simple_service.yml

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Cloudformation template para EC2 + ECR + RDS'

Parameters:
  AppName:
    Type: String
    Default: directo-app
    Description: Application name
  AWS_REGION:
    Type: String
    Default: us-east-2
    Description: Resources region
  RDSUsername:
    Type: String
    Default: directo
    Description: RDS username
  RDSPassword:
    Type: String
    NoEcho: true
    Description: RDS password (change!!)
  RDStorage:
    Type: String
    Default: '20'
   Description: Allocated storage in GB
 EC2InstanceType:
   Type: String
   Default: t3.micro
   Description: EC2 instance type
 AmiId:
  Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
  Default: /aws/service/canonical/ubuntu/server/22.04/stable/current/amd64/hvm/ebs-gp2/ami-id
  Descripition: Ubuntu 22.04

Resources:
  # =====================
  # KEY PAIR
  # =====================
  EC2KeyPair:
    Type: AWS::EC2::KeyPair
    Properties:
      KeyName: !Sub '${AppName}-key'
      Tags:
        - Key: Name
          Value: !Sub '${AppName}-keypair'
  # =====================
  # IAM ROLE FOR EC2
  # =====================
  EC2ECRRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub '${AppName}-ec2-ecr-role'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly
      Tags:
        - Key: Name
          Value: !Sub '${AppName}-ec2-role'
  EC2InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      InstanceProfileName: !Sub '${AppName}-ec2-profile'
      Roles:
        - !Ref EC2ECRRole
  # =====================
  # SECURITY GROUPS
  # (defined before RDS to avoid circular dependency)
  # =====================
  EC2SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for EC2 instance with Docker
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0
          Description: SSH access
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
          Description: HTTP for frontend
        - IpProtocol: tcp
          FromPort: 5000
          ToPort: 5000
          CidrIp: 0.0.0.0/0
          Description: Backend API
      Tags:
        - Key: Name
          Value: !Sub '${AppName}-ec2-sg'
  RDSSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for RDS - only EC2 access
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 5432
          ToPort: 5432
          SourceSecurityGroupId: !Ref EC2SecurityGroup
          Description: PostgreSQL from EC2 only
      Tags:
        - Key: Name
          Value: !Sub '${AppName}-rds-sg'
  # =====================
  # RDS DATABASE
  # =====================
  RDSInstance:
    Type: AWS::RDS::DBInstance
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      DBInstanceIdentifier: !Sub '${AppName}-db'
      DBInstanceClass: db.t3.micro
      Engine: postgres
      EngineVersion: '15'
      MasterUsername: !Ref RDSUsername
      MasterUserPassword: !Ref RDSPassword
      AllocatedStorage: !Ref RDSStorage
      DBName: miapp
      DBSubnetGroupName: !Ref RDSDBSubnetGroup
      VPCSecurityGroups:
        - !Ref RDSSecurityGroup
      PubliclyAccessible: false
      StorageType: gp2
      Tags:
        - Key: Name
          Value: !Sub '${AppName}-rds'
  # =====================
  # EC2 INSTANCE
  # =====================
  EC2Instance:
    Type: AWS::EC2::Instance
    DependsOn: RDSInstance
    Properties:
      InstanceType: !Ref EC2InstanceType
      ImageId: !Ref LatestAmiId
      KeyName: !Ref EC2KeyPair
      SecurityGroupIds:
        - !Ref EC2SecurityGroup
      IamInstanceProfile: !Ref EC2InstanceProfile
      UserData:
        Fn::Base64: !Sub |
        #!/bin/bash
        set -e
        echo "Starting EC2 setup..."
        # Update system and install dependencies
        apt-get update -y
        apt-get install -y docker.io awscli
	
  	# Install Docker Compose v2 CLI plugin
        mkdir -p /usr/local/lib/docker/cli-plugins
        curl -SL https://github.com/docker/compose/releases/download/v2.24.7/docker-compose-linux-x86_64 \
        -o /usr/local/lib/docker/cli-plugins/docker-compose
        chmod +x /usr/local/lib/docker/cli-plugins/docker-compose	

	# Start Docker and enable on boot
        systemctl start docker
        systemctl enable docker

	# Add ubuntu user to docker group
        usermod -aG docker ubuntu

	# Create app directory
        mkdir -p /home/ubuntu/app
        chown ubuntu:ubuntu /home/ubuntu/app

	# Generate docker-compose-prod.yml with real values
          cat > /home/ubuntu/app/docker-compose-prod.yml << EOFCOMPOSE
          version: '3.8'
          services:
            frontend:
              image: ${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${AppName}-frontend:latest
              container_name: frontend
              ports:
                - "80:4200"
              environment:
                - FRONTEND_PORT=4200
                - API_PORT=5000
                - ENVIRONMENT=production
              restart: unless-stopped
            backend:
              image: ${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${AppName}-backend:latest
              container_name: backend
              ports:
                - "5000:5000"
              environment:
                - ASPNETCORE_ENVIRONMENT=Production
                - DB_HOST=${RDSInstance.Endpoint.Address}
                - DB_PORT=5432
                - DB_NAME=miapp
                - DB_USER=${RDSMasterUsername}
                - DB_PASSWORD=${RDSMasterPassword}
                - API_PORT=5000
              restart: unless-stopped
              depends_on:
                - frontend
          networks:
            default:
              name: app-network
          EOFCOMPOSE

	aws ecr get-login-password --region $REGION | \
            docker login --username AWS --password-stdin $ACCOUNT.dkr.ecr.$REGION.amazonaws.com
	docker compose -f /home/ubuntu/app/docker-compose-prod.yml pull
        docker compose -f /home/ubuntu/app/docker-compose-prod.yml up -d
        docker compose -f /home/ubuntu/app/docker-compose-prod.yml ps
     	echo "EC2 setup complete"