cloudformation-template.yaml

Description: Launch complete Sentry stack into new VPC

Parameters:

  # VPC variables  
  VPCSubnetCidrBlock:
    Description: 172.80.0.0/16 = 172.80.0.0-172.80.255.255 = 256 Subnets = 65534 hosts
    Type: String
    Default: 172.80.0.0/16
    MinLength: '10'
    MaxLength: '18'
    AllowedPattern: "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
  AvailabilityZone1:
    Type: String
    Default: a
    AllowedValues:
    - a
    - b
    - c
  AvailabilityZone2:
    Type: String
    Default: b
    AllowedValues:
    - a
    - b
    - c
  AvailabilityZone3:
    Type: String
    Default: c
    AllowedValues:
    - a
    - b
    - c
  PublicSubnetCidrBlock1:
    Type: String
    Default: 172.80.0.0/20
    MinLength: '10'
    MaxLength: '18'
    AllowedPattern: "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
  PublicSubnetCidrBlock2:
    Type: String
    Default: 172.80.16.0/20
    MinLength: '10'
    MaxLength: '18'
    AllowedPattern: "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
  PublicSubnetCidrBlock3:
    Type: String
    Default: 172.80.32.0/20
    MinLength: '10'
    MaxLength: '18'
    AllowedPattern: "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
  PrivateSubnetCidrBlock1:
    Type: String
    Default: 172.80.48.0/20
    MinLength: '10'
    MaxLength: '18'
    AllowedPattern: "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
  PrivateSubnetCidrBlock2:
    Type: String
    Default: 172.80.64.0/20
    MinLength: '10'
    MaxLength: '18'
    AllowedPattern: "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
  PrivateSubnetCidrBlock3:
    Type: String
    Default: 172.80.80.0/20
    MinLength: '10'
    MaxLength: '18'
    AllowedPattern: "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
  
  # Kafka variables
  KafkaInstanceType:
    Type: String
    Default: 'kafka.t3.small'
    AllowedValues:
    - kafka.t3.small
    - kafka.m5.large
    - kafka.m5.xlarge
    - kafka.m5.2xlarge
    - kafka.m5.4xlarge
    - kafka.m5.8xlage
    - kafka.m5.12xlarge
    - kafka.m5.16xlarge
    - kafka.m5.24xlarge

  KafkaVersion:
    Type: String
    Default: '2.6.0'
    AllowedValues:
      - "2.2.1"
      - "2.3.1"
      - "2.4.1.1"
      - "2.5.1"
      - "2.6.0"
      - "2.7.0"

  KafkaInstanceRootVolumeSize:
    Type: String
    Default: '100'
    Description: Size in GB of the root volume for Kafka instances

  KafkaLogRetentionHours:
    Type: Number
    Default: 24

  # RDS Postres variables
  PostgresDbName:
    Default: "sentry"
    Type: String

  PostgresDbUsername:
    Default: "sentry"
    Type: String

  PostgresDbPassword:
    Type: String
    NoEcho: true
    Default: "Sentry123!"

  PostgresDbInstanceClass:
    Type: String
    Default: db.t3.medium
    AllowedValues:
    - db.t3.medium
    - db.t3.large
    - db.r4.large
    - db.r4.xlarge
    - db.r4.2xlarge
    - db.r4.4xlarge
    - db.r4.8xlarge
    - db.r4.16xlarge
    - db.r5.large
    - db.r5.xlarge
    - db.r5.2xlarge
    - db.r5.4xlarge
    - db.r5.12xlarge
    - db.r5.24xlarge

  PostgresMinReadReplicas:
    Type: Number
    Default: 1

  PostgresMaxReadReplicas:
    Type: Number
    Default: 10

  # ElastiCache Redis variables
  ElastiCacheInstanceClass:
    Type: String
    Default: cache.t2.medium
    AllowedValues:
    - cache.t2.medium
    - cache.t3.medium
    - cache.m5.large
    - cache.m5.xlarge
    - cache.m5.2xlarge
    - cache.m5.4xlarge
    - cache.m5.12xlarge
    - cache.m4.large
    - cache.m4.xlarge
    - cache.m4.2xlarge
    - cache.m4.4xlarge
    - cache.m4.10xlarge
    - cache.r6g.large
    - cache.r6g.xlarge
    - cache.r6g.2xlarge
    - cache.r6g.4xlarge
    - cache.r6g.8xlarge
    - cache.r6g.12xlarge
    - cache.r6g.16xlarge
    - cache.m6g.large
    - cache.m6g.xlarge
    - cache.m6g.2xlarge
    - cache.m6g.4xlarge
    - cache.m6g.8xlarge
    - cache.m6g.12xlarge
    - cache.m6g.16xlarge

  # OpsWorks ClickHouse variables
  ClickHouseCookbookUrl:
    Type: String
    Default: https://github.com/Rungutan/sentry-fargate-cf-stack/releases/download/1.15.2/clickhouse-1.15.2.tar.gz
    
  ClickHouseInstanceType:
    Type: String
    Default: 'c4.xlarge'
    AllowedValues:
    - c4.large
    - c4.xlarge
    - c4.2xlarge
    - c4.4xlarge
    - c4.8xlarge
    - c5.large
    - c5.xlarge
    - c5.2xlarge
    - c5.4xlarge
    - c5.9xlarge

  ClickHouseInstanceRootVolumeSize:
    Type: String
    Default: '200'
    Description: Size in GB of the root volume

  #Sentry ECS variables
  SslLoadBalancer:
    Type: String

  SentryImage:
    Type: String
    Default: rungutancommunity/sentry-base:1.15.2

  SnubaImage:
    Type: String
    Default: rungutancommunity/sentry-snuba:1.15.2

  RelayImage:
    Type: String
    Default: rungutancommunity/sentry-relay:1.15.2

  BashImage:
    Type: String
    Default: rungutancommunity/bash:1.15.2

  ClickHouseImage:
    Type: String
    Default: rungutancommunity/clickhouse-client:1.15.2

  MinCountSnubaApi:
    Type: String
    Default: "1"

  MaxCountSnubaApi:
    Type: String
    Default: "10"

  MinCountSentryWeb:
    Type: String
    Default: "1"

  MaxCountSentryWeb:
    Type: String
    Default: "10"

  MinCountSentryRelay:
    Type: String
    Default: "1"

  MaxCountSentryRelay:
    Type: String
    Default: "10"

  DesiredCountSentryCron:
    Type: String
    Default: "1"

  MinCountSentryIngestAttachments:
    Type: String
    Default: "1"

  MaxCountSentryIngestAttachments:
    Type: String
    Default: "10"

  MinCountSentryIngestEvents:
    Type: String
    Default: "1"

  MaxCountSentryIngestEvents:
    Type: String
    Default: "10"

  MinCountSentryIngestTransactions:
    Type: String
    Default: "1"

  MaxCountSentryIngestTransactions:
    Type: String
    Default: "10"

  MinCountSentryPostProcessForward:
    Type: String
    Default: "1"

  MaxCountSentryPostProcessForward:
    Type: String
    Default: "10"

  MinCountSentrySubscriptionConsumerEvents:
    Type: String
    Default: "1"

  MaxCountSentrySubscriptionConsumerEvents:
    Type: String
    Default: "10"

  MinCountSentrySubscriptionConsumerTransactions:
    Type: String
    Default: "1"

  MaxCountSentrySubscriptionConsumerTransactions:
    Type: String
    Default: "10"

  MinCountSnubaSessionsConsumer:
    Type: String
    Default: "1"

  MaxCountSnubaSessionsConsumer:
    Type: String
    Default: "10"

  MinCountSnubaOutcomesConsumer:
    Type: String
    Default: "1"

  MaxCountSnubaOutcomesConsumer:
    Type: String
    Default: "10"

  MinCountSnubaTransactionsConsumer:
    Type: String
    Default: "1"

  MaxCountSnubaTransactionsConsumer:
    Type: String
    Default: "10"

  MinCountSnubaReplacer:
    Type: String
    Default: "1"

  MaxCountSnubaReplacer:
    Type: String
    Default: "10"

  MinCountSnubaSubscriptionConsumerEvents:
    Type: String
    Default: "1"

  MaxCountSnubaSubscriptionConsumerEvents:
    Type: String
    Default: "10"

  MinCountSnubaSubscriptionConsumerTransactions:
    Type: String
    Default: "1"

  MaxCountSnubaSubscriptionConsumerTransactions:
    Type: String
    Default: "10"

  MinCountSnubaConsumer:
    Type: String
    Default: "1"

  MaxCountSnubaConsumer:
    Type: String
    Default: "10"

  MinCountSentryWorkers:
    Type: String
    Default: "1"

  MaxCountSentryWorkers:
    Type: String
    Default: "10"

  SentrySystemSecretKey:
    Type: String
    NoEcho: true
    Default: "f67bd277-4338-43e7-baa1-5cc121c50ff1"

  # Sentry initial user
  InitialAdminUserEmail:
    Type: String
    Description: The username (and email address) of the initial Admin user
    Default: "sentry@mydomain.com"

  InitialAdminUserPassword:
    Type: String
    Description: The password of the initial Admin user
    NoEcho: true
    Default: "Sentry123!"

  # DNS record definitions
  DnsZone:
    Type: AWS::Route53::HostedZone::Id
    Description: Route53 hosted zone in which to place dns records

  SentryDnsRecord:
    Type: String
    Default: sentry.mydomain.com

  SnubaApiDnsRecord:
    Type: String
    Default: snuba-api.mydomain.com

  SentryRelayAlternativeDnsRecord:
    Type: String
    Default: sentry-relay.mydomain.com

  # Sentry EMAIL parameters
  SentryEmailBackend:
    Type: String
    Default: smtp
    Description: To set up SES for using the SMTP interface follow this guide -> http://docs.aws.amazon.com/ses/latest/DeveloperGuide/send-email-smtp.html

  SentryEmailUsername:
    Type: String

  SentryEmailPassword:
    Type: String
    NoEcho: true

  SentryEmailPort:
    Type: String
    Default: "587"

  SentryEmailHost:
    Type: String
    Description: email-smtp.${aws_region}.amazonaws.com 

  SentryEmailFrom:
    Type: String

  SentryEmailUseTls:
    Type: String
    Default: "true"
    AllowedValues:
      - "true"
      - "false"

  SentryEmailUseSsl:
    Type: String
    Default: "false"
    AllowedValues:
      - "true"
      - "false"

  # Sentry SLACK integration
  SentrySlackClientId:
    Type: String
    Default: "not-defined"

  SentrySlackClientSecret:
    Type: String
    NoEcho: true
    Default: "not-defined"

  SentrySlackSigningSecret:
    Type: String
    NoEcho: true
    Default: "not-defined"

  # Sentry relat settings
  SentryRelayMode:
    Type: String
    Default: "proxy"
    AllowedValues:
      - "proxy"
      - "managed"
      - "static"
      

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: VPC variables
        Parameters:
          - VPCSubnetCidrBlock
          - PublicSubnetCidrBlock1
          - PublicSubnetCidrBlock2
          - PublicSubnetCidrBlock3
          - PrivateSubnetCidrBlock1
          - PrivateSubnetCidrBlock2
          - PrivateSubnetCidrBlock3
          - AvailabilityZone1
          - AvailabilityZone2
          - AvailabilityZone3

      - Label:
          default: Kafka variables
        Parameters:
          - KafkaInstanceType
          - KafkaVersion
          - KafkaInstanceRootVolumeSize
          - KafkaLogRetentionHours

      - Label:
          default: Postgres variables
        Parameters:
          - PostgresDbName
          - PostgresDbUsername
          - PostgresDbPassword
          - PostgresDbInstanceClass
          - PostgresMinReadReplicas
          - PostgresMaxReadReplicas

      - Label:
          default: ElastiCache Redis variables
        Parameters:
          - ElastiCacheInstanceClass

      - Label:
          default: OpsWorks ClickHouse variables
        Parameters:
          - ClickHouseCookbookUrl
          - ClickHouseInstanceType
          - ClickHouseInstanceRootVolumeSize

      - Label:
          default: Sentry ECS variables
        Parameters:
          - SslLoadBalancer
          - SentryImage
          - SnubaImage
          - RelayImage
          - BashImage
          - ClickHouseImage
          - MinCountSnubaApi
          - MaxCountSnubaApi 
          - MinCountSentryWeb
          - MaxCountSentryWeb
          - MinCountSentryRelay
          - MaxCountSentryRelay
          - DesiredCountSentryCron
          - MinCountSentryIngestAttachments
          - MaxCountSentryIngestAttachments
          - MinCountSentryIngestEvents
          - MaxCountSentryIngestEvents
          - MinCountSentryIngestTransactions
          - MaxCountSentryIngestTransactions
          - MinCountSentryPostProcessForward
          - MaxCountSentryPostProcessForward
          - MinCountSentrySubscriptionConsumerEvents
          - MaxCountSentrySubscriptionConsumerEvents
          - MinCountSentrySubscriptionConsumerTransactions
          - MaxCountSentrySubscriptionConsumerTransactions
          - MinCountSnubaSessionsConsumer
          - MaxCountSnubaSessionsConsumer
          - MinCountSnubaOutcomesConsumer
          - MaxCountSnubaOutcomesConsumer
          - MinCountSnubaTransactionsConsumer
          - MaxCountSnubaTransactionsConsumer
          - MinCountSnubaReplacer
          - MaxCountSnubaReplacer
          - MinCountSnubaSubscriptionConsumerEvents
          - MaxCountSnubaSubscriptionConsumerEvents
          - MinCountSnubaSubscriptionConsumerTransactions
          - MaxCountSnubaSubscriptionConsumerTransactions
          - MinCountSnubaConsumer
          - MaxCountSnubaConsumer
          - MinCountSentryWorkers
          - MaxCountSentryWorkers
          - SentrySystemSecretKey

      - Label:
          default: DNS record variables
        Parameters:
          - DnsZone
          - SentryDnsRecord
          - SnubaApiDnsRecord
          - SentryRelayAlternativeDnsRecord

      - Label:
          default: Sentry initial Admin credentials
        Parameters:
          - InitialAdminUserEmail
          - InitialAdminUserPassword

      - Label:
          default: Sentry email settings
        Parameters:
          - SentryEmailBackend
          - SentryEmailUsername
          - SentryEmailPassword
          - SentryEmailPort
          - SentryEmailHost
          - SentryEmailFrom
          - SentryEmailUseTls
          - SentryEmailUseSsl

Mappings:


  # Mappings created based on https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Managing.html#AuroraPostgreSQL.Managing.MaxConnections

  RDSConnections:   
    db.t3.medium:
      ScaleValue: 210
    db.t3.large:
      ScaleValue: 400
    db.r4.large:
      ScaleValue: 800
    db.r4.xlarge:
      ScaleValue: 1600
    db.r4.2xlarge:
      ScaleValue: 2500
    db.r4.4xlarge:
      ScaleValue: 2500
    db.r4.8xlarge:
      ScaleValue: 2500
    db.r4.16xlarge:
      ScaleValue: 2500
    db.r5.large:
      ScaleValue: 800
    db.r5.xlarge:
      ScaleValue: 1650
    db.r5.2xlarge:
      ScaleValue: 2500
    db.r5.4xlarge:
      ScaleValue: 2500
    db.r5.12xlarge:
      ScaleValue: 2500

Resources:

  VPC:
    Type: AWS::EC2::VPC
    Properties:
      EnableDnsSupport: 'true'
      EnableDnsHostnames: 'true'
      CidrBlock:
        Ref: VPCSubnetCidrBlock
      Tags:
      - Key: Name
        Value:
          Ref: "AWS::StackName"

  PublicSubnet1:
    Type: AWS::EC2::Subnet
    DependsOn: VPC
    Properties:
      VpcId:
        Ref: VPC
      AvailabilityZone:
        Fn::Sub: "${AWS::Region}${AvailabilityZone1}"
      MapPublicIpOnLaunch: true
      CidrBlock:
        Ref: PublicSubnetCidrBlock1
      Tags:
      - Key: Name
        Value:
          Fn::Sub: "${AWS::StackName}-public-az1"

  PublicSubnet2:
    Type: AWS::EC2::Subnet
    DependsOn: VPC
    Properties:
      VpcId:
        Ref: VPC
      AvailabilityZone:
        Fn::Sub: "${AWS::Region}${AvailabilityZone2}"
      MapPublicIpOnLaunch: true
      CidrBlock:
        Ref: PublicSubnetCidrBlock2
      Tags:
      - Key: Name
        Value:
          Fn::Sub: "${AWS::StackName}-public-az2"

  PublicSubnet3:
    Type: AWS::EC2::Subnet
    DependsOn: VPC
    Properties:
      VpcId:
        Ref: VPC
      AvailabilityZone:
        Fn::Sub: "${AWS::Region}${AvailabilityZone3}"
      MapPublicIpOnLaunch: true
      CidrBlock:
        Ref: PublicSubnetCidrBlock3
      Tags:
      - Key: Name
        Value:
          Fn::Sub: "${AWS::StackName}-public-az3"

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
      - Key: Name
        Value:
          Fn::Sub: "${AWS::StackName}-InternetGateway"

  GatewayToInternet:
    Type: AWS::EC2::VPCGatewayAttachment
    DependsOn:
    - InternetGateway
    - VPC
    Properties:
      VpcId:
        Ref: VPC
      InternetGatewayId:
        Ref: InternetGateway

  NatGatewayAz1:
    Type: AWS::EC2::NatGateway
    DependsOn: GatewayToInternet
    Properties:
      AllocationId:
        Fn::GetAtt:
        - EIPAz1
        - AllocationId
      SubnetId:
        Ref: PublicSubnet1
      Tags:
      - Key: Name
        Value:
          Fn::Sub: "${AWS::StackName}-NatGateway-az-1"

  EIPAz1:
    Type: AWS::EC2::EIP
    Properties:
      Domain: VPC

  NatGatewayAz2:
    Type: AWS::EC2::NatGateway
    DependsOn: GatewayToInternet
    Properties:
      AllocationId:
        Fn::GetAtt:
        - EIPAz2
        - AllocationId
      SubnetId:
        Ref: PublicSubnet2
      Tags:
      - Key: Name
        Value:
          Fn::Sub: "${AWS::StackName}-NatGateway-az-2"

  EIPAz2:
    Type: AWS::EC2::EIP
    Properties:
      Domain: VPC

  NatGatewayAz3:
    Type: AWS::EC2::NatGateway
    DependsOn: GatewayToInternet
    Properties:
      AllocationId:
        Fn::GetAtt:
        - EIPAz3
        - AllocationId
      SubnetId:
        Ref: PublicSubnet3
      Tags:
      - Key: Name
        Value:
          Fn::Sub: "${AWS::StackName}-NatGateway-az-3"

  EIPAz3:
    Type: AWS::EC2::EIP
    Properties:
      Domain: VPC

  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    DependsOn: VPC
    Properties:
      VpcId:
        Ref: VPC
      Tags:
      - Key: Name
        Value:
          Fn::Sub: "${AWS::StackName}-public"

  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn:
    - PublicRouteTable
    - InternetGateway
    Properties:
      RouteTableId:
        Ref: PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId:
        Ref: InternetGateway

  PublicSubnetRouteTableAssociation1:
    Type: AWS::EC2::SubnetRouteTableAssociation
    DependsOn:
    - PublicSubnet1
    - PublicRouteTable
    Properties:
      SubnetId:
        Ref: PublicSubnet1
      RouteTableId:
        Ref: PublicRouteTable

  PublicSubnetRouteTableAssociation2:
    Type: AWS::EC2::SubnetRouteTableAssociation
    DependsOn:
    - PublicSubnet2
    - PublicRouteTable
    - GatewayToInternet
    Properties:
      SubnetId:
        Ref: PublicSubnet2
      RouteTableId:
        Ref: PublicRouteTable

  PublicSubnetRouteTableAssociation3:
    Type: AWS::EC2::SubnetRouteTableAssociation
    DependsOn:
    - PublicSubnet3
    - PublicRouteTable
    - GatewayToInternet
    Properties:
      SubnetId:
        Ref: PublicSubnet3
      RouteTableId:
        Ref: PublicRouteTable

  PrivateSubnet1:
    Type: AWS::EC2::Subnet
    DependsOn: VPC
    Properties:
      VpcId:
        Ref: VPC
      AvailabilityZone:
        Fn::Sub: "${AWS::Region}${AvailabilityZone1}"
      CidrBlock:
        Ref: PrivateSubnetCidrBlock1
      Tags:
      - Key: Name
        Value:
          Fn::Sub: "${AWS::StackName}-private-az1"

  PrivateSubnet2:
    Type: AWS::EC2::Subnet
    DependsOn: VPC
    Properties:
      VpcId:
        Ref: VPC
      AvailabilityZone:
        Fn::Sub: "${AWS::Region}${AvailabilityZone2}"
      CidrBlock:
        Ref: PrivateSubnetCidrBlock2
      Tags:
      - Key: Name
        Value:
          Fn::Sub: "${AWS::StackName}-private-az2"

  PrivateSubnet3:
    Type: AWS::EC2::Subnet
    DependsOn: VPC
    Properties:
      VpcId:
        Ref: VPC
      AvailabilityZone:
        Fn::Sub: "${AWS::Region}${AvailabilityZone3}"
      CidrBlock:
        Ref: PrivateSubnetCidrBlock3
      Tags:
      - Key: Name
        Value:
          Fn::Sub: "${AWS::StackName}-private-az3"

  PrivateRouteTableAz1:
    Type: AWS::EC2::RouteTable
    DependsOn: VPC
    Properties:
      VpcId:
        Ref: VPC
      Tags:
      - Key: Name
        Value:
          Fn::Sub: "${AWS::StackName}-private-route-az1"

  PrivateRouteAz1:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId:
        Ref: PrivateRouteTableAz1
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId:
        Ref: NatGatewayAz1

  PrivateRouteTableAssociationAz1:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId:
        Ref: PrivateSubnet1
      RouteTableId:
        Ref: PrivateRouteTableAz1

  PrivateRouteTableAz2:
    Type: AWS::EC2::RouteTable
    DependsOn: VPC
    Properties:
      VpcId:
        Ref: VPC
      Tags:
      - Key: Name
        Value:
          Fn::Sub: "${AWS::StackName}-private-route-az2"

  PrivateRouteAz2:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId:
        Ref: PrivateRouteTableAz2
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId:
        Ref: NatGatewayAz2

  PrivateRouteTableAssociationAz2:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId:
        Ref: PrivateSubnet2
      RouteTableId:
        Ref: PrivateRouteTableAz2

  PrivateRouteTableAz3:
    Type: AWS::EC2::RouteTable
    DependsOn: VPC
    Properties:
      VpcId:
        Ref: VPC
      Tags:
      - Key: Name
        Value:
          Fn::Sub: "${AWS::StackName}-private-route-az3"

  PrivateRouteAz3:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId:
        Ref: PrivateRouteTableAz3
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId:
        Ref: NatGatewayAz3

  PrivateRouteTableAssociationAz3:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId:
        Ref: PrivateSubnet3
      RouteTableId:
        Ref: PrivateRouteTableAz3

