Skip to content

Web stack

A load balancer in front of port 8080, taking its network and tags from SSM parameters through a shared defaults module. The pieces are explained on the load balancer and parameters pages.

def build() -> cfn.Template:
    params = cfn.Params()
    net = network(params)  # only what is called gets declared
    tags = standard_tags(params)
    return {
        "AWSTemplateFormatVersion": "2010-09-09",
        "Parameters": params.declarations(),
        "Resources": web_entrypoint(
            "Web",
            vpc_id=net.vpc_id,
            subnets=net.private_subnets,
            ports=[8080],
            allowed_cidrs=["10.0.0.0/8"],
            scheme="internal",
            tags=tags,
        ),
    }

Rendered YAML

Committed as web-stack.yaml. Note that only the three parameters the stack uses are declared, and that every value from the defaults is a !Ref:

AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  VpcId:
    Type: AWS::SSM::Parameter::Value<String>
    Default: /platform/network/vpc-id
    Description: Shared VPC
  PrivateSubnets:
    Type: AWS::SSM::Parameter::Value<List<String>>
    Default: /platform/network/private-subnets
  Stage:
    Type: String
    Default: dev
    AllowedValues:
      - dev
      - test
      - prod
Resources:
  WebSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Web load balancer
      VpcId: !Ref VpcId
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 8080
          ToPort: 8080
          CidrIp: 10.0.0.0/8
  WebLoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Type: application
      Scheme: internal
      Subnets: !Ref PrivateSubnets
      SecurityGroups:
        - !Ref WebSecurityGroup
      LoadBalancerAttributes:
        - Key: idle_timeout.timeout_seconds
          Value: '60'
      Tags:
        - Key: Stage
          Value: !Ref Stage
        - Key: ManagedBy
          Value: cfn-typed
  WebTargetGroup8080:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      VpcId: !Ref VpcId
      Port: 8080
      Protocol: HTTP
      TargetType: instance
      HealthCheckEnabled: true
      HealthCheckPath: /
      HealthCheckPort: traffic-port
      HealthyThresholdCount: 2
      TargetGroupAttributes:
        - Key: deregistration_delay.timeout_seconds
          Value: '30'
      Tags:
        - Key: Stage
          Value: !Ref Stage
        - Key: ManagedBy
          Value: cfn-typed
  WebListener8080:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: !Ref WebLoadBalancer
      Port: 8080
      Protocol: HTTP
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref WebTargetGroup8080