template.yaml

Resources:
  SonarQubeSG6C05C623:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Aurora Security Group
      SecurityGroupEgress:
        - CidrIp: 0.0.0.0/0
          Description: Allow all outbound traffic by default
          IpProtocol: "-1"
      SecurityGroupIngress:
        - CidrIp: 0.0.0.0/0
          Description: SonarDBAurora
          FromPort: 5432
          IpProtocol: tcp
          ToPort: 5432
      VpcId: vpc-0a80e435cc7a23539
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarQubeSG/Resource
  SonarDBClusterSubnetsAB5EA67D:
    Type: AWS::RDS::DBSubnetGroup
    Properties:
      DBSubnetGroupDescription: Subnets for SonarDBCluster database
      SubnetIds:
        - subnet-0a7a0a3d8744f386f
        - subnet-080a99253fa7f5a12
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarDBCluster/Subnets/Default
  SonarDBClusterSecret8F820211:
    Type: AWS::SecretsManager::Secret
    Properties:
      Description:
        Fn::Join:
          - ""
          - - "Generated by the CDK for stack: "
            - Ref: AWS::StackName
      GenerateSecretString:
        ExcludeCharacters: " %+~`#$&*()|[]{}:;<>?!'/@\"\\"
        GenerateStringKey: password
        PasswordLength: 30
        SecretStringTemplate: '{"username":"postgres"}'
    UpdateReplacePolicy: Delete
    DeletionPolicy: Delete
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarDBCluster/Secret/Resource
  SonarDBClusterSecretAttachment74FE44D9:
    Type: AWS::SecretsManager::SecretTargetAttachment
    Properties:
      SecretId:
        Ref: SonarDBClusterSecret8F820211
      TargetId:
        Ref: SonarDBClusterE2562227
      TargetType: AWS::RDS::DBCluster
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarDBCluster/Secret/Attachment/Resource
  SonarDBClusterE2562227:
    Type: AWS::RDS::DBCluster
    Properties:
      CopyTagsToSnapshot: true
      DatabaseName: sonarqube
      DBClusterParameterGroupName: default.aurora-postgresql12
      DBSubnetGroupName:
        Ref: SonarDBClusterSubnetsAB5EA67D
      Engine: aurora-postgresql
      EngineVersion: "12.9"
      MasterUsername:
        Fn::Join:
          - ""
          - - "{{resolve:secretsmanager:"
            - Ref: SonarDBClusterSecret8F820211
            - :SecretString:username::}}
      MasterUserPassword:
        Fn::Join:
          - ""
          - - "{{resolve:secretsmanager:"
            - Ref: SonarDBClusterSecret8F820211
            - :SecretString:password::}}
      Port: 5432
      VpcSecurityGroupIds:
        - Fn::GetAtt:
            - SonarQubeSG6C05C623
            - GroupId
    UpdateReplacePolicy: Snapshot
    DeletionPolicy: Snapshot
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarDBCluster/Resource
  SonarDBClusterInstance107C65031:
    Type: AWS::RDS::DBInstance
    Properties:
      DBClusterIdentifier:
        Ref: SonarDBClusterE2562227
      DBInstanceClass: db.t3.medium
      DBSubnetGroupName:
        Ref: SonarDBClusterSubnetsAB5EA67D
      Engine: aurora-postgresql
    UpdateReplacePolicy: Delete
    DeletionPolicy: Delete
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarDBCluster/Instance1
  SonarDBClusterInstance29E32FBB9:
    Type: AWS::RDS::DBInstance
    Properties:
      DBClusterIdentifier:
        Ref: SonarDBClusterE2562227
      DBInstanceClass: db.t3.medium
      DBSubnetGroupName:
        Ref: SonarDBClusterSubnetsAB5EA67D
      Engine: aurora-postgresql
    UpdateReplacePolicy: Delete
    DeletionPolicy: Delete
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarDBCluster/Instance2
  SonarCluster26427412:
    Type: AWS::ECS::Cluster
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarCluster/Resource
  SonarClusterDefaultAutoScalingGroupInstanceSecurityGroup5A14A3BB:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: CdkPythoncStack/SonarCluster/DefaultAutoScalingGroup/InstanceSecurityGroup
      SecurityGroupEgress:
        - CidrIp: 0.0.0.0/0
          Description: Allow all outbound traffic by default
          IpProtocol: "-1"
      Tags:
        - Key: Name
          Value: CdkPythoncStack/SonarCluster/DefaultAutoScalingGroup
      VpcId: vpc-0a80e435cc7a23539
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarCluster/DefaultAutoScalingGroup/InstanceSecurityGroup/Resource
  SonarClusterDefaultAutoScalingGroupInstanceSecurityGroupfromCdkPythoncStackSonarServiceLBSecurityGroupDFB0343F3276865535ECA716E1:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      IpProtocol: tcp
      Description: Load balancer to target
      FromPort: 32768
      GroupId:
        Fn::GetAtt:
          - SonarClusterDefaultAutoScalingGroupInstanceSecurityGroup5A14A3BB
          - GroupId
      SourceSecurityGroupId:
        Fn::GetAtt:
          - SonarServiceLBSecurityGroup155666B5
          - GroupId
      ToPort: 65535
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarCluster/DefaultAutoScalingGroup/InstanceSecurityGroup/from CdkPythoncStackSonarServiceLBSecurityGroupDFB0343F:32768-65535
  SonarClusterDefaultAutoScalingGroupInstanceRole1E491345:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
        Version: "2012-10-17"
      Tags:
        - Key: Name
          Value: CdkPythoncStack/SonarCluster/DefaultAutoScalingGroup
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarCluster/DefaultAutoScalingGroup/InstanceRole/Resource
  SonarClusterDefaultAutoScalingGroupInstanceRoleDefaultPolicy2210237C:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
          - Action:
              - ecs:DeregisterContainerInstance
              - ecs:RegisterContainerInstance
              - ecs:Submit*
            Effect: Allow
            Resource:
              Fn::GetAtt:
                - SonarCluster26427412
                - Arn
          - Action:
              - ecs:Poll
