module-1/1-frontend-module-finish.yaml [223:628]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Properties:
      VPCZoneIdentifier:
        - !Ref Subnet0
        - !Ref Subnet1
      LaunchConfigurationName: !Ref AutoScalingGroupLaunchConfig
      MinSize: !Ref AutoScalingMinSize
      MaxSize: !Ref AutoScalingMaxSize
      HealthCheckGracePeriod: 300
      HealthCheckType: ELB
      TargetGroupARNs:
        - !Ref TargetGroup
      Tags:
        - Key: "Name"
          Value: !Sub '${AWS::StackName}-beacon-web-server'
          PropagateAtLaunch: true
    CreationPolicy:
      ResourceSignal:
        Timeout: PT15M
    UpdatePolicy:
      AutoScalingRollingUpdate:
        MinInstancesInService: 1
        MaxBatchSize: 1
        PauseTime: PT15M
        SuspendProcesses:
          - HealthCheck
          - ReplaceUnhealthy
          - AZRebalance
          - AlarmNotification
          - ScheduledActions
        WaitOnResourceSignals: true

  PacketsAlarmHigh:
    Type: AWS::CloudWatch::Alarm
    Properties:
      EvaluationPeriods: 3
      Statistic: Average
      Threshold: !FindInMap [Sizing, !Ref NodeSize, PacketsPerMinHigh]
      AlarmDescription: Alarm if Network Packets In too high or metric disappears indicating instance is under high load
      Period: 60
      AlarmActions:
        - !Ref ScaleUpPolicy
      Namespace: AWS/EC2
      Dimensions:
        - Name: AutoScalingGroupName
          Value: !Ref AutoScalingGroup
      ComparisonOperator: GreaterThanThreshold
      MetricName: NetworkPacketsIn

  ScaleUpPolicy:
    Type: AWS::AutoScaling::ScalingPolicy
    Properties:
      AdjustmentType: ChangeInCapacity
      Cooldown: '300'
      AutoScalingGroupName: !Ref AutoScalingGroup
      ScalingAdjustment: 1

  PacketsAlarmLow:
    Type: AWS::CloudWatch::Alarm
    Properties:
      EvaluationPeriods: 3
      Statistic: Average
      Threshold: !FindInMap [Sizing, !Ref NodeSize, PacketsPerMinLow]
      AlarmDescription: Alarm if Network Packets In are too low and indicating that we can shed instances
      Period: 60
      AlarmActions:
        - !Ref ScaleDownPolicy
      Namespace: AWS/EC2
      Dimensions:
        - Name: AutoScalingGroupName
          Value: !Ref AutoScalingGroup
      ComparisonOperator: LessThanThreshold
      MetricName: NetworkPacketsIn

  ScaleDownPolicy:
    Type: AWS::AutoScaling::ScalingPolicy
    Properties:
      AdjustmentType: ChangeInCapacity
      Cooldown: '180'
      AutoScalingGroupName: !Ref AutoScalingGroup
      ScalingAdjustment: -1

