AWSTemplateFormatVersion: 2010-09-09 Description: AWS CloudFormation template for creating required resources for the Thundra Debug Broker Metadata: AWS::CloudFormation::Interface: ParameterGroups: - Label: default: License Parameters: - ThundraLicenseKey - Label: default: Debug Broker Instance Parameters: - BrokerVersion - InstanceType - SSHLocation - SSHKeyName - Label: default: Network Configuration Parameters: - VpcId - SubnetIds - SSLCertificateARN - Label: default: DNS Management Parameters: - HostedZoneName - PublicBrokerSubdomain - InternalBrokerSubdomain ParameterLabels: ThundraLicenseKey: default: Thundra License Key BrokerVersion: default: Version InstanceType: default: EC2 Instance Type SSHLocation: default: SSH IP Address Range SSHKeyName: default: SSH Key Name VpcId: default: VPC SubnetIds: default: Subnets SSLCertificateARN: default: SSL Certificate ARN (Optional) HostedZoneName: default: Hosted Zone Name (Optional) PublicBrokerSubdomain: default: Subdomain for Public Broker Endpoint InternalBrokerSubdomain: default: Subdomain for Internal Broker Endpoint Parameters: ThundraLicenseKey: Description: Write license key you get from Thundra console Type: String BrokerVersion: Default: LATEST Description: Write debugger version you want to deploy. It should be a valid version defined in https://hub.docker.com/r/thundraio/thundra-debug-broker-onprem/tags Type: String InstanceType: Description: Select debug broker EC2 instance type Type: String Default: t2.small AllowedValues: - t1.micro - t2.nano - t2.micro - t2.small - t2.medium - t2.large - m1.small - m1.medium - m1.large - m1.xlarge - m2.xlarge - m2.2xlarge - m2.4xlarge - m3.medium - m3.large - m3.xlarge - m3.2xlarge - m4.large - m4.xlarge - m4.2xlarge - m4.4xlarge - m4.10xlarge - c1.medium - c1.xlarge - c3.large - c3.xlarge - c3.2xlarge - c3.4xlarge - c3.8xlarge - c4.large - c4.xlarge - c4.2xlarge - c4.4xlarge - c4.8xlarge - g2.2xlarge - g2.8xlarge - r3.large - r3.xlarge - r3.2xlarge - r3.4xlarge - r3.8xlarge - i2.xlarge - i2.2xlarge - i2.4xlarge - i2.8xlarge - d2.xlarge - d2.2xlarge - d2.4xlarge - d2.8xlarge - hi1.4xlarge - hs1.8xlarge - cr1.8xlarge - cc2.8xlarge - cg1.4xlarge VpcId: Description: Select the VPC you want to install the debug broker components. Type: AWS::EC2::VPC::Id SubnetIds: Description: Select two subnets in different AZs under the selected VPC. !!Please consider that the lambdas you want to debug and your debugging environment should be able to access these subnets. Type: List SSLCertificateARN: Default: '' Description: Write ARN of an existing certificate defined on AWS Certificate Manager to enable secure connection Type: String SSHKeyName: Description: Select an EC2 KeyPair to enable SSH access to the instance Type: AWS::EC2::KeyPair::KeyName SSHLocation: Description: Specify IP address range that can be used to SSH to the EC2 instance Type: String MinLength: 9 MaxLength: 18 Default: 0.0.0.0/0 AllowedPattern: "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})" ConstraintDescription: Must be a valid IP CIDR range of the form x.x.x.x/x HostedZoneName: Default: '' Description: Write AWS Route53 hosted zone name you want to create DNS mappings for debugger endpoints. Please write the host name without a dot at the