Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
Subnets: cf.split(',', cf.ref('ELBSubnets')),
Type: 'application'
}
},
TaskingManagerTargetGroup: {
Type: 'AWS::ElasticLoadBalancingV2::TargetGroup',
Properties: {
HealthCheckIntervalSeconds: 60,
HealthCheckPort: 8000,
HealthCheckProtocol: 'HTTP',
HealthCheckTimeoutSeconds: 10,
HealthyThresholdCount: 3,
UnhealthyThresholdCount: 3,
Port: 8000,
Protocol: 'HTTP',
VpcId: cf.importValue(cf.join('-', ['hotosm-network-production', 'default-vpc', cf.region])),
Matcher: {
HttpCode: '200,202,302,304'
}
}
},
TaskingManagerLoadBalancerHTTPSListener: {
Type: 'AWS::ElasticLoadBalancingV2::Listener',
Properties: {
Certificates: [ {
CertificateArn: cf.arn('acm', cf.ref('SSLCertificateIdentifier'))
}],
DefaultActions: [{
Type: 'forward',
TargetGroupArn: cf.ref('TaskingManagerTargetGroup')
}],
LoadBalancerArn: cf.ref('TaskingManagerLoadBalancer'),
}
},
MLEnablerService: {
Type: "AWS::ECS::Service",
Properties: {
ServiceName: cf.join("-", [cf.stackName, "Service"]),
Cluster: cf.ref("MLEnablerECSCluster"),
TaskDefinition: cf.ref("MLEnablerTaskDefinition"),
LaunchType: "FARGATE",
HealthCheckGracePeriodSeconds: 300,
DesiredCount: 1,
NetworkConfiguration: {
AwsvpcConfiguration: {
AssignPublicIp : "ENABLED",
SecurityGroups : [
cf.importValue(
cf.join("-", ["hotosm-network-production-production-ec2s-security-group", cf.region])
)
],
Subnets : cf.split(",", cf.ref("ELBSubnets"))
}
},
LoadBalancers: [{
ContainerName: "app",
ContainerPort: 5000,
TargetGroupArn: cf.ref("MLEnablerTargetGroup")
}]
}
},
MLEnablerTargetGroup: {
Type: "AWS::ElasticLoadBalancingV2::TargetGroup",
Properties: {
Subnets : cf.split(",", cf.ref("ELBSubnets"))
}
},
LoadBalancers: [{
ContainerName: "app",
ContainerPort: 5000,
TargetGroupArn: cf.ref("MLEnablerTargetGroup")
}]
}
},
MLEnablerTargetGroup: {
Type: "AWS::ElasticLoadBalancingV2::TargetGroup",
Properties: {
Port: 5000,
Protocol: "HTTP",
VpcId: cf.importValue(cf.join("-", ["hotosm-network-production", "default-vpc", cf.region])),
TargetType: "ip",
Matcher: {
HttpCode: "200,202,302,304"
}
}
},
MLEnablerALB: {
Type: "AWS::ElasticLoadBalancingV2::LoadBalancer",
Properties: {
Name: cf.stackName,
SecurityGroups: [
cf.importValue(
cf.join("-", ["hotosm-network-production-production-elbs-security-group", cf.region])
)
],
Subnets: cf.split(",", cf.ref("ELBSubnets")),
Subnets: cf.split(',', cf.ref('ELBSubnets')),
Type: 'application'
}
},
TaskingManagerTargetGroup: {
Type: 'AWS::ElasticLoadBalancingV2::TargetGroup',
Properties: {
HealthCheckIntervalSeconds: 60,
HealthCheckPort: 8000,
HealthCheckProtocol: 'HTTP',
HealthCheckTimeoutSeconds: 10,
HealthyThresholdCount: 3,
UnhealthyThresholdCount: 3,
Port: 8000,
Protocol: 'HTTP',
VpcId: cf.importValue(cf.join('-', ['hotosm-network-production', 'default-vpc', cf.region])),
Matcher: {
HttpCode: '200,202,302,304'
}
}
},
TaskingManagerLoadBalancerHTTPSListener: {
Type: 'AWS::ElasticLoadBalancingV2::Listener',
Properties: {
Certificates: [ {
CertificateArn: cf.arn('acm', cf.ref('SSLCertificateIdentifier'))
}],
DefaultActions: [{
Type: 'forward',
TargetGroupArn: cf.ref('TaskingManagerTargetGroup')
}],
LoadBalancerArn: cf.ref('TaskingManagerLoadBalancer'),
}],
RoleName: cf.join('-', [cf.stackName, 'ec2', 'database-dump-access', 'role'])
}
},
TaskingManagerEC2InstanceProfile: {
Type: "AWS::IAM::InstanceProfile",
Properties: {
Roles: cf.if('DatabaseDumpFileGiven', [cf.ref('TaskingManagerEC2Role'), cf.ref('TaskingManagerDatabaseDumpAccessRole')], [cf.ref('TaskingManagerEC2Role')]),
InstanceProfileName: cf.join('-', [cf.stackName, 'ec2', 'instance', 'profile'])
}
},
TaskingManagerLoadBalancer: {
Type: 'AWS::ElasticLoadBalancingV2::LoadBalancer',
Properties: {
Name: cf.stackName,
SecurityGroups: [cf.importValue(cf.join('-', ['hotosm-network-production', cf.ref('Environment'), 'elbs-security-group', cf.region]))],
Subnets: cf.split(',', cf.ref('ELBSubnets')),
Type: 'application'
}
},
TaskingManagerTargetGroup: {