  AutoScalingGroupLaunchConfig:
    Type: AWS::AutoScaling::LaunchConfiguration
    Metadata:
      AWS::CloudFormation::Init:
        config:
          packages:
            yum:
              httpd: []
              aws-kinesis-agent: []
          files:
            /etc/aws-kinesis/agent.json:
              content: !Sub |
                { "cloudwatch.emitMetrics": false,
                  "maxBufferAgeMillis":"1000",
                  "firehose.endpoint": "https://firehose.${AWS::Region}.amazonaws.com",
                  "flows": [
                    {
                     "filePattern": "/var/log/httpd/access_log*",
                      "deliveryStream": "${DeliveryStream}",
                      "partitionKeyOption": "RANDOM",
                      "dataProcessingOptions": [
                      {
                        "optionName": "LOGTOJSON",
                        "logFormat":"COMBINEDAPACHELOG",
                        "matchPattern": "^([\\d.]+) (\\S+) (\\S+) \\[([\\w:/]+\\s[+\\-]\\d{4})\\] \"(.+?)\" (\\d{3}) ([0-9]+) \"(.+?)\" \"(.+?)\" \"(.+?)\" \"(.+?)\" \"(.+?)\" \"(.+?)\" \"(.+?)\" \"(.+?)\" \"(.+?)\"$",
                        "customFieldNames": ["host", "ident", "authuser", "datetime", "request", "response", "bytes", "referrer", "agent", "event", "clientid", "page", "custom_metric_name", "custom_metric_int_value", "custom_metric_float_value", "custom_metric_string_value"]
                      }
                      ]
                    }
                  ]
                }
            /var/www/html/index.html:
              content: |-
                <HTML><HEAD></HEAD>
                <BODY>AWS Web Analytics Solution Accelerator</BODY>
                </HTML>
            /var/log/httpd/remove_old_log.sh:
              content: |-
                #!/bin/bash
                sleep 60
                echo "Rotating log on `date`" >> /var/log/httpd/rotate.log
                echo "New Log File: $1, Old Log File: $2" >> /var/log/httpd/rotate.log
                echo "rm $2" >> /var/log/httpd/rotate.log
                rm $2
              mode: "000775"
              owner: "root"
              group: "root"
          commands:
            aa-add-yum-update:
              command: yum update -y
            ab1-add-httpd:
              command: yum install httpd -y
            ab2-add-httpd:
              command: yum install aws-kinesis-agent -y
            ac1-add-service-httpd:
              command: chkconfig --add httpd
            ac2-make-readable-logs:
              command: chmod -R go+rX /var/log/httpd
            ad-add-service-aws-kinesis-agent:
              command: chkconfig --add aws-kinesis-agent
            ae-add-service-startup-aws-kinesis-agent:
              command: chkconfig aws-kinesis-agent on
            af-add-service-startup-httpd:
              command: chkconfig httpd on
            ba-return200s:
              command: echo "<Directory \"/\">" >> /etc/httpd/conf/httpd.conf
            bb-return200s:
              command: !Join ["", ["echo '   Header set Access-Control-Allow-Origin \"", Ref: "CorsOrig", "\"' >> /etc/httpd/conf/httpd.conf"]]
            bc-return200s:
              command: echo "   RewriteEngine on" >> /etc/httpd/conf/httpd.conf
            bd-return200s:
              command: echo "   RewriteRule '^.*' '/var/www/html/index.html'" >> /etc/httpd/conf/httpd.conf
            be-return200s:
              command: echo "</Directory>" >> /etc/httpd/conf/httpd.conf
            be-rotate-logs:
              command: sed -i 's/CustomLog logs\/access_log combined/CustomLog \"|\/usr\/sbin\/rotatelogs -p \/var\/log\/httpd\/remove_old_log.sh \/var\/log\/httpd\/access_log 1G\" combined/' /etc/httpd/conf/httpd.conf
            ca-add-data-header:
              command: sed -i 's/LogFormat "%h %l %u %t \\"%r\\" %>s %b \\"%{Referer}i\\"
                \\"%{User-Agent}i\\"" combined/LogFormat "%h %l %u %t \\"%r\\" %>s
                %b \\"%{Referer}i\\" \\"%{User-Agent}i\\" \\"%{event}i\\" \\"%{clientid}i\\"
                \\"%{page}i\\" \\"%{custom_metric_name}i\\" \\"%{custom_metric_int_value}i\\" \\"%{custom_metric_float_value}i\\" \\"%{custom_metric_string_value}i\\"" combined/' /etc/httpd/conf/httpd.conf
          services:
            sysvinit:
              httpd:
                enabled: 'true'
                ensureRunning: 'true'
                files:
                  - /etc/init.d/httpd
              aws-kinesis-agent:
                enabled: 'true'
                ensureRunning: 'true'
                files:
                  - /etc/init.d/aws-kinesis-agent
    Properties:
      ImageId: !Ref LatestAmiId
      InstanceType: !FindInMap [Sizing, !Ref NodeSize, InstanceType]
      IamInstanceProfile: !Ref WebServerInstanceProfile
      SecurityGroups:
        - !Ref WebServerNonSSLSecurityGroup
      UserData: !Base64
        Fn::Sub: |
          #!/bin/bash -xe
          /opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource AutoScalingGroupLaunchConfig --region ${AWS::Region}
          /opt/aws/bin/cfn-signal -e $? --region ${AWS::Region} --stack ${AWS::StackName} --resource AutoScalingGroup
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            VolumeSize: 8

  PatchingAssociation:
    Type: AWS::SSM::Association
    Properties:
      AssociationName: WASAPatching
      Name: AWS-RunPatchBaseline
      Parameters:
        Operation:
          - Install
      ScheduleExpression: rate(1 day)
      Targets:
        - Key: tag:aws:cloudformation:stack-name
          Values:
            - !Ref AWS::StackName

  ApplicationLoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Scheme: internet-facing
      Subnets:
        - !Ref Subnet0
        - !Ref Subnet1
      SecurityGroups:
        - !GetAtt ALBSecurityGroup.GroupId

  ALBListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref TargetGroup
      LoadBalancerArn: !Ref ApplicationLoadBalancer
      Port: 80
      Protocol: HTTP

  TargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckIntervalSeconds: 30
      HealthCheckPath: /
      HealthCheckTimeoutSeconds: 5
      Matcher:
        HttpCode: 200-499
      Port: 80
      Protocol: HTTP
      UnhealthyThresholdCount: 5
      TargetType: instance
      VpcId: !Ref VPC
      Tags:
        - Key: 'Name'
          Value: !Sub '${AWS::StackName}-target-group'

  ALBSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Web traffic for ALB
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: !Ref BeaconSourceCIDR

  WebServerNonSSLSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Web port only (80)
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          SourceSecurityGroupId: !Ref ALBSecurityGroup
      SecurityGroupEgress:
        - IpProtocol: '-1'
          CidrIp: 0.0.0.0/0

  WebServerInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /WebServerInstanceProfile/
      Roles:
        - !Ref WebServerKinesisRole

  WebServerKinesisRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: puttofirehose
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - firehose:PutRecord
                  - firehose:PutRecordBatch
                Resource:
                  - !GetAtt 'DeliveryStream.Arn'
        - PolicyName: ssmagent
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - ssm:DescribeAssociation
                  - ssm:GetDeployablePatchSnapshotForInstance
                  - ssm:GetDocument
                  - ssm:GetManifest
                  - ssm:GetParameters
                  - ssm:ListAssociations
                  - ssm:ListInstanceAssociations
                  - ssm:PutInventory
                  - ssm:PutComplianceItems
                  - ssm:PutConfigurePackageResult
                  - ssm:UpdateAssociationStatus
                  - ssm:UpdateInstanceAssociationStatus
                  - ssm:UpdateInstanceInformation
                  - ssmmessages:CreateControlChannel
                  - ssmmessages:CreateDataChannel
                  - ssmmessages:OpenControlChannel
                  - ssmmessages:OpenDataChannel
                Resource: '*'
              - Effect: Allow
                Action:
                  - s3:GetEncryptionConfiguration
                Resource: '*'
              - Effect: Allow
                Action:
                  - ec2messages:AcknowledgeMessage
                  - ec2messages:DeleteMessage
                  - ec2messages:FailMessage
                  - ec2messages:GetEndpoint
                  - ec2messages:GetMessages
                  - ec2messages:SendReply
                Resource: '*'
              - Effect: Allow
                Action:
                  - cloudwatch:PutMetricData
                Resource: '*'
              - Effect: Allow
                Action:
                  - ec2:DescribeInstanceStatus
                Resource: '*'
                Condition:
                  StringEquals:
                    ec2:ResourceTag/tag:aws:cloudformation:stack-name:
                      Ref: AWS::StackName
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:DescribeLogGroups
                  - logs:DescribeLogStreams
                  - logs:PutLogEvents
                Resource: '*'

# Kinesis Firehose
  DeliveryStreamRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - firehose.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: s3Access
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: ''
                Effect: Allow
                Action:
                  - s3:AbortMultipartUpload
                  - s3:GetBucketLocation
                  - s3:GetObject
                  - s3:ListBucket
                  - s3:ListBucketMultipartUploads
                  - s3:PutObject
                Resource:
                  - !Sub '${AnalyticsBucket.Arn}'
                  - !Sub '${AnalyticsBucket.Arn}/*'
              - Sid: ''
                Effect: Allow
                Action:
                  - logs:PutLogEvents
                Resource:
                  - !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/kinesisfirehose/*:log-stream:*'

  DeliveryStream:
    Type: AWS::KinesisFirehose::DeliveryStream
    Properties:
      DeliveryStreamType: DirectPut
      S3DestinationConfiguration:
        BucketARN: !Sub '${AnalyticsBucket.Arn}'
        BufferingHints:
          IntervalInSeconds: 60
          SizeInMBs: 1
        CompressionFormat: UNCOMPRESSED
        RoleARN: !GetAtt 'DeliveryStreamRole.Arn'

  AnalyticsBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



module-2/2-kinesis-analytics-module-update.yaml [239:644]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Properties:
      VPCZoneIdentifier:
        - !Ref Subnet0
        - !Ref Subnet1
      LaunchConfigurationName: !Ref AutoScalingGroupLaunchConfig
      MinSize: !Ref AutoScalingMinSize
      MaxSize: !Ref AutoScalingMaxSize
      HealthCheckGracePeriod: 300
      HealthCheckType: ELB
      TargetGroupARNs:
        - !Ref TargetGroup
      Tags:
        - Key: "Name"
          Value: !Sub '${AWS::StackName}-beacon-web-server'
          PropagateAtLaunch: true
    CreationPolicy:
      ResourceSignal:
        Timeout: PT15M
    UpdatePolicy:
      AutoScalingRollingUpdate:
        MinInstancesInService: 1
        MaxBatchSize: 1
        PauseTime: PT15M
        SuspendProcesses:
          - HealthCheck
          - ReplaceUnhealthy
          - AZRebalance
          - AlarmNotification
          - ScheduledActions
        WaitOnResourceSignals: true

  PacketsAlarmHigh:
    Type: AWS::CloudWatch::Alarm
    Properties:
      EvaluationPeriods: 3
      Statistic: Average
      Threshold: !FindInMap [Sizing, !Ref NodeSize, PacketsPerMinHigh]
      AlarmDescription: Alarm if Network Packets In too high or metric disappears indicating instance is under high load
      Period: 60
      AlarmActions:
        - !Ref ScaleUpPolicy
      Namespace: AWS/EC2
      Dimensions:
        - Name: AutoScalingGroupName
          Value: !Ref AutoScalingGroup
      ComparisonOperator: GreaterThanThreshold
      MetricName: NetworkPacketsIn

  ScaleUpPolicy:
    Type: AWS::AutoScaling::ScalingPolicy
    Properties:
      AdjustmentType: ChangeInCapacity
      Cooldown: '300'
      AutoScalingGroupName: !Ref AutoScalingGroup
      ScalingAdjustment: 1

  PacketsAlarmLow:
    Type: AWS::CloudWatch::Alarm
    Properties:
      EvaluationPeriods: 3
      Statistic: Average
      Threshold: !FindInMap [Sizing, !Ref NodeSize, PacketsPerMinLow]
      AlarmDescription: Alarm if Network Packets In are too low and indicating that we can shed instances
      Period: 60
      AlarmActions:
        - !Ref ScaleDownPolicy
      Namespace: AWS/EC2
      Dimensions:
        - Name: AutoScalingGroupName
          Value: !Ref AutoScalingGroup
      ComparisonOperator: LessThanThreshold
      MetricName: NetworkPacketsIn

  ScaleDownPolicy:
    Type: AWS::AutoScaling::ScalingPolicy
    Properties:
      AdjustmentType: ChangeInCapacity
      Cooldown: '180'
      AutoScalingGroupName: !Ref AutoScalingGroup
      ScalingAdjustment: -1

