-
Notifications
You must be signed in to change notification settings - Fork 1
/
OMEROonEC2EFSRDS_RW.yml
656 lines (645 loc) · 19.8 KB
/
OMEROonEC2EFSRDS_RW.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
AWSTemplateFormatVersion: '2010-09-09'
Conditions:
CreateLoadBalancer: !Equals
- ''
- !Ref 'ParameterLoadBalancerARN'
Description: CloudFormation template to deploy OMERO Web and Server on AWS ECS
Parameters:
ParameterLoadBalancerARN:
Description: Name of the LoadBalancer to connect to (optional)
Type: String
VPCID:
Description: ID of the VPC
Type: AWS::EC2::VPC::Id
PublicSubnet1Id:
Description: SubnetId, for Availability Zone 1 in the region in your VPC. The only one OMERO Server instance is deployed in this subnet.
Type: AWS::EC2::Subnet::Id
PublicSubnet2Id:
Description: SubnetId, for Availability Zone 2 in the region in your VPC. None of OMERO Server instance is deployed in this subnet.
Type: AWS::EC2::Subnet::Id
OmeroSecurityGroup:
Description: Security group for OMERO web and service containers
Type: AWS::EC2::SecurityGroup::Id
EFSSecurityGroup:
Description: Security group for EFS
Type: AWS::EC2::SecurityGroup::Id
KeyName:
Type: AWS::EC2::KeyPair::KeyName
Description: Name of an existing EC2 KeyPair to enable SSH access to the ECS instances.
EFSFileSystem:
Description: The ID of the EFS volume
Type: String
LBAccessLogBucketName:
Type: String
Default: ecs-loadbalancer-accesslog
RDSEndpointAddress:
Type: String
Description: The RDS database endpoinst address
NumberofWebInstances:
Type: Number
Default: 2
OMEROWebContainerCPU:
Description: The number of cpu units the Amazon ECS container agent will reserve for the container.
Type: Number
Default: 2048
AllowedValues: [256, 512, 1024, 2048, 4096]
OMEROWebContainerMemory:
Description: The amount (in MiB) of memory to present to the container. . Memory should be at least two times of vCPU unit according to documentation.
Type: Number
Default: 4096
AllowedValues: [512, 1024, 2048, 3072, 4096, 5120, 6144, 7168, 8192, 9216, 10240, 11264, 12288, 13312, 14336, 15360, 16384, 30720]
InstanceType:
Description: EC2 instance type
Type: String
Default: m4.xlarge
AllowedValues: [t2.large, m3.large,
m3.xlarge, m3.2xlarge, m4.large, m4.xlarge, m4.2xlarge, m4.4xlarge, m4.10xlarge,
c4.large, c4.xlarge, c4.2xlarge, c4.4xlarge, c4.8xlarge, c3.large, c3.xlarge,
c3.2xlarge, c3.4xlarge, c3.8xlarge, r3.large, r3.xlarge, r3.2xlarge, r3.4xlarge,
r3.8xlarge, i2.xlarge, i2.2xlarge, i2.4xlarge, i2.8xlarge]
ConstraintDescription: Please choose a valid instance type.
OMEROServerContainerCPU:
Description: The number of cpu units the Amazon ECS container agent will reserve for the container.
Type: Number
Default: 4096
AllowedValues: [256, 512, 1024, 2048, 4096]
OMEROServerContainerMemory:
Description: The amount (in MiB) of memory to present to the container. . Memory should be at least two times of vCPU unit according to documentation.