              - ecs:StartTelemetrySession
            Condition:
              ArnEquals:
                ecs:cluster:
                  Fn::GetAtt:
                    - SonarCluster26427412
                    - Arn
            Effect: Allow
            Resource: "*"
          - Action:
              - ecr:GetAuthorizationToken
              - ecs:DiscoverPollEndpoint
              - logs:CreateLogStream
              - logs:PutLogEvents
            Effect: Allow
            Resource: "*"
        Version: "2012-10-17"
      PolicyName: SonarClusterDefaultAutoScalingGroupInstanceRoleDefaultPolicy2210237C
      Roles:
        - Ref: SonarClusterDefaultAutoScalingGroupInstanceRole1E491345
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarCluster/DefaultAutoScalingGroup/InstanceRole/DefaultPolicy/Resource
  SonarClusterDefaultAutoScalingGroupInstanceProfileB6433243:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - Ref: SonarClusterDefaultAutoScalingGroupInstanceRole1E491345
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarCluster/DefaultAutoScalingGroup/InstanceProfile
  SonarClusterDefaultAutoScalingGroupLaunchConfig49841B24:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      ImageId:
        Ref: SsmParameterValueawsserviceecsoptimizedamiamazonlinux2recommendedimageidC96584B6F00A464EAD1953AFF4B05118Parameter
      InstanceType: t3.large
      IamInstanceProfile:
        Ref: SonarClusterDefaultAutoScalingGroupInstanceProfileB6433243
      SecurityGroups:
        - Fn::GetAtt:
            - SonarClusterDefaultAutoScalingGroupInstanceSecurityGroup5A14A3BB
            - GroupId
      UserData:
        Fn::Base64:
          Fn::Join:
            - ""
            - - |-
                #!/bin/bash
                echo ECS_CLUSTER=
              - Ref: SonarCluster26427412
              - |-2
                 >> /etc/ecs/ecs.config
                sudo iptables --insert FORWARD 1 --in-interface docker+ --destination 169.254.169.254/32 --jump DROP
                sudo service iptables save
                echo ECS_AWSVPC_BLOCK_IMDS=true >> /etc/ecs/ecs.config
                sysctl -qw vm.max_map_count=262144
                sysctl -w fs.file-max=65536
                ulimit -n 65536
                ulimit -u 4096
    DependsOn:
      - SonarClusterDefaultAutoScalingGroupInstanceRoleDefaultPolicy2210237C
      - SonarClusterDefaultAutoScalingGroupInstanceRole1E491345
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarCluster/DefaultAutoScalingGroup/LaunchConfig
  SonarClusterDefaultAutoScalingGroupASG8768A876:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      MaxSize: "1"
      MinSize: "1"
      LaunchConfigurationName:
        Ref: SonarClusterDefaultAutoScalingGroupLaunchConfig49841B24
      Tags:
        - Key: Name
          PropagateAtLaunch: true
          Value: CdkPythoncStack/SonarCluster/DefaultAutoScalingGroup
      VPCZoneIdentifier:
        - subnet-0a7a0a3d8744f386f
        - subnet-080a99253fa7f5a12
    UpdatePolicy:
      AutoScalingReplacingUpdate:
        WillReplace: true
      AutoScalingScheduledAction:
        IgnoreUnmodifiedGroupSizeProperties: true
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarCluster/DefaultAutoScalingGroup/ASG
  SonarClusterDefaultAutoScalingGroupDrainECSHookFunctionServiceRole486D5691:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
        Version: "2012-10-17"
      ManagedPolicyArns:
        - Fn::Join:
            - ""
            - - "arn:"
              - Ref: AWS::Partition
              - :iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Tags:
        - Key: Name
          Value: CdkPythoncStack/SonarCluster/DefaultAutoScalingGroup
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarCluster/DefaultAutoScalingGroup/DrainECSHook/Function/ServiceRole/Resource
  SonarClusterDefaultAutoScalingGroupDrainECSHookFunctionServiceRoleDefaultPolicyB468CFBE:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
          - Action:
              - ec2:DescribeHosts
              - ec2:DescribeInstanceAttribute
              - ec2:DescribeInstanceStatus
              - ec2:DescribeInstances
            Effect: Allow
            Resource: "*"
          - Action: autoscaling:CompleteLifecycleAction
            Effect: Allow
            Resource:
              Fn::Join:
                - ""
                - - arn:aws:autoscaling:eu-central-1:838223663339:autoScalingGroup:*:autoScalingGroupName/
                  - Ref: SonarClusterDefaultAutoScalingGroupASG8768A876
          - Action:
              - ecs:DescribeContainerInstances
              - ecs:DescribeTasks
              - ecs:ListTasks
              - ecs:UpdateContainerInstancesState
            Condition:
              ArnEquals:
                ecs:cluster:
                  Fn::GetAtt:
                    - SonarCluster26427412
                    - Arn
            Effect: Allow
            Resource: "*"
          - Action:
              - ecs:ListContainerInstances
              - ecs:SubmitContainerStateChange
              - ecs:SubmitTaskStateChange
            Effect: Allow
            Resource:
              Fn::GetAtt:
                - SonarCluster26427412
                - Arn
        Version: "2012-10-17"
      PolicyName: SonarClusterDefaultAutoScalingGroupDrainECSHookFunctionServiceRoleDefaultPolicyB468CFBE
      Roles:
        - Ref: SonarClusterDefaultAutoScalingGroupDrainECSHookFunctionServiceRole486D5691
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarCluster/DefaultAutoScalingGroup/DrainECSHook/Function/ServiceRole/DefaultPolicy/Resource
  SonarClusterDefaultAutoScalingGroupDrainECSHookFunction3E1C6F0C:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        ZipFile: |
          import boto3, json, os, time