end. e.g. "thundra.io" Type: String PublicBrokerSubdomain: Default: thundra-debug-public Description: Write subdomain the public broker will be served Type: String InternalBrokerSubdomain: Default: thundra-debug-internal Description: Write subdomain the internal broker will be served Type: String Conditions: CreateDnsMapping: !Not [!Equals [ !Ref HostedZoneName, '' ]] IsHttp: !Equals [ !Ref SSLCertificateARN, '' ] Mappings: AWSInstanceType2Arch: t1.micro: Arch: HVM64 t2.nano: Arch: HVM64 t2.micro: Arch: HVM64 t2.small: Arch: HVM64 t2.medium: Arch: HVM64 t2.large: Arch: HVM64 m1.small: Arch: HVM64 m1.medium: Arch: HVM64 m1.large: Arch: HVM64 m1.xlarge: Arch: HVM64 m2.xlarge: Arch: HVM64 m2.2xlarge: Arch: HVM64 m2.4xlarge: Arch: HVM64 m3.medium: Arch: HVM64 m3.large: Arch: HVM64 m3.xlarge: Arch: HVM64 m3.2xlarge: Arch: HVM64 m4.large: Arch: HVM64 m4.xlarge: Arch: HVM64 m4.2xlarge: Arch: HVM64 m4.4xlarge: Arch: HVM64 m4.10xlarge: Arch: HVM64 c1.medium: Arch: HVM64 c1.xlarge: Arch: HVM64 c3.large: Arch: HVM64 c3.xlarge: Arch: HVM64 c3.2xlarge: Arch: HVM64 c3.4xlarge: Arch: HVM64 c3.8xlarge: Arch: HVM64 c4.large: Arch: HVM64 c4.xlarge: Arch: HVM64 c4.2xlarge: Arch: HVM64 c4.4xlarge: Arch: HVM64 c4.8xlarge: Arch: HVM64 g2.2xlarge: Arch: HVMG2 g2.8xlarge: Arch: HVMG2 r3.large: Arch: HVM64 r3.xlarge: Arch: HVM64 r3.2xlarge: Arch: HVM64 r3.4xlarge: Arch: HVM64 r3.8xlarge: Arch: HVM64 i2.xlarge: Arch: HVM64 i2.2xlarge: Arch: HVM64 i2.4xlarge: Arch: HVM64 i2.8xlarge: Arch: HVM64 d2.xlarge: Arch: HVM64 d2.2xlarge: Arch: HVM64 d2.4xlarge: Arch: HVM64 d2.8xlarge: Arch: HVM64 hi1.4xlarge: Arch: HVM64 hs1.8xlarge: Arch: HVM64 cr1.8xlarge: Arch: HVM64 cc2.8xlarge: Arch: HVM64 AWSRegionArch2AMI: us-east-1: HVM64: ami-0ff8a91507f77f867 HVMG2: ami-0a584ac55a7631c0c us-west-2: HVM64: ami-a0cfeed8 HVMG2: ami-0e09505bc235aa82d us-west-1: HVM64: ami-0bdb828fd58c52235 HVMG2: ami-066ee5fd4a9ef77f1 eu-west-1: HVM64: ami-047bb4163c506cd98 HVMG2: ami-0a7c483d527806435 eu-west-2: HVM64: ami-f976839e HVMG2: NOT_SUPPORTED eu-west-3: HVM64: ami-0ebc281c20e89ba4b HVMG2: NOT_SUPPORTED eu-central-1: HVM64: ami-0233214e13e500f77 HVMG2: ami-06223d46a6d0661c7 ap-northeast-1: HVM64: ami-06cd52961ce9f0d85 HVMG2: ami-053cdd503598e4a9d ap-northeast-2: HVM64: ami-0a10b2721688ce9d2 HVMG2: NOT_SUPPORTED ap-northeast-3: HVM64: ami-0d98120a9fb693f07 HVMG2: NOT_SUPPORTED ap-southeast-1: HVM64: ami-08569b978cc4dfa10 HVMG2: ami-0be9df32ae9f92309 ap-southeast-2: HVM64: ami-09b42976632b27e9b HVMG2: ami-0a9ce9fecc3d1daf8 ap-south-1: HVM64: ami-0912f71e06545ad88 HVMG2: ami-097b15e89dbdcfcf4 us-east-2: HVM64: ami-0b59bfac6be064b78 HVMG2: NOT_SUPPORTED ca-central-1: HVM64: ami-0b18956f HVMG2: NOT_SUPPORTED sa-east-1: HVM64: ami-07b14488da8ea02a0 HVMG2: NOT_SUPPORTED cn-north-1: HVM64: ami-0a4eaf6c4454eda75 HVMG2: NOT_SUPPORTED cn-northwest-1: HVM64: ami-6b6a7d09 HVMG2: NOT_SUPPORTED Resources: LoadBalancerSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupName: thundra-debug-broker-load-balancer-sg GroupDescription: Enable TCP access to load balancer from anywhere via ports (80 or 443) & 444 VpcId: !Ref VpcId SecurityGroupIngress: - IpProtocol: tcp FromPort: Fn::If: - IsHttp - 80 - 443 ToPort: Fn::If: - IsHttp - 80 - 443 CidrIp: 0.0.0.0/0 - IpProtocol: tcp FromPort: 444 ToPort: 