  S3VpcEndpoint:
    Type: AWS::EC2::VPCEndpoint
    DependsOn:
    - VPC
    Properties:
      PolicyDocument:
        Statement:
        - Action: "*"
          Effect: Allow
          Resource: "*"
          Principal: "*"
      RouteTableIds:
      - Ref: PublicRouteTable
      - Ref: PrivateRouteTableAz1
      - Ref: PrivateRouteTableAz2
      - Ref: PrivateRouteTableAz3
      ServiceName:
        Fn::Sub: "com.amazonaws.${AWS::Region}.s3"
      VpcId:
        Ref: VPC

  # Public Network ACL
  PublicNetworkAcl:
    Type: AWS::EC2::NetworkAcl
    DependsOn: VPC
    Properties:
      VpcId:
        Ref: VPC
      Tags:
      - Key: Name
        Value:
          Fn::Sub: "${AWS::StackName}-public-acl"
      
  # Public Network ACL Rules
  InboundPublicNetworkAclAllowAll:
    Type: AWS::EC2::NetworkAclEntry
    DependsOn: PublicNetworkAcl
    Properties:
      NetworkAclId:
        Ref: PublicNetworkAcl
      RuleNumber: "100"
      Protocol: '-1'
      RuleAction: allow
      Egress: 'false'
      CidrBlock: 0.0.0.0/0
      PortRange:
        From: '0'
        To: '65535'

  OutboundPublicNetworkAclAllowAll:
    Type: AWS::EC2::NetworkAclEntry
    DependsOn: PublicNetworkAcl
    Properties:
      NetworkAclId:
        Ref: PublicNetworkAcl
      RuleNumber: "100"
      Protocol: "-1"
      RuleAction: allow
      Egress: 'true'
      CidrBlock: 0.0.0.0/0
      PortRange:
        From: '0'
        To: '65535'

  # Public Subnet Association
  PublicSubnetNetworkAclAssociation1:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    DependsOn:
    - PublicSubnet1
    - PublicNetworkAcl
    Properties:
      SubnetId:
        Ref: PublicSubnet1
      NetworkAclId:
        Ref: PublicNetworkAcl

  PublicSubnetNetworkAclAssociation2:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    DependsOn:
    - PublicSubnet2
    - PublicNetworkAcl
    Properties:
      SubnetId:
        Ref: PublicSubnet2
      NetworkAclId:
        Ref: PublicNetworkAcl

  PublicSubnetNetworkAclAssociation3:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    DependsOn:
    - PublicSubnet3
    - PublicNetworkAcl
    Properties:
      SubnetId:
        Ref: PublicSubnet3
      NetworkAclId:
        Ref: PublicNetworkAcl

  # Private Network ACL
  PrivateNetworkAcl:
    Type: AWS::EC2::NetworkAcl
    DependsOn: VPC
    Properties:
      VpcId:
        Ref: VPC
      Tags:
      - Key: Name
        Value:
          Fn::Sub: "${AWS::StackName}-private-acl"
      
  # Private Network ACL Rules
  InboundEphemeralPrivateNetworkAclAllowAll:
    Type: AWS::EC2::NetworkAclEntry
    DependsOn: PrivateNetworkAcl
    Properties:
      NetworkAclId:
        Ref: PrivateNetworkAcl
      RuleNumber: "100"
      Protocol: "-1"
      RuleAction: allow
      Egress: 'false'
      CidrBlock: 0.0.0.0/0
      PortRange:
        From: '0'
        To: '65535'

  OutboundPrivateNetworkAclAllowAll:
    Type: AWS::EC2::NetworkAclEntry
    DependsOn: PrivateNetworkAcl
    Properties:
      NetworkAclId:
        Ref: PrivateNetworkAcl
      RuleNumber: "100"
      Protocol: "-1"
      RuleAction: allow
      Egress: 'true'
      CidrBlock: 0.0.0.0/0
      PortRange:
        From: '0'
        To: '65535'

  # Private Subnet Associations
  PrivateSubnetNetworkAclAssociation1:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    DependsOn:
    - PrivateSubnet1
    - PrivateNetworkAcl
    Properties:
      SubnetId:
        Ref: PrivateSubnet1
      NetworkAclId:
        Ref: PrivateNetworkAcl

  PrivateSubnetNetworkAclAssociation2:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    DependsOn:
    - PrivateSubnet2
    - PrivateNetworkAcl
    Properties:
      SubnetId:
        Ref: PrivateSubnet2
      NetworkAclId:
        Ref: PrivateNetworkAcl

  PrivateSubnetNetworkAclAssociation3:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    DependsOn:
    - PrivateSubnet3
    - PrivateNetworkAcl
    Properties:
      SubnetId:
        Ref: PrivateSubnet3
      NetworkAclId:
        Ref: PrivateNetworkAcl

  # Security Groups
  InternalAccessSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    DependsOn: VPC
    Properties:
      GroupDescription: Instance to Instance Access in VPC
      VpcId:
        Ref: VPC
      Tags:
      - Key: Name
        Value:
          Fn::Sub: "${AWS::StackName}-instance-to-instance"

  InternalAccessSecurityGroupIngress:
    Type: AWS::EC2::SecurityGroupIngress
    DependsOn: InternalAccessSecurityGroup
    Properties:
      GroupId:
        Ref: InternalAccessSecurityGroup
      IpProtocol: "-1"
      SourceSecurityGroupId:
        Ref: InternalAccessSecurityGroup

  RemoteAccessSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Instance Access over VPN/Direct Connect
      VpcId:
        Ref: VPC
      Tags:
      - Key: Name
        Value:
          Fn::Sub: "${AWS::StackName}-remote-to-instance"
      SecurityGroupIngress:
      - IpProtocol: "-1"
        CidrIp: 
          Ref: VPCSubnetCidrBlock
      SecurityGroupEgress:
      - IpProtocol: "-1"
        CidrIp: 0.0.0.0/0

  Ec2SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription:
        Fn::Sub: ${AWS::StackName}-Sg
      VpcId:
        Ref: VPC
  
  Ec2SecurityGroupIngressItself:
    Type: AWS::EC2::SecurityGroupIngress
    Properties: 
      Description:
        Fn::Sub: ${AWS::StackName}-Ec2SecurityGroupIngressItself
      IpProtocol: "-1"
      GroupId:
        Fn::GetAtt: Ec2SecurityGroup.GroupId
      SourceSecurityGroupId:
        Fn::GetAtt: Ec2SecurityGroup.GroupId

  Ec2SecurityGroupIngressLb:
    Type: AWS::EC2::SecurityGroupIngress
    Properties: 
      Description:
        Fn::Sub: ${AWS::StackName}-Ec2SecurityGroupIngressLb
      IpProtocol: "-1"
      GroupId:
        Fn::GetAtt: Ec2SecurityGroup.GroupId
      SourceSecurityGroupId:
        Fn::GetAtt: LbSecurityGroup.GroupId

  Ec2SecurityGroupIngressClickHouse:
    Type: AWS::EC2::SecurityGroupIngress
    Properties: 
      Description:
        Fn::Sub: ${AWS::StackName}-Ec2SecurityGroupIngressClickHouse
      IpProtocol: "-1"
      GroupId:
        Fn::GetAtt: Ec2SecurityGroup.GroupId
      SourceSecurityGroupId:
        Fn::GetAtt: ClickHouseLbSecurityGroup.GroupId

  LbSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription:
        Fn::Sub: ${AWS::StackName}-Sg
      VpcId:
        Ref: VPC
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 80
        ToPort: 80
        CidrIp: 0.0.0.0/0
      - IpProtocol: tcp
        FromPort: 443
        ToPort: 443
        CidrIp: 0.0.0.0/0
  
  LbSecurityGroupIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties: 
      Description:
        Fn::Sub: ${AWS::StackName}-LbSecurityGroup
      IpProtocol: "-1"
      GroupId:
        Fn::GetAtt: LbSecurityGroup.GroupId
      SourceSecurityGroupId:
        Fn::GetAtt: LbSecurityGroup.GroupId

  ClickHouseLbSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription:
        Fn::Sub: ${AWS::StackName}-ClickHouseLbSecurityGroup
      VpcId:
        Ref: VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: '8123'
          ToPort: '8123'
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: '9000'
          ToPort: '9000'
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: '9004'
          ToPort: '9004'
          CidrIp: 0.0.0.0/0

  # Kafka stack
  KafkaKmsKey:
    Type: AWS::KMS::Key
    Properties:
      KeyPolicy:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action: kms:*
            Resource: "*"
            Principal:
              AWS:
                - Fn::Sub: arn:aws:iam::${AWS::AccountId}:root

  KafkaConfigurationLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal: {Service: [lambda.amazonaws.com]}
          Action: ['sts:AssumeRole']
      Policies:
      - PolicyName:
          Fn::Sub: ${AWS::StackName}-Kafka
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - kafka:*
            Resource: '*'
      - PolicyName:
          Fn::Sub: ${AWS::StackName}-CloudWatch
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - logs:*
            - cloudwatch:*
            Resource: '*'

  KafkaConfigurationLambdaLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName:
        Fn::Sub: /aws/lambda/${KafkaConfigurationLambdaFunction}
      RetentionInDays: 3

  KafkaConfigurationLambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      Handler: index.lambda_handler
      Runtime: python3.8
      Role:
        Fn::GetAtt: KafkaConfigurationLambdaRole.Arn
      Code:
        ZipFile:
          Fn::Sub: |
            import boto3
            from botocore.exceptions import ClientError
            import json
            import cfnresponse
            from datetime import datetime

            def lambda_handler(event, context):
              print(event);
              data = {}

              # ResourceProperties are only available during create or update
              if event['RequestType'] == 'Create' or event['RequestType'] == 'Update':
                server_properties = f"""auto.create.topics.enable = {event['ResourceProperties']['auto_create_topics_enable']}
            delete.topic.enable = {event['ResourceProperties']['delete_topic_enable']}
            default.replication.factor = {event['ResourceProperties']['default_replication_factor']}
            min.insync.replicas = {event['ResourceProperties']['min_insync_replicas']}
            num.network.threads = {event['ResourceProperties']['num_network_threads']}
            num.partitions = {event['ResourceProperties']['num_partitions']}
            message.max.bytes = {event['ResourceProperties']['message_and_request_max_bytes']}
            socket.request.max.bytes = {event['ResourceProperties']['message_and_request_max_bytes']}            
            log.message.timestamp.type = {event['ResourceProperties']['message_timestamp_type']}
            log.retention.hours = {event['ResourceProperties']['log_retention_hours']}
            """

              try:
                kafka_client = boto3.client('kafka',region_name="${AWS::Region}")

                # create a new config version
                if event['RequestType'] == 'Create':
                  response = kafka_client.create_configuration(
                    KafkaVersions=["${KafkaVersion}"],
                    Name="${AWS::StackName}",
                    ServerProperties=server_properties.encode()
                  )
                  data["Arn"] = response["Arn"]
                  data["LatestRevision"] = response["LatestRevision"]["Revision"]

                elif event['RequestType'] == 'Delete':
                  response_list = kafka_client.list_configurations(MaxResults=100)
                  if "Configurations" in response_list:
                    for config in response_list["Configurations"]:
                      if config["Name"] == "${AWS::StackName}":
                        try:
                          response = kafka_client.delete_configuration(Arn=config["Arn"])
                        except Exception as e:
                          print(str(e))
                          data["Reason"] = str(e)
                          # ignore the exceptions that are thrown because the config is in use
                          cfnresponse.send(event, context, cfnresponse.SUCCESS, data)
                  data["Reason"] = "OK"

                else:
                  # update an existing config
                  response_list = kafka_client.list_configurations(MaxResults=100)
                  if "Configurations" in response_list:
                    for config in response_list["Configurations"]:
                      if config["Name"] == "${AWS::StackName}":
                        response = kafka_client.update_configuration(Arn=config["Arn"], ServerProperties=server_properties.encode())
                  data["Arn"] = response["Arn"]
                  data["LatestRevision"] = response["LatestRevision"]["Revision"]
                  
                cfnresponse.send(event, context, cfnresponse.SUCCESS, data)
              except Exception as e:
                print(str(e))
                data["Reason"] = str(e)
                cfnresponse.send(event, context, cfnresponse.FAILED, data)

  KafkaConfigurationLambdaResult:
    Type: Custom::KafkaCreateConfiguration
    Properties:
      ServiceToken:
        Fn::GetAtt: KafkaConfigurationLambdaFunction.Arn
      auto_create_topics_enable: "true"
      delete_topic_enable: "true"
      default_replication_factor: "1"
      min_insync_replicas: "1"
      num_network_threads: "3"
      num_partitions: "1"
      message_and_request_max_bytes: "50000000"
      message_timestamp_type: "LogAppendTime"
      log_retention_hours:
        Ref: KafkaLogRetentionHours

  KafkaCluster:
    Type: AWS::MSK::Cluster
    Properties: 
      BrokerNodeGroupInfo: 
        ClientSubnets:
          - Ref: PrivateSubnet1
          - Ref: PrivateSubnet2
          - Ref: PrivateSubnet3
        InstanceType:
          Ref: KafkaInstanceType
        SecurityGroups: 
          - Ref: Ec2SecurityGroup
        StorageInfo:
          EBSStorageInfo:
            VolumeSize:
              Ref: KafkaInstanceRootVolumeSize
      ClusterName:
        Ref: AWS::StackName
      ConfigurationInfo: 
        Arn:
          Fn::GetAtt: KafkaConfigurationLambdaResult.Arn
        Revision:
          Fn::GetAtt: KafkaConfigurationLambdaResult.LatestRevision
      EncryptionInfo: 
        EncryptionAtRest: 
          DataVolumeKMSKeyId:
            Fn::GetAtt: KafkaKmsKey.Arn
        EncryptionInTransit: 
          ClientBroker: "TLS_PLAINTEXT"
          InCluster: True
      KafkaVersion:
        Ref: KafkaVersion
      NumberOfBrokerNodes: 3
      OpenMonitoring: 
        Prometheus:
          JmxExporter:
            EnabledInBroker: True
          NodeExporter:
            EnabledInBroker: True

  KafkaAutoScaling:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    Properties:
      MaxCapacity: "16384"   # Maximum size MUST be greater than initial size. There is no reason to not hardcode it to max value.
      MinCapacity: "1"       # Minimum size cannot be greater than 1
      ResourceId:
        Ref: KafkaCluster
      RoleARN:
        Fn::GetAtt: ScalingRole.Arn
      ScalableDimension: kafka:broker-storage:VolumeSize
      ServiceNamespace: kafka

  BrokerVolumeAutoScalingPolicyKafka:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-BrokerVolume-Kafka
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: KafkaAutoScaling
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: true
        TargetValue: 80 
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: KafkaBrokerStorageUtilization

  RDSSubnetGroup:
    Type: AWS::RDS::DBSubnetGroup
    Properties: 
      DBSubnetGroupDescription:
        Fn::Sub: ${AWS::StackName}-DBSubnetGroup
      SubnetIds:
        - Ref: PrivateSubnet1
        - Ref: PrivateSubnet2
        - Ref: PrivateSubnet3

  RdsKmsKey:
    Type: AWS::KMS::Key
    Properties:
      KeyPolicy:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action: kms:*
            Resource: "*"
            Principal:
              AWS:
                - Fn::Sub: arn:aws:iam::${AWS::AccountId}:root

  EnhancedMonitoringRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - monitoring.rds.amazonaws.com
          Action:
          - sts:AssumeRole
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole

  RDSCluster:
    Type: AWS::RDS::DBCluster
    Properties:
      BackupRetentionPeriod: 35
      Port: 5432
      DatabaseName:
        Ref: PostgresDbName
      MasterUsername: 
        Ref: PostgresDbUsername
      MasterUserPassword: 
        Ref: PostgresDbPassword
      Engine: aurora-postgresql
      EngineMode: 'provisioned'
      EngineVersion: '12.4'
      DBSubnetGroupName:
        Ref: RDSSubnetGroup
      VpcSecurityGroupIds:
        - Fn::GetAtt: Ec2SecurityGroup.GroupId
      KmsKeyId:
        Fn::GetAtt: RdsKmsKey.Arn
      StorageEncrypted: true
      EnableHttpEndpoint: true
      EnableCloudwatchLogsExports:
        - "postgresql"

  RDSInstance:
    Type: AWS::RDS::DBInstance
    Properties: 
      Engine: aurora-postgresql
      AllowMajorVersionUpgrade: true
      AutoMinorVersionUpgrade: true
      DBSubnetGroupName:
        Ref: RDSSubnetGroup
      DBClusterIdentifier:
        Ref: RDSCluster
      DBInstanceClass:
        Ref: PostgresDbInstanceClass
      EnablePerformanceInsights: true
      PerformanceInsightsRetentionPeriod: 7
      MultiAZ: false                                   # VPC Multi-AZ DB Instances are not available for engine: aurora-postgresql
      PubliclyAccessible: false
      MonitoringInterval: 60
      MonitoringRoleArn:
        Fn::GetAtt: EnhancedMonitoringRole.Arn

  RDSReplica:
    Type: AWS::RDS::DBInstance
    Properties: 
      Engine: aurora-postgresql
      AllowMajorVersionUpgrade: true
      AutoMinorVersionUpgrade: true
      DBSubnetGroupName:
        Ref: RDSSubnetGroup
      DBClusterIdentifier:
        Ref: RDSCluster
      DBInstanceClass:
        Ref: PostgresDbInstanceClass
      EnablePerformanceInsights: true
      PerformanceInsightsRetentionPeriod: 7
      MultiAZ: false                                   # VPC Multi-AZ DB Instances are not available for engine: aurora-postgresql
      PubliclyAccessible: false
      MonitoringInterval: 60
      MonitoringRoleArn:
        Fn::GetAtt: EnhancedMonitoringRole.Arn

  RDSAutoScaling:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    Properties:
      MaxCapacity:
        Ref: PostgresMaxReadReplicas
      MinCapacity:
        Ref: PostgresMinReadReplicas
      ResourceId:
        Fn::Sub: cluster:${RDSCluster}
      RoleARN:
        Fn::GetAtt: ScalingRole.Arn
      ScalableDimension: rds:cluster:ReadReplicaCount
      ServiceNamespace: rds

  CpuAutoScalingPolicyRds:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-CPU-RDS
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: RDSAutoScaling
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue: 40 
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: RDSReaderAverageCPUUtilization

  ConnectionsAutoScalingPolicyRds:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-Connections-RDS
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: RDSAutoScaling
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue:
          Fn::FindInMap:
            - RDSConnections
            - Ref: PostgresDbInstanceClass
            - ScaleValue
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: RDSReaderAverageDatabaseConnections

  ElastiCacheSubnetGroup:
    Type: AWS::ElastiCache::SubnetGroup
    Properties: 
      Description:
        Fn::Sub: ${AWS::StackName}-ElastiCacheSubnetGroup
      SubnetIds:
        - Ref: PrivateSubnet1
        - Ref: PrivateSubnet2
        - Ref: PrivateSubnet3
  
  ElastiCacheKmsKey:
    Type: AWS::KMS::Key
    Properties:
      EnableKeyRotation: true
      KeyPolicy:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action: kms:*
            Resource: "*"
            Principal:
              AWS:
                - Fn::Sub: arn:aws:iam::${AWS::AccountId}:root

  ElastiCacheReplicationGroup:
    Type: AWS::ElastiCache::ReplicationGroup
    Properties: 
      AutomaticFailoverEnabled: true
      AutoMinorVersionUpgrade: true
      AtRestEncryptionEnabled: true
      CacheNodeType:
        Ref: ElastiCacheInstanceClass
      CacheParameterGroupName: "default.redis5.0"
      CacheSubnetGroupName:
        Ref: ElastiCacheSubnetGroup
      Engine: redis
      EngineVersion: "5.0.6"
      KmsKeyId:
        Fn::GetAtt: ElastiCacheKmsKey.Arn
      MultiAZEnabled: true
      NumCacheClusters: 2
      Port: "6379"
      ReplicationGroupDescription:
        Fn::Sub: Redis based ElastiCache cluster for ${AWS::StackName}
      SecurityGroupIds: 
        - Fn::GetAtt: Ec2SecurityGroup.GroupId

  ServiceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - 'opsworks.amazonaws.com'
            Action:
              - 'sts:AssumeRole'
      Path: /
      Policies:
        - PolicyName:
            Fn::Sub: ${AWS::StackName}-OpsWorksDefaultPolicy
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - 'ec2:*'
                  - 'iam:PassRole'
                  - 'cloudwatch:GetMetricStatistics'
                  - 'cloudwatch:DescribeAlarms'
                  - 'elasticloadbalancing:*'
                  - 'ecs:*'
                  - 'rds:*'
                Resource: '*'

  InstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: 
                - 'ec2.amazonaws.com'
            Action:
              - 'sts:AssumeRole'
      Path: /
      Policies:
        - PolicyName:
            Fn::Sub: ${AWS::StackName}-CloudWatchLogs
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - 'cloudwatch:*'
                  - 'logs:*'
                Resource:
                  - '*'

  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - Ref: InstanceRole

  OpsWorksStack: 
    Type: AWS::OpsWorks::Stack
    Properties: 
      AgentVersion: LATEST
      Name: 
        Fn::Sub: ${AWS::StackName}-ClickHouse
      ServiceRoleArn: 
        Fn::GetAtt:
          - ServiceRole
          - Arn
      DefaultInstanceProfileArn: 
        Fn::GetAtt:
          - InstanceProfile
          - Arn
      ConfigurationManager:
        Name: Chef
        Version: '12'
      UseCustomCookbooks: true
      CustomCookbooksSource:
        Type: archive
        Url:
          Ref: ClickHouseCookbookUrl
      DefaultSubnetId:
        Ref: PrivateSubnet1
      VpcId:
        Ref: VPC
      UseOpsworksSecurityGroups: false
      DefaultOs: Ubuntu 18.04 LTS
      DefaultRootDeviceType: ebs

  Layer:
    Type: AWS::OpsWorks::Layer
    Properties:
      Name: Sentry-ClickHouse
      Shortname: sentry-clickhouse-
      Type: custom
      EnableAutoHealing: 'false'
      AutoAssignElasticIps: 'false'
      AutoAssignPublicIps: 'false'
      StackId:
        Ref: OpsWorksStack
      CustomRecipes:
        Setup:
          - 'clickhouse_stack::setup'
      UseEbsOptimizedInstances: True
      CustomSecurityGroupIds:
        - Fn::GetAtt: Ec2SecurityGroup.GroupId

  ElbClickHouse:
    Type: AWS::ElasticLoadBalancing::LoadBalancer
    DependsOn: Layer
    Properties:
      HealthCheck:
        Interval: 30
        Target: TCP:22
        Timeout: 5
        UnhealthyThreshold: 5
        HealthyThreshold: 5
      Listeners:
        - InstancePort: '8123'
          LoadBalancerPort: '8123'
          Protocol: TCP
          InstanceProtocol: TCP
        - InstancePort: '9000'
          LoadBalancerPort: '9000'
          Protocol: TCP
          InstanceProtocol: TCP
        - InstancePort: '9004'
          LoadBalancerPort: '9004'
          Protocol: TCP
          InstanceProtocol: TCP
      Scheme: internal
      SecurityGroups:
        - Ref: ClickHouseLbSecurityGroup
      Subnets:
        - Ref: PrivateSubnet1
        - Ref: PrivateSubnet2
        - Ref: PrivateSubnet3
      ConnectionDrainingPolicy:
        Enabled: 'true'
        Timeout: '300'
      LBCookieStickinessPolicy:
        - CookieExpirationPeriod: 600
          PolicyName:
            Ref: AWS::StackName

