monitoring/cf-service-grafana.yml [127:215]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      HTTPTargetGroup:
          Type: AWS::ElasticLoadBalancingV2::TargetGroup
          DependsOn: LoadBalancer
          Properties:
              VpcId:
                Fn::ImportValue:
                    !Join [':', [!Ref 'ClusterStackName', 'VPCId']]
              Port: !Ref HTTPPort
              Protocol: TCP

      HTTPListener:
          Type: AWS::ElasticLoadBalancingV2::Listener
          DependsOn: LoadBalancer
          Properties:
              Certificates:
                - CertificateArn: !Ref CertificateArn
              DefaultActions:
              - Type: forward
                TargetGroupArn: !Ref HTTPTargetGroup
              LoadBalancerArn: !Ref LoadBalancer
              Port: !Ref HTTPSPort
              Protocol: TLS

      # This is a role which is used by the ECS tasks themselves.
      ECSTaskExecutionRole:
        Type: AWS::IAM::Role
        Properties:
          AssumeRolePolicyDocument:
            Statement:
            - Effect: Allow
              Principal:
                Service: [ecs-tasks.amazonaws.com]
              Action: ['sts:AssumeRole']
          Path: /
          Policies:
            - PolicyName: AmazonECSTaskExecutionRolePolicy
              PolicyDocument:
                Statement:
                - Effect: Allow
                  Action:
                    # Allow the ECS Tasks to download images from ECR
                    - 'ecr:GetAuthorizationToken'
                    - 'ecr:BatchCheckLayerAvailability'
                    - 'ecr:GetDownloadUrlForLayer'
                    - 'ecr:BatchGetImage'
                    # Allow the ECS tasks to upload logs to CloudWatch
                    - 'logs:CreateLogStream'
                    - 'logs:PutLogEvents'
                  Resource: '*'
            - PolicyName: AmazonECSTaskSecretManagerRolePolicy
              PolicyDocument:
                Statement:
                - Effect: Allow
                  Action:
                    # Allow the ECS Tasks to get SSH Keys
                    - 'secretsmanager:GetSecretValue'
                    - 'kms:Decrypt'
                  Resource: '*'
  Outputs:
    PublicLoadBalancerDNSName:
      Description: The DNS name of the external load balancer
      Value: !GetAtt 'LoadBalancer.DNSName'
      Export:
        Name: !Join [ ':', [ !Ref 'AWS::StackName', 'PublicLoadBalancerDNSName' ] ]
    CanonicalHostedZoneID:
      Description: Canonical Hosted Zone ID
      Value: !GetAtt 'LoadBalancer.CanonicalHostedZoneID'
      Export:
        Name: !Join [ ':', [ !Ref 'AWS::StackName', 'CanonicalHostedZoneID' ] ]
    PublicLoadBalancerUrl:
      Description: The url of the external load balancer
      Value: !Join ['', ['http://', !GetAtt 'LoadBalancer.DNSName']]
      Export:
        Name: !Join [ ':', [ !Ref 'AWS::StackName', 'PublicLoadBalancerUrl' ] ]
    HostedZoneName:
      Description: Route53 Hosted Zone name
      Value: !Ref HostedZoneName
      Export:
        Name: !Join [ ':', [ !Ref 'AWS::StackName', 'HostedZoneName' ] ]
    Subdomain:
      Description: Service DNS subdomain
      Value: !Ref Subdomain
      Export:
        Name: !Join [ ':', [ !Ref 'AWS::StackName', 'Subdomain' ] ]
    CanonicalWebUrl:
      Description: Canonical Web URL
      Value: !Sub 'https://${Subdomain}.${HostedZoneName}'
      Export:
        Name: !Join [ ':', [ !Ref 'AWS::StackName', 'CanonicalWebUrl' ] ]
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



monitoring/cf-service-prometheus.yml [122:210]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      HTTPTargetGroup:
          Type: AWS::ElasticLoadBalancingV2::TargetGroup
          DependsOn: LoadBalancer
          Properties:
              VpcId:
                Fn::ImportValue:
                    !Join [':', [!Ref 'ClusterStackName', 'VPCId']]
              Port: !Ref HTTPPort
              Protocol: TCP

      HTTPListener:
          Type: AWS::ElasticLoadBalancingV2::Listener
          DependsOn: LoadBalancer
          Properties:
              Certificates:
                - CertificateArn: !Ref CertificateArn
              DefaultActions:
              - Type: forward
                TargetGroupArn: !Ref HTTPTargetGroup
              LoadBalancerArn: !Ref LoadBalancer
              Port: !Ref HTTPSPort
              Protocol: TLS

      # This is a role which is used by the ECS tasks themselves.
      ECSTaskExecutionRole:
        Type: AWS::IAM::Role
        Properties:
          AssumeRolePolicyDocument:
            Statement:
            - Effect: Allow
              Principal:
                Service: [ecs-tasks.amazonaws.com]
              Action: ['sts:AssumeRole']
          Path: /
          Policies:
            - PolicyName: AmazonECSTaskExecutionRolePolicy
              PolicyDocument:
                Statement:
                - Effect: Allow
                  Action:
                    # Allow the ECS Tasks to download images from ECR
                    - 'ecr:GetAuthorizationToken'
                    - 'ecr:BatchCheckLayerAvailability'
                    - 'ecr:GetDownloadUrlForLayer'
                    - 'ecr:BatchGetImage'
                    # Allow the ECS tasks to upload logs to CloudWatch
                    - 'logs:CreateLogStream'
                    - 'logs:PutLogEvents'
                  Resource: '*'
            - PolicyName: AmazonECSTaskSecretManagerRolePolicy
              PolicyDocument:
                Statement:
                - Effect: Allow
                  Action:
                    # Allow the ECS Tasks to get SSH Keys
                    - 'secretsmanager:GetSecretValue'
                    - 'kms:Decrypt'
                  Resource: '*'
  Outputs:
    PublicLoadBalancerDNSName:
      Description: The DNS name of the external load balancer
      Value: !GetAtt 'LoadBalancer.DNSName'
      Export:
        Name: !Join [ ':', [ !Ref 'AWS::StackName', 'PublicLoadBalancerDNSName' ] ]
    CanonicalHostedZoneID:
      Description: Canonical Hosted Zone ID
      Value: !GetAtt 'LoadBalancer.CanonicalHostedZoneID'
      Export:
        Name: !Join [ ':', [ !Ref 'AWS::StackName', 'CanonicalHostedZoneID' ] ]
    PublicLoadBalancerUrl:
      Description: The url of the external load balancer
      Value: !Join ['', ['http://', !GetAtt 'LoadBalancer.DNSName']]
      Export:
        Name: !Join [ ':', [ !Ref 'AWS::StackName', 'PublicLoadBalancerUrl' ] ]
    HostedZoneName:
      Description: Route53 Hosted Zone name
      Value: !Ref HostedZoneName
      Export:
        Name: !Join [ ':', [ !Ref 'AWS::StackName', 'HostedZoneName' ] ]
    Subdomain:
      Description: Service DNS subdomain
      Value: !Ref Subdomain
      Export:
        Name: !Join [ ':', [ !Ref 'AWS::StackName', 'Subdomain' ] ]
    CanonicalWebUrl:
      Description: Canonical Web URL
      Value: !Sub 'https://${Subdomain}.${HostedZoneName}'
      Export:
        Name: !Join [ ':', [ !Ref 'AWS::StackName', 'CanonicalWebUrl' ] ]
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



