stack.yml

Description: >
  This template deploys the SCAYLE Storefront application on ECS Fargate

Parameters:
  # =============================================================================
  # Global Configuration
  # =============================================================================
  Environment:
    Description: The environment to deploy (dev, staging, prod)
    Type: String
    Default: dev
    AllowedValues:
      - dev
      - staging
      - prod

  ScayleTenantSpace:
    Description: Choose your SCAYLE tenant space your storefront should connect to, e.g. acme-live
    Type: String
    AllowedPattern: "^[a-z]+(-[a-z]+)*$"

  # =============================================================================
  # ECS Configuration
  # =============================================================================
  Image:
    Description: Choose the docker image that should be deployed
    Type: String
    Default: scayle/storefront-boilerplate:1.0.0-storyblok

  # =============================================================================
  # SCAYLE Authentication
  # =============================================================================
  ScayleAuthClientId:
    Description: Your Client ID for the Authentication API from SCAYLE
    NoEcho: true
    Type: String

  ScayleAuthClientSecret:
    Description: Your Secret for the Authentication API from SCAYLE
    NoEcho: true
    Type: String

  ScayleCheckoutSecret:
    Description: Your Checkout Secret for your SCAYLE Shop. This needs to be provided through your SCAYLE Contact
    NoEcho: true
    Type: String

  ScayleCheckoutToken:
    Description: Your Checkout Token for your SCAYLE Shop. This needs to be provided through your SCAYLE Contact
    NoEcho: true
    Type: String

  ScayleStorefrontAPIToken:
    Description: Your Token for the Storefront API from SCAYLE
    NoEcho: true
    Type: String

  StoryblokAccessToken:
    Description: Your Storyblok Access Token for your CMS integration
    NoEcho: true
    Type: String

  # =============================================================================
  # Network Configuration
  # =============================================================================
  PrivateSubnets:
    Description: Choose which subnets Service and ElastiCache should be deployed to
    Type: List<AWS::EC2::Subnet::Id>

  PublicSubnets:
    Description: Choose which subnets the Load Balancer should be deployed to
    Type: List<AWS::EC2::Subnet::Id>

  VPC:
    Description: Choose which VPC this ECS cluster should be deployed to
    Type: AWS::EC2::VPC::Id

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "Global Configuration"
        Parameters:
          - Environment
          - ScayleTenantSpace
      - Label:
          default: "ECS Configuration"
        Parameters:
          - Image
      - Label:
          default: "SCAYLE Authentication"
        Parameters:
          - ScayleAuthClientId
          - ScayleAuthClientSecret
          - ScayleCheckoutSecret
          - ScayleCheckoutToken
          - ScayleStorefrontAPIToken
          - StoryblokAccessToken
      - Label:
          default: "Network Configuration"
        Parameters:
          - PrivateSubnets
          - PublicSubnets
          - VPC

Mappings:
  EnvironmentDefaults:
    dev:
      Cpu: 512
      Memory: 1024
      CpuTargetValue: 80
      DesiredCount: 1
      MaxCapacity: 10
      MinCapacity: 1
      CacheNodeType: cache.t4g.small
      NumCacheClusters: 1
      AutomaticFailoverEnabled: false
    staging:
      Cpu: 512
      Memory: 1024
      CpuTargetValue: 80
      DesiredCount: 1
      MaxCapacity: 10
      MinCapacity: 1
      CacheNodeType: cache.t4g.small
      NumCacheClusters: 1
      AutomaticFailoverEnabled: false
    prod:
      Cpu: 1024
      Memory: 2048
      CpuTargetValue: 40
      DesiredCount: 2
      MaxCapacity: 50
      MinCapacity: 2
      CacheNodeType: cache.m6g.large
      NumCacheClusters: 2
      AutomaticFailoverEnabled: true

Resources:
  # =============================================================================
  # ECS Cluster (Fargate only)
  # =============================================================================
  ECSCluster:
    Type: AWS::ECS::Cluster
    Properties:
      ClusterName: !Ref AWS::StackName
      ClusterSettings:
        - Name: containerInsights
          Value: enabled