          ecs = boto3.client('ecs')
          autoscaling = boto3.client('autoscaling')


          def lambda_handler(event, context):
            print(json.dumps(dict(event, ResponseURL='...')))
            cluster = os.environ['CLUSTER']
            snsTopicArn = event['Records'][0]['Sns']['TopicArn']
            lifecycle_event = json.loads(event['Records'][0]['Sns']['Message'])
            instance_id = lifecycle_event.get('EC2InstanceId')
            if not instance_id:
              print('Got event without EC2InstanceId: %s', json.dumps(dict(event, ResponseURL='...')))
              return

            instance_arn = container_instance_arn(cluster, instance_id)
            print('Instance %s has container instance ARN %s' % (lifecycle_event['EC2InstanceId'], instance_arn))

            if not instance_arn:
              return

            task_arns = container_instance_task_arns(cluster, instance_arn)

            if task_arns:
              print('Instance ARN %s has task ARNs %s' % (instance_arn, ', '.join(task_arns)))

            while has_tasks(cluster, instance_arn, task_arns):
              time.sleep(10)

            try:
              print('Terminating instance %s' % instance_id)
              autoscaling.complete_lifecycle_action(
                  LifecycleActionResult='CONTINUE',
                  **pick(lifecycle_event, 'LifecycleHookName', 'LifecycleActionToken', 'AutoScalingGroupName'))
            except Exception as e:
              # Lifecycle action may have already completed.
              print(str(e))


          def container_instance_arn(cluster, instance_id):
            """Turn an instance ID into a container instance ARN."""
            arns = ecs.list_container_instances(cluster=cluster, filter='ec2InstanceId==' + instance_id)['containerInstanceArns']
            if not arns:
              return None
            return arns[0]

