessLogBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties: 
      Bucket: !Ref LBAccessLogBucket
      PolicyDocument:
        Statement:
          - Action:
              - 's3:PutObject'
            Effect: Allow
            Resource: 
              - !Sub '${LBAccessLogBucket.Arn}/*'
            Principal: 
              AWS: !FindInMap [RegionELBAccountIdMap, !Ref 'AWS::Region', AccountId]
          - Action:
              - 's3:PutObject'
            Effect: Allow
            Resource: 
              - !Sub '${LBAccessLogBucket.Arn}/*'
            Principal: 
              Service: delivery.logs.amazonaws.com
          - Action:
              - 's3:GetBucketAcl'
            Effect: Allow
            Resource: 
              - !Sub ${LBAccessLogBucket.Arn}
            Principal: 
              Service: delivery.logs.amazonaws.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



dcm4chee/dcm4chee-arc-ec2-psql.yml [301:551]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  Default8443Ingress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      CidrIp: !Ref SecurityGroupIngressCIDR
      Description: arc:8443/tcp on default network
      FromPort: 8443
      GroupId: !Ref DefaultSecurityGroup
      IpProtocol: TCP
      ToPort: 8443
  Default8787Ingress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      CidrIp: !Ref SecurityGroupIngressCIDR
      Description: arc:8787/tcp on default network
      FromPort: 8787
      GroupId: !Ref DefaultSecurityGroup
      IpProtocol: TCP
      ToPort: 8787
  Default9990Ingress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      CidrIp: !Ref SecurityGroupIngressCIDR
      Description: arc:9990/tcp on default network
      FromPort: 9990
      GroupId: !Ref DefaultSecurityGroup
      IpProtocol: TCP
      ToPort: 9990
  Default9993Ingress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      CidrIp: !Ref SecurityGroupIngressCIDR
      Description: arc:9993/tcp on default network
      FromPort: 9993
      GroupId: !Ref DefaultSecurityGroup
      IpProtocol: TCP
      ToPort: 9993
  Default11112Ingress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      CidrIp: !Ref SecurityGroupIngressCIDR
      Description: arc:11112/tcp on default network
      FromPort: 11112
      GroupId: !Ref DefaultSecurityGroup
      IpProtocol: TCP
      ToPort: 11112
  Default389Ingress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      CidrIp: !Ref SecurityGroupIngressCIDR
      Description: ldap:389/tcp on default network
      FromPort: 389
      GroupId: !Ref DefaultSecurityGroup
      IpProtocol: TCP
      ToPort: 389
  EFSSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: DCM4CHEE EFS Security Group
      VpcId: !Ref 'ParameterVPCId'
      SecurityGroupIngress:
        - SourceSecurityGroupId: !Ref 'DefaultSecurityGroup'
          Description: efs:2049/tcp
          FromPort: 2049
          IpProtocol: TCP
          ToPort: 2049
      Tags:
        - Key: project
          Value: dcm4chee-arc-psql
        - Key: network
          Value: default
  RDSSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: DCM4CHEE RDS Security Group
      VpcId: !Ref 'ParameterVPCId'
      GroupName: RDSSecurityGroup
      SecurityGroupIngress:
        - SourceSecurityGroupId: !Ref 'DefaultSecurityGroup'
          Description: postgres:5432/tcp
          FromPort: 5432
          IpProtocol: TCP
          ToPort: 5432
      Tags:
        - Key: project
          Value: dcm4chee-arc-psql
        - Key: network
          Value: default
      

  RDSDatabaseSecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: RDSDatabaseSecret
      Description: !Join ['', ['RDS Database Master User Secret ', 'for CloudFormation Stack ', !Ref 'AWS::StackName']]
      Tags:
        - Key: project
          Value: dcm4chee-on-aws
      GenerateSecretString:
        SecretStringTemplate: !Join ['', ['{"username": "', postgres, '"}']]
        GenerateStringKey: "password"
        ExcludeCharacters: '"@/\'
        PasswordLength: 16
  SMSecretRDSDBAttachment:
    Type: AWS::SecretsManager::SecretTargetAttachment
    Properties:
      SecretId: !Ref RDSDatabaseSecret
      TargetId: !Ref RDSInstance
      TargetType: AWS::RDS::DBInstance
  DataBaseSubnetGroup:
    Type: AWS::RDS::DBSubnetGroup
    Properties:
      DBSubnetGroupDescription: DBSubnetGroup for Aurora RDS instances
      SubnetIds:
        - !Ref PrivateSubnet1Id
        - !Ref PrivateSubnet2Id
  RDSInstance:
    Type: AWS::RDS::DBInstance
    DeletionPolicy: Retain        ## or Delete/Snapshot
    Properties:
      DBInstanceIdentifier: dcm4chee-instance
      DBInstanceClass: !Ref RDSDBInstanceClass
      StorageType: !Ref RDSDBStorageType
      StorageEncrypted: True
      AllocatedStorage: !Ref RDSDBAllocatedStorage
      Engine: postgres
      EngineVersion: 11
      DBName: pacsdb
      MasterUsername: !Ref RDSDBUserName
      MasterUserPassword: !Join ['', ['{{resolve:secretsmanager:', !Ref RDSDatabaseSecret, ':SecretString:password}}' ]]
      PubliclyAccessible: False
      MultiAZ: !Ref IsDBMultiAZ
      Tags:
        - Key: project
          Value: dcm4chee-on-aws
      VPCSecurityGroups: 
        - !Ref RDSSecurityGroup
      DBSubnetGroupName: !Ref DataBaseSubnetGroup
      BackupRetentionPeriod: !Ref RDSDBBackupRetentionDays

  FileSystem:
    Type: AWS::EFS::FileSystem
    DeletionPolicy: Retain       ## or Delete/Snapshot
    Properties:
      Encrypted: True
      BackupPolicy: 
        Status: !Ref EnableEFSBackup
      LifecyclePolicies:
        - TransitionToIA: !Ref EFSStorageInfrequentAcessAfter
      FileSystemTags:
        - Key: Name
          Value: !Ref 'EFSNameTag'
  StorageAccessPoint:
    Type: AWS::EFS::AccessPoint
    Properties:
      FileSystemId: !Ref FileSystem
      PosixUser:
        Gid: "0"
        Uid: "0"
      RootDirectory:
        Path: "/"
      AccessPointTags:
        - Key: project
          Value: dcm4chee-arc-psql
        - Key: volume
          Value: storage
        - Key: Name
          Value: dcm4chee-arc-psql_storage
  StorageNFSMountTarget1:
    Type: AWS::EFS::MountTarget
    Properties:
      FileSystemId: !Ref FileSystem
      SecurityGroups:
        - !Ref EFSSecurityGroup
      SubnetId: !Ref PublicSubnet1Id
  StorageNFSMountTarget2:
    Type: AWS::EFS::MountTarget
    Properties:
      FileSystemId: !Ref FileSystem
      SecurityGroups:
        - Ref: EFSSecurityGroup
      SubnetId: !Ref PublicSubnet2Id

  DCM4CHEECluster:
    Type: AWS::ECS::Cluster
    Properties:
      ClusterName: dcm4chee-arc-psql
      Tags:
      - Key: project
        Value: dcm4chee-arc-psql
  LoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      LoadBalancerAttributes:
      - Key: load_balancing.cross_zone.enabled
        Value: "true"
      Scheme: internet-facing
      Subnets:
        - !Ref PublicSubnet1Id
        - !Ref PublicSubnet2Id
      Tags:
      - Key: project
        Value: dcm4chee-arc-psql
      Type: network
      LoadBalancerAttributes:
        - Key: access_logs.s3.enabled
          Value: true
        - Key: access_logs.s3.bucket
          Value: !Join
            - '-'
            - - !Ref LBAccessLogBucketName
              - !Ref AWS::AccountId
              - !Ref AWS::Region
  LBAccessLogBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Join
            - '-'
            - - !Ref LBAccessLogBucketName
              - !Ref AWS::AccountId
              - !Ref AWS::Region
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
  LBAccessLogBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties: 
      Bucket: !Ref LBAccessLogBucket
      PolicyDocument:
        Statement:
          - Action:
              - 's3:PutObject'
            Effect: Allow
            Resource: 
              - !Sub '${LBAccessLogBucket.Arn}/*'
            Principal: 
              AWS: !FindInMap [RegionELBAccountIdMap, !Ref 'AWS::Region', AccountId]
          - Action:
              - 's3:PutObject'
            Effect: Allow
            Resource: 
              - !Sub '${LBAccessLogBucket.Arn}/*'
            Principal: 
              Service: delivery.logs.amazonaws.com
          - Action:
              - 's3:GetBucketAcl'
            Effect: Allow
            Resource: 
              - !Sub ${LBAccessLogBucket.Arn}
            Principal: 
              Service: delivery.logs.amazonaws.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