  # =============================================================================
  # Security Groups
  # =============================================================================
  ElastiCacheSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Sub ${AWS::StackName}-sg-ec
      GroupDescription: SCAYLE Storefront ElastiCache Security Group
      SecurityGroupIngress:
        - SourceSecurityGroupId:
            Ref: ServiceSecurityGroup
          IpProtocol: tcp
          FromPort: 6379
          ToPort: 6379
      VpcId: !Ref VPC

  ServiceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Sub ${AWS::StackName}-sg-ecs
      GroupDescription: SCAYLE Storefront Service Security Group
      SecurityGroupIngress:
        - Description: Access from the LB to ECS
          IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          SourceSecurityGroupId:
            Ref: LoadBalancerSecurityGroup
      VpcId: !Ref VPC

  LoadBalancerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Sub ${AWS::StackName}-sg-lb
      GroupDescription: SCAYLE Storefront Load Balancer Security Group
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
      SecurityGroupEgress:
        - IpProtocol: -1
          FromPort: -1
          ToPort: -1
          CidrIp: 0.0.0.0/0

  # =============================================================================
  # Load Balancer
  # =============================================================================
  LoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Name: !Ref AWS::StackName
      Subnets: !Ref PublicSubnets
      SecurityGroups:
        - !Ref LoadBalancerSecurityGroup

  # IMPORTANT: Replace this default listener with one that supports HTTPS (Port 443)
  LoadBalancerListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: !Ref LoadBalancer
      Port: 80
      Protocol: HTTP
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref TargetGroup

  TargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    DependsOn:
      - LoadBalancer
    Properties:
      Port: 80
      Protocol: HTTP
      Matcher:
        HttpCode: 200-299
      HealthCheckIntervalSeconds: 10
      HealthCheckTimeoutSeconds: 5
      HealthCheckPort: traffic-port
      HealthCheckPath: /api/up
      HealthCheckProtocol: HTTP
      HealthyThresholdCount: 2
      UnhealthyThresholdCount: 3
      TargetType: ip
      TargetGroupAttributes:
        - Key: deregistration_delay.timeout_seconds
          Value: 30
      VpcId: !Ref VPC

  # =============================================================================
  # ElastiCache
  # =============================================================================
  ElastiCache:
    Type: AWS::ElastiCache::ReplicationGroup
    Properties:
      AutomaticFailoverEnabled: !FindInMap [ EnvironmentDefaults, !Ref Environment, AutomaticFailoverEnabled ]
      CacheNodeType: !FindInMap [ EnvironmentDefaults, !Ref Environment, CacheNodeType ]
      CacheSubnetGroupName: !Ref ElastiCacheSubnetGroup
      Engine: redis
      EngineVersion: 7.0
      MultiAZEnabled: !FindInMap [ EnvironmentDefaults, !Ref Environment, AutomaticFailoverEnabled ]
      NumCacheClusters: !FindInMap [ EnvironmentDefaults, !Ref Environment, NumCacheClusters ]
      PreferredMaintenanceWindow: tue:02:00-tue:04:00
      ReplicationGroupDescription: !Ref AWS::StackName
      ReplicationGroupId: !Ref AWS::StackName
      SecurityGroupIds:
        - !Ref ElastiCacheSecurityGroup
      SnapshotRetentionLimit: 1
      SnapshotWindow: 01:00-02:00
      SnapshottingClusterId: !Sub ${AWS::StackName}-001

  ElastiCacheSubnetGroup:
    Type: AWS::ElastiCache::SubnetGroup
    Properties:
      Description: !Ref AWS::StackName
      SubnetIds: !Ref PrivateSubnets

  # =============================================================================
  # ECS Service
  # =============================================================================
  CloudwatchLogsGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Ref AWS::StackName
      RetentionInDays: 14