          def container_instance_task_arns(cluster, instance_arn):
            """Fetch tasks for a container instance ARN."""
            arns = ecs.list_tasks(cluster=cluster, containerInstance=instance_arn)['taskArns']
            return arns

          def has_tasks(cluster, instance_arn, task_arns):
            """Return True if the instance is running tasks for the given cluster."""
            instances = ecs.describe_container_instances(cluster=cluster, containerInstances=[instance_arn])['containerInstances']
            if not instances:
              return False
            instance = instances[0]

            if instance['status'] == 'ACTIVE':
              # Start draining, then try again later
              set_container_instance_to_draining(cluster, instance_arn)
              return True

            task_count = None

            if task_arns:
              # Fetch details for tasks running on the container instance
              tasks = ecs.describe_tasks(cluster=cluster, tasks=task_arns)['tasks']
              if tasks:
                # Consider any non-stopped tasks as running
                task_count = sum(task['lastStatus'] != 'STOPPED' for task in tasks) + instance['pendingTasksCount']

            if not task_count:
              # Fallback to instance task counts if detailed task information is unavailable
              task_count = instance['runningTasksCount'] + instance['pendingTasksCount']

            print('Instance %s has %s tasks' % (instance_arn, task_count))

            return task_count > 0

          def set_container_instance_to_draining(cluster, instance_arn):
            ecs.update_container_instances_state(
                cluster=cluster,
                containerInstances=[instance_arn], status='DRAINING')