Type: Number
Default: 10240
AllowedValues: [512, 1024, 2048, 3072, 4096, 5120, 6144, 7168, 8192, 9216, 10240, 11264, 12288, 13312, 14336, 15360, 16384, 30720]
DBUser:
Type: String
Default: omero
Description: OMERO Database User
NoEcho: true
RDSDatabaseSecret:
Type: String
Description: OMERO Database Password
Default: RDSDatabaseSecret
Mappings:
AWSRegionToAMI:
us-east-1:
AMIID: ami-0c1f575380708aa63
us-east-2:
AMIID: ami-015a2afe7e1a8af56
us-west-1:
AMIID: ami-032a827d612b78a50
us-west-2:
AMIID: ami-05edb14e89a5b98f3
ap-northeast-1:
AMIID: ami-06ee72c3360fd7fad
ap-northeast-2:
AMIID: ami-0cfc5eb79eceeeec9
ap-south-1:
AMIID: ami-078902ae8103daac8
ap-southeast-1:
AMIID: ami-09dd721a797640468
ap-southeast-2:
AMIID: ami-040bd2e2325535b3d
ca-central-1:
AMIID: ami-0a06b44c462364156
eu-central-1:
AMIID: ami-09509e8f8dea8ab83
eu-north-1:
AMIID: ami-015b157d082fd4e0d
eu-west-1:
AMIID: ami-0489c3efb4fe85f5d
eu-west-2:
AMIID: ami-037dd70536680c11f
eu-west-3:
AMIID: ami-0182381900083ba64
sa-east-1:
AMIID: ami-05313c3a9e9148109
RegionELBAccountIdMap:
us-east-1:
AccountId: '127311923021'
us-west-1:
AccountId: '027434742980'
us-west-2:
AccountId: '797873946194'
eu-west-1:
AccountId: '156460612806'
ap-northeast-1:
AccountId: '582318560864'
ap-northeast-2:
AccountId: '600734575887'
ap-southeast-1:
AccountId: '114774131450'
ap-southeast-2:
AccountId: '783225319266'
ap-south-1:
AccountId: '718504428378'
us-east-2:
AccountId: '033677994240'
sa-east-1:
AccountId: '507241528517'
cn-north-1:
AccountId: '638102146993'
eu-central-1:
AccountId: '054676820928'
Resources:
CloudMap:
Type: AWS::ServiceDiscovery::PrivateDnsNamespace
Properties:
Description: Service Map for OMERO ECS deployment
Name: ecscloudmap.org
Vpc: !Ref VPCID
OmerowebServiceDiscoveryEntry:
Type: AWS::ServiceDiscovery::Service
Properties:
Description: '"omeroweb" service discovery entry in Cloud Map'
DnsConfig:
DnsRecords:
- TTL: 60
Type: A
RoutingPolicy: MULTIVALUE
HealthCheckCustomConfig:
FailureThreshold: 1
Name: omeroweb
NamespaceId: !Ref 'CloudMap'
OmeroserverServiceDiscoveryEntry:
Type: AWS::ServiceDiscovery::Service
Properties:
Description: '"omeroserver" service discovery entry in Cloud Map'
DnsConfig:
DnsRecords:
- TTL: 60
Type: A
RoutingPolicy: MULTIVALUE
HealthCheckCustomConfig:
FailureThreshold: 1
Name: omeroserver
NamespaceId: !Ref 'CloudMap'
OMEROECSCluster:
Type: AWS::ECS::Cluster
Properties:
ClusterName: OMEROECSCluster
ClusterSettings:
- Name: containerInsights
Value: enabled
Tags:
- Key: project
Value: omero-on-aws
OMEROLoadBalancer:
Condition: CreateLoadBalancer
DependsOn:
- LBAccessLogBucket
- LBAccessLogBucketPolicy
Type: AWS::ElasticLoadBalancingV2::LoadBalancer
Properties:
Name: OMEROLoadBalancer
Scheme: internet-facing
Subnets:
- !Ref 'PublicSubnet1Id'
- !Ref 'PublicSubnet2Id'
Tags:
- Key: project
Value: omero-on-aws
Type: network
LoadBalancerAttributes:
- Key: access_logs.s3.enabled
Value: true
- Key: access_logs.s3.bucket
Value: !Join
- '-'
- - !Ref LBAccessLogBucketName
- !Ref AWS::AccountId
- !Ref AWS::Region
LBAccessLogBucket:
Type: AWS::S3::Bucket
Properties:
BucketName: !Join
- '-'
- - !Ref LBAccessLogBucketName
- !Ref AWS::AccountId
- !Ref AWS::Region