  Service:
    DependsOn:
      - ElastiCache
    Type: AWS::ECS::Service
    Properties:
      Cluster: !Ref ECSCluster
      LaunchType: FARGATE
      DeploymentConfiguration:
        MaximumPercent: 200
        MinimumHealthyPercent: 100
      DesiredCount: !FindInMap [ EnvironmentDefaults, !Ref Environment, DesiredCount ]
      LoadBalancers:
        - ContainerName: storefront
          ContainerPort: 80
          TargetGroupArn: !Ref TargetGroup
      NetworkConfiguration:
        AwsvpcConfiguration:
          SecurityGroups:
            - !Ref ServiceSecurityGroup
          Subnets: !Ref PrivateSubnets
      TaskDefinition: !Ref TaskDefinition

  TaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: !Ref AWS::StackName
      RuntimePlatform:
        CpuArchitecture: X86_64
        OperatingSystemFamily: LINUX
      Cpu: !FindInMap [ EnvironmentDefaults, !Ref Environment, Cpu ]
      Memory: !FindInMap [ EnvironmentDefaults, !Ref Environment, Memory ]
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      ExecutionRoleArn: !GetAtt TaskExecutionRole.Arn
      TaskRoleArn: !GetAtt TaskRole.Arn
      ContainerDefinitions:
        - Name: storefront
          Image: !Ref Image
          PortMappings:
            - HostPort: 80
              Protocol: tcp
              ContainerPort: 80
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: !Ref CloudwatchLogsGroup
              awslogs-region: !Ref AWS::Region
              awslogs-stream-prefix: !Ref AWS::StackName
          Environment:
            - Name: NITRO_PORT
              Value: 80
            - Name: NODE_ENV
              Value: production
            - Name: NUXT_STOREFRONT_STORAGE_CACHE_HOST
              Value: !GetAtt ElastiCache.PrimaryEndPoint.Address
            - Name: NUXT_STOREFRONT_STORAGE_SESSION_HOST
              Value: !GetAtt ElastiCache.PrimaryEndPoint.Address
            - Name: NUXT_PUBLIC_STOREFRONT_LOG_LEVEL
              Value: info
          Ulimits:
            - Name: nofile
              SoftLimit: 65535
              HardLimit: 65535
            - Name: nproc
              SoftLimit: 65535
              HardLimit: 65535
          Secrets:
            - Name: SERVICE_SECRET
              ValueFrom: !Ref Secret
          Essential: true

  TaskExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ecs-tasks.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Policies:
        - PolicyName: !Join [ "-", [ !Ref AWS::StackName, "secretsmanager-permissions" ] ]
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                  - 'secretsmanager:GetResourcePolicy'
                  - 'secretsmanager:GetSecretValue'
                  - 'secretsmanager:DescribeSecret'
                  - 'secretsmanager:ListSecretVersionIds'
                Effect: Allow
                Resource: !Ref Secret
        - PolicyName: !Join [ "-", [ !Ref AWS::StackName, "cloudwatch-permissions" ] ]
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                  - 'logs:CreateLogStream'
                  - 'logs:PutLogEvents'
                Effect: Allow
                Resource: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${CloudwatchLogsGroup}:*"

  TaskRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: ssm-permissions
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                  - 'ssmmessages:CreateControlChannel'
                  - 'ssmmessages:CreateDataChannel'
                  - 'ssmmessages:OpenControlChannel'
                  - 'ssmmessages:OpenDataChannel'
                Effect: Allow
                Resource: '*'
        - PolicyName: ecs-exec-permissions
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                  - 'ecs:ExecuteCommand'
                Effect: Allow
                Condition:
                  StringEquals:
                    'aws:ResourceTag/service': storefront-boilerplate-service
                Resource: !Sub
                  - arn:aws:ecs:${AWS::Region}:${AWS::AccountId}:cluster/${ECSCluster}
                  - ECSCluster: !Ref ECSCluster