          def pick(dct, *keys):
            """Pick a subset of a dict."""
            return {k: v for k, v in dct.items() if k in keys}
      Role:
        Fn::GetAtt:
          - SonarClusterDefaultAutoScalingGroupDrainECSHookFunctionServiceRole486D5691
          - Arn
      Environment:
        Variables:
          CLUSTER:
            Ref: SonarCluster26427412
      Handler: index.lambda_handler
      Runtime: python3.9
      Tags:
        - Key: Name
          Value: CdkPythoncStack/SonarCluster/DefaultAutoScalingGroup
      Timeout: 310
    DependsOn:
      - SonarClusterDefaultAutoScalingGroupDrainECSHookFunctionServiceRoleDefaultPolicyB468CFBE
      - SonarClusterDefaultAutoScalingGroupDrainECSHookFunctionServiceRole486D5691
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarCluster/DefaultAutoScalingGroup/DrainECSHook/Function/Resource
  SonarClusterDefaultAutoScalingGroupDrainECSHookFunctionAllowInvokeCdkPythoncStackSonarClusterDefaultAutoScalingGroupLifecycleHookDrainHookTopic689529115C307343:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName:
        Fn::GetAtt:
          - SonarClusterDefaultAutoScalingGroupDrainECSHookFunction3E1C6F0C
          - Arn
      Principal: sns.amazonaws.com
      SourceArn:
        Ref: SonarClusterDefaultAutoScalingGroupLifecycleHookDrainHookTopic34CD5F37
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarCluster/DefaultAutoScalingGroup/DrainECSHook/Function/AllowInvoke:CdkPythoncStackSonarClusterDefaultAutoScalingGroupLifecycleHookDrainHookTopic68952911
  SonarClusterDefaultAutoScalingGroupDrainECSHookFunctionTopic1EBB0E98:
    Type: AWS::SNS::Subscription
    Properties:
      Protocol: lambda
      TopicArn:
        Ref: SonarClusterDefaultAutoScalingGroupLifecycleHookDrainHookTopic34CD5F37
      Endpoint:
        Fn::GetAtt:
          - SonarClusterDefaultAutoScalingGroupDrainECSHookFunction3E1C6F0C
          - Arn
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarCluster/DefaultAutoScalingGroup/DrainECSHook/Function/Topic/Resource
  SonarClusterDefaultAutoScalingGroupLifecycleHookDrainHookTopic34CD5F37:
    Type: AWS::SNS::Topic
    Properties:
      Tags:
        - Key: Name
          Value: CdkPythoncStack/SonarCluster/DefaultAutoScalingGroup
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarCluster/DefaultAutoScalingGroup/LifecycleHookDrainHook/Topic/Resource
  SonarClusterDefaultAutoScalingGroupLifecycleHookDrainHookRoleE08A5DEC:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: autoscaling.amazonaws.com
        Version: "2012-10-17"
      Tags:
        - Key: Name
          Value: CdkPythoncStack/SonarCluster/DefaultAutoScalingGroup
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarCluster/DefaultAutoScalingGroup/LifecycleHookDrainHook/Role/Resource
  SonarClusterDefaultAutoScalingGroupLifecycleHookDrainHookRoleDefaultPolicy713100C9:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
          - Action: sns:Publish
            Effect: Allow
            Resource:
              Ref: SonarClusterDefaultAutoScalingGroupLifecycleHookDrainHookTopic34CD5F37
        Version: "2012-10-17"
      PolicyName: SonarClusterDefaultAutoScalingGroupLifecycleHookDrainHookRoleDefaultPolicy713100C9
      Roles:
        - Ref: SonarClusterDefaultAutoScalingGroupLifecycleHookDrainHookRoleE08A5DEC
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarCluster/DefaultAutoScalingGroup/LifecycleHookDrainHook/Role/DefaultPolicy/Resource
  SonarClusterDefaultAutoScalingGroupLifecycleHookDrainHook082C154E:
    Type: AWS::AutoScaling::LifecycleHook
    Properties:
      AutoScalingGroupName:
        Ref: SonarClusterDefaultAutoScalingGroupASG8768A876
      LifecycleTransition: autoscaling:EC2_INSTANCE_TERMINATING
      DefaultResult: CONTINUE
      HeartbeatTimeout: 300
      NotificationTargetARN:
        Ref: SonarClusterDefaultAutoScalingGroupLifecycleHookDrainHookTopic34CD5F37
      RoleARN:
        Fn::GetAtt:
          - SonarClusterDefaultAutoScalingGroupLifecycleHookDrainHookRoleE08A5DEC
          - Arn
    DependsOn:
      - SonarClusterDefaultAutoScalingGroupLifecycleHookDrainHookRoleDefaultPolicy713100C9
      - SonarClusterDefaultAutoScalingGroupLifecycleHookDrainHookRoleE08A5DEC
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarCluster/DefaultAutoScalingGroup/LifecycleHookDrainHook/Resource
  SonarTaskRoleED103E92:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
        Version: "2012-10-17"
      ManagedPolicyArns:
        - Fn::Join:
            - ""
            - - "arn:"
              - Ref: AWS::Partition
              - :iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
      RoleName: SonarTaskRole
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarTaskRole/Resource
  SonarTaskRoleDefaultPolicy17297841:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
          - Action:
              - secretsmanager:DescribeSecret
              - secretsmanager:GetSecretValue
            Effect: Allow
            Resource:
              Ref: SonarDBClusterSecretAttachment74FE44D9
        Version: "2012-10-17"
      PolicyName: SonarTaskRoleDefaultPolicy17297841
      Roles:
        - Ref: SonarTaskRoleED103E92
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarTaskRole/DefaultPolicy/Resource
  SonarServiceLBEE839818:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      LoadBalancerAttributes:
        - Key: deletion_protection.enabled
          Value: "false"
      Scheme: internet-facing
      SecurityGroups:
        - Fn::GetAtt:
            - SonarServiceLBSecurityGroup155666B5
            - GroupId
      Subnets:
        - subnet-05f06d57a1389f223
        - subnet-026e1999bbb0bb80c
      Type: application
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarService/LB/Resource
