OMEROonEC2EFSRDS_RO.yml

AWSTemplateFormatVersion: '2010-09-09'
Conditions:
  CreateLoadBalancer: !Equals
    - ''
    - !Ref 'ParameterLoadBalancerARN'
Description: CloudFormation template created by Docker for deploying applications
  on Amazon ECS
Parameters:
  ParameterLoadBalancerARN:
    Description: Name of the LoadBalancer to connect to (optional)
    Type: String
  VPCID:
    Description: ID of the VPC
    Type: AWS::EC2::VPC::Id
  PublicSubnet1Id:
    Description: SubnetId, for Availability Zone 1 in the region in your VPC
    Type: AWS::EC2::Subnet::Id
  PublicSubnet2Id:
    Description: SubnetId, for Availability Zone 2 in the region in your VPC
    Type: AWS::EC2::Subnet::Id
  OmeroSecurityGroup:
    Description: Security group for OMERO web and service containers
    Type: AWS::EC2::SecurityGroup::Id 
  EFSSecurityGroup:
    Description: Security group for EFS
    Type: AWS::EC2::SecurityGroup::Id 
  KeyName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: Name of an existing EC2 KeyPair to enable SSH access to the ECS instances.
  EFSFileSystem:
    Description: The ID of the EFS volume
    Type: String
  RDSEndpointAddress:
    Type: String
    Description: The RDS database endpoinst address
  InstanceType:
    Description: EC2 instance type
    Type: String
    Default: m3.xlarge
    AllowedValues: [t2.large, m3.large,
      m3.xlarge, m3.2xlarge, m4.large, m4.xlarge, m4.2xlarge, m4.4xlarge, m4.10xlarge,
      c4.large, c4.xlarge, c4.2xlarge, c4.4xlarge, c4.8xlarge, c3.large, c3.xlarge,
      c3.2xlarge, c3.4xlarge, c3.8xlarge, r3.large, r3.xlarge, r3.2xlarge, r3.4xlarge,
      r3.8xlarge, i2.xlarge, i2.2xlarge, i2.4xlarge, i2.8xlarge]
    ConstraintDescription: Please choose a valid instance type.

Mappings:
  AWSRegionToAMI:
    us-east-1:
      AMIID: ami-0c1f575380708aa63
    us-east-2:
      AMIID: ami-015a2afe7e1a8af56
    us-west-1:
      AMIID: ami-032a827d612b78a50
    us-west-2:
      AMIID: ami-05edb14e89a5b98f3
    ap-northeast-1:
      AMIID: ami-06ee72c3360fd7fad
    ap-northeast-2:
      AMIID: ami-0cfc5eb79eceeeec9
    ap-south-1:
      AMIID: ami-078902ae8103daac8
    ap-southeast-1:
      AMIID: ami-09dd721a797640468
    ap-southeast-2:
      AMIID: ami-040bd2e2325535b3d
    ca-central-1:
      AMIID: ami-0a06b44c462364156
    eu-central-1:
      AMIID: ami-09509e8f8dea8ab83
    eu-north-1:
      AMIID: ami-015b157d082fd4e0d
    eu-west-1:
      AMIID: ami-0489c3efb4fe85f5d
    eu-west-2:
      AMIID: ami-037dd70536680c11f
    eu-west-3:
      AMIID: ami-0182381900083ba64
    sa-east-1:
      AMIID: ami-05313c3a9e9148109

