{ "AWSTemplateFormatVersion": "2010-09-09", "Description": "ArcGIS CloudFormation Template: Provisions a ArcGIS site with Portal for ArcGIS, ArcGIS Server, ArcGIS Data Store and ArcGIS Web Adaptor on an EC2 instance running Ubuntu Linux 14.04 LTS. **WARNING** You will be billed by AWS for the AWS resources if you create a stack from this template.", "Mappings" : { "RegionMap" : { "ap-northeast-1": { "en": "ami-0e54d73f4bcc76292" }, "ap-northeast-2": { "en": "ami-0b1af78e0524740b5" }, "ap-southeast-1": { "en": "ami-06331803eb6900ee8" }, "ap-southeast-2": { "en": "ami-0188a914465246389" }, "eu-central-1": { "en": "ami-0289bf79b7eda068b" }, "eu-west-1": { "en": "ami-02f1cd182a955fc9c" }, "sa-east-1": { "en": "ami-03b09761d3895542d" }, "us-east-1": { "en": "ami-01f50e9f7e1e05a40" }, "us-west-1": { "en": "ami-0a014280b35a2ac0c" }, "us-west-2": { "en": "ami-0a25ed1b7fdc503a6" }, "ap-south-1": { "en": "ami-0aca14adf0b2b4f6d" } } }, "Parameters": { "AZ" : { "Type" : "AWS::EC2::AvailabilityZone::Name", "Description" : "Select availability zone for your VPC subnet" }, "DeploymentBucket": { "Description": "S3 bucket for license files and SSL certificates", "Type": "String", "AllowedPattern": "[a-zA-Z][0-9a-zA-Z-_.]{2,62}", "ConstraintDescription": "S3 bucket name must be between 3 and 63 characters and and must start with a letter." }, "DriveSizeRoot": { "Default": "100", "Description": " The size of the Root Drive in GB. ", "Type": "Number", "MinValue": "100", "MaxValue": "1024", "ConstraintDescription": " Must be between 100 and 1024 GB. " }, "DriveSizeData": { "Default": "100", "Description": " The size of the Data Drive - /gisdata folder in GB. ", "Type": "Number", "MinValue": "10", "MaxValue": "1024", "ConstraintDescription": " Must be between 10 and 1024 GB. " }, "InstanceType": { "Description": "The EC2 instance type", "Type": "String", "AllowedValues": [ "m3.large", "m3.xlarge", "m3.2xlarge", "m4.large", "m4.xlarge", "m4.2xlarge", "m4.4xlarge", "m4.10xlarge", "c4.large", "c4.xlarge", "c4.2xlarge", "c4.4xlarge", "c4.8xlarge", "c3.large", "c3.xlarge", "c3.2xlarge", "c3.4xlarge", "c3.8xlarge", "r3.large", "r3.xlarge", "r3.2xlarge", "r3.4xlarge", "r3.8xlarge" ], "Default": "m3.xlarge" }, "KeyName": { "Description": "The EC2 KeyPair to allow remote access to the instances", "Type": "AWS::EC2::KeyPair::KeyName" }, "ServerLicenseFile": { "Description": "ArcGIS for Server authorization file (must be uploaded to DeploymentBucket)", "Type": "String", "AllowedPattern": "[^\"]{1,1024}", "ConstraintDescription": "S3 object key name must be between 1 and 1024 characters." }, "PortalLicenseFile": { "Description": "Portal for ArcGIS authorization file (must be uploaded to DeploymentBucket)", "Type": "String", "AllowedPattern": "[^\"]{1,1024}", "ConstraintDescription": "S3 object key name must be between 1 and 1024 characters." }, "SiteAdmin": { "Description": "User name for ArcGIS Server site admin and Portal initial admin accounts", "Type": "String", "Default": "admin", "AllowedPattern": "[0-9a-zA-Z.]{4,24}", "ConstraintDescription": "User name must be between 4 and 24 characters and can only contain digits 0 through 9, ASCII letters A through Z (uppercase and lowercase), and a dot (.)." }, "SiteAdminPassword": { "Description": "Password for the site admin account", "Type": "String", "NoEcho": "true", "AllowedPattern": "[0-9a-zA-Z.]