  AutoScalingGroupLaunchConfig:
    Type: AWS::AutoScaling::LaunchConfiguration
    Metadata:
      AWS::CloudFormation::Init:
        config:
          packages:
            yum:
              httpd: []
              aws-kinesis-agent: []
          files:
            /etc/aws-kinesis/agent.json:
              content: !Sub |
                { "cloudwatch.emitMetrics": false,
                  "maxBufferAgeMillis":"1000",
                  "firehose.endpoint": "https://firehose.${AWS::Region}.amazonaws.com",
                  "flows": [
                    {
                     "filePattern": "/var/log/httpd/access_log*",
                      "deliveryStream": "${DeliveryStream}",
                      "partitionKeyOption": "RANDOM",
                      "dataProcessingOptions": [
                      {
                        "optionName": "LOGTOJSON",
                        "logFormat":"COMBINEDAPACHELOG",
                        "matchPattern": "^([\\d.]+) (\\S+) (\\S+) \\[([\\w:/]+\\s[+\\-]\\d{4})\\] \"(.+?)\" (\\d{3}) ([0-9]+) \"(.+?)\" \"(.+?)\" \"(.+?)\" \"(.+?)\" \"(.+?)\" \"(.+?)\" \"(.+?)\" \"(.+?)\" \"(.+?)\"$",
                        "customFieldNames": ["host", "ident", "authuser", "datetime", "request", "response", "bytes", "referrer", "agent", "event", "clientid", "page", "custom_metric_name", "custom_metric_int_value", "custom_metric_float_value", "custom_metric_string_value"]
                      }
                      ]
                    }
                  ]
                }
            /var/www/html/index.html:
              content: |-
                <HTML><HEAD></HEAD>
                <BODY>AWS Web Analytics Solution Accelerator</BODY>
                </HTML>
            /var/log/httpd/remove_old_log.sh:
              content: |-
                #!/bin/bash
                sleep 60
                echo "Rotating log on `date`" >> /var/log/httpd/rotate.log
                echo "New Log File: $1, Old Log File: $2" >> /var/log/httpd/rotate.log
                echo "rm $2" >> /var/log/httpd/rotate.log
                rm $2
              mode: "000775"
              owner: "root"
              group: "root"
          commands:
            aa-add-yum-update:
              command: yum update -y
            ab1-add-httpd:
              command: yum install httpd -y
            ab2-add-httpd:
              command: yum install aws-kinesis-agent -y
            ac1-add-service-httpd:
              command: chkconfig --add httpd
            ac2-make-readable-logs:
              command: chmod -R go+rX /var/log/httpd
            ad-add-service-aws-kinesis-agent:
              command: chkconfig --add aws-kinesis-agent
            ae-add-service-startup-aws-kinesis-agent:
              command: chkconfig aws-kinesis-agent on
            af-add-service-startup-httpd:
              command: chkconfig httpd on
            ba-return200s:
              command: echo "<Directory \"/\">" >> /etc/httpd/conf/httpd.conf
            bb-return200s:
              command: !Join ["", ["echo '   Header set Access-Control-Allow-Origin \"", Ref: "CorsOrig", "\"' >> /etc/httpd/conf/httpd.conf"]]
            bc-return200s:
              command: echo "   RewriteEngine on" >> /etc/httpd/conf/httpd.conf
            bd-return200s:
              command: echo "   RewriteRule '^.*' '/var/www/html/index.html'" >> /etc/httpd/conf/httpd.conf
            be-return200s:
              command: echo "</Directory>" >> /etc/httpd/conf/httpd.conf
            be-rotate-logs:
              command: sed -i 's/CustomLog logs\/access_log combined/CustomLog \"|\/usr\/sbin\/rotatelogs -p \/var\/log\/httpd\/remove_old_log.sh \/var\/log\/httpd\/access_log 1G\" combined/' /etc/httpd/conf/httpd.conf
            ca-add-data-header:
              command: sed -i 's/LogFormat "%h %l %u %t \\"%r\\" %>s %b \\"%{Referer}i\\"
                \\"%{User-Agent}i\\"" combined/LogFormat "%h %l %u %t \\"%r\\" %>s
                %b \\"%{Referer}i\\" \\"%{User-Agent}i\\" \\"%{event}i\\" \\"%{clientid}i\\"
                \\"%{page}i\\" \\"%{custom_metric_name}i\\" \\"%{custom_metric_int_value}i\\" \\"%{custom_metric_float_value}i\\" \\"%{custom_metric_string_value}i\\"" combined/' /etc/httpd/conf/httpd.conf
          services:
            sysvinit:
              httpd:
                enabled: 'true'
                ensureRunning: 'true'
                files:
                  - /etc/init.d/httpd
              aws-kinesis-agent:
                enabled: 'true'
                ensureRunning: 'true'
                files:
                  - /etc/init.d/aws-kinesis-agent
    Properties:
      ImageId: !Ref LatestAmiId
      InstanceType: !FindInMap [Sizing, !Ref NodeSize, InstanceType]
      IamInstanceProfile: !Ref WebServerInstanceProfile
      SecurityGroups:
        - !Ref WebServerNonSSLSecurityGroup
      UserData: !Base64
        Fn::Sub: |
          #!/bin/bash -xe
          /opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource AutoScalingGroupLaunchConfig --region ${AWS::Region}
          /opt/aws/bin/cfn-signal -e $? --region ${AWS::Region} --stack ${AWS::StackName} --resource AutoScalingGroup
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            VolumeSize: 8

  PatchingAssociation:
    Type: AWS::SSM::Association
    Properties:
      AssociationName: WASAPatching
      Name: AWS-RunPatchBaseline
      Parameters:
        Operation:
          - Install
      ScheduleExpression: rate(1 day)
      Targets:
        - Key: tag:aws:cloudformation:stack-name
          Values:
            - !Ref AWS::StackName

  ApplicationLoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Scheme: internet-facing
      Subnets:
        - !Ref Subnet0
        - !Ref Subnet1
      SecurityGroups:
        - !GetAtt ALBSecurityGroup.GroupId

  ALBListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref TargetGroup
      LoadBalancerArn: !Ref ApplicationLoadBalancer
      Port: 80
      Protocol: HTTP

  TargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckIntervalSeconds: 30
      HealthCheckPath: /
      HealthCheckTimeoutSeconds: 5
      Matcher:
        HttpCode: 200-499
      Port: 80
      Protocol: HTTP
      UnhealthyThresholdCount: 5
      TargetType: instance
      VpcId: !Ref VPC
      Tags:
        - Key: 'Name'
          Value: !Sub '${AWS::StackName}-target-group'

  ALBSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Web traffic for ALB
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: !Ref BeaconSourceCIDR

  WebServerNonSSLSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Web port only (80)
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          SourceSecurityGroupId: !Ref ALBSecurityGroup
      SecurityGroupEgress:
        - IpProtocol: '-1'
          CidrIp: 0.0.0.0/0

  WebServerInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /WebServerInstanceProfile/
      Roles:
        - !Ref WebServerKinesisRole

  WebServerKinesisRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: puttofirehose
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - firehose:PutRecord
                  - firehose:PutRecordBatch
                Resource:
                  - !GetAtt 'DeliveryStream.Arn'
        - PolicyName: ssmagent
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - ssm:DescribeAssociation
                  - ssm:GetDeployablePatchSnapshotForInstance
                  - ssm:GetDocument
                  - ssm:GetManifest
                  - ssm:GetParameters
                  - ssm:ListAssociations
                  - ssm:ListInstanceAssociations
                  - ssm:PutInventory
                  - ssm:PutComplianceItems
                  - ssm:PutConfigurePackageResult
                  - ssm:UpdateAssociationStatus
                  - ssm:UpdateInstanceAssociationStatus
                  - ssm:UpdateInstanceInformation
                  - ssmmessages:CreateControlChannel
                  - ssmmessages:CreateDataChannel
                  - ssmmessages:OpenControlChannel
                  - ssmmessages:OpenDataChannel
                Resource: '*'
              - Effect: Allow
                Action:
                  - s3:GetEncryptionConfiguration
                Resource: '*'
              - Effect: Allow
                Action:
                  - ec2messages:AcknowledgeMessage
                  - ec2messages:DeleteMessage
                  - ec2messages:FailMessage
                  - ec2messages:GetEndpoint
                  - ec2messages:GetMessages
                  - ec2messages:SendReply
                Resource: '*'
              - Effect: Allow
                Action:
                  - cloudwatch:PutMetricData
                Resource: '*'
              - Effect: Allow
                Action:
                  - ec2:DescribeInstanceStatus
                Resource: '*'
                Condition:
                  StringEquals:
                    ec2:ResourceTag/tag:aws:cloudformation:stack-name:
                      Ref: AWS::StackName
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:DescribeLogGroups
                  - logs:DescribeLogStreams
                  - logs:PutLogEvents
                Resource: '*'

# Kinesis Firehose
  DeliveryStreamRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - firehose.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: s3Access
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: ''
                Effect: Allow
                Action:
                  - s3:AbortMultipartUpload
                  - s3:GetBucketLocation
                  - s3:GetObject
                  - s3:ListBucket
                  - s3:ListBucketMultipartUploads
                  - s3:PutObject
                Resource:
                  - !Sub '${AnalyticsBucket.Arn}'
                  - !Sub '${AnalyticsBucket.Arn}/*'
              - Sid: ''
                Effect: Allow
                Action:
                  - logs:PutLogEvents
                Resource:
                  - !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/kinesisfirehose/*:log-stream:*'

  DeliveryStream:
    Type: AWS::KinesisFirehose::DeliveryStream
    Properties:
      DeliveryStreamType: DirectPut
      S3DestinationConfiguration:
        BucketARN: !Sub '${AnalyticsBucket.Arn}'
        BufferingHints:
          IntervalInSeconds: 60
          SizeInMBs: 1
        CompressionFormat: UNCOMPRESSED
        RoleARN: !GetAtt 'DeliveryStreamRole.Arn'

  AnalyticsBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



