efsbackup.yaml

AWSTemplateFormatVersion: 2010-09-09
Parameters:
  VPC:
    Description: VPC to launch in.
    Type: 'AWS::EC2::VPC::Id'
    ConstraintDescription: Must be the id of an existing VPC.
  KeyName:
    Description: Name of an existing EC2 KeyPair to enable SSH access to the instance
    Type: 'AWS::EC2::KeyPair::KeyName'
    ConstraintDescription: must be the name of an existing EC2 KeyPair.
  InstanceType:
    Description: Backup Server. This server runs tasks such as nightly backups. An m4.large with Spot pricing is recommended to take advantage of faster network performance.
    Type: String
    Default: m5.large
    AllowedValues:
      - t2.nano
      - t2.micro
      - t2.small
      - t2.medium
      - t2.large
      - t3.micro
      - t3.small
      - t3.medium
      - t3.large
      - m3.medium
      - m4.large
      - m5.large
  InstanceSubnets:
    Description: A list of subnet identifiers for subnets with EFS endpoints for your EFS file system.
    Type: 'List<AWS::EC2::Subnet::Id>'
  SSHLocation:
    Description: ' The IP address range that can be used to SSH to the EC2 instances'
    Type: String
    MinLength: '9'
    MaxLength: '18'
    AllowedPattern: '(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})'
    ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x.
  S3Bucket:
    Description: 'The name of the bucket that contains your lambda source code'
    Type: String
  S3Folder: 
    Description: 'The folder where you loaded the source for the functions.'
    Type: String
    Default: 'efsbackup'
  EFSSecurityGroup: 
    Description: 'The name of the existing SecurityGroup that allows ingress to EFS'
    Type: String
Mappings:
  AWSInstanceType2Arch:
    t2.nano:
      Arch: HVM64
    t2.micro:
      Arch: HVM64
    t2.small:
      Arch: HVM64
    t2.medium:
      Arch: HVM64
    t2.large:
      Arch: HVM64
    m3.medium:
      Arch: HVM64
    m4.large:
      Arch: HVM64
    m5.large:
      Arch: HVM64
    t3.micro:
      Arch: HVM64
    t3.small:
      Arch: HVM64
    t3.medium:
      Arch: HVM64
    t3.large:
      Arch: HVM64
  SpotBidPrice:
    t2.nano:
      Spot: "0.0050"
    t2.micro:
      Spot: "0.0100"
    t2.small:
      Spot: "0.0200"
    t2.medium:
      Spot: "0.0400"
    t2.large:
      Spot: "0.0800"
    t3.micro:
      Spot: "0.0100"
    t3.small:
      Spot: "0.0200"
    t3.medium:
      Spot: "0.0400"
    t3.large:
      Spot: "0.0800"
    m3.medium:
      Spot: "0.0100"
    m4.large:
      Spot: "0.1000"
    m5.large:
      Spot: "0.0900"
Resources:
  AMIInfo:
    Type: 'Custom::AMIInfo'
    Properties:
      ServiceToken: !GetAtt AMIInfoFunction.Arn
      Region: !Ref 'AWS::Region'
      Architecture: 
        Fn::FindInMap: 
          - AWSInstanceType2Arch
          - !Ref InstanceType
          - 'Arch'
  AMIInfoFunction:
    Type: 'AWS::Lambda::Function'
    Properties:
      Code:
        S3Bucket: !Ref S3Bucket
        S3Key: 
          Fn::Join:
            - '/'
            - - !Ref S3Folder
              - 'amilookup.zip'
      Handler: amilookup.handler
      Role: !GetAtt LambdaExecutionRole.Arn        
      Runtime: 'nodejs8.10'
      Timeout: 30
  LambdaExecutionRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - 'logs:CreateLogGroup'
                  - 'logs:CreateLogStream'
                  - 'logs:PutLogEvents'
                Resource: 'arn:aws:logs:*:*:*'
              - Effect: Allow
                Action:
                  - 'ec2:DescribeImages'
                Resource: '*'
  BatchProfile:
    Type: "AWS::IAM::InstanceProfile"
    Properties:
      Path: "/"
      Roles:
        - 
          !Ref "BatchRole"
  BatchRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Principal:
              Service:
                - "ec2.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"
  ASGMgrProfile:
    Type: "AWS::IAM::InstanceProfile"
    Properties:
      Path: "/"
      Roles:
        - 
          !Ref "ASGMgrRole"
  ASGMgrRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Principal:
              Service:
                - "lambda.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
  BatchScalePolicy:
    Type: "AWS::IAM::Policy"
    Properties: 
      PolicyName: BatchScalePolicy
      PolicyDocument: 
        Version: 2012-10-17
        Statement:
          - Sid: ScaleDown
            Effect: Allow
            Action:
              - 'autoscaling:SetDesiredCapacity'
            Resource: !Join
              - ''
              - - 'arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/'
                - !Ref BatchASG
      Roles:
        - !Ref BatchRole
        - !Ref ASGMgrRole
  ServerConfigRO:
    Type: "AWS::IAM::Policy"
    Properties: 
      PolicyName: ServerConfigRO
      PolicyDocument: 
        Version: 2012-10-17
        Statement:
          - Sid: EFSBackupS3ObjectActions
            Effect: Allow
            Action:
              - 's3:Get*'
              - 's3:List*'
            Resource: !Join
              - ''
              - - 'arn:aws:s3:::'
                - !Ref S3Bucket
                - '/'
                - !Ref S3Folder
                - '/*'
          - Sid: EFSBackupS3BucketActions
            Effect: Allow
            Action:
              - 's3:ListBucket'
            Resource: !Join
              - ''
              - - 'arn:aws:s3:::'
                - !Ref S3Bucket
            Condition:
              StringLike:
                's3:prefix': !Join
                  - ''
                  - - !Ref S3Folder
                    - '/*'
      Roles:
        - !Ref BatchRole
  S3BackupRW:
    Type: "AWS::IAM::Policy"
    Properties: 
      PolicyName: S3BackupRW
      PolicyDocument: 
        Version: 2012-10-17
        Statement:
          - Sid: EFSBackupS3ObjectActions
            Effect: Allow
            Action:
              - 's3:Get*'
              - 's3:Put*'
              - 's3:List*'
            Resource:
              - 'arn:aws:s3:::example-com/web-sites/*'
              - 'arn:aws:s3:::example1.org/*'
              - 'arn:aws:s3:::example2.org/*'
          - Sid: EFSBackupS3BucketActions
            Effect: Allow
            Action:
              - 's3:ListBucket'
            Resource:
              - 'arn:aws:s3:::example-com'
            Condition:
              StringLike:
                's3:prefix':
                  - 'web-sites/*'
          - Sid: BareDomainS3Buckets
            Effect: Allow
            Action: 
              - 's3:ListBucket'
            Resource:
              - 'arn:aws:s3:::example-com/web-sites'
              - 'arn:aws:s3:::example1.org'
              - 'arn:aws:s3:::example2.org'
      Roles:
        - !Ref BatchRole  
  AWSLogs:
    Type: "AWS::IAM::Policy"
    Properties: 
      PolicyName: AWSLogs
      PolicyDocument: 
        Version: 2012-10-17
        Statement:
          - Sid: LogActions
            Effect: Allow
            Action:
              - 'logs:CreateLogGroup'
              - 'logs:CreateLogStream'
              - 'logs:PutLogEvents'
              - 'logs:DescribeLogStreams'
            Resource:
              - 'arn:aws:logs:*:*:*'
      Roles:
        - !Ref BatchRole 
  BatchNotify:
    Type: "AWS::IAM::Policy"
    Properties: 
      PolicyName: BatchNotify
      PolicyDocument: 
        Version: 2012-10-17
        Statement:
          - Sid: SendNofity
            Effect: Allow
            Action:
              - 'sns:Publish'
            Resource:
              - !Ref BatchNotifyTopic
      Roles:
        - !Ref BatchRole 
  BatchSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: 'Allow SSH from SSHLocation'
      Tags: 
        -
          Key: "Name"
          Value:  "BatchServers"
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: '22'
          ToPort: '22'
          CidrIp: !Ref SSHLocation
  BatchEFSIngress:
    Type: 'AWS::EC2::SecurityGroupIngress'
    Properties:
      GroupName: !Ref EFSSecurityGroup
      IpProtocol: tcp
      FromPort: '2049'
      ToPort: '2049'
      SourceSecurityGroupId: !Ref BatchSecurityGroup
  BatchLC:
    Type: 'AWS::AutoScaling::LaunchConfiguration'
    Properties:
      InstanceType: !Ref InstanceType
      IamInstanceProfile: !Ref BatchProfile
      KeyName: !Ref KeyName
      ImageId: !GetAtt AMIInfo.Id
      SecurityGroups:
        - !Ref BatchSecurityGroup
      SpotPrice: !FindInMap 
        - SpotBidPrice
        - !Ref InstanceType
        - Spot  
      UserData: 
        Fn::Base64: 
          !Sub |
            #!/bin/bash -xe
            yum update -y aws-cfn-bootstrap
            aws s3 cp s3://${S3Bucket}/${S3Folder}/dailybackups.sh /tmp
            chmod u+x /tmp/dailybackups.sh
            /tmp/dailybackups.sh ${BatchNotifyTopic}

