cloudformation-template.yaml

Parameters:

  Ami:
    Type: String
    Description: Latest Ubuntu 16.04 AMI in your AWS Region

  AsgMaxSize:
    Type: Number
    Description: The maximum size of ASG
    Default: 8

  AsgMinSize:
    Type: Number
    Description: The minimum size of ASG
    Default: 1

  EmailAlerts:
    Type: String
    Default: email_for_alerts@domain.com

  InstanceType:
    Type: String
    Default: t2.medium
    AllowedValues:
    - t2.micro
    - t2.medium
    - t2.small
    - t2.large
    - m3.medium
    - m3.large
    - m3.xlarge
    - m3.2xlarge
    - m4.large
    - m4.xlarge
    - m4.2xlarge
    - m4.4xlarge
    - m4.10xlarge
    - c4.large
    - c4.xlarge
    - c4.2xlarge
    - c4.4xlarge
    - c4.8xlarge
    - c3.large
    - c3.xlarge
    - c3.2xlarge
    - c3.4xlarge
    - c3.8xlarge
    - r3.large
    - r3.xlarge
    - r3.2xlarge
    - r3.4xlarge
    - r3.8xlarge
    - i2.xlarge
    - i2.2xlarge
    - i2.4xlarge
    - i2.8xlarge
    - g2.2xlarge
    - g2.8xlarge
    - d2.xlarge
    - d2.2xlarge
    - d2.4xlarge
    - d2.8xlarge
  
  KeyName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: Name of an existing EC2 KeyPair to enable SSH access to instances

  SubnetID1:
    Type: AWS::EC2::Subnet::Id

  SubnetID2:
    Type: AWS::EC2::Subnet::Id

  VpcId:
    Type: AWS::EC2::VPC::Id

  ElasticSearchSecurityGroup:
    Type: String
    Description: Auto-Discovery SecurityGroup for ElasticSearch

Resources:

  Sg:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription:
        Fn::Sub: ${AWS::StackName}-Sg
      VpcId: !Ref VpcId

  SgSshPorts:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref 'Sg'
      IpProtocol: tcp
      FromPort: '22'
      ToPort: '22'
      CidrIp: 0.0.0.0/0

  SgElasticsearchToKibanaPorts:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref 'Sg'
      IpProtocol: tcp
      FromPort: '9200'
      ToPort: '9400'
      SourceSecurityGroupId: !Ref 'ElasticSearchSecurityGroup'

  SgNodeExporterPorts:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref 'Sg'
      IpProtocol: tcp
      FromPort: '9100'
      ToPort: '9100'
      CidrIp: 0.0.0.0/0

  SgKibanaToElasticsearchPorts:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref 'ElasticSearchSecurityGroup'
      IpProtocol: tcp
      FromPort: '9100'
      ToPort: '9400'
      SourceSecurityGroupId: !Ref 'Sg'

  SgElbAllTrafficports:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref 'Sg'
      IpProtocol: tcp
      FromPort: '0'
      ToPort: '65535'
      SourceSecurityGroupId: !Ref 'ElbSecurityGroup'

  AlertsTopic: 
    Type: AWS::SNS::Topic
    Properties: 
      Subscription: 
        - Endpoint: !Ref EmailAlerts
          Protocol: email
      TopicName: 
        Fn::Sub: ${AWS::StackName}-AlertsTopic

  HostRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - ec2.amazonaws.com
            - autoscaling.amazonaws.com
            - s3.amazonaws.com
            - cloudformation.amazonaws.com
          Action:
          - sts:AssumeRole
      Policies:
      - PolicyName:
          Fn::Sub: ${AWS::StackName}-DumpBackupS3
        PolicyDocument:
          Statement:
          - Action: s3:*
            Resource: !GetAtt KibanaBackup.Arn
            Effect: Allow
          - Action: s3:*
            Resource: !Sub
              - ${Bucket}/*
              - { Bucket: !GetAtt KibanaBackup.Arn }
            Effect: Allow
      - PolicyName:
          Fn::Sub: ${AWS::StackName}-GetCloudformation
        PolicyDocument:
          Statement:
          - Action:
            - cloudformation:DescribeStacks
            - cloudformation:DescribeStackEvents
            - cloudformation:DescribeStackResource
            - cloudformation:DescribeStackResources
            - cloudformation:GetTemplate
            - cloudformation:List*
            Resource: "*"
            Effect: Allow
      - PolicyName:
          Fn::Sub: ${AWS::StackName}-DescribeInstances
        PolicyDocument:
          Statement:
          - Action:
            - ec2:DescribeInstances
            Resource: "*"
            Effect: Allow

  HostProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
      - Ref: HostRole