{4,24}", "ConstraintDescription": "Password must be between 4 and 24 characters and can only contain digits 0 through 9, ASCII letters A through Z (uppercase and lowercase), and a dot (.)." }, "SiteEIPAllocationID": { "Description": "Allocation ID of Elastic IP address for VPC (eipalloc-XXXXXXXX)", "Type": "String", "AllowedPattern": "eipalloc-.*" }, "SiteDomain": { "Description": "The domain name of your ArcGIS site", "Type": "String", "AllowedPattern": "[^\"]{1,253}", "ConstraintDescription": "The domain name is invalid." }, "SSLCertificateFile": { "Description": "SSL certificate file issued to the site domain (must be uploaded to DeploymentBucket)", "Type": "String", "AllowedPattern": "[^\"]{1,1024}", "ConstraintDescription": "S3 object key name must be between 1 and 1024 characters." }, "SSLCertPassword": { "Description": "SSL certificate file password", "Type": "String", "NoEcho": "true", "AllowedPattern": "[^\\\"]{1,128}", "ConstraintDescription": "Password must be between 1 and 128 characters and must not contain backslashes (\\) or quotation marks (\")." } }, "Resources": { "VPC": { "Type": "AWS::EC2::VPC", "Properties": { "CidrBlock": "10.0.0.0/16", "Tags": [{ "Key" : "Name", "Value" : {"Ref" : "AWS::StackName"} }, { "Key": "Application", "Value": "arcgis-allinone-ubuntu-vpc" }, { "Key": "Network", "Value": "Public" }] } }, "Subnet1": { "Type": "AWS::EC2::Subnet", "Properties": { "VpcId": {"Ref": "VPC"}, "CidrBlock": "10.0.0.0/24", "AvailabilityZone": {"Ref": "AZ"}, "Tags": [{ "Key": "Name", "Value": {"Fn::Join" : ["", [{"Ref" : "AWS::StackName"}, "-subnet1"]]} }, { "Key": "Application", "Value": "arcgis-allinone-ubuntu-vpc" }, { "Key": "Network", "Value": "Public" }] } }, "InternetGateway": { "Type": "AWS::EC2::InternetGateway", "Properties": { "Tags": [{ "Key" : "Name", "Value" : {"Ref" : "AWS::StackName"} }, { "Key": "Application", "Value": "arcgis-allinone-ubuntu-vpc" }, { "Key": "Network", "Value": "Public" }] } }, "AttachGateway": { "Type": "AWS::EC2::VPCGatewayAttachment", "Properties": { "VpcId": {"Ref": "VPC"}, "InternetGatewayId": {"Ref": "InternetGateway"} } }, "RouteTable": { "Type": "AWS::EC2::RouteTable", "Properties": { "VpcId": {"Ref": "VPC"}, "Tags": [{ "Key" : "Name", "Value" : {"Ref" : "AWS::StackName"} }, { "Key": "Application", "Value": "arcgis-allinone-ubuntu-vpc" }, { "Key": "Network", "Value": "Public" }] } }, "Route": { "Type": "AWS::EC2::Route", "DependsOn" : "AttachGateway", "Properties": { "RouteTableId": {"Ref": "RouteTable"}, "DestinationCidrBlock": "0.0.0.0/0", "GatewayId": {"Ref": "InternetGateway"} } }, "Subnet1RouteTableAssociation": { "Type": "AWS::EC2::SubnetRouteTableAssociation", "Properties": { "SubnetId": {"Ref": "Subnet1"}, "RouteTableId": {"Ref": "RouteTable"} } }, "EC2SecurityGroup": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": {"Ref": "AWS::StackName"}, "VpcId": {"Ref": "VPC"}, "SecurityGroupIngress": [ { "IpProtocol": "tcp", "FromPort": "80", "ToPort": "80", "CidrIp": "0.0.0.0/0" }, { "IpProtocol": "tcp", "FromPort": "443", "ToPort": "443", "CidrIp": "0.0.0.0/0" } ] } }, "SecurityGroupIngress" : { "Type" : "AWS::EC2::SecurityGroupIngress", "Properties" : { "GroupId" : {"Ref" : "EC2SecurityGroup"}, "IpProtocol" : "tcp", "FromPort" : "0", "ToPort" : "65535", "SourceSecurityGroupId" : {"Ref" : "EC2SecurityGroup"} } }, "EIPAssociation": { "Type": "AWS::EC2::EIPAssociation", "DependsOn": "WaitCondition", "Properties": { "AllocationId": {"Ref": "SiteEIPAllocationID"}, "InstanceId": {"Ref": "AllInOneEC2Instance"} } }, "IAMRole": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Effect": "Allow", "Principal": { "Service": [ "ec2.amazonaws.com" ] }, "Action": [ "sts:AssumeRole" ] } ] }, "Path": "/" } }, "IAMPolicy": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyName": "IAMRole", "PolicyDocument": { "Statement": [ { "Action": [ "s3:GetObject", "logs:*" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::*", "arn:aws:logs:*:*:*" ] } ] }, "Roles": [ {"Ref": "IAMRole"} ] } }, "IAMInstanceProfile": { "Type": "AWS::IAM::InstanceProfile", "Properties": { "Path": "/", "Roles": [ {"Ref": "IAMRole"}] } }, "AllInOneEC2Instance": { "Type": "AWS::EC2::Instance", "Properties": { "ImageId": {"Fn::FindInMap" : ["RegionMap", {"Ref":"AWS::Region"}, "en"]}, "InstanceType": {"Ref": "InstanceType" }, "KeyName": {"Ref": "KeyName"}, "IamInstanceProfile": {"Ref": "IAMInstanceProfile"}, "Tags": [ { "Key": "Name", "Value": {"Ref": "AWS::StackName"} }, { "Key": "Application", "Value": "arcgis-allinone-ubuntu-vpc" } ], "Monitoring": true, "BlockDeviceMappings": [ { "DeviceName": "/dev/sda1", "Ebs": { "VolumeSize": {"Ref": "DriveSizeRoot"}, "DeleteOnTermination": true, "VolumeType": "gp2" } }, { "DeviceName": "/dev/sdx", "Ebs": { "VolumeSize": {"Ref": "DriveSizeData"}, "DeleteOnTermination": true, "VolumeType": "gp2" } }, { "DeviceName": "xvdca", "NoDevice": {} },{ "DeviceName": "xvdcb", "NoDevice": {} },{ "DeviceName": "xvdcc", "NoDevice": {} },{ "DeviceName": "xvdcd", "NoDevice": {} },{ "DeviceName": "xvdce", "NoDevice": {} },{ "DeviceName": "xvdcf", "NoDevice": {} },{ "DeviceName": "xvdcg", "NoDevice": {} },{ "DeviceName": "xvdch", "NoDevice": {} },{ "DeviceName": "xvdci", "NoDevice": {} },{ "DeviceName": "xvdcj", "NoDevice": {} },{ "DeviceName": "xvdck", "NoDevice": {} },{ "DeviceName": "xvdcl", "NoDevice": {} },{ "DeviceName": "xvdcm", "NoDevice": {} },{ "DeviceName": "xvdcn", "NoDevice": {} },{ "DeviceName": "xvdco", "NoDevice": {} },{ "DeviceName": "xvdcp", "NoDevice": {} },{ "DeviceName": "xvdcq", "NoDevice": {} },{ "DeviceName": "xvdcr", "NoDevice": {} },{ "DeviceName": "xvdcs", "NoDevice": {} },{ "DeviceName": "xvdct", "NoDevice": {} },{ "DeviceName": "xvdcu", "NoDevice": {} },{ "DeviceName": "xvdcv", "NoDevice": {} },{ "DeviceName": "xvdcw", "NoDevice": {} },{ "DeviceName": "xvdcx", "NoDevice": {} },{ "DeviceName": "xvdcy", "NoDevice": {} },{ "DeviceName": "xvdcz", "NoDevice": {} } ], "NetworkInterfaces": [ { "PrivateIpAddress": "10.0.0.5", "GroupSet": [ {"Ref": "EC2SecurityGroup"} ], "AssociatePublicIpAddress": "true", "DeviceIndex": "0", "DeleteOnTermination": "true", "SubnetId": {"Ref": "Subnet1"} } ], "UserData": { "Fn::Base64": { "Fn::Join": [ "", [ "#!/bin/bash -v\n", "cfn-init -v -s ", {"Ref": "AWS::StackName"}, " -r AllInOneEC2Instance", " --region ", {"Ref": "AWS::Region"}, "\n", "exitcode=$?