Type: 'AWS::ElasticLoadBalancingV2::TargetGroup',
Properties: {
HealthCheckIntervalSeconds: 60,
HealthCheckPort: 8000,
HealthCheckProtocol: 'HTTP',
HealthCheckTimeoutSeconds: 10,
HealthyThresholdCount: 3,
UnhealthyThresholdCount: 3,
Port: 8000,
Protocol: 'HTTP',
VpcId: cf.importValue(cf.join('-', ['hotosm-network-production', 'default-vpc', cf.region])),
Subnets: cf.split(",", cf.ref("ELBSubnets")),
Type: "application"
}
},
VisualizeChangeTargetGroup: {
Type: "AWS::ElasticLoadBalancingV2::TargetGroup",
Properties: {
HealthCheckIntervalSeconds: 60,
HealthCheckPort: 8000,
HealthCheckProtocol: "HTTP",
HealthCheckTimeoutSeconds: 10,
HealthyThresholdCount: 3,
UnhealthyThresholdCount: 3,
Port: 8000,
Protocol: "HTTP",
VpcId: cf.importValue(cf.join("-", ["hotosm-network-production", "default-vpc", cf.region])),
Matcher: {
HttpCode: "200,202,302,304"
}
}
}
};
module.exports = { Parameters, Resources };
]
},
Policies: [
{
PolicyName: 'gatekeeper-to-app',
PolicyDocument: {
Statement: [
{
Effect: 'Allow',
Action: 'logs:*',
Resource: cf.getAtt('GatekeeperLambdaLogs', 'Arn')
},
{
Effect: 'Allow',
Action: 'kms:Decrypt',
Resource: cf.importValue('cloudformation-kms-production')
}
]
}
}
]
}
},
GatekeeperLambda: {
Type: 'AWS::Lambda::Function',
Properties: {
FunctionName: cf.sub('${AWS::StackName}-gatekeeper'),
Description: 'Add repositories to Github app',
Code: {
S3Bucket: cf.sub('${OutputBucketPrefix}-${AWS::Region}'),
S3Key: cf.sub('${OutputKeyPrefix}/stork/${GitSha}.zip')
},
},
{
Effect: 'Allow',
Action: [
'logs:CreateLogStream',
'logs:PutLogEvents',
'logs:FilterLogEvents'
],
Resource: cf.getAtt(prefixed('LogGroup'), 'Arn')
},
cf.if(
'NotInChina',
{
Effect: 'Allow',
Action: 'kms:Decrypt',
Resource: cf.importValue('cloudformation-kms-production')
},
cf.noValue
)
]
}
}
]
}
};
if (!options.fifo)
Resources[prefixed('Role')].Properties.Policies[0].PolicyDocument.Statement.push({
Effect: 'Allow',
Action: 'sns:Publish',
Resource: cf.ref(prefixed('Topic'))
});
TaskingManagerRDS: {
Type: 'AWS::RDS::DBInstance',
Properties: {
Engine: 'postgres',
DBName: cf.if('UseASnapshot', cf.noValue, cf.ref('PostgresDB')),
EngineVersion: '11.5',
MasterUsername: cf.if('UseASnapshot', cf.noValue, cf.ref('PostgresUser')),
MasterUserPassword: cf.if('UseASnapshot', cf.noValue, cf.ref('PostgresPassword')),
AllocatedStorage: cf.ref('DatabaseSize'),
BackupRetentionPeriod: 10,
StorageType: 'gp2',
DBParameterGroupName: 'tm3-logging-postgres11',
EnableCloudwatchLogsExports: ['postgresql'],
DBInstanceClass: cf.if('IsTaskingManagerProduction', 'db.t3.2xlarge', 'db.t2.small'),
DBSnapshotIdentifier: cf.if('UseASnapshot', cf.ref('DBSnapshot'), cf.noValue),
VPCSecurityGroups: [cf.importValue(cf.join('-', ['hotosm-network-production', cf.ref('NetworkEnvironment'), 'ec2s-security-group', cf.region]))],
}
}
};
module.exports = { Parameters, Resources, Conditions }
}
},
VisualizeChangeLaunchConfiguration: {
Type: "AWS::AutoScaling::LaunchConfiguration",
Properties: {
IamInstanceProfile: cf.ref("VisualizeChangeEC2InstanceProfile"),
ImageId: "ami-dfca85a0",
InstanceType: "t2.large",
BlockDeviceMappings: [
{
DeviceName: "/dev/sda1",
Ebs: { VolumeSize: "150" }
}
],
SecurityGroups: [
cf.importValue(
cf.join("-", ["hotosm-network-production", cf.ref("Environment"), "ec2s-security-group", cf.region])
)
],
UserData: cf.userData([
"#!/bin/bash",
"set -x",
"curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | sudo apt-key add - ",
"echo 'deb https://dl.yarnpkg.com/debian/ stable main' | sudo tee /etc/apt/sources.list.d/yarn.list",
"sudo apt-get update && sudo apt-get install -y yarn git",
"https://github.com/hotosm/visualize-change.git /dev/sda1/visualize-change && cd /dev/sda1/visualize-change/ ",
"git reset --hard ${GitSha}",
"# ./scripts/get-indonesia-tiles.sh",
"./scripts/setup-docker-data-folders.sh",
"if [ ${MAP_LAYER_MINZOOM} == 0 ]; then ./scripts/tiles-add-underzoom.sh; fi",
"./scripts/build.prod.sh",
"./scripts/start.prod.sh"