  Secret:
    Type: 'AWS::SecretsManager::Secret'
    Properties:
      Name: !Ref AWS::StackName
      Description: 'Storefront Boilerplate Secrets'
      SecretString: !Sub |
        {
          "NUXT_PUBLIC_CDN_URL": "https://${ScayleTenantSpace}.cdn.scayle.cloud/",
          "NUXT_PUBLIC_LOG_NAME": "storefront-boilerplate",
          "NUXT_PUBLIC_CMS_ACCESS_TOKEN": "${StoryblokAccessToken}",
          "NUXT_PUBLIC_STORYBLOK_ACCESS_TOKEN": "${StoryblokAccessToken}",
          "NUXT_STOREFRONT_BAPI_HOST": "https://${ScayleTenantSpace}.storefront.api.scayle.cloud/v1/",
          "NUXT_STOREFRONT_BAPI_TOKEN": "${ScayleStorefrontAPIToken}",
          "NUXT_STOREFRONT_OAUTH_API_HOST": "https://${ScayleTenantSpace}.auth.scayle.cloud",
          "NUXT_STOREFRONT_OAUTH_CLIENT_ID": "${ScayleAuthClientId}",
          "NUXT_STOREFRONT_OAUTH_CLIENT_SECRET": "${ScayleAuthClientSecret}",
          "NUXT_STOREFRONT_REDIRECTS_ENABLED": "true",
          "NUXT_STOREFRONT_STORES_1001_CHECKOUT_HOST": "https://${ScayleTenantSpace}.checkout.api.scayle.cloud",
          "NUXT_STOREFRONT_STORES_1001_CHECKOUT_SECRET": "${ScayleCheckoutSecret}",
          "NUXT_STOREFRONT_STORES_1001_CHECKOUT_TOKEN": "${ScayleCheckoutToken}",
          "NUXT_STOREFRONT_STORES_1001_CHECKOUT_USER": "1001",
          "NUXT_PUBLIC_GTM_ID": "GTM-123"
        }

  # =============================================================================
  # Auto Scaling
  # =============================================================================
  ECSAutoScalingTarget:
    DependsOn: Service
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    Properties:
      MaxCapacity: !FindInMap [ EnvironmentDefaults, !Ref Environment, MaxCapacity ]
      MinCapacity: !FindInMap [ EnvironmentDefaults, !Ref Environment, MinCapacity ]
      ResourceId: !Sub
        - service/${ECSCluster}/${ServiceName}
        - ServiceName: !GetAtt Service.Name
      RoleARN: !GetAtt ApplicationAutoScalingRole.Arn
      ScalableDimension: ecs:service:DesiredCount
      ServiceNamespace: ecs

  ECSAutoScalingPolicy:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName: !Sub "${AWS::StackName}-ECSAutoScalingPolicy"
      PolicyType: TargetTrackingScaling
      ScalingTargetId: !Ref ECSAutoScalingTarget
      TargetTrackingScalingPolicyConfiguration:
        PredefinedMetricSpecification:
          PredefinedMetricType: ECSServiceAverageCPUUtilization
        TargetValue: !FindInMap [ EnvironmentDefaults, !Ref Environment, CpuTargetValue ]

  ApplicationAutoScalingRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ecs.application-autoscaling.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: !Join [ "-", [ !Ref AWS::StackName, "autoscaling-permissions" ] ]
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - application-autoscaling:*
                  - cloudwatch:DescribeAlarms
                  - cloudwatch:PutMetricAlarm
                  - ecs:UpdateService
                  - ecs:DescribeServices
                  - ecs:DescribeClusters
                Resource: '*'

Outputs:
  LoadBalancerDNSName:
    Description: "DNS name of the load balancer"
    Value: !GetAtt LoadBalancer.DNSName

  ECSClusterName:
    Description: "Name of the ECS Cluster"
    Value: !Ref ECSCluster

  ECSServiceName:
    Description: "Name of the ECS Service"
    Value: !Ref Service

  TaskDefinitionARN:
    Description: "ARN of the ECS Task Definition"
    Value: !Ref TaskDefinition

  ElastiCachePrimaryEndpoint:
    Description: "Primary endpoint address of the ElastiCache cluster"
    Value: !GetAtt ElastiCache.PrimaryEndPoint.Address

  CloudWatchLogGroupName:
    Description: "Name of the CloudWatch Logs log group"
    Value: !Ref CloudwatchLogsGroup