\n", "wget https://s3.amazonaws.com/aws-cloudwatch/downloads/latest/awslogs-agent-setup.py\n", "sudo python awslogs-agent-setup.py -n -r ", {"Ref": "AWS::Region"}, " -c /tmp/cwlogs/cwlogs.conf || error_exit 'Failed to run CloudWatch Logs agent setup'\n", "if [ $exitcode -ne 0 ]; then\n", " sleep 60\n", " cfn-signal -e $exitcode -r 'cfn-init failed. See CloudWatch log group ", {"Ref": "DeploymentLogs"}, " for details.' '", { "Ref": "WaitHandle"}, "'\n", " exit $exitcode\n", "fi\n", "chmod 777 /mnt\n", "export arcgis_cloud_platform=aws\n", "chef-solo -j /tmp/node.json -r https://arcgisstore1041.s3.amazonaws.com/5686/cookbooks/arcgis-2.2.1-cookbooks.tar.gz -L /var/log/chef-run.log -l info\n", "exitcode=$?\n", "if [ $exitcode -ne 0 ]; then\n", " sleep 60\n", " cfn-signal -e $exitcode -r 'Chef run failed. See CloudWatch log group ", {"Ref": "DeploymentLogs"}, " for details.' '", {"Ref": "WaitHandle"}, "'\n", " exit $exitcode\n", "fi\n", "cfn-signal -e 0 -r 'Setup complete' '", {"Ref": "WaitHandle"}, "'\n" ] ] } } }, "Metadata": { "AWS::CloudFormation::Authentication": { "S3AccessCreds": { "type": "S3", "buckets": [{"Ref": "DeploymentBucket"}], "roleName": {"Ref": "IAMRole"} } }, "AWS::CloudFormation::Init": { "config": { "commands": { "rename-server-license": { "command": { "Fn::Join": ["", ["mv /tmp/server_license.tmp /tmp/", {"Ref": "ServerLicenseFile"}]] } }, "rename-portal-license": { "command": { "Fn::Join": ["", ["mv /tmp/portal_license.tmp /tmp/", {"Ref": "PortalLicenseFile" }]] } } }, "files": { "/tmp/cwlogs/cwlogs.conf": { "content": { "Fn::Join": [ "", [ "[general]\n", "state_file= /var/awslogs/agent-state\n", "[/var/log/cfn-init.log]\n", "file = /var/log/cfn-init.log\n", "log_group_name = ", {"Ref": "DeploymentLogs"}, "\n", "log_stream_name = {instance_id}/cfn-init.log\n", "datetime_format = %d/%b/%Y:%H:%M:%S\n", "[/var/log/chef-run.log]\n", "file = /var/log/chef-run.log\n", "log_group_name = ", {"Ref": "DeploymentLogs"}, "\n", "log_stream_name = {instance_id}/chef-run.log\n", "datetime_format = %Y-%m-%dT%H:%M:%S%z\n", "[/var/lib/tomcat7/logs/catalina.out]\n", "file = /var/lib/tomcat7/logs/catalina.out\n", "log_group_name = ", {"Ref": "DeploymentLogs"}, "\n", "log_stream_name = {instance_id}/catalina.out\n", "datetime_format = %d/%b/%Y:%H:%M:%S\n" ] ] } }, "/etc/tomcat7/pkcs12_cert.pfx": { "source": { "Fn::Join": ["", ["https://", {"Ref": "DeploymentBucket"}, ".s3.amazonaws.com/", {"Ref": "SSLCertificateFile"}]] }, "authentication": "S3AccessCreds" }, "/tmp/server_license.tmp": { "source": { "Fn::Join": ["", ["https://", {"Ref": "DeploymentBucket"}, ".s3.amazonaws.com/", {"Ref": "ServerLicenseFile"}]] }, "authentication": "S3AccessCreds" }, "/tmp/portal_license.tmp": { "source": { "Fn::Join": ["", ["https://", {"Ref": "DeploymentBucket"}, ".s3.amazonaws.com/", {"Ref": "PortalLicenseFile"}]] }, "authentication": "S3AccessCreds" }, "/tmp/node.json": { "content": { "Fn::Join": [ "", [ "{\n", " \"java\" : {\n", " \"install_flavor\" : \"openjdk\",\n", " \"jdk_version\" : \"7\",\n", " \"oracle\" : {\n", " \"accept_oracle_download_terms\" : true\n", " }\n", " },\n", " \"tomcat\" : {\n", " \"base_version\" : 7,\n", " \"port\" : 80,\n", " \"ssl_port\" : 