Resources:
  CloudMap:
    Type: AWS::ServiceDiscovery::PrivateDnsNamespace
    Properties:
      Description: Service Map for OMERO ECS deployment
      Name: ecscloudmap.org
      Vpc: !Ref VPCID
  OmerowebServiceDiscoveryEntry:
    Type: AWS::ServiceDiscovery::Service
    Properties:
      Description: '"omeroweb" service discovery entry in Cloud Map'
      DnsConfig:
        DnsRecords:
          - TTL: 60
            Type: A
        RoutingPolicy: MULTIVALUE
      HealthCheckCustomConfig:
        FailureThreshold: 1
      Name: omeroweb
      NamespaceId: !Ref 'CloudMap'
  OmeroserverServiceDiscoveryEntry:
    Type: AWS::ServiceDiscovery::Service
    Properties:
      Description: '"omeroserver" service discovery entry in Cloud Map'
      DnsConfig:
        DnsRecords:
          - TTL: 60
            Type: A
        RoutingPolicy: MULTIVALUE
      HealthCheckCustomConfig:
        FailureThreshold: 1
      Name: omeroserver
      NamespaceId: !Ref 'CloudMap'
  
  OMEROECSCluster:
    Type: AWS::ECS::Cluster
    Properties:
      ClusterName: OMEROECSCluster
      Tags:
        - Key: project
          Value: omero-on-aws
          
  OMEROLoadBalancer:
    Condition: CreateLoadBalancer
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Name: OMEROLoadBalancer
      Scheme: internet-facing
      Subnets:
        - !Ref 'PublicSubnet1Id'
        - !Ref 'PublicSubnet2Id'
      Tags:
        - Key: project
          Value: omero-on-aws
      Type: network
  
  LogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /ecs/omero
  
  MountTarget1:
    Type: AWS::EFS::MountTarget
    Properties:
      FileSystemId: !Ref EFSFileSystem
      SubnetId: !Ref PublicSubnet1Id
      SecurityGroups:
        - !Ref EFSSecurityGroup
  MountTarget2:
    Type: AWS::EFS::MountTarget
    Properties:
      FileSystemId: !Ref EFSFileSystem
      SubnetId: !Ref PublicSubnet2Id
      SecurityGroups:
        - !Ref EFSSecurityGroup
  NFSAccessPoint:
    Type: AWS::EFS::AccessPoint
    Properties: 
      FileSystemId: !Ref EFSFileSystem
      RootDirectory: 
        Path: '/'

  OmeroserverService:
    Type: AWS::ECS::Service
    DependsOn:
      - OmeroserverTCP4063Listener
      - OmeroserverTCP4064Listener
      - OmeroserverTaskDefinition
    Properties:
      Cluster: !Ref 'OMEROECSCluster'
      DeploymentConfiguration:
        MaximumPercent: 200
        MinimumHealthyPercent: 100
      DeploymentController:
        Type: ECS
      DesiredCount: 2
      LaunchType: EC2
      LoadBalancers:
        - ContainerName: omeroserver
          ContainerPort: 4063
          TargetGroupArn: !Ref 'OmeroserverTCP4063TargetGroup'
        - ContainerName: omeroserver
          ContainerPort: 4064
          TargetGroupArn: !Ref 'OmeroserverTCP4064TargetGroup'
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: DISABLED
          SecurityGroups:
            - !Ref OmeroSecurityGroup
          Subnets:
            - !Ref 'PublicSubnet1Id'
            - !Ref 'PublicSubnet2Id'
      PropagateTags: SERVICE
      SchedulingStrategy: REPLICA
      ServiceRegistries:
        - RegistryArn: !GetAtt 'OmeroserverServiceDiscoveryEntry.Arn'
      Tags:
        - Key: com.docker.compose.project
          Value: omero-on-aws
        - Key: com.docker.compose.service
          Value: omeroserver
      TaskDefinition: !Ref 'OmeroserverTaskDefinition'
  