BucketEncryption:
ServerSideEncryptionConfiguration:
- ServerSideEncryptionByDefault:
SSEAlgorithm: AES256
LBAccessLogBucketPolicy:
Type: AWS::S3::BucketPolicy
Properties:
Bucket: !Ref LBAccessLogBucket
PolicyDocument:
Statement:
- Action:
- 's3:PutObject'
Effect: Allow
Resource:
- !Sub '${LBAccessLogBucket.Arn}/*'
Principal:
AWS: !FindInMap [RegionELBAccountIdMap, !Ref 'AWS::Region', AccountId]
- Action:
- 's3:PutObject'
Effect: Allow
Resource:
- !Sub '${LBAccessLogBucket.Arn}/*'
Principal:
Service: delivery.logs.amazonaws.com
- Action:
- 's3:GetBucketAcl'
Effect: Allow
Resource:
- !Sub ${LBAccessLogBucket.Arn}
Principal:
Service: delivery.logs.amazonaws.com
LogGroup:
Type: AWS::Logs::LogGroup
Properties:
LogGroupName: /ecs/omero
MountTarget:
Type: AWS::EFS::MountTarget
Properties:
FileSystemId: !Ref EFSFileSystem
SubnetId: !Ref PublicSubnet1Id
SecurityGroups:
- !Ref EFSSecurityGroup
NFSAccessPoint:
Type: AWS::EFS::AccessPoint
Properties:
FileSystemId: !Ref EFSFileSystem
PosixUser:
Gid: "0"
Uid: "0"
RootDirectory:
Path: "/"
OmeroserverService:
Type: AWS::ECS::Service
DependsOn:
- OmeroserverTCP4063Listener
- OmeroserverTCP4064Listener
- OmeroserverTaskDefinition
Properties:
Cluster: !Ref 'OMEROECSCluster'
DeploymentConfiguration:
MaximumPercent: 200
MinimumHealthyPercent: 100
DeploymentController:
Type: ECS
DesiredCount: 1
LaunchType: EC2
LoadBalancers:
- ContainerName: omeroserver
ContainerPort: 4063
TargetGroupArn: !Ref 'OmeroserverTCP4063TargetGroup'
- ContainerName: omeroserver
ContainerPort: 4064
TargetGroupArn: !Ref 'OmeroserverTCP4064TargetGroup'
NetworkConfiguration:
AwsvpcConfiguration:
AssignPublicIp: DISABLED
SecurityGroups:
- !Ref OmeroSecurityGroup
Subnets:
- !Ref 'PublicSubnet1Id'
PropagateTags: SERVICE
SchedulingStrategy: REPLICA
ServiceRegistries:
- RegistryArn: !GetAtt 'OmeroserverServiceDiscoveryEntry.Arn'
Tags:
- Key: project
Value: omero-on-aws
- Key: service
Value: omeroserver
TaskDefinition: !Ref 'OmeroserverTaskDefinition'
OmeroserverTCP4063Listener:
Type: AWS::ElasticLoadBalancingV2::Listener
Properties:
DefaultActions:
- ForwardConfig:
TargetGroups:
- TargetGroupArn: !Ref 'OmeroserverTCP4063TargetGroup'
Type: forward
LoadBalancerArn: !If
- CreateLoadBalancer
- !Ref 'OMEROLoadBalancer'
- !Ref 'ParameterLoadBalancerARN'
Port: 4063
Protocol: TCP
OmeroserverTCP4063TargetGroup:
Type: AWS::ElasticLoadBalancingV2::TargetGroup
Properties:
Port: 4063
Protocol: TCP
Tags:
- Key: project
Value: omero-on-aws
TargetType: ip
VpcId: !Ref VPCID
OmeroserverTCP4064Listener:
Type: AWS::ElasticLoadBalancingV2::Listener
Properties:
DefaultActions:
- ForwardConfig:
TargetGroups:
- TargetGroupArn: !Ref 'OmeroserverTCP4064TargetGroup'
Type: forward
LoadBalancerArn: !If
- CreateLoadBalancer
- !Ref 'OMEROLoadBalancer'
- !Ref 'ParameterLoadBalancerARN'
Port: 4064
Protocol: TCP
OmeroserverTCP4064TargetGroup:
Type: AWS::ElasticLoadBalancingV2::TargetGroup
Properties:
Port: 4064
Protocol: TCP
Tags:
- Key: project
Value: omero-on-aws
TargetType: ip
VpcId: !Ref VPCID
OmeroserverTaskDefinition:
Type: AWS::ECS::TaskDefinition
Properties:
ContainerDefinitions:
- Environment:
- Name: CONFIG_omero_db_host
Value: !Ref RDSEndpointAddress