443,\n", " \"authbind\" : \"yes\",\n", " \"keystore_file\" : \"pkcs12_cert.pfx\",\n", " \"keystore_type\" : \"pkcs12\",\n", " \"keystore_password\" : \"", {"Ref": "SSLCertPassword"}, "\"\n", " },\n", " \"arcgis\" : {\n", " \"version\" : \"10.4.1\",\n", " \"hosts\" : {\n", " \"", {"Ref": "SiteDomain"}, "\" : \"10.0.0.5\"\n", " },\n", " \"server\" : {\n", " \"domain_name\" : \"",{"Ref": "SiteDomain"}, "\",\n", " \"admin_username\" : \"", {"Ref": "SiteAdmin"}, "\",\n", " \"admin_password\" : \"", {"Ref": "SiteAdminPassword"}, "\",\n", " \"directories_root\" : \"/gisdata/arcgisserver\",\n", " \"authorization_file\" : \"/tmp/", {"Ref": "ServerLicenseFile"}, "\"\n", " },\n", " \"web_adaptor\" : {\r\n", " \"admin_access\" : true\r\n", " },\r\n", " \"data_store\" : {\r\n", " \"data_dir\" : \"/gisdata/arcgisdatastore\"\n", " },\r\n", " \"portal\" : {\n", " \"domain_name\" : \"", {"Ref": "SiteDomain"}, "\",\n", " \"private_url\" : \"https://", {"Ref": "SiteDomain"}, "/portal\",\n", " \"web_context_url\" : \"https://", {"Ref": "SiteDomain"}, "/portal\",\n", " \"admin_username\" : \"", {"Ref": "SiteAdmin"}, "\",\n", " \"admin_password\" : \"", {"Ref": "SiteAdminPassword"}, "\",\n", " \"data_dir\" : \"/gisdata/arcgisportal\",\n", " \"authorization_file\" : \"/tmp/", {"Ref": "PortalLicenseFile"}, "\"\n", " }\n", " },\n", " \"run_list\" : [\n", " \"recipe[apt]\",\n", " \"recipe[arcgis::system]\",\n", " \"recipe[java]\",\n", " \"recipe[arcgis::authbind]\",\n", " \"recipe[tomcat]\",\n", " \"recipe[arcgis::server]\",\n", " \"recipe[arcgis::server_wa]\",\n", " \"recipe[arcgis::datastore]\",\n", " \"recipe[arcgis::portal]\",\n", " \"recipe[arcgis::portal_wa]\",\n", " \"recipe[arcgis::federation]\"]\n", "}\n" ] ] } } } } } } }, "EC2InstanceRecoveryAlarm" : { "Type" : "AWS::CloudWatch::Alarm", "Properties" : { "AlarmDescription" : "Trigger a recovery when instance status check fails for 5 consecutive minutes.", "MetricName" : "StatusCheckFailed_System", "Namespace" : "AWS/EC2", "Statistic" : "Minimum", "Period" : "60", "EvaluationPeriods" : "5", "Threshold" : "0", "ComparisonOperator" : "GreaterThanThreshold", "AlarmActions" : [ {"Fn::Join" : ["", ["arn:aws:automate:", { "Ref" : "AWS::Region" }, ":ec2:recover" ]]} ], "Dimensions" : [ { "Name" : "InstanceId", "Value" : {"Ref" : "AllInOneEC2Instance"} } ] } }, "WaitHandle": { "Type": "AWS::CloudFormation::WaitConditionHandle", "Properties": {} }, "WaitCondition": { "Type": "AWS::CloudFormation::WaitCondition", "DependsOn": "AllInOneEC2Instance", "Properties": { "Handle": { "Ref": "WaitHandle" }, "Timeout": "7200" } }, "DeploymentLogs": { "Type": "AWS::Logs::LogGroup", "DeletionPolicy": "Retain", "Properties": { "RetentionInDays": 7 } } }, "Outputs": { "AdminURL": { "Value": {"Fn::Join": [ "", [ "https://", {"Ref": "SiteDomain"}, "/server/manager" ] ]}, "Description": "ArcGIS Server Administrator Directory URL" }, "RestURL": { "Value": {"Fn::Join": ["", [ "http://", {"Ref": "SiteDomain"}, "/server/rest" ] ]}, "Description": "ArcGIS REST Services Directory URL" }, "PortalURL": { "Value": {"Fn::Join": ["", [ "http://", {"Ref": "SiteDomain"}, "/portal/home" ] ]}, "Description": "Portal for ArcGIS Server Home URL" }, "LogsURL": { "Value": {"Fn::Join": ["", ["https://console.aws.amazon.com/cloudwatch/home?region=", {"Ref": "AWS::Region"}, "#logStream:group=", {"Ref": "DeploymentLogs"} ] ]}, "Description": "Deployment Logs" }, "VPCId" : { "Description" : "VPC ID", "Value" : {"Ref" : "VPC"} }, "SecurityGroup" : { "Description" : "Security group ID", "Value" : {"Fn::GetAtt" : ["EC2SecurityGroup", "GroupId"]} }, "RouteTable" : { "Description" : "Route table", "Value" : {"Ref" : "RouteTable"} } } }