444 CidrIp: 0.0.0.0/0 SecurityGroupEgress: - IpProtocol: -1 CidrIp: 0.0.0.0/0 Tags: - Key: PRODUCT Value: THUNDRA BrokerInstanceSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupName: thundra-debug-broker-instance-sg GroupDescription: Enable SSH access via port 22 and TCP access from security group thundra-debug-broker-load-balancer-sg via ports 4444,5555 VpcId: !Ref VpcId SecurityGroupIngress: - SourceSecurityGroupId: !Ref LoadBalancerSecurityGroup IpProtocol: tcp FromPort: 4444 ToPort: 4444 - SourceSecurityGroupId: !Ref LoadBalancerSecurityGroup IpProtocol: tcp FromPort: 5555 ToPort: 5555 - IpProtocol: tcp FromPort: 22 ToPort: 22 CidrIp: !Ref SSHLocation Tags: - Key: PRODUCT Value: THUNDRA BrokerInstance: Type: AWS::EC2::Instance Properties: ImageId: Fn::FindInMap: - AWSRegionArch2AMI - Ref: AWS::Region - Fn::FindInMap: - AWSInstanceType2Arch - Ref: InstanceType - Arch InstanceType: Ref: InstanceType SubnetId: Fn::Select: - 0 - !Ref SubnetIds SecurityGroupIds: - !Ref BrokerInstanceSecurityGroup KeyName: !Ref SSHKeyName UserData: Fn::Base64: Fn::Join: - "\n" - - "#!/bin/bash" - yum install java-1.8.0-openjdk -y - yum install java-1.8.0-openjdk-devel -y - alternatives --set java /usr/lib/jvm/jre-1.8.0-openjdk.x86_64/bin/java - cd /home/ec2-user/ - Fn::Join: - '' - - echo " - Ref: ThundraLicenseKey - "\" > .thundra-license-key" - mkdir debug-broker - cd debug-broker/ - Fn::Sub: wget https://thundra-dist.s3-us-west-2.amazonaws.com/thundra-debug-broker/thundra-debug-broker-${BrokerVersion}.jar - Fn::Sub: su - ec2-user -c "java -jar /home/ec2-user/debug-broker/thundra-debug-broker-${BrokerVersion}.jar" Tags: - Key: Name Value: thundra-debug-broker - Key: PRODUCT Value: THUNDRA DebuggerTargetGroupPublic: Type: AWS::ElasticLoadBalancingV2::TargetGroup Properties: HealthCheckEnabled: true HealthCheckIntervalSeconds: 30 HealthCheckPath: /ping HealthCheckPort: 5555 Name: thundra-debugger-public-debug TargetType: instance Port: 5555 Protocol: HTTP VpcId: !Ref VpcId Targets: - Id: !Ref BrokerInstance Port: 5555 Tags: - Key: PRODUCT Value: THUNDRA DebuggerTargetGroupInternal: Type: AWS::ElasticLoadBalancingV2::TargetGroup Properties: HealthCheckEnabled: true HealthCheckIntervalSeconds: 30 HealthCheckPath: /ping HealthCheckPort: 5555 Name: thundra-debugger-internal-debug TargetType: instance Port: 5555 Protocol: HTTP VpcId: !Ref VpcId Targets: - Id: !Ref BrokerInstance Port: 5555 Tags: - Key: PRODUCT Value: THUNDRA AppTargetGroupPublic: Type: AWS::ElasticLoadBalancingV2::TargetGroup Properties: HealthCheckEnabled: true HealthCheckIntervalSeconds: 30 HealthCheckPath: /ping HealthCheckPort: 4444 Name: thundra-debugger-public-app TargetType: instance Port: 4444 Protocol: HTTP VpcId: !Ref VpcId Targets: - Id: !Ref BrokerInstance Port: 4444 Tags: - Key: PRODUCT Value: THUNDRA AppTargetGroupInternal: Type: AWS::ElasticLoadBalancingV2::TargetGroup Properties: HealthCheckEnabled: true HealthCheckIntervalSeconds: 30 HealthCheckPath: /ping HealthCheckPort: 4444 Name: thundra-debugger-internal-app TargetType: instance Port: 4444 Protocol: HTTP VpcId: !Ref VpcId Targets: - Id: !Ref BrokerInstance Port: 4444 Tags: - Key: PRODUCT Value: THUNDRA LoadBalancerPublic: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: thundra-debug-broker-lb-public