- Name: CONFIG_omero_db_user
Value: !Ref DBUser
- Name: CONFIG_omero_db_pass
Value: !Join ['', ['{{resolve:secretsmanager:', !Ref RDSDatabaseSecret, ':SecretString:password}}' ]]
- Name: CONFIG_omero_db_name
Value: omero
- Name: LOCALDOMAIN
Value: !Join
- ''
- - !Ref 'AWS::Region'
- .compute.internal
- 'omero.local'
- Name: ROOTPASS
Value: omero
Essential: true
Image: openmicroscopy/omero-server:5.6
LinuxParameters: {}
LogConfiguration:
LogDriver: awslogs
Options:
awslogs-group: !Ref 'LogGroup'
awslogs-region: !Ref 'AWS::Region'
awslogs-stream-prefix: omeroserver
Name: omeroserver
MountPoints:
- ContainerPath: /OMERO
SourceVolume: my-efs
PortMappings:
- ContainerPort: 4063
HostPort: 4063
Protocol: tcp
- ContainerPort: 4064
HostPort: 4064
Protocol: tcp
Volumes:
- name: my-efs
EFSVolumeConfiguration:
FilesystemId: !Ref EFSFileSystem
TransitEncryption: ENABLED
AuthorizationConfig:
AccessPointId: !Ref NFSAccessPoint
IAM: ENABLED
Cpu: !Ref OMEROServerContainerCPU
Memory: !Ref OMEROServerContainerMemory
ExecutionRoleArn: !Ref 'OmeroserverTaskExecutionRole'
TaskRoleArn: !Ref 'OmeroserverTaskRole'
Family: omero-server
NetworkMode: awsvpc
RequiresCompatibilities:
- EC2
OmeroserverTaskExecutionRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Statement:
- Action:
- sts:AssumeRole
Effect: Allow
Principal:
Service: ecs-tasks.amazonaws.com
Version: '2012-10-17'
ManagedPolicyArns:
- arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
- arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly
Tags:
- Key: project
Value: omero-on-aws
- Key: service
Value: omeroserver
OmeroserverTaskRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Statement:
- Action:
- sts:AssumeRole
Effect: Allow
Principal:
Service: ecs-tasks.amazonaws.com
Version: '2012-10-17'
Policies:
- PolicyName: OmeroserverOmeroVolumeMountPolicy
PolicyDocument:
Statement:
- Action:
- elasticfilesystem:ClientMount
- elasticfilesystem:ClientWrite
- elasticfilesystem:ClientRootAccess
Condition:
StringEquals:
elasticfilesystem:AccessPointArn: !Ref NFSAccessPoint
Effect: Allow
Resource:
- !Join
- ''
- - 'arn:aws:elasticfilesystem:'
- !Ref 'AWS::Region'
- ':'
- !Ref 'AWS::AccountId'
- ':file-system/'
- !Ref EFSFileSystem
Tags:
- Key: project
Value: omero-on-aws
- Key: service
Value: omeroserver
ECSAutoScalingGroup:
Type: AWS::AutoScaling::AutoScalingGroup
DependsOn:
- MountTarget
Properties:
VPCZoneIdentifier:
- !Ref PublicSubnet1Id
LaunchConfigurationName: !Ref 'ContainerInstances'
MinSize: '1'
MaxSize: '1'
DesiredCapacity: '1'
CreationPolicy:
ResourceSignal:
Timeout: PT15M
UpdatePolicy:
AutoScalingReplacingUpdate:
WillReplace: 'true'
ContainerInstances:
Type: AWS::AutoScaling::LaunchConfiguration
Properties:
ImageId: !FindInMap [AWSRegionToAMI, !Ref 'AWS::Region', AMIID]
SecurityGroups:
- !Ref OmeroSecurityGroup
InstanceType: !Ref 'InstanceType'
IamInstanceProfile: !Ref 'EC2InstanceProfile'
KeyName: !Ref 'KeyName'
UserData:
Fn::Base64: !Sub |
#!/bin/bash -xe
echo ECS_CLUSTER=${OMEROECSCluster} >> /etc/ecs/ecs.config
yum install -y aws-cfn-bootstrap bzip2 unzip
/opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource ECSAutoScalingGroup --region ${AWS::Region}