  OmeroserverTCP4063Listener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - ForwardConfig:
            TargetGroups:
              - TargetGroupArn: !Ref 'OmeroserverTCP4063TargetGroup'
          Type: forward
      LoadBalancerArn: !If
        - CreateLoadBalancer
        - !Ref 'OMEROLoadBalancer'
        - !Ref 'ParameterLoadBalancerARN'
      Port: 4063
      Protocol: TCP
  OmeroserverTCP4063TargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Port: 4063
      Protocol: TCP
      Tags:
        - Key: com.docker.compose.project
          Value: omero-on-aws
      TargetType: ip
      VpcId: !Ref VPCID
  OmeroserverTCP4064Listener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - ForwardConfig:
            TargetGroups:
              - TargetGroupArn: !Ref 'OmeroserverTCP4064TargetGroup'
          Type: forward
      LoadBalancerArn: !If
        - CreateLoadBalancer
        - !Ref 'OMEROLoadBalancer'
        - !Ref 'ParameterLoadBalancerARN'
      Port: 4064
      Protocol: TCP
  OmeroserverTCP4064TargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Port: 4064
      Protocol: TCP
      Tags:
        - Key: com.docker.compose.project
          Value: omero-on-aws
      TargetType: ip
      VpcId: !Ref VPCID
  OmeroserverTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        - Command:
          - !Join
            - ''
            - - !Ref 'AWS::Region'
              - .compute.internal
              - 'omero.local'
          - omero-on-aws.local
          Essential: false
          Image: docker/ecs-searchdomain-sidecar:1.0
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group:
                Ref: LogGroup
              awslogs-region:
                Ref: AWS::Region
              awslogs-stream-prefix: omero-on-aws
          Name: Omeroserverreadonly_ResolvConf_InitContainer
        - DependsOn:
          - Condition: SUCCESS
            ContainerName: Omeroserverreadonly_ResolvConf_InitContainer
          Environment:
            - Name: CONFIG_omero_cluster_read__only
              Value: "true"
            - Name: CONFIG_omero_db_host
              Value: !Ref RDSEndpointAddress
            - Name: CONFIG_omero_db_user
              Value: omero
            - Name: CONFIG_omero_db_pass
              Value: omeromaster
            - Name: CONFIG_omero_db_name
              Value: omero
            - Name: LOCALDOMAIN
              Value: !Join
                - ''
                - - !Ref 'AWS::Region'
                  - .compute.internal
                  - 'omero.local'
            - Name: CONFIG_omero_pixeldata_memoizer_dir_local
              Value: /tmp/BioFormatsCache
            - Name: ROOTPASS
              Value: omero
          Essential: true
          Image: openmicroscopy/omero-server:5.6
          LinuxParameters: {}
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: !Ref 'LogGroup'
              awslogs-region: !Ref 'AWS::Region'
              awslogs-stream-prefix: omeroserver
          Name: omeroserver
          MountPoints:
            - ContainerPath: /OMERO
              SourceVolume: my-efs
          PortMappings:
            - ContainerPort: 4063
              HostPort: 4063
              Protocol: tcp
            - ContainerPort: 4064
              HostPort: 4064
              Protocol: tcp
      Volumes:
        - name: my-efs
          EFSVolumeConfiguration: 
            FilesystemId: !Ref EFSFileSystem
            TransitEncryption: ENABLED
            AuthorizationConfig: 
              AccessPointId: !Ref NFSAccessPoint
              IAM: ENABLED
      Cpu: '4096'
      Memory: '8192'
      ExecutionRoleArn: !Ref 'OmeroserverTaskExecutionRole'
      TaskRoleArn: !Ref 'OmeroserverTaskRole'
      Family: omero-server
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - EC2
  OmeroserverTaskExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
        Version: '2012-10-17'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
        - arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly
  OmeroserverTaskRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
        Version: '2012-10-17'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonElasticFileSystemFullAccess
  ECSAutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    DependsOn:
      - MountTarget1
      - MountTarget2
    Properties:
      VPCZoneIdentifier:
        - !Ref PublicSubnet1Id
        - !Ref PublicSubnet2Id
      LaunchConfigurationName: !Ref 'ContainerInstances'
      MinSize: '2'
      MaxSize: '2'
      DesiredCapacity: '2'
    CreationPolicy:
      ResourceSignal:
        Timeout: PT15M
    UpdatePolicy:
      AutoScalingReplacingUpdate:
        WillReplace: 'true'
  ContainerInstances:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      ImageId: !FindInMap [AWSRegionToAMI, !Ref 'AWS::Region', AMIID]
      SecurityGroups:
            - !Ref OmeroSecurityGroup
      InstanceType: !Ref 'InstanceType'
      IamInstanceProfile: !Ref 'EC2InstanceProfile'
      KeyName: !Ref 'KeyName'
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash -xe
          echo ECS_CLUSTER=${OMEROECSCluster} >> /etc/ecs/ecs.config
          yum install -y aws-cfn-bootstrap bzip2 unzip
          /opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource ECSAutoScalingGroup --region ${AWS::Region}
  EC2Role:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
        - arn:aws:iam::aws:policy/AmazonS3FullAccess
  EC2InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles: [!Ref 'EC2Role']

