ecs_cloud_formation_template.rb.txt

#!/usr/bin/env ruby

require 'bundler/setup'
require 'cloudformation-ruby-dsl/cfntemplate'
require 'cloudformation-ruby-dsl/spotprice'
require 'cloudformation-ruby-dsl/table'

template do

  value AWSTemplateFormatVersion: '2010-09-09'

  parameter 'ClusterName',
            :Description => 'The name of the ECS cluster',
            :Type => 'String',
            :Default => 'GoCD',
            :UsePreviousValue => true

  output 'AccessKey',
         Value: ref('AccessKey')

  output 'SecretKey',
         Value: get_att('AccessKey', 'SecretAccessKey')

  output 'GoCDEC2OptimizedRole',
         Value: get_att('GoCDEC2OptimizedRole', 'Arn')

  output 'GoCDEC2OptimizedInstanceProfile',
         Value: get_att('GoCDEC2OptimizedInstanceProfile', 'Arn')

  resource 'GoCDECSCluster',
           Type: 'AWS::ECS::Cluster',
           Properties: {
             ClusterName: ref('ClusterName')
           }

  resource 'AccessKey',
           Type: 'AWS::IAM::AccessKey',
           Properties: {
             UserName: ref('GoCDECSPluginUser')
           }

  resource 'GoCDECSPluginUser',
           Type: 'AWS::IAM::User',
           Properties: {
             Policies: [
               {
                 PolicyName: 'ManageEC2Instances',
                 PolicyDocument: {
                   Version: '2012-10-17',
                   Statement: [
                     {
                       Effect: 'Allow',
                       Action: %w(
                        ec2:RunInstances
                        ec2:CreateTags
                        ec2:TerminateInstances
                        ec2:DescribeInstances
                        ec2:DescribeSubnets
                        ec2:CreateVolume
                        ec2:AttachVolume
                        ec2:StopInstances
                        ec2:StartInstances
                        ec2:DeleteTags
                        iam:PassRole
                        iam:GetRole
                       ),
                       Resource: ['*'],
                     },
                   ],
                 },
               },
               {
                 PolicyName: 'ManageECSInstances',
                 PolicyDocument: {
                   Version: '2012-10-17',
                   Statement: [
                     {
                       Effect: 'Allow',
                       Action: %w(
                        ecs:DescribeClusters
                        ecs:DeregisterContainerInstance
                        ecs:DescribeContainerInstances
                        ecs:ListContainerInstances
                        ecs:RegisterTaskDefinition
                        ecs:DeregisterTaskDefinition
                        ecs:DeleteTaskDefinitions
                        ecs:StartTask
                        ecs:StopTask
                        ecs:ListTasks
                        ecs:DescribeTasks
                        ecs:DescribeTaskDefinition
                       ),
                       Resource: ['*'],
                     },
                   ],
                 },
               }
             ],
           }

  resource 'GoCDEC2OptimizedRole',
           Type: 'AWS::IAM::Role',
           Properties: {
             AssumeRolePolicyDocument: {
               Statement: {
                 Effect: 'Allow',
                 Principal: {
                   Service: [
                     'ec2.amazonaws.com'
                   ]
                 },
                 Action: [
                   'sts:AssumeRole'
                 ]
               }
             },
             Policies: [
               {
                 PolicyName: 'AllowECSAgentToManageContainers',
                 PolicyDocument: {
                   Version: '2012-10-17',
                   Statement: [
                     {
                       Effect: 'Allow',
                       Action: %w(
                        ecs:DescribeClusters
                        ecs:DiscoverPollEndpoint
                        ecs:RegisterContainerInstance
                        ecs:DeregisterContainerInstance
                        ecs:Poll
                        ecs:StartTelemetrySession
                        ecs:SubmitContainerStateChange
                        ecs:SubmitTaskStateChange
                        logs:CreateLogStream
                        logs:PutLogEvents
                       ),
                       Resource: [
                         '*'
                       ]
                     }
                   ]
                 }
               }
             ]
           }

  resource 'GoCDEC2OptimizedInstanceProfile',
           Type: 'AWS::IAM::InstanceProfile',
           Properties: {
             Roles: [ref('GoCDEC2OptimizedRole')]
           }
end.exec!