EC2Role:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Statement:
- Effect: Allow
Principal:
Service:
- ec2.amazonaws.com
Action:
- sts:AssumeRole
Path: /
ManagedPolicyArns:
- arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role
- arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
- arn:aws:iam::aws:policy/AmazonS3FullAccess
Tags:
- Key: project
Value: omero-on-aws
- Key: service
Value: omeroserver
EC2InstanceProfile:
Type: AWS::IAM::InstanceProfile
Properties:
Path: /
Roles: [!Ref 'EC2Role']
OmerowebService:
Type: AWS::ECS::Service
DependsOn:
- OmerowebTCP4080Listener
Properties:
Cluster: !Ref 'OMEROECSCluster'
DeploymentConfiguration:
MaximumPercent: 200
MinimumHealthyPercent: 100
DeploymentController:
Type: ECS
DesiredCount: !Ref NumberofWebInstances
LaunchType: FARGATE
LoadBalancers:
- ContainerName: omeroweb
ContainerPort: 4080
TargetGroupArn: !Ref 'OmerowebTCP4080TargetGroup'
NetworkConfiguration:
AwsvpcConfiguration:
AssignPublicIp: ENABLED
SecurityGroups:
- !Ref OmeroSecurityGroup
Subnets:
- !Ref 'PublicSubnet1Id'
- !Ref 'PublicSubnet2Id'
PropagateTags: SERVICE
SchedulingStrategy: REPLICA
ServiceRegistries:
- RegistryArn: !GetAtt 'OmerowebServiceDiscoveryEntry.Arn'
Tags:
- Key: project
Value: omero-on-aws
- Key: service
Value: omeroweb
TaskDefinition: !Ref 'OmerowebTaskDefinition'
OmerowebTCP4080Listener:
Type: AWS::ElasticLoadBalancingV2::Listener
Properties:
DefaultActions:
- ForwardConfig:
TargetGroups:
- TargetGroupArn: !Ref 'OmerowebTCP4080TargetGroup'
Type: forward
LoadBalancerArn: !If
- CreateLoadBalancer
- !Ref 'OMEROLoadBalancer'
- !Ref 'ParameterLoadBalancerARN'
Port: 4080
Protocol: TCP
OmerowebTCP4080TargetGroup:
Type: AWS::ElasticLoadBalancingV2::TargetGroup
Properties:
Port: 4080
Protocol: TCP
Tags:
- Key: project
Value: omero-on-aws
TargetType: ip
VpcId: !Ref VPCID
OmerowebTaskDefinition:
Type: AWS::ECS::TaskDefinition
Properties:
ContainerDefinitions:
- Environment:
- Name: OMEROHOST
Value: omeroserver.ecscloudmap.org
- Name: LOCALDOMAIN
Value: !Join
- ''
- - !Ref 'AWS::Region'
- .compute.internal
- 'omero.local'
Essential: true
Image: openmicroscopy/omero-web-standalone:5.6
LinuxParameters: {}
LogConfiguration:
LogDriver: awslogs
Options:
awslogs-group: !Ref 'LogGroup'
awslogs-region: !Ref 'AWS::Region'
awslogs-stream-prefix: omeroweb
Name: omeroweb
PortMappings:
- ContainerPort: 4080
HostPort: 4080
Protocol: tcp
Cpu: !Ref OMEROWebContainerCPU
Memory: !Ref OMEROWebContainerMemory
ExecutionRoleArn: !Ref 'OmerowebTaskExecutionRole'
Family: omero-web
NetworkMode: awsvpc
RequiresCompatibilities:
- FARGATE
OmerowebTaskExecutionRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Statement:
- Action:
- sts:AssumeRole
Effect: Allow
Principal:
Service: ecs-tasks.amazonaws.com
Version: '2012-10-17'
ManagedPolicyArns:
- arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
- arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly
Tags:
- Key: project
Value: omero-on-aws
- Key: service
Value: omeroweb
Outputs:
OMEROLoadBalancerHTTPEnpoint:
Description: The HTTP endpoint of the OMEROLoadBalancer
Value: !Join
- ''
- - 'http://'
- !GetAtt OMEROLoadBalancer.DNSName
- ':4080'