  OmerowebService:
    Type: AWS::ECS::Service
    DependsOn:
      - OmerowebTCP4080Listener
    Properties:
      Cluster: !Ref 'OMEROECSCluster'
      DeploymentConfiguration:
        MaximumPercent: 200
        MinimumHealthyPercent: 100
      DeploymentController:
        Type: ECS
      DesiredCount: 2
      LaunchType: FARGATE
      LoadBalancers:
        - ContainerName: omeroweb
          ContainerPort: 4080
          TargetGroupArn: !Ref 'OmerowebTCP4080TargetGroup'
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: ENABLED
          SecurityGroups:
            - !Ref OmeroSecurityGroup
          Subnets:
            - !Ref 'PublicSubnet1Id'
            - !Ref 'PublicSubnet2Id'
      PropagateTags: SERVICE
      SchedulingStrategy: REPLICA
      ServiceRegistries:
        - RegistryArn: !GetAtt 'OmerowebServiceDiscoveryEntry.Arn'
      Tags:
        - Key: project
          Value: omero-on-aws
        - Key: service
          Value: omeroweb
      TaskDefinition: !Ref 'OmerowebTaskDefinition'
  
  OmerowebTCP4080Listener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - ForwardConfig:
            TargetGroups:
              - TargetGroupArn: !Ref 'OmerowebTCP4080TargetGroup'
          Type: forward
      LoadBalancerArn: !If
        - CreateLoadBalancer
        - !Ref 'OMEROLoadBalancer'
        - !Ref 'ParameterLoadBalancerARN'
      Port: 4080
      Protocol: TCP
  OmerowebTCP4080TargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Port: 4080
      Protocol: TCP
      Tags:
        - Key: project
          Value: omero-on-aws
      TargetType: ip
      VpcId: !Ref VPCID
  OmerowebTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        - Environment:
            - Name: OMEROHOST
              Value: omeroserver.ecscloudmap.org
            - Name: LOCALDOMAIN
              Value: !Join
                - ''
                - - !Ref 'AWS::Region'
                  - .compute.internal
                  - 'omero.local'
          Essential: true
          Image: openmicroscopy/omero-web-standalone:5.6
          LinuxParameters: {}
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: !Ref 'LogGroup'
              awslogs-region: !Ref 'AWS::Region'
              awslogs-stream-prefix: omeroweb
          Name: omeroweb
          PortMappings:
            - ContainerPort: 4080
              HostPort: 4080
              Protocol: tcp
      Cpu: '4096'
      Memory: '8192'
      ExecutionRoleArn: !Ref 'OmerowebTaskExecutionRole'
      Family: omero-web
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
  OmerowebTaskExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
        Version: '2012-10-17'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
        - arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly
    
Outputs:
  OMEROLoadBalancerHTTPEnpoint:
    Description: The HTTP endpoint of the OMEROLoadBalancer
    Value: !Join
      - ''
      - - 'http://'
        - !GetAtt OMEROLoadBalancer.DNSName
        - ':4080'