  KibanaBackup:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain

  Asg:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      VPCZoneIdentifier:
      - !Ref SubnetID1
      - !Ref SubnetID2
      NotificationConfiguration:
        TopicARN:
          Ref: AlertsTopic
        NotificationTypes:
        - autoscaling:EC2_INSTANCE_LAUNCH
        - autoscaling:EC2_INSTANCE_TERMINATE
        - autoscaling:EC2_INSTANCE_LAUNCH_ERROR
        - autoscaling:EC2_INSTANCE_TERMINATE_ERROR
      HealthCheckGracePeriod: '600'
      HealthCheckType: EC2
      LoadBalancerNames: 
      LaunchConfigurationName:
        Ref: Lc
      MinSize:
        Ref: AsgMinSize
      MaxSize:
        Ref: AsgMaxSize
      DesiredCapacity:
        Ref: AsgMinSize
      LoadBalancerNames:
      - Ref: ElbKibana
      Tags:
      - Key: Name
        Value: KibanaCluster
        PropagateAtLaunch: true
      - Key: Creator
        Value:
          Ref: KeyName
        PropagateAtLaunch: true
    UpdatePolicy:
      AutoScalingRollingUpdate:
        MinInstancesInService:
          Ref: AsgMinSize
        PauseTime: PT5M

  Lc:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      ImageId:
        Ref: Ami
      BlockDeviceMappings:
      - DeviceName: /dev/xvdcy
        Ebs:
          VolumeSize: 100
          VolumeType: gp2
      InstanceType:
        Ref: InstanceType
      IamInstanceProfile:
        Ref: HostProfile
      KeyName:
        Ref: KeyName
      SecurityGroups:
      - Ref: Sg
      UserData:
        Fn::Base64:
          Fn::Sub: |
            #cloud-config
            package_upgrade: true
            packages:
            - awscli
            - ntp
            - apt-transport-https
            - zip
            - unzip
            - curl
            - openssh-server
            - ca-certificates
            - default-jre
            - wget
            write_files:
            - path: /etc/cron.d/kibana-backup
              content: |
                0 1 */3 0 0 root aws s3 sync /mnt/kibana/ s3://${KibanaBackup}/$(HOSTNAME)/$(date)/
              permissions: '0600'
            - path: /etc/elasticsearch/elasticsearch.yml
              content: |
                cluster.name: elasticsearch_netbears
                path.data: /mnt/elasticsearch
                network.bind_host: 0.0.0.0
                network.publish_host: _eth0:ipv4_
                discovery.zen.minimum_master_nodes: 2
                cloud.aws.region: ${AWS::Region}
                discovery.zen.hosts_provider: ec2
                discovery.ec2.groups: ${ElasticSearchSecurityGroup}
                discovery.ec2.host_type: private_ip
                node.master: false
                node.data: false
                node.ingest: false
              permissions: '0644'
            - path: /etc/kibana/kibana.yml
              content: |
                server.port: 5601
                server.host: 0.0.0.0
                server.defaultRoute: /app/kibana
                elasticsearch.url: http://localhost:9200
                kibana.index: .index
                kibana.defaultAppId: discover
                path.data: /mnt/kibana
                status.allowAnonymous: true
              permissions: '0644'
            runcmd:
            - mkfs -t ext4 /dev/xvdcy
            - mkdir -p /mnt/elasticsearch
            - mkdir -p /mnt/kibana
            - mount /dev/xvdcy /mnt/kibana
            - echo "/dev/xvdcy       /mnt/kibana   ext4    defaults,nofail        0       2" | tee -a /etc/fstab
            - wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | apt-key add 
            - echo "deb https://artifacts.elastic.co/packages/5.x/apt stable main" | tee -a /etc/apt/sources.list.d/elastic-5.x.list
            - apt-get update
            - printf '\n' | apt-get install -y elasticsearch
            - printf '\n' | apt-get install -y kibana
            - cd /tmp
            - curl -LO https://github.com/prometheus/node_exporter/releases/download/v0.14.0/node_exporter-0.14.0.linux-amd64.tar.gz
            - tar xvf node_exporter-0.14.0.linux-amd64.tar.gz
            - cp node_exporter-0.14.0.linux-amd64/node_exporter /usr/local/bin
            - chown -R elasticsearch:elasticsearch /mnt/elasticsearch
            - chown -R kibana:kibana /mnt/kibana
            - chown elasticsearch:elasticsearch /etc/elasticsearch/elasticsearch.yml
            - chown kibana:kibana /etc/kibana/kibana.yml
            - printf 'yes' | /usr/share/elasticsearch/bin/elasticsearch-plugin install discovery-ec2
            - service elasticsearch start
            - service kibana start
            - /usr/local/bin/node_exporter