Type: application Scheme: internet-facing SecurityGroups: - !Ref LoadBalancerSecurityGroup Subnets: !Ref SubnetIds Tags: - Key: PRODUCT Value: THUNDRA LoadBalancerInternal: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: thundra-debug-broker-lb-internal Type: application Scheme: internal SecurityGroups: - !Ref LoadBalancerSecurityGroup Subnets: !Ref SubnetIds Tags: - Key: PRODUCT Value: THUNDRA DebuggerListenerPublic: Type: AWS::ElasticLoadBalancingV2::Listener Properties: LoadBalancerArn: !Ref LoadBalancerPublic Certificates: Fn::If: - IsHttp - !Ref AWS::NoValue - - CertificateArn: !Ref SSLCertificateARN DefaultActions: - TargetGroupArn: !Ref DebuggerTargetGroupPublic Type: forward Port: Fn::If: - IsHttp - 80 - 443 Protocol: Fn::If: - IsHttp - HTTP - HTTPS DebuggerListenerInternal: Type: AWS::ElasticLoadBalancingV2::Listener Properties: LoadBalancerArn: !Ref LoadBalancerInternal Certificates: Fn::If: - IsHttp - !Ref AWS::NoValue - - CertificateArn: !Ref SSLCertificateARN DefaultActions: - TargetGroupArn: !Ref DebuggerTargetGroupInternal Type: forward Port: Fn::If: - IsHttp - 80 - 443 Protocol: Fn::If: - IsHttp - HTTP - HTTPS AppListenerPublic: Type: AWS::ElasticLoadBalancingV2::Listener Properties: LoadBalancerArn: !Ref LoadBalancerPublic Certificates: Fn::If: - IsHttp - !Ref AWS::NoValue - - CertificateArn: !Ref SSLCertificateARN DefaultActions: - TargetGroupArn: !Ref AppTargetGroupPublic Type: forward Port: 444 Protocol: Fn::If: - IsHttp - HTTP - HTTPS AppListenerInternal: Type: AWS::ElasticLoadBalancingV2::Listener Properties: LoadBalancerArn: !Ref LoadBalancerInternal Certificates: Fn::If: - IsHttp - !Ref AWS::NoValue - - CertificateArn: !Ref SSLCertificateARN DefaultActions: - TargetGroupArn: !Ref AppTargetGroupInternal Type: forward Port: 444 Protocol: Fn::If: - IsHttp - HTTP - HTTPS DnsRecords: Condition: CreateDnsMapping Type: AWS::Route53::RecordSetGroup Properties: Comment: Creating records for Thundra debug broker endpoint mappings HostedZoneName: Fn::Join: # add dot to the end to match with DNS zone name format - '.' - - !Ref HostedZoneName - '' RecordSets: - Name: Fn::Join: - '.' - - !Ref InternalBrokerSubdomain - !Ref HostedZoneName ResourceRecords: - Fn::GetAtt: - LoadBalancerInternal - DNSName TTL: 300 Type: CNAME - Name: Fn::Join: - '.' - - !Ref PublicBrokerSubdomain - !Ref HostedZoneName ResourceRecords: - Fn::GetAtt: - LoadBalancerPublic - DNSName TTL: 300 Type: CNAME Outputs: BrokerInternalURL: Description: Set this value as broker host in Thundra debug client configuration if you want to use the internal endpoint. Value: Fn::Join: - '' - - Fn::If: - IsHttp - ws:// - wss:// - Fn::If: - CreateDnsMapping - Fn::Join: - '.' - - !Ref InternalBrokerSubdomain - !Ref HostedZoneName - Fn::GetAtt: - LoadBalancerInternal - DNSName BrokerPublicURL: Description: Set this value as broker host in Thundra debug client configuration if you want to use the public endpoint Value: Fn::Join: - '' - - Fn::If: - IsHttp - ws:// - wss:// - Fn::If: - CreateDnsMapping - Fn::Join: - '.' - - !Ref PublicBrokerSubdomain - !Ref HostedZoneName - Fn::GetAtt: - LoadBalancerPublic - DNSName BrokerPort: Description: Set this value as broker port in Thundra debug client configuration. Value: Fn::If: - IsHttp - 80 - 443