  ElbClickHouseLayer:
    DependsOn: ElbClickHouse
    Type: AWS::OpsWorks::ElasticLoadBalancerAttachment
    Properties: 
      ElasticLoadBalancerName: 
        Ref: ElbClickHouse
      LayerId: 
        Ref: Layer

  InstanceOpsWorks:
    Type: AWS::OpsWorks::Instance
    Properties:
      StackId:
        Ref: OpsWorksStack
      LayerIds:
        - Ref: Layer
      InstanceType:
        Ref: ClickHouseInstanceType
      RootDeviceType: ebs
      SubnetId:
        Ref: PrivateSubnet1
      Hostname: sentry-clickhouse-1
      BlockDeviceMappings:
        - DeviceName: ROOT_DEVICE
          Ebs:
            VolumeType: gp2
            VolumeSize:
              Ref: ClickHouseInstanceRootVolumeSize

  KafkaGetBrokersLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal: {Service: [lambda.amazonaws.com]}
          Action: ['sts:AssumeRole']
      Policies:
      - PolicyName:
          Fn::Sub: ${AWS::StackName}-Kafka
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - kafka:*
            Resource: '*'
      - PolicyName:
          Fn::Sub: ${AWS::StackName}-CloudWatch
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - logs:*
            - cloudwatch:*
            Resource: '*'

  KafkaGetBrokersLambdaLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName:
        Fn::Sub: /aws/lambda/${KafkaGetBrokersLambdaFunction}
      RetentionInDays: 3

  KafkaGetBrokersLambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      Handler: index.lambda_handler
      Runtime: python3.8
      Role:
        Fn::GetAtt: KafkaGetBrokersLambdaRole.Arn
      Code:
        ZipFile:
          Fn::Sub: |
            import boto3
            from botocore.exceptions import ClientError
            import json
            import cfnresponse
            from datetime import datetime

            def lambda_handler(event, context):
              # This comment was added to force an update on this function's code
              data = {}

              try:
                kafka_client = boto3.client('kafka',region_name="${AWS::Region}")

                if event['RequestType'] in ['Create', 'Update']:
                  
                  response = kafka_client.get_bootstrap_brokers(
                    ClusterArn=event["ResourceProperties"]["ClusterArn"]
                  )
                  data["BootstrapBrokerString"] = response["BootstrapBrokerString"]
                  data["BootstrapBrokerStringTls"] = response["BootstrapBrokerStringTls"]
                  data["KafkaBroker1"] = str(response["BootstrapBrokerString"]).split(",")[0]
                  data["KafkaBroker2"] = str(response["BootstrapBrokerString"]).split(",")[1]
                  data["KafkaBroker3"] = str(response["BootstrapBrokerString"]).split(",")[2]

                else:
                  data["Reason"] = "OK"
                  
                cfnresponse.send(event, context, cfnresponse.SUCCESS, data)
              except Exception as e:
                print(str(e))
                data["Reason"] = str(e)
                cfnresponse.send(event, context, cfnresponse.FAILED, data)

  KafkaGetBrokersLambdaResult:
    Type: Custom::KafkaGetBrokers
    Properties:
      ServiceToken:
        Fn::GetAtt: KafkaGetBrokersLambdaFunction.Arn
      ClusterArn:
        Ref: KafkaCluster

  SecretPostgresPassword:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name:
        Fn::Sub: ${AWS::StackName}-SecretPostgresPassword
      SecretString:
        Ref: PostgresDbPassword

  SecretAdminPassword:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name:
        Fn::Sub: ${AWS::StackName}-SecretAdminPassword
      SecretString:
        Ref: InitialAdminUserPassword

  SecretSentryEmailPassword:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name:
        Fn::Sub: ${AWS::StackName}-SecretSentryEmailPassword
      SecretString:
        Ref: SentryEmailPassword

  S3KmsKey:
    Type: AWS::KMS::Key
    Properties:
      EnableKeyRotation: true
      KeyPolicy:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action: kms:*
            Resource: "*"
            Principal:
              AWS:
                - Fn::Sub: arn:aws:iam::${AWS::AccountId}:root
          - Effect: Allow
            Principal:
              AWS: "*"
            Action:
              - kms:Encrypt
              - kms:Decrypt
              - kms:ReEncrypt*
              - kms:GenerateDataKey*
              - kms:CreateGrant
              - kms:DescribeKey
            Resource: "*"
            Condition:
              StringEquals:
                kms:CallerAccount:
                  Ref: AWS::AccountId
                kms:ViaService:
                  Fn::Sub: s3.${AWS::Region}.amazonaws.com

  SentryBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
        - BucketKeyEnabled: true
          ServerSideEncryptionByDefault:
            SSEAlgorithm: 'aws:kms'
            KMSMasterKeyID:
              Fn::GetAtt: S3KmsKey.Arn
      PublicAccessBlockConfiguration:
        BlockPublicAcls: True
        BlockPublicPolicy: True
        IgnorePublicAcls: True
        RestrictPublicBuckets: True

  ClusterWeb:
    Type: AWS::ECS::Cluster

  ClusterWorkers:
    Type: AWS::ECS::Cluster
    Properties:
      CapacityProviders: 
        - FARGATE_SPOT
      DefaultCapacityProviderStrategy: 
        - CapacityProvider: FARGATE_SPOT
          Weight: 1

  LoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      LoadBalancerAttributes:
        - Key: idle_timeout.timeout_seconds
          Value: 30
      Scheme: "internal"
      SecurityGroups:
        - Ref: LbSecurityGroup
      Subnets:
        - Ref: PrivateSubnet1
        - Ref: PrivateSubnet2
        - Ref: PrivateSubnet3

  LoadBalancerProxy:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      LoadBalancerAttributes:
        - Key: idle_timeout.timeout_seconds
          Value: 30
      Scheme: "internet-facing"
      SecurityGroups:
        - Ref: LbSecurityGroup
      Subnets:
        - Ref: PublicSubnet1
        - Ref: PublicSubnet2
        - Ref: PublicSubnet3

  Route53RecordSentry:
    Type: AWS::Route53::RecordSetGroup
    Properties:
      HostedZoneId:
        Ref: DnsZone
      Comment: 
        Fn::Sub: Route53-record-for-Sentry
      RecordSets:
      - Name:
          Ref: SentryDnsRecord
        Type: A
        AliasTarget:
          HostedZoneId: 
            Fn::GetAtt:
              - LoadBalancerProxy
              - CanonicalHostedZoneID
          DNSName: 
            Fn::GetAtt:
              - LoadBalancerProxy
              - DNSName

  Route53RecordSnubaApi:
    Type: AWS::Route53::RecordSetGroup
    Properties:
      HostedZoneId:
        Ref: DnsZone
      Comment: 
        Fn::Sub: Route53-record-for-Sentry-SnubaApi
      RecordSets:
      - Name:
          Ref: SnubaApiDnsRecord
        Type: A
        AliasTarget:
          HostedZoneId: 
            Fn::GetAtt:
              - LoadBalancer
              - CanonicalHostedZoneID
          DNSName: 
            Fn::GetAtt:
              - LoadBalancer
              - DNSName

  Route53RecordRelay:
    Type: AWS::Route53::RecordSetGroup
    Properties:
      HostedZoneId:
        Ref: DnsZone
      Comment: 
        Fn::Sub: Route53-record-for-Sentry-Relay
      RecordSets:
      - Name:
          Fn::Sub: "*.ingest.${SentryDnsRecord}"
        Type: A
        AliasTarget:
          HostedZoneId: 
            Fn::GetAtt:
              - LoadBalancerProxy
              - CanonicalHostedZoneID
          DNSName: 
            Fn::GetAtt:
              - LoadBalancerProxy
              - DNSName

  Route53RecordRelayAlternative:
    Type: AWS::Route53::RecordSetGroup
    Properties:
      HostedZoneId:
        Ref: DnsZone
      Comment: 
        Fn::Sub: Route53-record-for-Sentry-Relay-Alternative
      RecordSets:
      - Name:
          Ref: SentryRelayAlternativeDnsRecord
        Type: A
        AliasTarget:
          HostedZoneId: 
            Fn::GetAtt:
              - LoadBalancerProxy
              - CanonicalHostedZoneID
          DNSName: 
            Fn::GetAtt:
              - LoadBalancerProxy
              - DNSName

  TargetGroupDefault:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Port: 80
      Protocol: HTTP
      VpcId:
        Ref: VPC

  ListenerHTTPDefault:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - TargetGroupArn:
            Ref: TargetGroupDefault
          Type: forward
      LoadBalancerArn:
        Ref: LoadBalancer
      Port: 80
      Protocol: HTTP

  ListenerHTTPSDefault:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - TargetGroupArn:
            Ref: TargetGroupDefault
          Type: forward
      LoadBalancerArn:
        Ref: LoadBalancer
      Port: 443
      Protocol: HTTPS
      Certificates:
        - CertificateArn:
            Ref: SslLoadBalancer

  TargetGroupProxy:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Port: 80
      Protocol: HTTP
      VpcId:
        Ref: VPC

  ListenerHTTPProxy:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - TargetGroupArn:
            Ref: TargetGroupProxy
          Type: forward
      LoadBalancerArn:
        Ref: LoadBalancerProxy
      Port: 80
      Protocol: HTTP

  ListenerHTTPSProxy:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - TargetGroupArn:
            Ref: TargetGroupProxy
          Type: forward
      LoadBalancerArn:
        Ref: LoadBalancerProxy
      Port: 443
      Protocol: HTTPS
      Certificates:
        - CertificateArn:
            Ref: SslLoadBalancer

  HttpRedirectHttpsSentryProxy:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      Actions:
      - Type: redirect
        RedirectConfig:
          Protocol: HTTPS
          Port: '443'
          StatusCode: HTTP_301
      Conditions:
      - Field: host-header
        Values:
        - Ref: SentryDnsRecord
      ListenerArn:
        Ref: ListenerHTTPProxy
      Priority: 1

  ScalingRole: 
    Type: AWS::IAM::Role
    Properties: 
      RoleName:
        Fn::Sub: ${AWS::StackName}-ScalingRole
      AssumeRolePolicyDocument: 
        Statement: 
        - Effect: Allow
          Principal:
            Service: application-autoscaling.amazonaws.com
          Action: 'sts:AssumeRole'
      Policies:
      - PolicyName: CloudWatchManagement
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - cloudwatch:PutMetricAlarm
                - cloudwatch:DescribeAlarms
                - cloudwatch:GetMetricStatistics
                - cloudwatch:SetAlarmState
                - cloudwatch:DeleteAlarms
              Resource: "*"
      - PolicyName: ScalingPolicyEcs
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - application-autoscaling:*
                - ecs:RunTask
                - ecs:UpdateSerice
                - ecs:DescribeServices
              Resource: "*"
      - PolicyName: ScalingPolicyRds
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - rds:AddTagsToResource
                - rds:CreateDBInstance
                - rds:DeleteDBInstance
                - rds:DescribeDBClusters
                - rds:DescribeDBInstance
              Resource: "*"
      - PolicyName: ScalingPolicyKafka
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - kafka:DescribeCluster
                - kafka:DescribeClusterOperation
                - kafka:UpdateBrokerStorage
              Resource: "*"

  ExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName:
        Fn::Sub: ${AWS::StackName}-ExecutionRole
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action: 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy'
      Policies:
      - PolicyName: SecretsManagerAccess
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - secretsmanager:GetSecretValue
              Resource:
                - Ref: SecretPostgresPassword
                - Ref: SecretAdminPassword
                - Ref: SecretSentryEmailPassword

  TaskRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName:
        Fn::Sub: ${AWS::StackName}-TaskRole
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action: 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/AmazonSSMReadOnlyAccess'
      Policies:
      - PolicyName: S3Access
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - s3:*
              Resource:
                - Fn::Sub: arn:aws:s3:::${SentryBucket}/*
                - Fn::Sub: arn:aws:s3:::${SentryBucket}
            - Effect: Allow
              Action:
                - s3:GetAccessPoint
                - s3:PutAccountPublicAccessBlock
                - s3:GetAccountPublicAccessBlock
                - s3:ListAllMyBuckets
                - s3:ListAccessPoints
                - s3:ListJobs
                - s3:CreateJob
                - s3:HeadBucket
              Resource: "*"
            - Effect: Allow
              Action:
                - ssmmessages:CreateControlChannel
                - ssmmessages:CreateDataChannel
                - ssmmessages:OpenControlChannel
                - ssmmessages:OpenDataChannel
              Resource: "*"

  LogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      RetentionInDays: 3

  TaskDefinitionSnubaApi:
    Type: AWS::ECS::TaskDefinition
    Properties:
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      Cpu: "256"
      Memory: 0.5GB
      ExecutionRoleArn:
        Fn::GetAtt: ExecutionRole.Arn
      TaskRoleArn:
        Fn::GetAtt: TaskRole.Arn
      ContainerDefinitions:
        - Name: sentry-snuba-api
          Image:
            Ref: SnubaImage
          PortMappings:
          - ContainerPort: 1218
            Protocol: tcp
          Secrets:
            - Name: POSTGRES_PASSWORD
              ValueFrom:
                Ref: SecretPostgresPassword
            - Name: SENTRY_EMAIL_PASSWORD
              ValueFrom:
                Ref: SecretSentryEmailPassword
          Environment:
            - Name: AWS_DEFAULT_REGION
              Value:
                Ref: AWS::Region
            - Name: REDIS_HOST
              Value:
                Fn::GetAtt: ElastiCacheReplicationGroup.PrimaryEndPoint.Address
            - Name: REDIS_PORT
              Value: "6379"
            - Name: CLICKHOUSE_HOST
              Value:
                Fn::GetAtt: ElbClickHouse.DNSName
            - Name: CLICKHOUSE_PORT
              Value: "9000"
            - Name: CLICKHOUSE_HTTP_PORT
              Value: "8123"
            - Name: CLICKHOUSE_SINGLE_NODE
              Value: "true"
            - Name: CLICKHOUSE_DATABASE
              Value: "default"
            - Name: KAFKA_BROKER_1
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker1
            - Name: KAFKA_BROKER_2
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker2
            - Name: KAFKA_BROKER_3
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker3
            - Name: DEFAULT_BROKERS
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.BootstrapBrokerString
            - Name: POSTGRES_HOST
              Value:
                Fn::GetAtt: RDSCluster.Endpoint.Address
            - Name: POSTGRES_PORT
              Value: "5432"
            - Name: POSTGRES_DB
              Value:
                Ref: PostgresDbName
            - Name: POSTGRES_USER
              Value:
                Ref: PostgresDbUsername
            - Name: SENTRY_EMAIL_BACKEND
              Value:
                Ref: SentryEmailBackend
            - Name: SENTRY_EMAIL_USERNAME
              Value:
                Ref: SentryEmailUsername
            - Name: SENTRY_EMAIL_PORT
              Value:
                Ref: SentryEmailPort
            - Name: SENTRY_EMAIL_HOST
              Value:
                Ref: SentryEmailHost
            - Name: SENTRY_EMAIL_FROM
              Value:
                Ref: SentryEmailFrom
            - Name: SENTRY_EMAIL_USE_TLS
              Value:
                Ref: SentryEmailUseTls
            - Name: SENTRY_EMAIL_USE_SSL
              Value:
                Ref: SentryEmailUseSsl
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs

  ServiceSnubaApi:
    Type: AWS::ECS::Service
    DependsOn:
      - ListenerHTTPSDefault
    Properties:
      PlatformVersion: '1.4.0'
      Cluster:
        Ref: ClusterWeb
      TaskDefinition:
        Ref: TaskDefinitionSnubaApi
      DeploymentConfiguration:
        MinimumHealthyPercent: 100
        MaximumPercent: 200
      DesiredCount:
        Ref: MinCountSnubaApi
      HealthCheckGracePeriodSeconds: 30
      LaunchType: FARGATE
      PropagateTags: SERVICE
      NetworkConfiguration: 
        AwsvpcConfiguration:
          AssignPublicIp: DISABLED
          Subnets:
            - Ref: PrivateSubnet1
            - Ref: PrivateSubnet2
            - Ref: PrivateSubnet3
          SecurityGroups:
            - Ref: Ec2SecurityGroup
      LoadBalancers:
        - ContainerName: sentry-snuba-api
          ContainerPort: 1218
          TargetGroupArn:
            Ref: TargetGroupSnubaApi
      EnableExecuteCommand: true

  TargetGroupSnubaApi:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Name:
        Fn::Join:
          - '-'
          - - 'TG-SnubaApi-'
            - Fn::Select:
                - 2
                - Fn::Split:
                    - '/'
                    - Fn::GetAtt: LoadBalancer.LoadBalancerFullName
      HealthCheckIntervalSeconds: 10
      HealthCheckPath: /
      HealthCheckTimeoutSeconds: 5
      UnhealthyThresholdCount: 2
      HealthyThresholdCount: 2
      Port: 1218
      Protocol: HTTP
      TargetGroupAttributes:
        - Key: deregistration_delay.timeout_seconds
          Value: 30
      TargetType: ip
      VpcId:
        Ref: VPC

  HttpListenerRuleSnubaApi:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      Actions:
      - Type: forward
        TargetGroupArn:
          Ref: TargetGroupSnubaApi
      Conditions:
      - Field: host-header
        Values:
        - Ref: SnubaApiDnsRecord
      ListenerArn:
        Ref: ListenerHTTPDefault
      Priority: 20

  HttpsListenerRuleSnubaApi:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      Actions:
      - Type: forward
        TargetGroupArn:
          Ref: TargetGroupSnubaApi
      Conditions:
      - Field: host-header
        Values:
        - Ref: SnubaApiDnsRecord
      ListenerArn:
        Ref: ListenerHTTPSDefault
      Priority: 30

  AutoScalingTargetSnubaApi:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    Properties:
      MaxCapacity:
        Ref: MaxCountSnubaApi
      MinCapacity:
        Ref: MinCountSnubaApi
      ResourceId:
        Fn::Sub: service/${ClusterWeb}/${ServiceSnubaApi.Name}
      RoleARN:
        Fn::GetAtt: ScalingRole.Arn
      ScalableDimension: ecs:service:DesiredCount
      ServiceNamespace: ecs

  RequestsAutoScalingPolicySnubaApi:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-Requests-SnubaApi
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: AutoScalingTargetSnubaApi
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue: 50 
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: ALBRequestCountPerTarget
          ResourceLabel:
            Fn::Sub: ${LoadBalancer.LoadBalancerFullName}/${TargetGroupSnubaApi.TargetGroupFullName}

  TaskDefinitionSentryWeb:
    Type: AWS::ECS::TaskDefinition
    Properties:
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      Cpu: "512"
      Memory: 1GB
      ExecutionRoleArn:
        Fn::GetAtt: ExecutionRole.Arn
      TaskRoleArn:
        Fn::GetAtt: TaskRole.Arn
      Volumes:
        - Name: sentry-conf-vol
          Host: {}
      ContainerDefinitions:
        - Name: sentry-config
          Image:
            Ref: BashImage
          Essential: false
          Command:
            - -c
            - echo $SENTRY_CONFIG | base64 -d - | tee /config-sentry/config.yml
          Environment:
            - Name: SENTRY_CONFIG
              Value:
                Fn::Base64:
                  Fn::Sub: |
                    system.secret-key: "${SentrySystemSecretKey}"
                    system.url-prefix: "https://${SentryDnsRecord}"

                    slack.client-id: "${SentrySlackClientId}"
                    slack.client-secret: "${SentrySlackClientSecret}"
                    slack.legacy-app: False
                    slack.signing-secret: "${SentrySlackSigningSecret}"

                    filestore.backend: 's3'
                    filestore.options:
                      bucket_name: "${SentryBucket}"
                      default_acl: "private"
                      acl: "private"
          MountPoints:
            - ContainerPath: /config-sentry/
              SourceVolume: sentry-conf-vol
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs
        - Name: sentry-web
          Image:
            Ref: SentryImage
          EntryPoint: ["/bin/bash"]
          Command:
            - "-c"
            - "cp /config-sentry/config.yml /etc/sentry/config.yml && sentry run web"
          Essential: true
          DependsOn:
          - Condition: COMPLETE
            ContainerName: sentry-config
          MountPoints:
            - ContainerPath: /config-sentry/
              SourceVolume: sentry-conf-vol
          PortMappings:
          - ContainerPort: 9000
            Protocol: tcp
          Secrets:
            - Name: POSTGRES_PASSWORD
              ValueFrom:
                Ref: SecretPostgresPassword
            - Name: SENTRY_EMAIL_PASSWORD
              ValueFrom:
                Ref: SecretSentryEmailPassword
          Environment:
            - Name: AWS_DEFAULT_REGION
              Value:
                Ref: AWS::Region
            - Name: C_FORCE_ROOT
              Value: "true"
            - Name: SNUBA
              Value: 
                Fn::Sub: http://${SnubaApiDnsRecord}
            - Name: REDIS_HOST
              Value:
                Fn::GetAtt: ElastiCacheReplicationGroup.PrimaryEndPoint.Address
            - Name: REDIS_PORT
              Value: "6379"
            - Name: CLICKHOUSE_HOST
              Value:
                Fn::GetAtt: ElbClickHouse.DNSName
            - Name: CLICKHOUSE_PORT
              Value: "9000"
            - Name: CLICKHOUSE_SINGLE_NODE
              Value: "true"
            - Name: KAFKA_BROKER_1
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker1
            - Name: KAFKA_BROKER_2
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker2
            - Name: KAFKA_BROKER_3
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker3
            - Name: POSTGRES_HOST
              Value:
                Fn::GetAtt: RDSCluster.Endpoint.Address
            - Name: POSTGRES_PORT
              Value: "5432"
            - Name: POSTGRES_DB
              Value:
                Ref: PostgresDbName
            - Name: POSTGRES_USER
              Value:
                Ref: PostgresDbUsername
            - Name: SENTRY_EMAIL_BACKEND
              Value:
                Ref: SentryEmailBackend
            - Name: SENTRY_EMAIL_USERNAME
              Value:
                Ref: SentryEmailUsername
            - Name: SENTRY_EMAIL_PORT
              Value:
                Ref: SentryEmailPort
            - Name: SENTRY_EMAIL_HOST
              Value:
                Ref: SentryEmailHost
            - Name: SENTRY_EMAIL_FROM
              Value:
                Ref: SentryEmailFrom
            - Name: SENTRY_EMAIL_USE_TLS
              Value:
                Ref: SentryEmailUseTls
            - Name: SENTRY_EMAIL_USE_SSL
              Value:
                Ref: SentryEmailUseSsl
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs

  ServiceSentryWeb:
    Type: AWS::ECS::Service
    DependsOn:
      - ListenerHTTPSDefault
    Properties:
      PlatformVersion: '1.4.0'
      Cluster:
        Ref: ClusterWeb
      TaskDefinition:
        Ref: TaskDefinitionSentryWeb
      DeploymentConfiguration:
        MinimumHealthyPercent: 100
        MaximumPercent: 200
      DesiredCount:
        Ref: MinCountSentryWeb
      HealthCheckGracePeriodSeconds: 30
      LaunchType: FARGATE
      PropagateTags: SERVICE
      NetworkConfiguration: 
        AwsvpcConfiguration:
          AssignPublicIp: DISABLED
          Subnets:
            - Ref: PrivateSubnet1
            - Ref: PrivateSubnet2
            - Ref: PrivateSubnet3
          SecurityGroups:
            - Ref: Ec2SecurityGroup
      LoadBalancers:
        - ContainerName: sentry-web
          ContainerPort: 9000
          TargetGroupArn:
            Ref: TargetGroupSentryWeb
      EnableExecuteCommand: true            

  TargetGroupSentryWeb:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Name:
        Fn::Join:
          - '-'
          - - 'TG-SentryWeb-'
            - Fn::Select:
                - 2
                - Fn::Split:
                    - '/'
                    - Fn::GetAtt: LoadBalancer.LoadBalancerFullName
      HealthCheckIntervalSeconds: 10
      HealthCheckPath: /_health/
      HealthCheckTimeoutSeconds: 5
      UnhealthyThresholdCount: 2
      HealthyThresholdCount: 2
      Port: 9000
      Protocol: HTTP
      TargetGroupAttributes:
        - Key: deregistration_delay.timeout_seconds
          Value: 30
      TargetType: ip
      VpcId:
        Ref: VPC

  HttpListenerRuleSentryWeb:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      Actions:
      - Type: forward
        TargetGroupArn:
          Ref: TargetGroupSentryWeb
      Conditions:
      - Field: host-header
        Values:
        - Ref: SentryDnsRecord
      ListenerArn:
        Ref: ListenerHTTPProxy
      Priority: 40

  HttpsListenerRuleSentryWeb:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      Actions:
      - Type: forward
        TargetGroupArn:
          Ref: TargetGroupSentryWeb
      Conditions:
      - Field: host-header
        Values:
        - Ref: SentryDnsRecord
      ListenerArn:
        Ref: ListenerHTTPSProxy
      Priority: 50

  AutoScalingTargetSentryWeb:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    Properties:
      MaxCapacity:
        Ref: MaxCountSentryWeb
      MinCapacity:
        Ref: MinCountSentryWeb
      ResourceId:
        Fn::Sub: service/${ClusterWeb}/${ServiceSentryWeb.Name}
      RoleARN:
        Fn::GetAtt: ScalingRole.Arn
      ScalableDimension: ecs:service:DesiredCount
      ServiceNamespace: ecs

  RequestsAutoScalingPolicySentryWeb:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-Requests-SentryWeb
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: AutoScalingTargetSentryWeb
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue: 50 
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: ALBRequestCountPerTarget
          ResourceLabel:
            Fn::Sub: ${LoadBalancerProxy.LoadBalancerFullName}/${TargetGroupSentryWeb.TargetGroupFullName}

  TaskDefinitionRelay:
    Type: AWS::ECS::TaskDefinition
    Properties:
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      Cpu: "256"
      Memory: 0.5GB
      ExecutionRoleArn:
        Fn::GetAtt: ExecutionRole.Arn
      TaskRoleArn:
        Fn::GetAtt: TaskRole.Arn
      Volumes:
        - Name: relay-conf-vol
          Host: {}
      ContainerDefinitions:
        - Name: relay-config
          Image:
            Ref: BashImage
          Essential: false
          Command:
            - -c
            - echo $RELAY_CONFIG | base64 -d - | tee /config-relay/config.yml
          Environment:
            - Name: RELAY_CONFIG
              Value:
                Fn::Base64:
                  Fn::Sub: |
                    relay:
                      mode: ${SentryRelayMode}
                      upstream: "https://${SentryDnsRecord}/"
                      host: 0.0.0.0
                      port: 3000

                    processing:
                      enabled: true
                      geoip_path: "/work/.relay/GeoLite2-City.mmdb"

                      kafka_config:
                        - name: "bootstrap.servers"
                          value: "${KafkaGetBrokersLambdaResult.KafkaBroker1},${KafkaGetBrokersLambdaResult.KafkaBroker2},${KafkaGetBrokersLambdaResult.KafkaBroker3}"
                        - name: "message.max.bytes"
                          value: 50000000  # 50MB or bust
                      redis: "redis://:@${ElastiCacheReplicationGroup.PrimaryEndPoint.Address}:6379"
          MountPoints:
            - ContainerPath: /config-relay/
              SourceVolume: relay-conf-vol
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs
        - Name: relay
          Image:
            Ref: RelayImage
          Essential: true
          DependsOn:
          - Condition: COMPLETE
            ContainerName: relay-config
          PortMappings:
          - ContainerPort: 3000
            Protocol: tcp
          MountPoints:
            - ContainerPath: /config-relay/
              SourceVolume: relay-conf-vol
          Secrets:
            - Name: POSTGRES_PASSWORD
              ValueFrom:
                Ref: SecretPostgresPassword
            - Name: SENTRY_EMAIL_PASSWORD
              ValueFrom:
                Ref: SecretSentryEmailPassword
          Environment:
            - Name: AWS_DEFAULT_REGION
              Value:
                Ref: AWS::Region
            - Name: CONFIG_FILE_PATH
              Value: /config-relay/config.yml
            - Name: RELAY_PORT
              Value: "3000"
            - Name: REDIS_HOST
              Value:
                Fn::GetAtt: ElastiCacheReplicationGroup.PrimaryEndPoint.Address
            - Name: REDIS_PORT
              Value: "6379"
            - Name: CLICKHOUSE_HOST
              Value:
                Fn::GetAtt: ElbClickHouse.DNSName
            - Name: CLICKHOUSE_PORT
              Value: "9000"
            - Name: CLICKHOUSE_SINGLE_NODE
              Value: "true"
            - Name: KAFKA_BROKER_1
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker1
            - Name: KAFKA_BROKER_2
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker2
            - Name: KAFKA_BROKER_3
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker3
            - Name: POSTGRES_HOST
              Value:
                Fn::GetAtt: RDSCluster.Endpoint.Address
            - Name: POSTGRES_PORT
              Value: "5432"
            - Name: POSTGRES_DB
              Value:
                Ref: PostgresDbName
            - Name: POSTGRES_USER
              Value:
                Ref: PostgresDbUsername
            - Name: SENTRY_EMAIL_BACKEND
              Value:
                Ref: SentryEmailBackend
            - Name: SENTRY_EMAIL_USERNAME
              Value:
                Ref: SentryEmailUsername
            - Name: SENTRY_EMAIL_PORT
              Value:
                Ref: SentryEmailPort
            - Name: SENTRY_EMAIL_HOST
              Value:
                Ref: SentryEmailHost
            - Name: SENTRY_EMAIL_FROM
              Value:
                Ref: SentryEmailFrom
            - Name: SENTRY_EMAIL_USE_TLS
              Value:
                Ref: SentryEmailUseTls
            - Name: SENTRY_EMAIL_USE_SSL
              Value:
                Ref: SentryEmailUseSsl
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs

  ServiceRelay:
    Type: AWS::ECS::Service
    DependsOn:
      - ListenerHTTPSDefault
    Properties:
      PlatformVersion: '1.4.0'
      Cluster:
        Ref: ClusterWeb
      TaskDefinition:
        Ref: TaskDefinitionRelay
      DeploymentConfiguration:
        MinimumHealthyPercent: 100
        MaximumPercent: 200
      DesiredCount:
        Ref: MinCountSentryRelay
      HealthCheckGracePeriodSeconds: 30
      LaunchType: FARGATE
      PropagateTags: SERVICE
      NetworkConfiguration: 
        AwsvpcConfiguration:
          AssignPublicIp: DISABLED
          Subnets:
            - Ref: PrivateSubnet1
            - Ref: PrivateSubnet2
            - Ref: PrivateSubnet3
          SecurityGroups:
            - Ref: Ec2SecurityGroup
      LoadBalancers:
        - ContainerName: relay
          ContainerPort: 3000
          TargetGroupArn:
            Ref: TargetGroupRelay
      EnableExecuteCommand: true

  TargetGroupRelay:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Name:
        Fn::Join:
          - '-'
          - - 'TG-Ingest-'
            - Fn::Select:
                - 2
                - Fn::Split:
                    - '/'
                    - Fn::GetAtt: LoadBalancer.LoadBalancerFullName
      HealthCheckIntervalSeconds: 10
      HealthCheckPath: /api/relay/healthcheck/ready/
      HealthCheckTimeoutSeconds: 5
      UnhealthyThresholdCount: 2
      HealthyThresholdCount: 2
      Port: 3000
      Protocol: HTTP
      TargetGroupAttributes:
        - Key: deregistration_delay.timeout_seconds
          Value: 30
      TargetType: ip
      VpcId:
        Ref: VPC

  HttpListenerRuleRelay:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      Actions:
      - Type: forward
        TargetGroupArn:
          Ref: TargetGroupRelay
      Conditions:
      - Field: host-header
        Values:
          - Fn::Sub: "*.ingest.${SentryDnsRecord}"
      ListenerArn:
        Ref: ListenerHTTPProxy
      Priority: 60

  HttpsListenerRuleRelay:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      Actions:
      - Type: forward
        TargetGroupArn:
          Ref: TargetGroupRelay
      Conditions:
      - Field: host-header
        Values:
          - Fn::Sub: "*.ingest.${SentryDnsRecord}"
      ListenerArn:
        Ref: ListenerHTTPSProxy
      Priority: 70

  HttpListenerRuleRelayAlternative:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      Actions:
      - Type: forward
        TargetGroupArn:
          Ref: TargetGroupRelay
      Conditions:
      - Field: host-header
        Values:
          - Ref: SentryRelayAlternativeDnsRecord
      ListenerArn:
        Ref: ListenerHTTPProxy
      Priority: 80

  HttpsListenerRuleRelayAlternative:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      Actions:
      - Type: forward
        TargetGroupArn:
          Ref: TargetGroupRelay
      Conditions:
      - Field: host-header
        Values:
          - Ref: SentryRelayAlternativeDnsRecord
      ListenerArn:
        Ref: ListenerHTTPSProxy
      Priority: 90

  AutoScalingTargetSentryRelay:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    Properties:
      MaxCapacity:
        Ref: MaxCountSentryRelay
      MinCapacity:
        Ref: MinCountSentryRelay
      ResourceId:
        Fn::Sub: service/${ClusterWeb}/${ServiceRelay.Name}
      RoleARN:
        Fn::GetAtt: ScalingRole.Arn
      ScalableDimension: ecs:service:DesiredCount
      ServiceNamespace: ecs

  RequestsAutoScalingPolicySentryRelay:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-Requests-SentryRelay
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: AutoScalingTargetSentryRelay
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue: 50 
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: ALBRequestCountPerTarget
          ResourceLabel:
            Fn::Sub: ${LoadBalancerProxy.LoadBalancerFullName}/${TargetGroupRelay.TargetGroupFullName}

  TaskDefinitionSentryCron:
    Type: AWS::ECS::TaskDefinition
    Properties:
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      Cpu: "1024"
      Memory: 2GB
      ExecutionRoleArn:
        Fn::GetAtt: ExecutionRole.Arn
      TaskRoleArn:
        Fn::GetAtt: TaskRole.Arn
      Volumes:
        - Name: sentry-conf-vol
          Host: {}
      ContainerDefinitions:
        - Name: sentry-config
          Image:
            Ref: BashImage
          Essential: false
          Command:
            - -c
            - echo $SENTRY_CONFIG | base64 -d - | tee /config-sentry/config.yml
          Environment:
            - Name: SENTRY_CONFIG
              Value:
                Fn::Base64:
                  Fn::Sub: |
                    system.secret-key: "${SentrySystemSecretKey}"
                    system.url-prefix: "https://${SentryDnsRecord}"

                    slack.client-id: "${SentrySlackClientId}"
                    slack.client-secret: "${SentrySlackClientSecret}"
                    slack.legacy-app: False
                    slack.signing-secret: "${SentrySlackSigningSecret}"

                    filestore.backend: 's3'
                    filestore.options:
                      bucket_name: "${SentryBucket}"
                      default_acl: "private"
                      acl: "private"
          MountPoints:
            - ContainerPath: /config-sentry/
              SourceVolume: sentry-conf-vol
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs
        - Name: sentry-cron
          Image:
            Ref: SentryImage
          Essential: true
          DependsOn:
          - Condition: COMPLETE
            ContainerName: sentry-config
          MountPoints:
            - ContainerPath: /config-sentry/
              SourceVolume: sentry-conf-vol
          EntryPoint: ["/bin/bash"]
          Command:
            - "-c"
            - "cp /config-sentry/config.yml /etc/sentry/config.yml && sentry run cron"
          Secrets:
            - Name: POSTGRES_PASSWORD
              ValueFrom:
                Ref: SecretPostgresPassword
            - Name: SENTRY_EMAIL_PASSWORD
              ValueFrom:
                Ref: SecretSentryEmailPassword
          Environment:
            - Name: AWS_DEFAULT_REGION
              Value:
                Ref: AWS::Region
            - Name: C_FORCE_ROOT
              Value: "true"
            - Name: SNUBA
              Value: 
                Fn::Sub: http://${SnubaApiDnsRecord}
            - Name: REDIS_HOST
              Value:
                Fn::GetAtt: ElastiCacheReplicationGroup.PrimaryEndPoint.Address
            - Name: REDIS_PORT
              Value: "6379"
            - Name: CLICKHOUSE_HOST
              Value:
                Fn::GetAtt: ElbClickHouse.DNSName
            - Name: CLICKHOUSE_PORT
              Value: "9000"
            - Name: CLICKHOUSE_SINGLE_NODE
              Value: "true"
            - Name: KAFKA_BROKER_1
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker1
            - Name: KAFKA_BROKER_2
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker2
            - Name: KAFKA_BROKER_3
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker3
            - Name: POSTGRES_HOST
              Value:
                Fn::GetAtt: RDSCluster.Endpoint.Address
            - Name: POSTGRES_PORT
              Value: "5432"
            - Name: POSTGRES_DB
              Value:
                Ref: PostgresDbName
            - Name: POSTGRES_USER
              Value:
                Ref: PostgresDbUsername
            - Name: SENTRY_EMAIL_BACKEND
              Value:
                Ref: SentryEmailBackend
            - Name: SENTRY_EMAIL_USERNAME
              Value:
                Ref: SentryEmailUsername
            - Name: SENTRY_EMAIL_PORT
              Value:
                Ref: SentryEmailPort
            - Name: SENTRY_EMAIL_HOST
              Value:
                Ref: SentryEmailHost
            - Name: SENTRY_EMAIL_FROM
              Value:
                Ref: SentryEmailFrom
            - Name: SENTRY_EMAIL_USE_TLS
              Value:
                Ref: SentryEmailUseTls
            - Name: SENTRY_EMAIL_USE_SSL
              Value:
                Ref: SentryEmailUseSsl 
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs

  ServiceSentryCron:
    Type: AWS::ECS::Service
    Properties:
      PlatformVersion: '1.4.0'
      Cluster:
        Ref: ClusterWorkers
      TaskDefinition:
        Ref: TaskDefinitionSentryCron
      DeploymentConfiguration:
        MinimumHealthyPercent: 100
        MaximumPercent: 200
      DesiredCount:
        Ref: DesiredCountSentryCron
      PropagateTags: SERVICE
      NetworkConfiguration: 
        AwsvpcConfiguration:
          AssignPublicIp: DISABLED
          Subnets:
            - Ref: PrivateSubnet1
            - Ref: PrivateSubnet2
            - Ref: PrivateSubnet3
          SecurityGroups:
            - Ref: Ec2SecurityGroup
      EnableExecuteCommand: true

  TaskDefinitionSentryIngestAttachments:
    Type: AWS::ECS::TaskDefinition
    Properties:
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      Cpu: "512"
      Memory: 1GB
      ExecutionRoleArn:
        Fn::GetAtt: ExecutionRole.Arn
      TaskRoleArn:
        Fn::GetAtt: TaskRole.Arn
      Volumes:
        - Name: sentry-conf-vol
          Host: {}
      ContainerDefinitions:
        - Name: sentry-config
          Image:
            Ref: BashImage
          Essential: false
          Command:
            - -c
            - echo $SENTRY_CONFIG | base64 -d - | tee /config-sentry/config.yml
          Environment:
            - Name: SENTRY_CONFIG
              Value:
                Fn::Base64:
                  Fn::Sub: |
                    system.secret-key: "${SentrySystemSecretKey}"
                    system.url-prefix: "https://${SentryDnsRecord}"

                    slack.client-id: "${SentrySlackClientId}"
                    slack.client-secret: "${SentrySlackClientSecret}"
                    slack.legacy-app: False
                    slack.signing-secret: "${SentrySlackSigningSecret}"

                    filestore.backend: 's3'
                    filestore.options:
                      bucket_name: "${SentryBucket}"
                      default_acl: "private"
                      acl: "private"
          MountPoints:
            - ContainerPath: /config-sentry/
              SourceVolume: sentry-conf-vol
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs
        - Name: sentry-ingest-attachments
          Image:
            Ref: SentryImage
          Essential: true
          DependsOn:
          - Condition: COMPLETE
            ContainerName: sentry-config
          MountPoints:
            - ContainerPath: /config-sentry/
              SourceVolume: sentry-conf-vol
          EntryPoint: ["/bin/bash"]
          Command:
            - "-c"
            - "cp /config-sentry/config.yml /etc/sentry/config.yml && sentry run ingest-consumer --consumer-type attachments"
          Secrets:
            - Name: POSTGRES_PASSWORD
              ValueFrom:
                Ref: SecretPostgresPassword
            - Name: SENTRY_EMAIL_PASSWORD
              ValueFrom:
                Ref: SecretSentryEmailPassword
          Environment:
            - Name: AWS_DEFAULT_REGION
              Value:
                Ref: AWS::Region
            - Name: C_FORCE_ROOT
              Value: "true"
            - Name: SNUBA
              Value: 
                Fn::Sub: http://${SnubaApiDnsRecord}
            - Name: REDIS_HOST
              Value:
                Fn::GetAtt: ElastiCacheReplicationGroup.PrimaryEndPoint.Address
            - Name: REDIS_PORT
              Value: "6379"
            - Name: CLICKHOUSE_HOST
              Value:
                Fn::GetAtt: ElbClickHouse.DNSName
            - Name: CLICKHOUSE_PORT
              Value: "9000"
            - Name: CLICKHOUSE_SINGLE_NODE
              Value: "true"
            - Name: KAFKA_BROKER_1
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker1
            - Name: KAFKA_BROKER_2
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker2
            - Name: KAFKA_BROKER_3
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker3
            - Name: POSTGRES_HOST
              Value:
                Fn::GetAtt: RDSCluster.Endpoint.Address
            - Name: POSTGRES_PORT
              Value: "5432"
            - Name: POSTGRES_DB
              Value:
                Ref: PostgresDbName
            - Name: POSTGRES_USER
              Value:
                Ref: PostgresDbUsername
            - Name: SENTRY_EMAIL_BACKEND
              Value:
                Ref: SentryEmailBackend
            - Name: SENTRY_EMAIL_USERNAME
              Value:
                Ref: SentryEmailUsername
            - Name: SENTRY_EMAIL_PORT
              Value:
                Ref: SentryEmailPort
            - Name: SENTRY_EMAIL_HOST
              Value:
                Ref: SentryEmailHost
            - Name: SENTRY_EMAIL_FROM
              Value:
                Ref: SentryEmailFrom
            - Name: SENTRY_EMAIL_USE_TLS
              Value:
                Ref: SentryEmailUseTls
            - Name: SENTRY_EMAIL_USE_SSL
              Value:
                Ref: SentryEmailUseSsl
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs

  ServiceSentryIngestAttachments:
    Type: AWS::ECS::Service
    Properties:
      PlatformVersion: '1.4.0'
      Cluster:
        Ref: ClusterWorkers
      TaskDefinition:
        Ref: TaskDefinitionSentryIngestAttachments
      DeploymentConfiguration:
        MinimumHealthyPercent: 100
        MaximumPercent: 200
      DesiredCount:
        Ref: MinCountSentryIngestAttachments
      PropagateTags: SERVICE
      NetworkConfiguration: 
        AwsvpcConfiguration:
          AssignPublicIp: DISABLED
          Subnets:
            - Ref: PrivateSubnet1
            - Ref: PrivateSubnet2
            - Ref: PrivateSubnet3
          SecurityGroups:
            - Ref: Ec2SecurityGroup
      EnableExecuteCommand: true

  AutoScalingTargetSentryIngestAttachments:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    Properties:
      MaxCapacity:
        Ref: MaxCountSentryIngestAttachments
      MinCapacity:
        Ref: MinCountSentryIngestAttachments
      ResourceId:
        Fn::Sub: service/${ClusterWorkers}/${ServiceSentryIngestAttachments.Name}
      RoleARN:
        Fn::GetAtt: ScalingRole.Arn
      ScalableDimension: ecs:service:DesiredCount
      ServiceNamespace: ecs

  CpuAutoScalingPolicySentryIngestAttachments:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-Cpu-SentryIngestAttachments
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: AutoScalingTargetSentryIngestAttachments
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue: 40
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: ECSServiceAverageCPUUtilization

  RamAutoScalingPolicySentryIngestAttachments:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-Ram-SentryIngestAttachments
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: AutoScalingTargetSentryIngestAttachments
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue: 40 
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: ECSServiceAverageMemoryUtilization