  BatchASG:
    Type: 'AWS::AutoScaling::AutoScalingGroup'
    Properties: 
      AvailabilityZones:
        Fn::GetAZs: ''
      LaunchConfigurationName:
        !Ref BatchLC
      MinSize: '0'
      MaxSize: '1'

  BatchSched:
    Type: 'AWS::AutoScaling::ScheduledAction'
    Properties: 
      AutoScalingGroupName: !Ref BatchASG
      DesiredCapacity: 1
      Recurrence: '0 5 * * *'
  BatchScaleInLambda: 
      Type: AWS::Lambda::Function
      Properties:
        Code: 
          S3Bucket: !Ref S3Bucket
          S3Key: 
            Fn::Join:
              - '/'
              - - !Ref S3Folder
                - 'BatchScaleIn.zip'
        Handler: BatchScaleIn.lambda_handler
        Role: 
          Fn::GetAtt: 
            - ASGMgrRole
            - Arn
        Runtime: python2.7
        Timeout: 5
        Environment:
          Variables:
            ASG: !Ref BatchASG
      DependsOn:
        ASGMgrRole
  BatchNotifyTopic:
    Type: AWS::SNS::Topic
    Properties:
      DisplayName: 'EFSBackupTopic'
      TopicName: 'EFSBackupNotification'
  BatchNotifySubscription:
    Type: AWS::SNS::Subscription
    Properties:
      Endpoint: !GetAtt BatchScaleInLambda.Arn
      Protocol: lambda
      TopicArn: !Ref BatchNotifyTopic
Metadata:
  'AWS::CloudFormation::Interface':
    ParameterGroups:
      - Label:
          default: Network Configuration
        Parameters:
          - VPC
          - InstanceSubnets
          - SSHLocation
          - EFSSecurityGroup
      - Label:
          default: Backup Server EC2 Configuration
        Parameters:
          - InstanceType
          - BatchAMI
      - Label:
          default: Lambda Configuration
        Parameters:
          - S3Bucket
          - S3Folder