  CpuUtilization:
    Type: AWS::AutoScaling::ScalingPolicy
    Properties:
      AutoScalingGroupName:
        Ref: Asg
      PolicyType: TargetTrackingScaling
      TargetTrackingConfiguration:
        TargetValue: 70
        PredefinedMetricSpecification:
          PredefinedMetricType: ASGAverageCPUUtilization

  NetworkInAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmActions:
      - Ref: AlertsTopic
      MetricName: NetworkIn
      ComparisonOperator: GreaterThanThreshold
      AlarmDescription: High network input traffic during 15 minutes
      Statistic: Average
      Period: '300'
      Dimensions:
      - Value:
          Ref: Asg
        Name: AutoScalingGroupName
      EvaluationPeriods: '3'
      InsufficientDataActions:
      - Ref: AlertsTopic
      Namespace: AWS/EC2
      Threshold: '2400000000'

  RAMAlarmHigh:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmActions:
      - Ref: AlertsTopic
      MetricName: MemoryUtilization
      ComparisonOperator: GreaterThanThreshold
      AlarmDescription: Memory utilization > 85% during 15 minutes
      Statistic: Average
      Period: '300'
      Dimensions:
      - Value:
          Ref: Asg
        Name: AutoScalingGroupName
      EvaluationPeriods: '3'
      InsufficientDataActions:
      - Ref: AlertsTopic
      Namespace: System/Linux
      Threshold: '85'

  NetworkOutAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmActions:
      - Ref: AlertsTopic
      MetricName: NetworkOut
      ComparisonOperator: GreaterThanThreshold
      AlarmDescription: High network output traffic during 15 minutes
      Statistic: Average
      Period: '300'
      Dimensions:
      - Value:
          Ref: Asg
        Name: AutoScalingGroupName
      EvaluationPeriods: '3'
      InsufficientDataActions:
      - Ref: AlertsTopic
      Namespace: AWS/EC2
      Threshold: '2400000000'

  IOWaitAlarmHigh:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmActions:
      - Ref: AlertsTopic
      MetricName: IOWait
      ComparisonOperator: GreaterThanThreshold
      AlarmDescription: Alarm if IOWait > 85% for 15 minutes
      Statistic: Average
      Period: '300'
      Dimensions:
      - Value:
          Ref: AWS::StackName
        Name: StackName
      EvaluationPeriods: '3'
      InsufficientDataActions:
      - Ref: AlertsTopic
      Namespace: AWS/EC2
      Threshold: '85'

  StatusAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmActions:
      - Ref: AlertsTopic
      MetricName: StatusCheckFailed
      ComparisonOperator: GreaterThanOrEqualToThreshold
      AlarmDescription: Alert if asg has degraded instances
      Statistic: Maximum
      Period: '60'
      Dimensions:
      - Value:
          Ref: Asg
        Name: AutoScalingGroupName
      EvaluationPeriods: '2'
      InsufficientDataActions:
      - Ref: AlertsTopic
      Unit: Count
      Namespace: AWS/EC2
      Threshold: '1'

  ElbSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Elb Allowed Ports
      VpcId: !Ref VpcId

  ElbSecurityGroupHTTPinbound:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref 'ElbSecurityGroup'
      IpProtocol: tcp
      FromPort: '80'
      ToPort: '80'
      CidrIp: 0.0.0.0/0

  ElbSecurityGroupESinbound:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref 'ElbSecurityGroup'
      IpProtocol: tcp
      FromPort: '5601'
      ToPort: '5601'
      CidrIp: 0.0.0.0/0

  ElbSecurityGroupElbAllTrafficports:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref 'ElbSecurityGroup'
      IpProtocol: tcp
      FromPort: '0'
      ToPort: '65535'
      SourceSecurityGroupId: !Ref 'Sg'

  ElbKibana:
    Type: AWS::ElasticLoadBalancing::LoadBalancer
    Properties:
      LoadBalancerName:
        Fn::Sub: ${AWS::StackName}
      Scheme: internet-facing
      Subnets: 
      - !Ref SubnetID1
      - !Ref SubnetID2
      SecurityGroups: [ !Ref ElbSecurityGroup ]
      HealthCheck:
        Target:
          Fn::Join:
          - ''
          - - 'HTTP:'
            - '5601'
            - "/app/kibana"
        HealthyThreshold: '3'
        UnhealthyThreshold: '5'
        Interval: '30'
        Timeout: '5'
      Listeners:
      - LoadBalancerPort: '80'
        InstancePort: '5601'
        Protocol: TCP
      - LoadBalancerPort: '5601'
        InstancePort: '5601'
        Protocol: TCP


Outputs:
  Asg:
    Value: !Ref Asg

  URL:
    Description: The URL to access the Kibana Cluster
    Value:
      Fn::Join:
      - ''
      - - http://
        - Fn::GetAtt:
          - ElbKibana
          - DNSName
        - /app/kibana