  TaskDefinitionSentryIngestEvents:
    Type: AWS::ECS::TaskDefinition
    Properties:
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      Cpu: "512"
      Memory: 1GB
      ExecutionRoleArn:
        Fn::GetAtt: ExecutionRole.Arn
      TaskRoleArn:
        Fn::GetAtt: TaskRole.Arn
      Volumes:
        - Name: sentry-conf-vol
          Host: {}
      ContainerDefinitions:
        - Name: sentry-config
          Image:
            Ref: BashImage
          Essential: false
          Command:
            - -c
            - echo $SENTRY_CONFIG | base64 -d - | tee /config-sentry/config.yml
          Environment:
            - Name: SENTRY_CONFIG
              Value:
                Fn::Base64:
                  Fn::Sub: |
                    system.secret-key: "${SentrySystemSecretKey}"
                    system.url-prefix: "https://${SentryDnsRecord}"

                    slack.client-id: "${SentrySlackClientId}"
                    slack.client-secret: "${SentrySlackClientSecret}"
                    slack.legacy-app: False
                    slack.signing-secret: "${SentrySlackSigningSecret}"

                    filestore.backend: 's3'
                    filestore.options:
                      bucket_name: "${SentryBucket}"
                      default_acl: "private"
                      acl: "private"
          MountPoints:
            - ContainerPath: /config-sentry/
              SourceVolume: sentry-conf-vol
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs
        - Name: sentry-ingest-events
          Image:
            Ref: SentryImage
          Essential: true
          DependsOn:
          - Condition: COMPLETE
            ContainerName: sentry-config
          MountPoints:
            - ContainerPath: /config-sentry/
              SourceVolume: sentry-conf-vol
          EntryPoint: ["/bin/bash"]
          Command:
            - "-c"
            - "cp /config-sentry/config.yml /etc/sentry/config.yml && sentry run ingest-consumer --consumer-type events"
          Secrets:
            - Name: POSTGRES_PASSWORD
              ValueFrom:
                Ref: SecretPostgresPassword
            - Name: SENTRY_EMAIL_PASSWORD
              ValueFrom:
                Ref: SecretSentryEmailPassword
          Environment:
            - Name: AWS_DEFAULT_REGION
              Value:
                Ref: AWS::Region
            - Name: C_FORCE_ROOT
              Value: "true"
            - Name: SNUBA
              Value: 
                Fn::Sub: http://${SnubaApiDnsRecord}
            - Name: REDIS_HOST
              Value:
                Fn::GetAtt: ElastiCacheReplicationGroup.PrimaryEndPoint.Address
            - Name: REDIS_PORT
              Value: "6379"
            - Name: CLICKHOUSE_HOST
              Value:
                Fn::GetAtt: ElbClickHouse.DNSName
            - Name: CLICKHOUSE_PORT
              Value: "9000"
            - Name: CLICKHOUSE_SINGLE_NODE
              Value: "true"
            - Name: KAFKA_BROKER_1
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker1
            - Name: KAFKA_BROKER_2
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker2
            - Name: KAFKA_BROKER_3
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker3
            - Name: POSTGRES_HOST
              Value:
                Fn::GetAtt: RDSCluster.Endpoint.Address
            - Name: POSTGRES_PORT
              Value: "5432"
            - Name: POSTGRES_DB
              Value:
                Ref: PostgresDbName
            - Name: POSTGRES_USER
              Value:
                Ref: PostgresDbUsername
            - Name: SENTRY_EMAIL_BACKEND
              Value:
                Ref: SentryEmailBackend
            - Name: SENTRY_EMAIL_USERNAME
              Value:
                Ref: SentryEmailUsername
            - Name: SENTRY_EMAIL_PORT
              Value:
                Ref: SentryEmailPort
            - Name: SENTRY_EMAIL_HOST
              Value:
                Ref: SentryEmailHost
            - Name: SENTRY_EMAIL_FROM
              Value:
                Ref: SentryEmailFrom
            - Name: SENTRY_EMAIL_USE_TLS
              Value:
                Ref: SentryEmailUseTls
            - Name: SENTRY_EMAIL_USE_SSL
              Value:
                Ref: SentryEmailUseSsl 
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs

  ServiceSentryIngestEvents:
    Type: AWS::ECS::Service
    Properties:
      PlatformVersion: '1.4.0'
      Cluster:
        Ref: ClusterWorkers
      TaskDefinition:
        Ref: TaskDefinitionSentryIngestEvents
      DeploymentConfiguration:
        MinimumHealthyPercent: 100
        MaximumPercent: 200
      DesiredCount:
        Ref: MinCountSentryIngestEvents
      PropagateTags: SERVICE
      NetworkConfiguration: 
        AwsvpcConfiguration:
          AssignPublicIp: DISABLED
          Subnets:
            - Ref: PrivateSubnet1
            - Ref: PrivateSubnet2
            - Ref: PrivateSubnet3
          SecurityGroups:
            - Ref: Ec2SecurityGroup
      EnableExecuteCommand: true

  AutoScalingTargetSentryIngestEvents:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    Properties:
      MaxCapacity:
        Ref: MaxCountSentryIngestEvents
      MinCapacity:
        Ref: MinCountSentryIngestEvents
      ResourceId:
        Fn::Sub: service/${ClusterWorkers}/${ServiceSentryIngestEvents.Name}
      RoleARN:
        Fn::GetAtt: ScalingRole.Arn
      ScalableDimension: ecs:service:DesiredCount
      ServiceNamespace: ecs

  CpuAutoScalingPolicySentryIngestEvents:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-Cpu-SentryIngestEvents
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: AutoScalingTargetSentryIngestEvents
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue: 40
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: ECSServiceAverageCPUUtilization

  RamAutoScalingPolicySentryIngestEvents:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-Ram-SentryIngestEvents
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: AutoScalingTargetSentryIngestEvents
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue: 40 
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: ECSServiceAverageMemoryUtilization

  TaskDefinitionSentryIngestTransactions:
    Type: AWS::ECS::TaskDefinition
    Properties:
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      Cpu: "512"
      Memory: 1GB
      ExecutionRoleArn:
        Fn::GetAtt: ExecutionRole.Arn
      TaskRoleArn:
        Fn::GetAtt: TaskRole.Arn
      Volumes:
        - Name: sentry-conf-vol
          Host: {}
      ContainerDefinitions:
        - Name: sentry-config
          Image:
            Ref: BashImage
          Essential: false
          Command:
            - -c
            - echo $SENTRY_CONFIG | base64 -d - | tee /config-sentry/config.yml
          Environment:
            - Name: SENTRY_CONFIG
              Value:
                Fn::Base64:
                  Fn::Sub: |
                    system.secret-key: "${SentrySystemSecretKey}"
                    system.url-prefix: "https://${SentryDnsRecord}"

                    slack.client-id: "${SentrySlackClientId}"
                    slack.client-secret: "${SentrySlackClientSecret}"
                    slack.legacy-app: False
                    slack.signing-secret: "${SentrySlackSigningSecret}"

                    filestore.backend: 's3'
                    filestore.options:
                      bucket_name: "${SentryBucket}"
                      default_acl: "private"
                      acl: "private"
          MountPoints:
            - ContainerPath: /config-sentry/
              SourceVolume: sentry-conf-vol
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs
        - Name: sentry-ingest-transactions
          Image:
            Ref: SentryImage
          Essential: true
          DependsOn:
          - Condition: COMPLETE
            ContainerName: sentry-config
          MountPoints:
            - ContainerPath: /config-sentry/
              SourceVolume: sentry-conf-vol
          EntryPoint: ["/bin/bash"]
          Command:
            - "-c"
            - "cp /config-sentry/config.yml /etc/sentry/config.yml && sentry run ingest-consumer --consumer-type transactions"
          Secrets:
            - Name: POSTGRES_PASSWORD
              ValueFrom:
                Ref: SecretPostgresPassword
            - Name: SENTRY_EMAIL_PASSWORD
              ValueFrom:
                Ref: SecretSentryEmailPassword
          Environment:
            - Name: AWS_DEFAULT_REGION
              Value:
                Ref: AWS::Region
            - Name: C_FORCE_ROOT
              Value: "true"
            - Name: SNUBA
              Value: 
                Fn::Sub: http://${SnubaApiDnsRecord}
            - Name: REDIS_HOST
              Value:
                Fn::GetAtt: ElastiCacheReplicationGroup.PrimaryEndPoint.Address
            - Name: REDIS_PORT
              Value: "6379"
            - Name: CLICKHOUSE_HOST
              Value:
                Fn::GetAtt: ElbClickHouse.DNSName
            - Name: CLICKHOUSE_PORT
              Value: "9000"
            - Name: CLICKHOUSE_SINGLE_NODE
              Value: "true"
            - Name: KAFKA_BROKER_1
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker1
            - Name: KAFKA_BROKER_2
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker2
            - Name: KAFKA_BROKER_3
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker3
            - Name: POSTGRES_HOST
              Value:
                Fn::GetAtt: RDSCluster.Endpoint.Address
            - Name: POSTGRES_PORT
              Value: "5432"
            - Name: POSTGRES_DB
              Value:
                Ref: PostgresDbName
            - Name: POSTGRES_USER
              Value:
                Ref: PostgresDbUsername
            - Name: SENTRY_EMAIL_BACKEND
              Value:
                Ref: SentryEmailBackend
            - Name: SENTRY_EMAIL_USERNAME
              Value:
                Ref: SentryEmailUsername
            - Name: SENTRY_EMAIL_PORT
              Value:
                Ref: SentryEmailPort
            - Name: SENTRY_EMAIL_HOST
              Value:
                Ref: SentryEmailHost
            - Name: SENTRY_EMAIL_FROM
              Value:
                Ref: SentryEmailFrom
            - Name: SENTRY_EMAIL_USE_TLS
              Value:
                Ref: SentryEmailUseTls
            - Name: SENTRY_EMAIL_USE_SSL
              Value:
                Ref: SentryEmailUseSsl
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs

  ServiceSentryIngestTransactions:
    Type: AWS::ECS::Service
    Properties:
      PlatformVersion: '1.4.0'
      Cluster:
        Ref: ClusterWorkers
      TaskDefinition:
        Ref: TaskDefinitionSentryIngestTransactions
      DeploymentConfiguration:
        MinimumHealthyPercent: 100
        MaximumPercent: 200
      DesiredCount:
        Ref: MinCountSentryIngestTransactions
      PropagateTags: SERVICE
      NetworkConfiguration: 
        AwsvpcConfiguration:
          AssignPublicIp: DISABLED
          Subnets:
            - Ref: PrivateSubnet1
            - Ref: PrivateSubnet2
            - Ref: PrivateSubnet3
          SecurityGroups:
            - Ref: Ec2SecurityGroup
      EnableExecuteCommand: true

  AutoScalingTargetSentryIngestTransactions:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    Properties:
      MaxCapacity:
        Ref: MaxCountSentryIngestTransactions
      MinCapacity:
        Ref: MinCountSentryIngestTransactions
      ResourceId:
        Fn::Sub: service/${ClusterWorkers}/${ServiceSentryIngestTransactions.Name}
      RoleARN:
        Fn::GetAtt: ScalingRole.Arn
      ScalableDimension: ecs:service:DesiredCount
      ServiceNamespace: ecs

  CpuAutoScalingPolicySentryIngestTransactions:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-Cpu-SentryIngestTransactions
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: AutoScalingTargetSentryIngestTransactions
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue: 40
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: ECSServiceAverageCPUUtilization

  RamAutoScalingPolicySentryIngestTransactions:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-Ram-SentryIngestTransactions
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: AutoScalingTargetSentryIngestTransactions
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue: 40 
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: ECSServiceAverageMemoryUtilization

  TaskDefinitionSentryPostProcessForward:
    Type: AWS::ECS::TaskDefinition
    Properties:
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      Cpu: "512"
      Memory: 1GB
      ExecutionRoleArn:
        Fn::GetAtt: ExecutionRole.Arn
      TaskRoleArn:
        Fn::GetAtt: TaskRole.Arn
      Volumes:
        - Name: sentry-conf-vol
          Host: {}
      ContainerDefinitions:
        - Name: sentry-config
          Image:
            Ref: BashImage
          Essential: false
          Command:
            - -c
            - echo $SENTRY_CONFIG | base64 -d - | tee /config-sentry/config.yml
          Environment:
            - Name: SENTRY_CONFIG
              Value:
                Fn::Base64:
                  Fn::Sub: |
                    system.secret-key: "${SentrySystemSecretKey}"
                    system.url-prefix: "https://${SentryDnsRecord}"

                    slack.client-id: "${SentrySlackClientId}"
                    slack.client-secret: "${SentrySlackClientSecret}"
                    slack.legacy-app: False
                    slack.signing-secret: "${SentrySlackSigningSecret}"

                    filestore.backend: 's3'
                    filestore.options:
                      bucket_name: "${SentryBucket}"
                      default_acl: "private"
                      acl: "private"
          MountPoints:
            - ContainerPath: /config-sentry/
              SourceVolume: sentry-conf-vol
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs
        - Name: sentry-post-process-forward
          Image:
            Ref: SentryImage
          Essential: true
          DependsOn:
          - Condition: COMPLETE
            ContainerName: sentry-config
          MountPoints:
            - ContainerPath: /config-sentry/
              SourceVolume: sentry-conf-vol
          EntryPoint: ["/bin/bash"]
          Command:
            - "-c"
            - "cp /config-sentry/config.yml /etc/sentry/config.yml && sentry run post-process-forwarder --commit-batch-size 1"
          Secrets:
            - Name: POSTGRES_PASSWORD
              ValueFrom:
                Ref: SecretPostgresPassword
            - Name: SENTRY_EMAIL_PASSWORD
              ValueFrom:
                Ref: SecretSentryEmailPassword
          Environment:
            - Name: AWS_DEFAULT_REGION
              Value:
                Ref: AWS::Region
            - Name: C_FORCE_ROOT
              Value: "true"
            - Name: SNUBA
              Value: 
                Fn::Sub: http://${SnubaApiDnsRecord}
            - Name: REDIS_HOST
              Value:
                Fn::GetAtt: ElastiCacheReplicationGroup.PrimaryEndPoint.Address
            - Name: REDIS_PORT
              Value: "6379"
            - Name: CLICKHOUSE_HOST
              Value:
                Fn::GetAtt: ElbClickHouse.DNSName
            - Name: CLICKHOUSE_PORT
              Value: "9000"
            - Name: CLICKHOUSE_SINGLE_NODE
              Value: "true"
            - Name: KAFKA_BROKER_1
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker1
            - Name: KAFKA_BROKER_2
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker2
            - Name: KAFKA_BROKER_3
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker3
            - Name: POSTGRES_HOST
              Value:
                Fn::GetAtt: RDSCluster.Endpoint.Address
            - Name: POSTGRES_PORT
              Value: "5432"
            - Name: POSTGRES_DB
              Value:
                Ref: PostgresDbName
            - Name: POSTGRES_USER
              Value:
                Ref: PostgresDbUsername
            - Name: SENTRY_EMAIL_BACKEND
              Value:
                Ref: SentryEmailBackend
            - Name: SENTRY_EMAIL_USERNAME
              Value:
                Ref: SentryEmailUsername
            - Name: SENTRY_EMAIL_PORT
              Value:
                Ref: SentryEmailPort
            - Name: SENTRY_EMAIL_HOST
              Value:
                Ref: SentryEmailHost
            - Name: SENTRY_EMAIL_FROM
              Value:
                Ref: SentryEmailFrom
            - Name: SENTRY_EMAIL_USE_TLS
              Value:
                Ref: SentryEmailUseTls
            - Name: SENTRY_EMAIL_USE_SSL
              Value:
                Ref: SentryEmailUseSsl
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs

  ServiceSentryPostProcessForward:
    Type: AWS::ECS::Service
    Properties:
      PlatformVersion: '1.4.0'
      Cluster:
        Ref: ClusterWorkers
      TaskDefinition:
        Ref: TaskDefinitionSentryPostProcessForward
      DeploymentConfiguration:
        MinimumHealthyPercent: 100
        MaximumPercent: 200
      DesiredCount:
        Ref: MinCountSentryPostProcessForward
      PropagateTags: SERVICE
      NetworkConfiguration: 
        AwsvpcConfiguration:
          AssignPublicIp: DISABLED
          Subnets:
            - Ref: PrivateSubnet1
            - Ref: PrivateSubnet2
            - Ref: PrivateSubnet3
          SecurityGroups:
            - Ref: Ec2SecurityGroup
      EnableExecuteCommand: true

  AutoScalingTargetSentryPostProcessForward:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    Properties:
      MaxCapacity:
        Ref: MaxCountSentryIngestTransactions
      MinCapacity:
        Ref: MinCountSentryIngestTransactions
      ResourceId:
        Fn::Sub: service/${ClusterWorkers}/${ServiceSentryPostProcessForward.Name}
      RoleARN:
        Fn::GetAtt: ScalingRole.Arn
      ScalableDimension: ecs:service:DesiredCount
      ServiceNamespace: ecs

  CpuAutoScalingPolicySentryPostProcessForward:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-Cpu-SentryPostProcessForward
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: AutoScalingTargetSentryPostProcessForward
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue: 40
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: ECSServiceAverageCPUUtilization

  RamAutoScalingPolicySentryPostProcessForward:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-Ram-SentryPostProcessForward
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: AutoScalingTargetSentryPostProcessForward
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue: 40 
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: ECSServiceAverageMemoryUtilization            

  TaskDefinitionSnubaSessionsConsumer:
    Type: AWS::ECS::TaskDefinition
    Properties:
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      Cpu: "256"
      Memory: 0.5GB
      ExecutionRoleArn:
        Fn::GetAtt: ExecutionRole.Arn
      TaskRoleArn:
        Fn::GetAtt: TaskRole.Arn
      ContainerDefinitions:
        - Name: sentry-snuba-sessions-consumer
          Image:
            Ref: SnubaImage
          EntryPoint: ["snuba", "consumer", "--storage", "sessions_raw", "--auto-offset-reset=latest", "--max-batch-time-ms", "750"]
          Secrets:
            - Name: POSTGRES_PASSWORD
              ValueFrom:
                Ref: SecretPostgresPassword
            - Name: SENTRY_EMAIL_PASSWORD
              ValueFrom:
                Ref: SecretSentryEmailPassword
          Environment:
            - Name: AWS_DEFAULT_REGION
              Value:
                Ref: AWS::Region
            - Name: REDIS_HOST
              Value:
                Fn::GetAtt: ElastiCacheReplicationGroup.PrimaryEndPoint.Address
            - Name: REDIS_PORT
              Value: "6379"
            - Name: CLICKHOUSE_HOST
              Value:
                Fn::GetAtt: ElbClickHouse.DNSName
            - Name: CLICKHOUSE_PORT
              Value: "9000"
            - Name: CLICKHOUSE_HTTP_PORT
              Value: "8123"
            - Name: CLICKHOUSE_SINGLE_NODE
              Value: "true"
            - Name: CLICKHOUSE_DATABASE
              Value: "default"
            - Name: KAFKA_BROKER_1
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker1
            - Name: KAFKA_BROKER_2
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker2
            - Name: KAFKA_BROKER_3
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker3
            - Name: DEFAULT_BROKERS
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.BootstrapBrokerString
            - Name: POSTGRES_HOST
              Value:
                Fn::GetAtt: RDSCluster.Endpoint.Address
            - Name: POSTGRES_PORT
              Value: "5432"
            - Name: POSTGRES_DB
              Value:
                Ref: PostgresDbName
            - Name: POSTGRES_USER
              Value:
                Ref: PostgresDbUsername
            - Name: SENTRY_EMAIL_BACKEND
              Value:
                Ref: SentryEmailBackend
            - Name: SENTRY_EMAIL_USERNAME
              Value:
                Ref: SentryEmailUsername
            - Name: SENTRY_EMAIL_PORT
              Value:
                Ref: SentryEmailPort
            - Name: SENTRY_EMAIL_HOST
              Value:
                Ref: SentryEmailHost
            - Name: SENTRY_EMAIL_FROM
              Value:
                Ref: SentryEmailFrom
            - Name: SENTRY_EMAIL_USE_TLS
              Value:
                Ref: SentryEmailUseTls
            - Name: SENTRY_EMAIL_USE_SSL
              Value:
                Ref: SentryEmailUseSsl
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs

  ServiceSnubaSessionsConsumer:
    Type: AWS::ECS::Service
    Properties:
      PlatformVersion: '1.4.0'
      Cluster:
        Ref: ClusterWorkers
      TaskDefinition:
        Ref: TaskDefinitionSnubaSessionsConsumer
      DeploymentConfiguration:
        MinimumHealthyPercent: 100
        MaximumPercent: 200
      DesiredCount:
        Ref: MinCountSnubaSessionsConsumer
      PropagateTags: SERVICE
      NetworkConfiguration: 
        AwsvpcConfiguration:
          AssignPublicIp: DISABLED
          Subnets:
            - Ref: PrivateSubnet1
            - Ref: PrivateSubnet2
            - Ref: PrivateSubnet3
          SecurityGroups:
            - Ref: Ec2SecurityGroup
      EnableExecuteCommand: true

  AutoScalingTargetSnubaSessionsConsumer:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    Properties:
      MaxCapacity:
        Ref: MaxCountSnubaSessionsConsumer
      MinCapacity:
        Ref: MinCountSnubaSessionsConsumer
      ResourceId:
        Fn::Sub: service/${ClusterWorkers}/${ServiceSnubaSessionsConsumer.Name}
      RoleARN:
        Fn::GetAtt: ScalingRole.Arn
      ScalableDimension: ecs:service:DesiredCount
      ServiceNamespace: ecs

  CpuAutoScalingPolicySnubaSessionsConsumer:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-Cpu-SnubaSessionsConsumer
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: AutoScalingTargetSnubaSessionsConsumer
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue: 40
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: ECSServiceAverageCPUUtilization

  RamAutoScalingPolicySnubaSessionsConsumer:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-Ram-SnubaSessionsConsumer
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: AutoScalingTargetSnubaSessionsConsumer
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue: 40 
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: ECSServiceAverageMemoryUtilization

  TaskDefinitionSnubaOutcomesConsumer:
    Type: AWS::ECS::TaskDefinition
    Properties:
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      Cpu: "256"
      Memory: 0.5GB
      ExecutionRoleArn:
        Fn::GetAtt: ExecutionRole.Arn
      TaskRoleArn:
        Fn::GetAtt: TaskRole.Arn
      ContainerDefinitions:
        - Name: sentry-snuba-outcomes-consumer
          Image:
            Ref: SnubaImage
          EntryPoint: ["snuba", "consumer", "--storage", "outcomes_raw", "--auto-offset-reset=earliest", "--max-batch-time-ms", "750"]
          Secrets:
            - Name: POSTGRES_PASSWORD
              ValueFrom:
                Ref: SecretPostgresPassword
            - Name: SENTRY_EMAIL_PASSWORD
              ValueFrom:
                Ref: SecretSentryEmailPassword
          Environment:
            - Name: AWS_DEFAULT_REGION
              Value:
                Ref: AWS::Region
            - Name: REDIS_HOST
              Value:
                Fn::GetAtt: ElastiCacheReplicationGroup.PrimaryEndPoint.Address
            - Name: REDIS_PORT
              Value: "6379"
            - Name: CLICKHOUSE_HOST
              Value:
                Fn::GetAtt: ElbClickHouse.DNSName
            - Name: CLICKHOUSE_PORT
              Value: "9000"
            - Name: CLICKHOUSE_HTTP_PORT
              Value: "8123"
            - Name: CLICKHOUSE_SINGLE_NODE
              Value: "true"
            - Name: CLICKHOUSE_DATABASE
              Value: "default"
            - Name: KAFKA_BROKER_1
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker1
            - Name: KAFKA_BROKER_2
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker2
            - Name: KAFKA_BROKER_3
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker3
            - Name: DEFAULT_BROKERS
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.BootstrapBrokerString
            - Name: POSTGRES_HOST
              Value:
                Fn::GetAtt: RDSCluster.Endpoint.Address
            - Name: POSTGRES_PORT
              Value: "5432"
            - Name: POSTGRES_DB
              Value:
                Ref: PostgresDbName
            - Name: POSTGRES_USER
              Value:
                Ref: PostgresDbUsername
            - Name: SENTRY_EMAIL_BACKEND
              Value:
                Ref: SentryEmailBackend
            - Name: SENTRY_EMAIL_USERNAME
              Value:
                Ref: SentryEmailUsername
            - Name: SENTRY_EMAIL_PORT
              Value:
                Ref: SentryEmailPort
            - Name: SENTRY_EMAIL_HOST
              Value:
                Ref: SentryEmailHost
            - Name: SENTRY_EMAIL_FROM
              Value:
                Ref: SentryEmailFrom
            - Name: SENTRY_EMAIL_USE_TLS
              Value:
                Ref: SentryEmailUseTls
            - Name: SENTRY_EMAIL_USE_SSL
              Value:
                Ref: SentryEmailUseSsl
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs

  ServiceSnubaOutcomesConsumer:
    Type: AWS::ECS::Service
    Properties:
      PlatformVersion: '1.4.0'
      Cluster:
        Ref: ClusterWorkers
      TaskDefinition:
        Ref: TaskDefinitionSnubaOutcomesConsumer
      DeploymentConfiguration:
        MinimumHealthyPercent: 100
        MaximumPercent: 200
      DesiredCount:
        Ref: MinCountSnubaOutcomesConsumer
      PropagateTags: SERVICE
      NetworkConfiguration: 
        AwsvpcConfiguration:
          AssignPublicIp: DISABLED
          Subnets:
            - Ref: PrivateSubnet1
            - Ref: PrivateSubnet2
            - Ref: PrivateSubnet3
          SecurityGroups:
            - Ref: Ec2SecurityGroup
      EnableExecuteCommand: true

  AutoScalingTargetSnubaOutcomesConsumer:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    Properties:
      MaxCapacity:
        Ref: MaxCountSnubaOutcomesConsumer
      MinCapacity:
        Ref: MinCountSnubaOutcomesConsumer
      ResourceId:
        Fn::Sub: service/${ClusterWorkers}/${ServiceSnubaOutcomesConsumer.Name}
      RoleARN:
        Fn::GetAtt: ScalingRole.Arn
      ScalableDimension: ecs:service:DesiredCount
      ServiceNamespace: ecs

  CpuAutoScalingPolicySnubaOutcomesConsumer:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-Cpu-SnubaOutcomesConsumer
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: AutoScalingTargetSnubaOutcomesConsumer
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue: 40
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: ECSServiceAverageCPUUtilization

  RamAutoScalingPolicySnubaOutcomesConsumer:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-Ram-SnubaOutcomesConsumer
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: AutoScalingTargetSnubaOutcomesConsumer
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue: 40 
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: ECSServiceAverageMemoryUtilization

  TaskDefinitionSnubaSubscriptionConsumerTransactions:
    Type: AWS::ECS::TaskDefinition
    Properties:
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      Cpu: "256"
      Memory: 0.5GB
      ExecutionRoleArn:
        Fn::GetAtt: ExecutionRole.Arn
      TaskRoleArn:
        Fn::GetAtt: TaskRole.Arn
      ContainerDefinitions:
        - Name: sentry-snuba-subscription-consumer-transactions
          Image:
            Ref: SnubaImage
          EntryPoint: ["snuba", "subscriptions", "--auto-offset-reset=latest", "--consumer-group=snuba-transactions-subscriptions-consumers", "--topic=events", "--result-topic=transactionss-subscription-results", "--dataset=transactions", "--commit-log-topic=snuba-commit-log", "--commit-log-group=transactions_group", "--delay-seconds=60", "--schedule-ttl=60"]
          Secrets:
            - Name: POSTGRES_PASSWORD
              ValueFrom:
                Ref: SecretPostgresPassword
            - Name: SENTRY_EMAIL_PASSWORD
              ValueFrom:
                Ref: SecretSentryEmailPassword
          Environment:
            - Name: AWS_DEFAULT_REGION
              Value:
                Ref: AWS::Region
            - Name: REDIS_HOST
              Value:
                Fn::GetAtt: ElastiCacheReplicationGroup.PrimaryEndPoint.Address
            - Name: REDIS_PORT
              Value: "6379"
            - Name: CLICKHOUSE_HOST
              Value:
                Fn::GetAtt: ElbClickHouse.DNSName
            - Name: CLICKHOUSE_PORT
              Value: "9000"
            - Name: CLICKHOUSE_HTTP_PORT
              Value: "8123"
            - Name: CLICKHOUSE_SINGLE_NODE
              Value: "true"
            - Name: CLICKHOUSE_DATABASE
              Value: "default"
            - Name: KAFKA_BROKER_1
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker1
            - Name: KAFKA_BROKER_2
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker2
            - Name: KAFKA_BROKER_3
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker3
            - Name: DEFAULT_BROKERS
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.BootstrapBrokerString
            - Name: POSTGRES_HOST
              Value:
                Fn::GetAtt: RDSCluster.Endpoint.Address
            - Name: POSTGRES_PORT
              Value: "5432"
            - Name: POSTGRES_DB
              Value:
                Ref: PostgresDbName
            - Name: POSTGRES_USER
              Value:
                Ref: PostgresDbUsername
            - Name: SENTRY_EMAIL_BACKEND
              Value:
                Ref: SentryEmailBackend
            - Name: SENTRY_EMAIL_USERNAME
              Value:
                Ref: SentryEmailUsername
            - Name: SENTRY_EMAIL_PORT
              Value:
                Ref: SentryEmailPort
            - Name: SENTRY_EMAIL_HOST
              Value:
                Ref: SentryEmailHost
            - Name: SENTRY_EMAIL_FROM
              Value:
                Ref: SentryEmailFrom
            - Name: SENTRY_EMAIL_USE_TLS
              Value:
                Ref: SentryEmailUseTls
            - Name: SENTRY_EMAIL_USE_SSL
              Value:
                Ref: SentryEmailUseSsl
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs

  ServiceSnubaSubscriptionConsumerTransactions:
    Type: AWS::ECS::Service
    Properties:
      PlatformVersion: '1.4.0'
      Cluster:
        Ref: ClusterWorkers
      TaskDefinition:
        Ref: TaskDefinitionSnubaSubscriptionConsumerTransactions
      DeploymentConfiguration:
        MinimumHealthyPercent: 100
        MaximumPercent: 200
      DesiredCount:
        Ref: MinCountSnubaSubscriptionConsumerTransactions
      PropagateTags: SERVICE
      NetworkConfiguration: 
        AwsvpcConfiguration:
          AssignPublicIp: DISABLED
          Subnets:
            - Ref: PrivateSubnet1
            - Ref: PrivateSubnet2
            - Ref: PrivateSubnet3
          SecurityGroups:
            - Ref: Ec2SecurityGroup
      EnableExecuteCommand: true

  AutoScalingTargetSnubaSubscriptionConsumerTransactions:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    Properties:
      MaxCapacity:
        Ref: MaxCountSnubaSubscriptionConsumerTransactions
      MinCapacity:
        Ref: MinCountSnubaSubscriptionConsumerTransactions
      ResourceId:
        Fn::Sub: service/${ClusterWorkers}/${ServiceSnubaSubscriptionConsumerTransactions.Name}
      RoleARN:
        Fn::GetAtt: ScalingRole.Arn
      ScalableDimension: ecs:service:DesiredCount
      ServiceNamespace: ecs

  CpuAutoScalingPolicySnubaSubscriptionConsumerTransactions:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-Cpu-SnubaSubscriptionConsumerTransactions
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: AutoScalingTargetSnubaSubscriptionConsumerTransactions
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue: 40
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: ECSServiceAverageCPUUtilization

  RamAutoScalingPolicySnubaSubscriptionConsumerTransactions:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-Ram-SnubaSubscriptionConsumerTransactions
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: AutoScalingTargetSnubaSubscriptionConsumerTransactions
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue: 40 
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: ECSServiceAverageMemoryUtilization

  TaskDefinitionSnubaTransactionsConsumer:
    Type: AWS::ECS::TaskDefinition
    Properties:
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      Cpu: "256"
      Memory: 0.5GB
      ExecutionRoleArn:
        Fn::GetAtt: ExecutionRole.Arn
      TaskRoleArn:
        Fn::GetAtt: TaskRole.Arn
      ContainerDefinitions:
        - Name: sentry-snuba-transactions-consumer
          Image:
            Ref: SnubaImage
          EntryPoint: ["snuba", "consumer", "--storage", "transactions", "--consumer-group", "transactions_group", "--auto-offset-reset=latest", "--max-batch-time-ms", "750", "--commit-log-topic=snuba-commit-log"]
          Secrets:
            - Name: POSTGRES_PASSWORD
              ValueFrom:
                Ref: SecretPostgresPassword
            - Name: SENTRY_EMAIL_PASSWORD
              ValueFrom:
                Ref: SecretSentryEmailPassword
          Environment:
            - Name: AWS_DEFAULT_REGION
              Value:
                Ref: AWS::Region
            - Name: REDIS_HOST
              Value:
                Fn::GetAtt: ElastiCacheReplicationGroup.PrimaryEndPoint.Address
            - Name: REDIS_PORT
              Value: "6379"
            - Name: CLICKHOUSE_HOST
              Value:
                Fn::GetAtt: ElbClickHouse.DNSName
            - Name: CLICKHOUSE_PORT
              Value: "9000"
            - Name: CLICKHOUSE_HTTP_PORT
              Value: "8123"
            - Name: CLICKHOUSE_SINGLE_NODE
              Value: "true"
            - Name: CLICKHOUSE_DATABASE
              Value: "default"
            - Name: KAFKA_BROKER_1
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker1
            - Name: KAFKA_BROKER_2
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker2
            - Name: KAFKA_BROKER_3
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker3
            - Name: DEFAULT_BROKERS
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.BootstrapBrokerString
            - Name: POSTGRES_HOST
              Value:
                Fn::GetAtt: RDSCluster.Endpoint.Address
            - Name: POSTGRES_PORT
              Value: "5432"
            - Name: POSTGRES_DB
              Value:
                Ref: PostgresDbName
            - Name: POSTGRES_USER
              Value:
                Ref: PostgresDbUsername
            - Name: SENTRY_EMAIL_BACKEND
              Value:
                Ref: SentryEmailBackend
            - Name: SENTRY_EMAIL_USERNAME
              Value:
                Ref: SentryEmailUsername
            - Name: SENTRY_EMAIL_PORT
              Value:
                Ref: SentryEmailPort
            - Name: SENTRY_EMAIL_HOST
              Value:
                Ref: SentryEmailHost
            - Name: SENTRY_EMAIL_FROM
              Value:
                Ref: SentryEmailFrom
            - Name: SENTRY_EMAIL_USE_TLS
              Value:
                Ref: SentryEmailUseTls
            - Name: SENTRY_EMAIL_USE_SSL
              Value:
                Ref: SentryEmailUseSsl
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs

  ServiceSnubaTransactionsConsumer:
    Type: AWS::ECS::Service
    Properties:
      PlatformVersion: '1.4.0'
      Cluster:
        Ref: ClusterWorkers
      TaskDefinition:
        Ref: TaskDefinitionSnubaTransactionsConsumer
      DeploymentConfiguration:
        MinimumHealthyPercent: 100
        MaximumPercent: 200
      DesiredCount:
        Ref: MinCountSnubaTransactionsConsumer
      PropagateTags: SERVICE
      NetworkConfiguration: 
        AwsvpcConfiguration:
          AssignPublicIp: DISABLED
          Subnets:
            - Ref: PrivateSubnet1
            - Ref: PrivateSubnet2
            - Ref: PrivateSubnet3
          SecurityGroups:
            - Ref: Ec2SecurityGroup
      EnableExecuteCommand: true

  AutoScalingTargetSnubaTransactionsConsumer:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    Properties:
      MaxCapacity:
        Ref: MaxCountSnubaTransactionsConsumer
      MinCapacity:
        Ref: MinCountSnubaTransactionsConsumer
      ResourceId:
        Fn::Sub: service/${ClusterWorkers}/${ServiceSnubaTransactionsConsumer.Name}
      RoleARN:
        Fn::GetAtt: ScalingRole.Arn
      ScalableDimension: ecs:service:DesiredCount
      ServiceNamespace: ecs

  CpuAutoScalingPolicySnubaTransactionsConsumer:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-Cpu-SnubaTransactionsConsumer
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: AutoScalingTargetSnubaTransactionsConsumer
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue: 40
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: ECSServiceAverageCPUUtilization

  RamAutoScalingPolicySnubaTransactionsConsumer:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-Ram-SnubaTransactionsConsumer
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: AutoScalingTargetSnubaTransactionsConsumer
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue: 40 
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: ECSServiceAverageMemoryUtilization      


  TaskDefinitionSnubaReplacer:
    Type: AWS::ECS::TaskDefinition
    Properties:
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      Cpu: "256"
      Memory: 0.5GB
      ExecutionRoleArn:
        Fn::GetAtt: ExecutionRole.Arn
      TaskRoleArn:
        Fn::GetAtt: TaskRole.Arn
      ContainerDefinitions:
        - Name: sentry-snuba-replacer
          Image:
            Ref: SnubaImage
          EntryPoint: ["snuba", "replacer", "--storage", "errors", "--auto-offset-reset=latest", "--max-batch-size", "3"]
          Secrets:
            - Name: POSTGRES_PASSWORD
              ValueFrom:
                Ref: SecretPostgresPassword
            - Name: SENTRY_EMAIL_PASSWORD
              ValueFrom:
                Ref: SecretSentryEmailPassword
          Environment:
            - Name: AWS_DEFAULT_REGION
              Value:
                Ref: AWS::Region
            - Name: REDIS_HOST
              Value:
                Fn::GetAtt: ElastiCacheReplicationGroup.PrimaryEndPoint.Address
            - Name: REDIS_PORT
              Value: "6379"
            - Name: CLICKHOUSE_HOST
              Value:
                Fn::GetAtt: ElbClickHouse.DNSName
            - Name: CLICKHOUSE_PORT
              Value: "9000"
            - Name: CLICKHOUSE_HTTP_PORT
              Value: "8123"
            - Name: CLICKHOUSE_SINGLE_NODE
              Value: "true"
            - Name: CLICKHOUSE_DATABASE
              Value: "default"
            - Name: KAFKA_BROKER_1
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker1
            - Name: KAFKA_BROKER_2
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker2
            - Name: KAFKA_BROKER_3
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker3
            - Name: DEFAULT_BROKERS
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.BootstrapBrokerString
            - Name: POSTGRES_HOST
              Value:
                Fn::GetAtt: RDSCluster.Endpoint.Address
            - Name: POSTGRES_PORT
              Value: "5432"
            - Name: POSTGRES_DB
              Value:
                Ref: PostgresDbName
            - Name: POSTGRES_USER
              Value:
                Ref: PostgresDbUsername
            - Name: SENTRY_EMAIL_BACKEND
              Value:
                Ref: SentryEmailBackend
            - Name: SENTRY_EMAIL_USERNAME
              Value:
                Ref: SentryEmailUsername
            - Name: SENTRY_EMAIL_PORT
              Value:
                Ref: SentryEmailPort
            - Name: SENTRY_EMAIL_HOST
              Value:
                Ref: SentryEmailHost
            - Name: SENTRY_EMAIL_FROM
              Value:
                Ref: SentryEmailFrom
            - Name: SENTRY_EMAIL_USE_TLS
              Value:
                Ref: SentryEmailUseTls
            - Name: SENTRY_EMAIL_USE_SSL
              Value:
                Ref: SentryEmailUseSsl
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs

  ServiceSnubaReplacer:
    Type: AWS::ECS::Service
    Properties:
      PlatformVersion: '1.4.0'
      Cluster:
        Ref: ClusterWorkers
      TaskDefinition:
        Ref: TaskDefinitionSnubaReplacer
      DeploymentConfiguration:
        MinimumHealthyPercent: 100
        MaximumPercent: 200
      DesiredCount:
        Ref: MinCountSnubaReplacer
      PropagateTags: SERVICE
      NetworkConfiguration: 
        AwsvpcConfiguration:
          AssignPublicIp: DISABLED
          Subnets:
            - Ref: PrivateSubnet1
            - Ref: PrivateSubnet2
            - Ref: PrivateSubnet3
          SecurityGroups:
            - Ref: Ec2SecurityGroup
      EnableExecuteCommand: true

  AutoScalingTargetSnubaReplacer:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    Properties:
      MaxCapacity:
        Ref: MaxCountSnubaReplacer
      MinCapacity:
        Ref: MinCountSnubaReplacer
      ResourceId:
        Fn::Sub: service/${ClusterWorkers}/${ServiceSnubaReplacer.Name}
      RoleARN:
        Fn::GetAtt: ScalingRole.Arn
      ScalableDimension: ecs:service:DesiredCount
      ServiceNamespace: ecs

  CpuAutoScalingPolicySnubaReplacer:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-Cpu-SnubaReplacer
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: AutoScalingTargetSnubaReplacer
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue: 40
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: ECSServiceAverageCPUUtilization

  RamAutoScalingPolicySnubaReplacer:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-Ram-SnubaReplacer
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: AutoScalingTargetSnubaReplacer
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue: 40 
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: ECSServiceAverageMemoryUtilization

  TaskDefinitionSnubaSubscriptionConsumerEvents:
    Type: AWS::ECS::TaskDefinition
    Properties:
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      Cpu: "256"
      Memory: 0.5GB
      ExecutionRoleArn:
        Fn::GetAtt: ExecutionRole.Arn
      TaskRoleArn:
        Fn::GetAtt: TaskRole.Arn
      ContainerDefinitions:
        - Name: sentry-snuba-subscription-consumer-events
          Image:
            Ref: SnubaImage
          EntryPoint: ["snuba", "subscriptions", "--auto-offset-reset=latest", "--consumer-group=snuba-events-subscriptions-consumers", "--topic=events", "--result-topic=events-subscription-results", "--dataset=events", "--commit-log-topic=snuba-commit-log", "--commit-log-group=snuba-consumers", "--delay-seconds=60", "--schedule-ttl=60"]
          Secrets:
            - Name: POSTGRES_PASSWORD
              ValueFrom:
                Ref: SecretPostgresPassword
            - Name: SENTRY_EMAIL_PASSWORD
              ValueFrom:
                Ref: SecretSentryEmailPassword
          Environment:
            - Name: AWS_DEFAULT_REGION
              Value:
                Ref: AWS::Region
            - Name: REDIS_HOST
              Value:
                Fn::GetAtt: ElastiCacheReplicationGroup.PrimaryEndPoint.Address
            - Name: REDIS_PORT
              Value: "6379"
            - Name: CLICKHOUSE_HOST
              Value:
                Fn::GetAtt: ElbClickHouse.DNSName
            - Name: CLICKHOUSE_PORT
              Value: "9000"
            - Name: CLICKHOUSE_HTTP_PORT
              Value: "8123"
            - Name: CLICKHOUSE_SINGLE_NODE
              Value: "true"
            - Name: CLICKHOUSE_DATABASE
              Value: "default"
            - Name: KAFKA_BROKER_1
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker1
            - Name: KAFKA_BROKER_2
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker2
            - Name: KAFKA_BROKER_3
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker3
            - Name: DEFAULT_BROKERS
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.BootstrapBrokerString
            - Name: POSTGRES_HOST
              Value:
                Fn::GetAtt: RDSCluster.Endpoint.Address
            - Name: POSTGRES_PORT
              Value: "5432"
            - Name: POSTGRES_DB
              Value:
                Ref: PostgresDbName
            - Name: POSTGRES_USER
              Value:
                Ref: PostgresDbUsername
            - Name: SENTRY_EMAIL_BACKEND
              Value:
                Ref: SentryEmailBackend
            - Name: SENTRY_EMAIL_USERNAME
              Value:
                Ref: SentryEmailUsername
            - Name: SENTRY_EMAIL_PORT
              Value:
                Ref: SentryEmailPort
            - Name: SENTRY_EMAIL_HOST
              Value:
                Ref: SentryEmailHost
            - Name: SENTRY_EMAIL_FROM
              Value:
                Ref: SentryEmailFrom
            - Name: SENTRY_EMAIL_USE_TLS
              Value:
                Ref: SentryEmailUseTls
            - Name: SENTRY_EMAIL_USE_SSL
              Value:
                Ref: SentryEmailUseSsl
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs

  ServiceSnubaSubscriptionConsumerEvents:
    Type: AWS::ECS::Service
    Properties:
      PlatformVersion: '1.4.0'
      Cluster:
        Ref: ClusterWorkers
      TaskDefinition:
        Ref: TaskDefinitionSnubaSubscriptionConsumerEvents
      DeploymentConfiguration:
        MinimumHealthyPercent: 100
        MaximumPercent: 200
      DesiredCount:
        Ref: MinCountSnubaSubscriptionConsumerEvents
      PropagateTags: SERVICE
      NetworkConfiguration: 
        AwsvpcConfiguration:
          AssignPublicIp: DISABLED
          Subnets:
            - Ref: PrivateSubnet1
            - Ref: PrivateSubnet2
            - Ref: PrivateSubnet3
          SecurityGroups:
            - Ref: Ec2SecurityGroup
      EnableExecuteCommand: true

  AutoScalingTargetSnubaSubscriptionConsumerEvents:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    Properties:
      MaxCapacity:
        Ref: MaxCountSnubaSubscriptionConsumerEvents
      MinCapacity:
        Ref: MinCountSnubaSubscriptionConsumerEvents
      ResourceId:
        Fn::Sub: service/${ClusterWorkers}/${ServiceSnubaSubscriptionConsumerEvents.Name}
      RoleARN:
        Fn::GetAtt: ScalingRole.Arn
      ScalableDimension: ecs:service:DesiredCount
      ServiceNamespace: ecs

  CpuAutoScalingPolicySnubaSubscriptionConsumerEvents:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-Cpu-SnubaSubscriptionConsumerEvents
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: AutoScalingTargetSnubaSubscriptionConsumerEvents
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue: 40
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: ECSServiceAverageCPUUtilization

  RamAutoScalingPolicySnubaSubscriptionConsumerEvents:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-Ram-SnubaSubscriptionConsumerEvents
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: AutoScalingTargetSnubaSubscriptionConsumerEvents
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue: 40 
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: ECSServiceAverageMemoryUtilization

  TaskDefinitionSnubaConsumer:
    Type: AWS::ECS::TaskDefinition
    Properties:
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      Cpu: "256"
      Memory: 0.5GB
      ExecutionRoleArn:
        Fn::GetAtt: ExecutionRole.Arn
      TaskRoleArn:
        Fn::GetAtt: TaskRole.Arn
      ContainerDefinitions:
        - Name: sentry-snuba-consumer
          Image:
            Ref: SnubaImage
          EntryPoint: ["snuba", "consumer", "--storage", "errors", "--auto-offset-reset=latest", "--max-batch-time-ms", "750"]
          Secrets:
            - Name: POSTGRES_PASSWORD
              ValueFrom:
                Ref: SecretPostgresPassword
            - Name: SENTRY_EMAIL_PASSWORD
              ValueFrom:
                Ref: SecretSentryEmailPassword
          Environment:
            - Name: AWS_DEFAULT_REGION
              Value:
                Ref: AWS::Region
            - Name: REDIS_HOST
              Value:
                Fn::GetAtt: ElastiCacheReplicationGroup.PrimaryEndPoint.Address
            - Name: REDIS_PORT
              Value: "6379"
            - Name: CLICKHOUSE_HOST
              Value:
                Fn::GetAtt: ElbClickHouse.DNSName
            - Name: CLICKHOUSE_PORT
              Value: "9000"
            - Name: CLICKHOUSE_HTTP_PORT
              Value: "8123"
            - Name: CLICKHOUSE_SINGLE_NODE
              Value: "true"
            - Name: CLICKHOUSE_DATABASE
              Value: "default"
            - Name: KAFKA_BROKER_1
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker1
            - Name: KAFKA_BROKER_2
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker2
            - Name: KAFKA_BROKER_3
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker3
            - Name: DEFAULT_BROKERS
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.BootstrapBrokerString
            - Name: POSTGRES_HOST
              Value:
                Fn::GetAtt: RDSCluster.Endpoint.Address
            - Name: POSTGRES_PORT
              Value: "5432"
            - Name: POSTGRES_DB
              Value:
                Ref: PostgresDbName
            - Name: POSTGRES_USER
              Value:
                Ref: PostgresDbUsername
            - Name: SENTRY_EMAIL_BACKEND
              Value:
                Ref: SentryEmailBackend
            - Name: SENTRY_EMAIL_USERNAME
              Value:
                Ref: SentryEmailUsername
            - Name: SENTRY_EMAIL_PORT
              Value:
                Ref: SentryEmailPort
            - Name: SENTRY_EMAIL_HOST
              Value:
                Ref: SentryEmailHost
            - Name: SENTRY_EMAIL_FROM
              Value:
                Ref: SentryEmailFrom
            - Name: SENTRY_EMAIL_USE_TLS
              Value:
                Ref: SentryEmailUseTls
            - Name: SENTRY_EMAIL_USE_SSL
              Value:
                Ref: SentryEmailUseSsl
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs

  ServiceSnubaConsumer:
    Type: AWS::ECS::Service
    Properties:
      PlatformVersion: '1.4.0'
      Cluster:
        Ref: ClusterWorkers
      TaskDefinition:
        Ref: TaskDefinitionSnubaConsumer
      DeploymentConfiguration:
        MinimumHealthyPercent: 100
        MaximumPercent: 200
      DesiredCount:
        Ref: MinCountSnubaConsumer
      PropagateTags: SERVICE
      NetworkConfiguration: 
        AwsvpcConfiguration:
          AssignPublicIp: DISABLED
          Subnets:
            - Ref: PrivateSubnet1
            - Ref: PrivateSubnet2
            - Ref: PrivateSubnet3
          SecurityGroups:
            - Ref: Ec2SecurityGroup
      EnableExecuteCommand: true

  AutoScalingTargetSnubaConsumer:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    Properties:
      MaxCapacity:
        Ref: MaxCountSnubaConsumer
      MinCapacity:
        Ref: MinCountSnubaConsumer
      ResourceId:
        Fn::Sub: service/${ClusterWorkers}/${ServiceSnubaConsumer.Name}
      RoleARN:
        Fn::GetAtt: ScalingRole.Arn
      ScalableDimension: ecs:service:DesiredCount
      ServiceNamespace: ecs

  CpuAutoScalingPolicySnubaConsumer:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-Cpu-SnubaConsumer
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: AutoScalingTargetSnubaConsumer
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue: 40
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: ECSServiceAverageCPUUtilization

  RamAutoScalingPolicySnubaConsumer:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-Ram-SnubaConsumer
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: AutoScalingTargetSnubaConsumer
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue: 40 
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: ECSServiceAverageMemoryUtilization

  TaskDefinitionSentryWorkers:
    Type: AWS::ECS::TaskDefinition
    Properties:
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      Cpu: "1024"
      Memory: 2GB
      ExecutionRoleArn:
        Fn::GetAtt: ExecutionRole.Arn
      TaskRoleArn:
        Fn::GetAtt: TaskRole.Arn
      Volumes:
        - Name: sentry-conf-vol
          Host: {}
      ContainerDefinitions:
        - Name: sentry-config
          Image:
            Ref: BashImage
          Essential: false
          Command:
            - -c
            - echo $SENTRY_CONFIG | base64 -d - | tee /config-sentry/config.yml
          Environment:
            - Name: SENTRY_CONFIG
              Value:
                Fn::Base64:
                  Fn::Sub: |
                    system.secret-key: "${SentrySystemSecretKey}"
                    system.url-prefix: "https://${SentryDnsRecord}"

                    slack.client-id: "${SentrySlackClientId}"
                    slack.client-secret: "${SentrySlackClientSecret}"
                    slack.legacy-app: False
                    slack.signing-secret: "${SentrySlackSigningSecret}"

                    filestore.backend: 's3'
                    filestore.options:
                      bucket_name: "${SentryBucket}"
                      default_acl: "private"
                      acl: "private"
          MountPoints:
            - ContainerPath: /config-sentry/
              SourceVolume: sentry-conf-vol
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs
        - Name: sentry-worker
          Image:
            Ref: SentryImage
          Essential: true
          DependsOn:
          - Condition: COMPLETE
            ContainerName: sentry-config
          MountPoints:
            - ContainerPath: /config-sentry/
              SourceVolume: sentry-conf-vol
          EntryPoint: ["/bin/bash"]
          Command:
            - "-c"
            - "cp /config-sentry/config.yml /etc/sentry/config.yml && sentry run worker -c 4"
          Secrets:
            - Name: POSTGRES_PASSWORD
              ValueFrom:
                Ref: SecretPostgresPassword
            - Name: SENTRY_EMAIL_PASSWORD
              ValueFrom:
                Ref: SecretSentryEmailPassword
          Environment:
            - Name: AWS_DEFAULT_REGION
              Value:
                Ref: AWS::Region
            - Name: C_FORCE_ROOT
              Value: "true"
            - Name: SNUBA
              Value: 
                Fn::Sub: http://${SnubaApiDnsRecord}
            - Name: REDIS_HOST
              Value:
                Fn::GetAtt: ElastiCacheReplicationGroup.PrimaryEndPoint.Address
            - Name: REDIS_PORT
              Value: "6379"
            - Name: CLICKHOUSE_HOST
              Value:
                Fn::GetAtt: ElbClickHouse.DNSName 
            - Name: KAFKA_BROKER_1
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker1
            - Name: KAFKA_BROKER_2
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker2
            - Name: KAFKA_BROKER_3
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker3
            - Name: POSTGRES_HOST
              Value:
                Fn::GetAtt: RDSCluster.Endpoint.Address
            - Name: POSTGRES_PORT
              Value: "5432"
            - Name: POSTGRES_DB
              Value:
                Ref: PostgresDbName
            - Name: POSTGRES_USER
              Value:
                Ref: PostgresDbUsername
            - Name: SENTRY_EMAIL_BACKEND
              Value:
                Ref: SentryEmailBackend
            - Name: SENTRY_EMAIL_USERNAME
              Value:
                Ref: SentryEmailUsername
            - Name: SENTRY_EMAIL_PORT
              Value:
                Ref: SentryEmailPort
            - Name: SENTRY_EMAIL_HOST
              Value:
                Ref: SentryEmailHost
            - Name: SENTRY_EMAIL_FROM
              Value:
                Ref: SentryEmailFrom
            - Name: SENTRY_EMAIL_USE_TLS
              Value:
                Ref: SentryEmailUseTls
            - Name: SENTRY_EMAIL_USE_SSL
              Value:
                Ref: SentryEmailUseSsl
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs

  ServiceSentryWorkers:
    Type: AWS::ECS::Service
    Properties:
      PlatformVersion: '1.4.0'
      Cluster:
        Ref: ClusterWorkers
      TaskDefinition:
        Ref: TaskDefinitionSentryWorkers
      DeploymentConfiguration:
        MinimumHealthyPercent: 100
        MaximumPercent: 200
      DesiredCount:
        Ref: MinCountSentryWorkers
      PropagateTags: SERVICE
      NetworkConfiguration: 
        AwsvpcConfiguration:
          AssignPublicIp: DISABLED
          Subnets:
            - Ref: PrivateSubnet1
            - Ref: PrivateSubnet2
            - Ref: PrivateSubnet3
          SecurityGroups:
            - Ref: Ec2SecurityGroup
      EnableExecuteCommand: true

  AutoScalingTargetSentryWorkers:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    Properties:
      MaxCapacity:
        Ref: MaxCountSentryWorkers
      MinCapacity:
        Ref: MinCountSentryWorkers
      ResourceId:
        Fn::Sub: service/${ClusterWorkers}/${ServiceSentryWorkers.Name}
      RoleARN:
        Fn::GetAtt: ScalingRole.Arn
      ScalableDimension: ecs:service:DesiredCount
      ServiceNamespace: ecs

  CpuAutoScalingPolicySentryWorkers:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-Cpu-SentryWorkers
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: AutoScalingTargetSentryWorkers
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue: 40
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: ECSServiceAverageCPUUtilization

  RamAutoScalingPolicySentryWorkers:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-Ram-SentryWorkers
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: AutoScalingTargetSentryWorkers
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue: 40 
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: ECSServiceAverageMemoryUtilization

  TaskDefinitionSentrySubscriptionConsumerEvents:
    Type: AWS::ECS::TaskDefinition
    Properties:
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      Cpu: "1024"
      Memory: 2GB
      ExecutionRoleArn:
        Fn::GetAtt: ExecutionRole.Arn
      TaskRoleArn:
        Fn::GetAtt: TaskRole.Arn
      Volumes:
        - Name: sentry-conf-vol
          Host: {}
      ContainerDefinitions:
        - Name: sentry-config
          Image:
            Ref: BashImage
          Essential: false
          Command:
            - -c
            - echo $SENTRY_CONFIG | base64 -d - | tee /config-sentry/config.yml
          Environment:
            - Name: SENTRY_CONFIG
              Value:
                Fn::Base64:
                  Fn::Sub: |
                    system.secret-key: "${SentrySystemSecretKey}"
                    system.url-prefix: "https://${SentryDnsRecord}"

                    slack.client-id: "${SentrySlackClientId}"
                    slack.client-secret: "${SentrySlackClientSecret}"
                    slack.legacy-app: False
                    slack.signing-secret: "${SentrySlackSigningSecret}"

                    filestore.backend: 's3'
                    filestore.options:
                      bucket_name: "${SentryBucket}"
                      default_acl: "private"
                      acl: "private"
          MountPoints:
            - ContainerPath: /config-sentry/
              SourceVolume: sentry-conf-vol
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs
        - Name: subscription-consumer-events
          Image:
            Ref: SentryImage
          Essential: true
          DependsOn:
          - Condition: COMPLETE
            ContainerName: sentry-config
          MountPoints:
            - ContainerPath: /config-sentry/
              SourceVolume: sentry-conf-vol
          EntryPoint: ["/bin/bash"]
          Command:
            - "-c"
            - "cp /config-sentry/config.yml /etc/sentry/config.yml && sentry run query-subscription-consumer --commit-batch-size 1 --topic events-subscription-results"
          Secrets:
            - Name: POSTGRES_PASSWORD
              ValueFrom:
                Ref: SecretPostgresPassword
            - Name: SENTRY_EMAIL_PASSWORD
              ValueFrom:
                Ref: SecretSentryEmailPassword
          Environment:
            - Name: AWS_DEFAULT_REGION
              Value:
                Ref: AWS::Region
            - Name: C_FORCE_ROOT
              Value: "true"
            - Name: SNUBA
              Value: 
                Fn::Sub: http://${SnubaApiDnsRecord}
            - Name: REDIS_HOST
              Value:
                Fn::GetAtt: ElastiCacheReplicationGroup.PrimaryEndPoint.Address
            - Name: REDIS_PORT
              Value: "6379"
            - Name: CLICKHOUSE_HOST
              Value:
                Fn::GetAtt: ElbClickHouse.DNSName 
            - Name: KAFKA_BROKER_1
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker1
            - Name: KAFKA_BROKER_2
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker2
            - Name: KAFKA_BROKER_3
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker3
            - Name: POSTGRES_HOST
              Value:
                Fn::GetAtt: RDSCluster.Endpoint.Address
            - Name: POSTGRES_PORT
              Value: "5432"
            - Name: POSTGRES_DB
              Value:
                Ref: PostgresDbName
            - Name: POSTGRES_USER
              Value:
                Ref: PostgresDbUsername
            - Name: SENTRY_EMAIL_BACKEND
              Value:
                Ref: SentryEmailBackend
            - Name: SENTRY_EMAIL_USERNAME
              Value:
                Ref: SentryEmailUsername
            - Name: SENTRY_EMAIL_PORT
              Value:
                Ref: SentryEmailPort
            - Name: SENTRY_EMAIL_HOST
              Value:
                Ref: SentryEmailHost
            - Name: SENTRY_EMAIL_FROM
              Value:
                Ref: SentryEmailFrom
            - Name: SENTRY_EMAIL_USE_TLS
              Value:
                Ref: SentryEmailUseTls
            - Name: SENTRY_EMAIL_USE_SSL
              Value:
                Ref: SentryEmailUseSsl
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs

  ServiceSentrySubscriptionConsumerEvents:
    Type: AWS::ECS::Service
    Properties:
      PlatformVersion: '1.4.0'
      Cluster:
        Ref: ClusterWorkers
      TaskDefinition:
        Ref: TaskDefinitionSentrySubscriptionConsumerEvents
      DeploymentConfiguration:
        MinimumHealthyPercent: 100
        MaximumPercent: 200
      DesiredCount:
        Ref: MinCountSentrySubscriptionConsumerEvents
      PropagateTags: SERVICE
      NetworkConfiguration: 
        AwsvpcConfiguration:
          AssignPublicIp: DISABLED
          Subnets:
            - Ref: PrivateSubnet1
            - Ref: PrivateSubnet2
            - Ref: PrivateSubnet3
          SecurityGroups:
            - Ref: Ec2SecurityGroup
      EnableExecuteCommand: true

  AutoScalingTargetSentrySubscriptionConsumerEvents:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    Properties:
      MaxCapacity:
        Ref: MaxCountSentrySubscriptionConsumerEvents
      MinCapacity:
        Ref: MinCountSentrySubscriptionConsumerEvents
      ResourceId:
        Fn::Sub: service/${ClusterWorkers}/${ServiceSentrySubscriptionConsumerEvents.Name}
      RoleARN:
        Fn::GetAtt: ScalingRole.Arn
      ScalableDimension: ecs:service:DesiredCount
      ServiceNamespace: ecs

  CpuAutoScalingPolicySentrySubscriptionConsumerEvents:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-Cpu-SentrySubscriptionConsumerEvents
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: AutoScalingTargetSentrySubscriptionConsumerEvents
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue: 40
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: ECSServiceAverageCPUUtilization

  RamAutoScalingPolicySentrySubscriptionConsumerEvents:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-Ram-SentrySubscriptionConsumerEvents
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: AutoScalingTargetSentrySubscriptionConsumerEvents
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue: 40 
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: ECSServiceAverageMemoryUtilization

  TaskDefinitionSentrySubscriptionConsumerTransactions:
    Type: AWS::ECS::TaskDefinition
    Properties:
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      Cpu: "1024"
      Memory: 2GB
      ExecutionRoleArn:
        Fn::GetAtt: ExecutionRole.Arn
      TaskRoleArn:
        Fn::GetAtt: TaskRole.Arn
      Volumes:
        - Name: sentry-conf-vol
          Host: {}
      ContainerDefinitions:
        - Name: sentry-config
          Image:
            Ref: BashImage
          Essential: false
          Command:
            - -c
            - echo $SENTRY_CONFIG | base64 -d - | tee /config-sentry/config.yml
          Environment:
            - Name: SENTRY_CONFIG
              Value:
                Fn::Base64:
                  Fn::Sub: |
                    system.secret-key: "${SentrySystemSecretKey}"
                    system.url-prefix: "https://${SentryDnsRecord}"

                    slack.client-id: "${SentrySlackClientId}"
                    slack.client-secret: "${SentrySlackClientSecret}"
                    slack.legacy-app: False
                    slack.signing-secret: "${SentrySlackSigningSecret}"

                    filestore.backend: 's3'
                    filestore.options:
                      bucket_name: "${SentryBucket}"
                      default_acl: "private"
                      acl: "private"
          MountPoints:
            - ContainerPath: /config-sentry/
              SourceVolume: sentry-conf-vol
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs
        - Name: subscription-consumer-transactions
          Image:
            Ref: SentryImage
          Essential: true
          DependsOn:
          - Condition: COMPLETE
            ContainerName: sentry-config
          MountPoints:
            - ContainerPath: /config-sentry/
              SourceVolume: sentry-conf-vol
          EntryPoint: ["/bin/bash"]
          Command:
            - "-c"
            - "cp /config-sentry/config.yml /etc/sentry/config.yml && sentry run query-subscription-consumer --commit-batch-size 1 --topic transactions-subscription-results"
          Secrets:
            - Name: POSTGRES_PASSWORD
              ValueFrom:
                Ref: SecretPostgresPassword
            - Name: SENTRY_EMAIL_PASSWORD
              ValueFrom:
                Ref: SecretSentryEmailPassword
          Environment:
            - Name: AWS_DEFAULT_REGION
              Value:
                Ref: AWS::Region
            - Name: C_FORCE_ROOT
              Value: "true"
            - Name: SNUBA
              Value: 
                Fn::Sub: http://${SnubaApiDnsRecord}
            - Name: REDIS_HOST
              Value:
                Fn::GetAtt: ElastiCacheReplicationGroup.PrimaryEndPoint.Address
            - Name: REDIS_PORT
              Value: "6379"
            - Name: CLICKHOUSE_HOST
              Value:
                Fn::GetAtt: ElbClickHouse.DNSName 
            - Name: KAFKA_BROKER_1
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker1
            - Name: KAFKA_BROKER_2
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker2
            - Name: KAFKA_BROKER_3
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker3
            - Name: POSTGRES_HOST
              Value:
                Fn::GetAtt: RDSCluster.Endpoint.Address
            - Name: POSTGRES_PORT
              Value: "5432"
            - Name: POSTGRES_DB
              Value:
                Ref: PostgresDbName
            - Name: POSTGRES_USER
              Value:
                Ref: PostgresDbUsername
            - Name: SENTRY_EMAIL_BACKEND
              Value:
                Ref: SentryEmailBackend
            - Name: SENTRY_EMAIL_USERNAME
              Value:
                Ref: SentryEmailUsername
            - Name: SENTRY_EMAIL_PORT
              Value:
                Ref: SentryEmailPort
            - Name: SENTRY_EMAIL_HOST
              Value:
                Ref: SentryEmailHost
            - Name: SENTRY_EMAIL_FROM
              Value:
                Ref: SentryEmailFrom
            - Name: SENTRY_EMAIL_USE_TLS
              Value:
                Ref: SentryEmailUseTls
            - Name: SENTRY_EMAIL_USE_SSL
              Value:
                Ref: SentryEmailUseSsl
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs

  ServiceSentrySubscriptionConsumerTransactions:
    Type: AWS::ECS::Service
    Properties:
      PlatformVersion: '1.4.0'
      Cluster:
        Ref: ClusterWorkers
      TaskDefinition:
        Ref: TaskDefinitionSentrySubscriptionConsumerTransactions
      DeploymentConfiguration:
        MinimumHealthyPercent: 100
        MaximumPercent: 200
      DesiredCount:
        Ref: MinCountSentrySubscriptionConsumerTransactions
      PropagateTags: SERVICE
      NetworkConfiguration: 
        AwsvpcConfiguration:
          AssignPublicIp: DISABLED
          Subnets:
            - Ref: PrivateSubnet1
            - Ref: PrivateSubnet2
            - Ref: PrivateSubnet3
          SecurityGroups:
            - Ref: Ec2SecurityGroup
      EnableExecuteCommand: true

  AutoScalingTargetSentrySubscriptionConsumerTransactions:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    Properties:
      MaxCapacity:
        Ref: MaxCountSentrySubscriptionConsumerTransactions
      MinCapacity:
        Ref: MinCountSentrySubscriptionConsumerTransactions
      ResourceId:
        Fn::Sub: service/${ClusterWorkers}/${ServiceSentrySubscriptionConsumerTransactions.Name}
      RoleARN:
        Fn::GetAtt: ScalingRole.Arn
      ScalableDimension: ecs:service:DesiredCount
      ServiceNamespace: ecs

  CpuAutoScalingPolicySentrySubscriptionConsumerTransactions:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-Cpu-SentrySubscriptionConsumerTransactions
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: AutoScalingTargetSentrySubscriptionConsumerTransactions
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue: 40
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: ECSServiceAverageCPUUtilization

  RamAutoScalingPolicySentrySubscriptionConsumerTransactions:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName:
        Fn::Sub: ${AWS::StackName}-Ram-SentrySubscriptionConsumerTransactions
      PolicyType: TargetTrackingScaling
      ScalingTargetId:
        Ref: AutoScalingTargetSentrySubscriptionConsumerTransactions
      TargetTrackingScalingPolicyConfiguration:
        DisableScaleIn: false
        TargetValue: 40 
        ScaleInCooldown: 600
        ScaleOutCooldown: 60
        PredefinedMetricSpecification: 
          PredefinedMetricType: ECSServiceAverageMemoryUtilization

  TaskDefinitionClickHouseBootstrap:
    Type: AWS::ECS::TaskDefinition
    Properties:
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      Cpu: "1024"
      Memory: 2GB
      ExecutionRoleArn:
        Fn::GetAtt: ExecutionRole.Arn
      TaskRoleArn:
        Fn::GetAtt: TaskRole.Arn
      ContainerDefinitions:
        - Name: clickhouse-client
          Image:
            Ref: ClickHouseImage
          EntryPoint: ["/bin/bash"]
          Command:
            - "-ec"
            - Fn::Sub: |
                for tbl in errors groupassignee groupedmessage outcomes_hourly outcomes_mv_hourly outcomes_raw sentry sessions_hourly sessions_hourly_mv sessions_raw transactions; do
                  clickhouse-client --database=default --host=${ElbClickHouse.DNSName} --port=9000 --query="DROP TABLE IF EXISTS ${!tbl}_dist"
                  clickhouse-client --database=default --host=${ElbClickHouse.DNSName} --port=9000 --query="CREATE TABLE ${!tbl}_dist AS ${!tbl}_local ENGINE = Distributed('sentry_clickhouse', default, ${!tbl}_local, rand())"
                done
          Secrets:
            - Name: POSTGRES_PASSWORD
              ValueFrom:
                Ref: SecretPostgresPassword
            - Name: SENTRY_EMAIL_PASSWORD
              ValueFrom:
                Ref: SecretSentryEmailPassword
          Environment:
            - Name: AWS_DEFAULT_REGION
              Value:
                Ref: AWS::Region
            - Name: C_FORCE_ROOT
              Value: "true"
            - Name: SNUBA
              Value: 
                Fn::Sub: http://${SnubaApiDnsRecord}
            - Name: REDIS_HOST
              Value:
                Fn::GetAtt: ElastiCacheReplicationGroup.PrimaryEndPoint.Address
            - Name: REDIS_PORT
              Value: "6379"
            - Name: CLICKHOUSE_HOST
              Value:
                Fn::GetAtt: ElbClickHouse.DNSName 
            - Name: KAFKA_BROKER_1
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker1
            - Name: KAFKA_BROKER_2
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker2
            - Name: KAFKA_BROKER_3
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker3
            - Name: POSTGRES_HOST
              Value:
                Fn::GetAtt: RDSCluster.Endpoint.Address
            - Name: POSTGRES_PORT
              Value: "5432"
            - Name: POSTGRES_DB
              Value:
                Ref: PostgresDbName
            - Name: POSTGRES_USER
              Value:
                Ref: PostgresDbUsername
            - Name: SENTRY_EMAIL_BACKEND
              Value:
                Ref: SentryEmailBackend
            - Name: SENTRY_EMAIL_USERNAME
              Value:
                Ref: SentryEmailUsername
            - Name: SENTRY_EMAIL_PORT
              Value:
                Ref: SentryEmailPort
            - Name: SENTRY_EMAIL_HOST
              Value:
                Ref: SentryEmailHost
            - Name: SENTRY_EMAIL_FROM
              Value:
                Ref: SentryEmailFrom
            - Name: SENTRY_EMAIL_USE_TLS
              Value:
                Ref: SentryEmailUseTls
            - Name: SENTRY_EMAIL_USE_SSL
              Value:
                Ref: SentryEmailUseSsl
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs

  ClickHouseBoostrapLambdaResultSingleExecution:
    Type: Custom::ClickHouseBootstrapSingleExecution
    Properties:
      ServiceToken:
        Fn::GetAtt: ContainerSingleExecutionLambdaFunction.Arn
      TaskDefinitionArn:
        Fn::GetAtt: TaskDefinitionClickHouseBootstrap.TaskDefinitionArn
      RerunOnUpdate: "NO"
      Image:
        Ref: ClickHouseImage

  DelayClickHouseBootstrapLambdaResult:
    Type: Custom::DelayClickHouseBootstrap
    DependsOn: ClickHouseBoostrapLambdaResultSingleExecution
    Properties:
      ServiceToken:
        Fn::GetAtt: DelayResourceLambdaFunction.Arn
      TimeToWait: "60"

  TaskDefinitionSentryMigration:
    Type: AWS::ECS::TaskDefinition
    Properties:
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      Cpu: "1024"
      Memory: 2GB
      ExecutionRoleArn:
        Fn::GetAtt: ExecutionRole.Arn
      TaskRoleArn:
        Fn::GetAtt: TaskRole.Arn
      Volumes:
        - Name: sentry-conf-vol
          Host: {}
      ContainerDefinitions:
        - Name: sentry-config
          Image:
            Ref: BashImage
          Essential: false
          Command:
            - -c
            - echo $SENTRY_CONFIG | base64 -d - | tee /config-sentry/config.yml
          Environment:
            - Name: SENTRY_CONFIG
              Value:
                Fn::Base64:
                  Fn::Sub: |
                    system.secret-key: "${SentrySystemSecretKey}"
                    system.url-prefix: "https://${SentryDnsRecord}"

                    slack.client-id: "${SentrySlackClientId}"
                    slack.client-secret: "${SentrySlackClientSecret}"
                    slack.legacy-app: False
                    slack.signing-secret: "${SentrySlackSigningSecret}"

                    filestore.backend: 's3'
                    filestore.options:
                      bucket_name: "${SentryBucket}"
                      default_acl: "private"
                      acl: "private"
          MountPoints:
            - ContainerPath: /config-sentry/
              SourceVolume: sentry-conf-vol
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs
        - Name: sentry-worker
          Image:
            Ref: SentryImage
          Essential: true
          DependsOn:
          - Condition: COMPLETE
            ContainerName: sentry-config
          MountPoints:
            - ContainerPath: /config-sentry/
              SourceVolume: sentry-conf-vol
          EntryPoint: ["/bin/bash"]
          Command:
            - "-c"
            - "cp /config-sentry/config.yml /etc/sentry/config.yml && sentry upgrade"
          Secrets:
            - Name: POSTGRES_PASSWORD
              ValueFrom:
                Ref: SecretPostgresPassword
            - Name: SENTRY_EMAIL_PASSWORD
              ValueFrom:
                Ref: SecretSentryEmailPassword
          Environment:
            - Name: AWS_DEFAULT_REGION
              Value:
                Ref: AWS::Region
            - Name: C_FORCE_ROOT
              Value: "true"
            - Name: SNUBA
              Value: 
                Fn::Sub: http://${SnubaApiDnsRecord}
            - Name: REDIS_HOST
              Value:
                Fn::GetAtt: ElastiCacheReplicationGroup.PrimaryEndPoint.Address
            - Name: REDIS_PORT
              Value: "6379"
            - Name: CLICKHOUSE_HOST
              Value:
                Fn::GetAtt: ElbClickHouse.DNSName 
            - Name: KAFKA_BROKER_1
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker1
            - Name: KAFKA_BROKER_2
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker2
            - Name: KAFKA_BROKER_3
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker3
            - Name: POSTGRES_HOST
              Value:
                Fn::GetAtt: RDSCluster.Endpoint.Address
            - Name: POSTGRES_PORT
              Value: "5432"
            - Name: POSTGRES_DB
              Value:
                Ref: PostgresDbName
            - Name: POSTGRES_USER
              Value:
                Ref: PostgresDbUsername
            - Name: SENTRY_EMAIL_BACKEND
              Value:
                Ref: SentryEmailBackend
            - Name: SENTRY_EMAIL_USERNAME
              Value:
                Ref: SentryEmailUsername
            - Name: SENTRY_EMAIL_PORT
              Value:
                Ref: SentryEmailPort
            - Name: SENTRY_EMAIL_HOST
              Value:
                Ref: SentryEmailHost
            - Name: SENTRY_EMAIL_FROM
              Value:
                Ref: SentryEmailFrom
            - Name: SENTRY_EMAIL_USE_TLS
              Value:
                Ref: SentryEmailUseTls
            - Name: SENTRY_EMAIL_USE_SSL
              Value:
                Ref: SentryEmailUseSsl
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs

  SentryMigrationLambdaResultSingleExecution:
    Type: Custom::SentryMigrationSingleExecution
    DependsOn: DelayClickHouseBootstrapLambdaResult
    Properties:
      ServiceToken:
        Fn::GetAtt: ContainerSingleExecutionLambdaFunction.Arn
      TaskDefinitionArn:
        Fn::GetAtt: TaskDefinitionSentryMigration.TaskDefinitionArn
      RerunOnUpdate: "YES"
      Image:
        Ref: SentryImage

  DelaySentryMigrationLambdaResult:
    Type: Custom::DelaySentryMigration
    DependsOn: SentryMigrationLambdaResultSingleExecution
    Properties:
      ServiceToken:
        Fn::GetAtt: DelayResourceLambdaFunction.Arn
      TimeToWait: "120"
      SentryImage:
        Ref: SentryImage

  TaskDefinitionSnubaBootstrap:
    Type: AWS::ECS::TaskDefinition
    Properties:
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      Cpu: "1024"
      Memory: 2GB
      ExecutionRoleArn:
        Fn::GetAtt: ExecutionRole.Arn
      TaskRoleArn:
        Fn::GetAtt: TaskRole.Arn
      ContainerDefinitions:
        - Name: sentry-snuba-bootstrap
          Image:
            Ref: SnubaImage
          EntryPoint: ["snuba", "bootstrap", "--force"]
          Secrets:
            - Name: POSTGRES_PASSWORD
              ValueFrom:
                Ref: SecretPostgresPassword
            - Name: SENTRY_EMAIL_PASSWORD
              ValueFrom:
                Ref: SecretSentryEmailPassword
          Environment:
            - Name: AWS_DEFAULT_REGION
              Value:
                Ref: AWS::Region
            - Name: REDIS_HOST
              Value:
                Fn::GetAtt: ElastiCacheReplicationGroup.PrimaryEndPoint.Address
            - Name: REDIS_PORT
              Value: "6379"
            - Name: CLICKHOUSE_HOST
              Value:
                Fn::GetAtt: ElbClickHouse.DNSName
            - Name: CLICKHOUSE_PORT
              Value: "9000"
            - Name: CLICKHOUSE_HTTP_PORT
              Value: "8123"
            - Name: CLICKHOUSE_SINGLE_NODE
              Value: "true"
            - Name: CLICKHOUSE_DATABASE
              Value: "default"
            - Name: KAFKA_BROKER_1
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker1
            - Name: KAFKA_BROKER_2
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker2
            - Name: KAFKA_BROKER_3
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker3
            - Name: DEFAULT_BROKERS
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.BootstrapBrokerString
            - Name: POSTGRES_HOST
              Value:
                Fn::GetAtt: RDSCluster.Endpoint.Address
            - Name: POSTGRES_PORT
              Value: "5432"
            - Name: POSTGRES_DB
              Value:
                Ref: PostgresDbName
            - Name: POSTGRES_USER
              Value:
                Ref: PostgresDbUsername
            - Name: SENTRY_EMAIL_BACKEND
              Value:
                Ref: SentryEmailBackend
            - Name: SENTRY_EMAIL_USERNAME
              Value:
                Ref: SentryEmailUsername
            - Name: SENTRY_EMAIL_PORT
              Value:
                Ref: SentryEmailPort
            - Name: SENTRY_EMAIL_HOST
              Value:
                Ref: SentryEmailHost
            - Name: SENTRY_EMAIL_FROM
              Value:
                Ref: SentryEmailFrom
            - Name: SENTRY_EMAIL_USE_TLS
              Value:
                Ref: SentryEmailUseTls
            - Name: SENTRY_EMAIL_USE_SSL
              Value:
                Ref: SentryEmailUseSsl
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs

  SnubaBootstrapLambdaResultSingleExecution:
    Type: Custom::SnubaBootstrapSingleExecution
    DependsOn: DelaySentryMigrationLambdaResult
    Properties:
      ServiceToken:
        Fn::GetAtt: ContainerSingleExecutionLambdaFunction.Arn
      TaskDefinitionArn:
        Fn::GetAtt: TaskDefinitionSnubaBootstrap.TaskDefinitionArn
      RerunOnUpdate: "YES"
      ClusterArn:
        Ref: KafkaCluster

  DelaySnubaBootstrapLambdaResult:
    Type: Custom::DelaySnubaBootstrap
    DependsOn: SnubaBootstrapLambdaResultSingleExecution
    Properties:
      ServiceToken:
        Fn::GetAtt: DelayResourceLambdaFunction.Arn
      TimeToWait: "120"

  TaskDefinitionSnubaMigrations:
    Type: AWS::ECS::TaskDefinition
    Properties:
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      Cpu: "1024"
      Memory: 2GB
      ExecutionRoleArn:
        Fn::GetAtt: ExecutionRole.Arn
      TaskRoleArn:
        Fn::GetAtt: TaskRole.Arn
      ContainerDefinitions:
        - Name: sentry-snuba-migrations
          Image:
            Ref: SnubaImage
          EntryPoint: ["/usr/src/snuba/docker_entrypoint.sh"]
          Command: ["snuba", "migrations", "migrate", "--force"]
          Secrets:
            - Name: POSTGRES_PASSWORD
              ValueFrom:
                Ref: SecretPostgresPassword
            - Name: SENTRY_EMAIL_PASSWORD
              ValueFrom:
                Ref: SecretSentryEmailPassword
          Environment:
            - Name: AWS_DEFAULT_REGION
              Value:
                Ref: AWS::Region
            - Name: REDIS_HOST
              Value:
                Fn::GetAtt: ElastiCacheReplicationGroup.PrimaryEndPoint.Address
            - Name: REDIS_PORT
              Value: "6379"
            - Name: CLICKHOUSE_HOST
              Value:
                Fn::GetAtt: ElbClickHouse.DNSName
            - Name: CLICKHOUSE_PORT
              Value: "9000"
            - Name: CLICKHOUSE_HTTP_PORT
              Value: "8123"
            - Name: CLICKHOUSE_SINGLE_NODE
              Value: "true"
            - Name: CLICKHOUSE_DATABASE
              Value: "default"
            - Name: KAFKA_BROKER_1
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker1
            - Name: KAFKA_BROKER_2
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker2
            - Name: KAFKA_BROKER_3
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker3
            - Name: DEFAULT_BROKERS
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.BootstrapBrokerString
            - Name: POSTGRES_HOST
              Value:
                Fn::GetAtt: RDSCluster.Endpoint.Address
            - Name: POSTGRES_PORT
              Value: "5432"
            - Name: POSTGRES_DB
              Value:
                Ref: PostgresDbName
            - Name: POSTGRES_USER
              Value:
                Ref: PostgresDbUsername
            - Name: SENTRY_EMAIL_BACKEND
              Value:
                Ref: SentryEmailBackend
            - Name: SENTRY_EMAIL_USERNAME
              Value:
                Ref: SentryEmailUsername
            - Name: SENTRY_EMAIL_PORT
              Value:
                Ref: SentryEmailPort
            - Name: SENTRY_EMAIL_HOST
              Value:
                Ref: SentryEmailHost
            - Name: SENTRY_EMAIL_FROM
              Value:
                Ref: SentryEmailFrom
            - Name: SENTRY_EMAIL_USE_TLS
              Value:
                Ref: SentryEmailUseTls
            - Name: SENTRY_EMAIL_USE_SSL
              Value:
                Ref: SentryEmailUseSsl
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs

  SnubaMigrationsLambdaResultSingleExecution:
    Type: Custom::SnubaMigrationsSingleExecution
    DependsOn: DelaySnubaBootstrapLambdaResult
    Properties:
      ServiceToken:
        Fn::GetAtt: ContainerSingleExecutionLambdaFunction.Arn
      RerunOnUpdate: "YES"
      TaskDefinitionArn:
        Fn::GetAtt: TaskDefinitionSnubaMigrations.TaskDefinitionArn
      ClusterArn:
        Ref: KafkaCluster

  DelaySnubaMigrationsLambdaResult:
    Type: Custom::DelaySnubaMigrations
    DependsOn: SnubaMigrationsLambdaResultSingleExecution
    Properties:
      ServiceToken:
        Fn::GetAtt: DelayResourceLambdaFunction.Arn
      SnubaImage:
        Ref: SnubaImage

  TaskDefinitionSentryInitialUser:
    Type: AWS::ECS::TaskDefinition
    Properties:
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      Cpu: "1024"
      Memory: 2GB
      ExecutionRoleArn:
        Fn::GetAtt: ExecutionRole.Arn
      TaskRoleArn:
        Fn::GetAtt: TaskRole.Arn
      Volumes:
        - Name: sentry-conf-vol
          Host: {}
      ContainerDefinitions:
        - Name: sentry-config
          Image:
            Ref: BashImage
          Essential: false
          Command:
            - -c
            - echo $SENTRY_CONFIG | base64 -d - | tee /config-sentry/config.yml
          Environment:
            - Name: SENTRY_CONFIG
              Value:
                Fn::Base64:
                  Fn::Sub: |
                    system.secret-key: "${SentrySystemSecretKey}"
                    system.url-prefix: "https://${SentryDnsRecord}"

                    slack.client-id: "${SentrySlackClientId}"
                    slack.client-secret: "${SentrySlackClientSecret}"
                    slack.legacy-app: False
                    slack.signing-secret: "${SentrySlackSigningSecret}"

                    filestore.backend: 's3'
                    filestore.options:
                      bucket_name: "${SentryBucket}"
                      default_acl: "private"
                      acl: "private"
          MountPoints:
            - ContainerPath: /config-sentry/
              SourceVolume: sentry-conf-vol
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs
        - Name: sentry-worker
          Image:
            Ref: SentryImage
          Essential: true
          DependsOn:
          - Condition: COMPLETE
            ContainerName: sentry-config
          MountPoints:
            - ContainerPath: /config-sentry/
              SourceVolume: sentry-conf-vol
          EntryPoint: ["/bin/bash"]
          Command:
            - "-c"
            - Fn::Sub: "cp /config-sentry/config.yml /etc/sentry/config.yml && (sentry createuser --no-input --superuser --email \"${InitialAdminUserEmail}\" --password \"${!INITIAL_ADMIN_USER_PASSWORD}\" || true)"
          Secrets:
            - Name: INITIAL_ADMIN_USER_PASSWORD
              ValueFrom:
                Ref: SecretAdminPassword
            - Name: POSTGRES_PASSWORD
              ValueFrom:
                Ref: SecretPostgresPassword
            - Name: SENTRY_EMAIL_PASSWORD
              ValueFrom:
                Ref: SecretSentryEmailPassword
          Environment:
            - Name: AWS_DEFAULT_REGION
              Value:
                Ref: AWS::Region
            - Name: C_FORCE_ROOT
              Value: "true"
            - Name: SNUBA
              Value: 
                Fn::Sub: http://${SnubaApiDnsRecord}
            - Name: REDIS_HOST
              Value:
                Fn::GetAtt: ElastiCacheReplicationGroup.PrimaryEndPoint.Address
            - Name: REDIS_PORT
              Value: "6379"
            - Name: CLICKHOUSE_HOST
              Value:
                Fn::GetAtt: ElbClickHouse.DNSName 
            - Name: KAFKA_BROKER_1
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker1
            - Name: KAFKA_BROKER_2
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker2
            - Name: KAFKA_BROKER_3
              Value:
                Fn::GetAtt: KafkaGetBrokersLambdaResult.KafkaBroker3
            - Name: POSTGRES_HOST
              Value:
                Fn::GetAtt: RDSCluster.Endpoint.Address
            - Name: POSTGRES_PORT
              Value: "5432"
            - Name: POSTGRES_DB
              Value:
                Ref: PostgresDbName
            - Name: POSTGRES_USER
              Value:
                Ref: PostgresDbUsername
            - Name: SENTRY_EMAIL_BACKEND
              Value:
                Ref: SentryEmailBackend
            - Name: SENTRY_EMAIL_USERNAME
              Value:
                Ref: SentryEmailUsername
            - Name: SENTRY_EMAIL_PORT
              Value:
                Ref: SentryEmailPort
            - Name: SENTRY_EMAIL_HOST
              Value:
                Ref: SentryEmailHost
            - Name: SENTRY_EMAIL_FROM
              Value:
                Ref: SentryEmailFrom
            - Name: SENTRY_EMAIL_USE_TLS
              Value:
                Ref: SentryEmailUseTls
            - Name: SENTRY_EMAIL_USE_SSL
              Value:
                Ref: SentryEmailUseSsl
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region:
                Ref: AWS::Region
              awslogs-group:
                Ref: LogGroup
              awslogs-stream-prefix: ecs

  SentryInitialUserLambdaResultSingleExecution:
    Type: Custom::SentryInitialUserSingleExecution
    DependsOn: DelaySnubaMigrationsLambdaResult
    Properties:
      ServiceToken:
        Fn::GetAtt: ContainerSingleExecutionLambdaFunction.Arn
      TaskDefinitionArn:
        Fn::GetAtt: TaskDefinitionSentryInitialUser.TaskDefinitionArn
      RerunOnUpdate: "NO"
      Image:
        Ref: SentryImage

  DelayResourceLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal: {Service: [lambda.amazonaws.com]}
          Action: ['sts:AssumeRole']
      Policies:
      - PolicyName:
          Fn::Sub: ${AWS::StackName}-CloudWatch
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - logs:*
            - cloudwatch:*
            Resource: '*'

  DelayResourceLambdaLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName:
        Fn::Sub: /aws/lambda/${DelayResourceLambdaFunction}
      RetentionInDays: 3

  DelayResourceLambdaFunction:
    Type: 'AWS::Lambda::Function'
    Properties:
      Handler: "index.lambda_handler"
      Timeout: "900"
      Role:
        Fn::GetAtt: DelayResourceLambdaRole.Arn
      Runtime: python3.8
      Code:
        ZipFile:
          Fn::Sub: |
            import json
            import cfnresponse
            import time

            def lambda_handler(event, context):
              # This comment was added to force an update on this function's code
              data = {}
              wait_time = int(event['ResourceProperties']['TimeToWait']) if 'TimeToWait' in event['ResourceProperties'] else 120

              try:
                if event['RequestType'] in ['Create', 'Update']:
                  time.sleep(wait_time)

                cfnresponse.send(event, context, cfnresponse.SUCCESS, data)
                
              except Exception as e:
                print(str(e))
                data["Reason"] = str(e)
                cfnresponse.send(event, context, cfnresponse.FAILED, data)

  ContainerSingleExecutionLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal: {Service: [lambda.amazonaws.com]}
          Action: ['sts:AssumeRole']
      Policies:
      - PolicyName:
          Fn::Sub: ${AWS::StackName}-Ecs
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - ecs:*
            Resource: '*'
      - PolicyName:
          Fn::Sub: ${AWS::StackName}-CloudWatch
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - logs:*
            - cloudwatch:*
            Resource: '*'
      - PolicyName:
          Fn::Sub: ${AWS::StackName}-SSM
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - secretsmanager:GetSecretValue
              Resource:
                - Ref: SecretPostgresPassword
      - PolicyName:
          Fn::Sub: ${AWS::StackName}-IAM
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - iam:PassRole
              Resource:
                - Fn::GetAtt: ExecutionRole.Arn
                - Fn::GetAtt: TaskRole.Arn

  ContainerSingleExecutionLambdaLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName:
        Fn::Sub: /aws/lambda/${ContainerSingleExecutionLambdaFunction}
      RetentionInDays: 3

  ContainerSingleExecutionLambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      Handler: index.lambda_handler
      Runtime: python3.8
      Role:
        Fn::GetAtt: ContainerSingleExecutionLambdaRole.Arn
      Code:
        ZipFile:
          Fn::Sub: |
            import boto3
            from botocore.exceptions import ClientError
            import json
            import cfnresponse
            from datetime import datetime

            def lambda_handler(event, context):
              # This comment was added to force an update on this function's code
              data = {}

              try:
                ecs_client = boto3.client('ecs',region_name="${AWS::Region}")

                if event['RequestType'] == 'Create':
                  
                  response = ecs_client.run_task(
                    cluster='${ClusterWorkers}',
                    networkConfiguration={
                      'awsvpcConfiguration': {
                        'subnets': ["${PrivateSubnet1}","${PrivateSubnet2}","${PrivateSubnet3}"],
                            'securityGroups': [ "${Ec2SecurityGroup}"],
                            'assignPublicIp': 'DISABLED'
                        }
                    },
                    taskDefinition=event["ResourceProperties"]["TaskDefinitionArn"]
                  )
                  if "failures" in response and len(response["failures"]) > 0:
                    print(response)
                    data["Reason"] = "NOT_OK"
                    cfnresponse.send(event, context, cfnresponse.FAILED, data)

                elif event['RequestType'] == 'Update' and event['ResourceProperties']['RerunOnUpdate'] == 'YES':

                  response = ecs_client.run_task(
                      cluster='${ClusterWorkers}',
                      networkConfiguration={
                        'awsvpcConfiguration': {
                          'subnets': ["${PrivateSubnet1}","${PrivateSubnet2}","${PrivateSubnet3}"],
                              'securityGroups': [ "${Ec2SecurityGroup}"],
                              'assignPublicIp': 'DISABLED'
                          }
                      },
                      taskDefinition=event["ResourceProperties"]["TaskDefinitionArn"]
                    )
                  if "failures" in response and len(response["failures"]) > 0:
                    print(response)
                    data["Reason"] = "NOT_OK"
                    cfnresponse.send(event, context, cfnresponse.FAILED, data)

                else:
                  data["Reason"] = "OK"
                  
                cfnresponse.send(event, context, cfnresponse.SUCCESS, data)
              except Exception as e:
                print(str(e))
                data["Reason"] = str(e)
                cfnresponse.send(event, context, cfnresponse.FAILED, data)