  SonarServiceLBSecurityGroup155666B5:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Automatically created Security Group for ELB CdkPythoncStackSonarServiceLB50EC59E6
      SecurityGroupIngress:
        - CidrIp: 0.0.0.0/0
          Description: Allow from anyone on port 80
          FromPort: 80
          IpProtocol: tcp
          ToPort: 80
      VpcId: vpc-0a80e435cc7a23539
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarService/LB/SecurityGroup/Resource
  SonarServiceLBSecurityGrouptoCdkPythoncStackSonarClusterDefaultAutoScalingGroupInstanceSecurityGroupC7F1071B32768655356F39771B:
    Type: AWS::EC2::SecurityGroupEgress
    Properties:
      GroupId:
        Fn::GetAtt:
          - SonarServiceLBSecurityGroup155666B5
          - GroupId
      IpProtocol: tcp
      Description: Load balancer to target
      DestinationSecurityGroupId:
        Fn::GetAtt:
          - SonarClusterDefaultAutoScalingGroupInstanceSecurityGroup5A14A3BB
          - GroupId
      FromPort: 32768
      ToPort: 65535
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarService/LB/SecurityGroup/to CdkPythoncStackSonarClusterDefaultAutoScalingGroupInstanceSecurityGroupC7F1071B:32768-65535
  SonarServiceLBPublicListenerD6C54638:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - TargetGroupArn:
            Ref: SonarServiceLBPublicListenerECSGroup1BFB21EC
          Type: forward
      LoadBalancerArn:
        Ref: SonarServiceLBEE839818
      Port: 80
      Protocol: HTTP
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarService/LB/PublicListener/Resource
  SonarServiceLBPublicListenerECSGroup1BFB21EC:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Port: 80
      Protocol: HTTP
      TargetGroupAttributes:
        - Key: stickiness.enabled
          Value: "false"
      TargetType: instance
      VpcId: vpc-0a80e435cc7a23539
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarService/LB/PublicListener/ECSGroup/Resource
  SonarServiceTaskDefED6D849E:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        - Environment:
            - Name: sonar.jdbc.url
              Value:
                Fn::Join:
                  - ""
                  - - jdbc:postgresql://
                    - Fn::GetAtt:
                        - SonarDBClusterE2562227
                        - Endpoint.Address
                    - ":"
                    - Fn::GetAtt:
                        - SonarDBClusterE2562227
                        - Endpoint.Port
                    - /sonarqube
          Essential: true
          Image: sonarqube:9.8-community
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group:
                Ref: SonarServiceTaskDefwebLogGroup6DBF3E58
              awslogs-stream-prefix: SonarService
              awslogs-region: eu-central-1
          Memory: 2048
          Name: web
          PortMappings:
            - ContainerPort: 9000
              HostPort: 0
              Protocol: tcp
          Secrets:
            - Name: sonar.jdbc.username
              ValueFrom:
                Fn::Join:
                  - ""
                  - - Ref: SonarDBClusterSecretAttachment74FE44D9
                    - ":username::"
            - Name: sonar.jdbc.password
              ValueFrom:
                Fn::Join:
                  - ""
                  - - Ref: SonarDBClusterSecretAttachment74FE44D9
                    - ":password::"
          Ulimits:
            - HardLimit: 65536
              Name: nofile
              SoftLimit: 65536
      ExecutionRoleArn:
        Fn::GetAtt:
          - SonarServiceTaskDefExecutionRoleEF6A9987
          - Arn
      Family: CdkPythoncStackSonarServiceTaskDef1530315E
      NetworkMode: bridge
      RequiresCompatibilities:
        - EC2
      TaskRoleArn:
        Fn::GetAtt:
          - SonarTaskRoleED103E92
          - Arn
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarService/TaskDef/Resource
  SonarServiceTaskDefwebLogGroup6DBF3E58:
    Type: AWS::Logs::LogGroup
    UpdateReplacePolicy: Retain
    DeletionPolicy: Retain
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarService/TaskDef/web/LogGroup/Resource
  SonarServiceTaskDefExecutionRoleEF6A9987:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
        Version: "2012-10-17"
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarService/TaskDef/ExecutionRole/Resource
  SonarServiceTaskDefExecutionRoleDefaultPolicy639B757E:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
          - Action:
              - logs:CreateLogStream
              - logs:PutLogEvents
            Effect: Allow
            Resource:
              Fn::GetAtt:
                - SonarServiceTaskDefwebLogGroup6DBF3E58
                - Arn
          - Action:
              - secretsmanager:DescribeSecret
              - secretsmanager:GetSecretValue
            Effect: Allow
            Resource:
              Ref: SonarDBClusterSecretAttachment74FE44D9
        Version: "2012-10-17"
      PolicyName: SonarServiceTaskDefExecutionRoleDefaultPolicy639B757E
      Roles:
        - Ref: SonarServiceTaskDefExecutionRoleEF6A9987
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarService/TaskDef/ExecutionRole/DefaultPolicy/Resource
  SonarServiceF91D02E7:
    Type: AWS::ECS::Service
    Properties:
      Cluster:
        Ref: SonarCluster26427412
      DeploymentConfiguration:
        MaximumPercent: 100
        MinimumHealthyPercent: 0
      DesiredCount: 1
      EnableECSManagedTags: false
      HealthCheckGracePeriodSeconds: 60
      LaunchType: EC2
      LoadBalancers:
        - ContainerName: web
          ContainerPort: 9000
          TargetGroupArn:
            Ref: SonarServiceLBPublicListenerECSGroup1BFB21EC
      SchedulingStrategy: REPLICA
      TaskDefinition:
        Ref: SonarServiceTaskDefED6D849E
    DependsOn:
      - SonarServiceLBPublicListenerECSGroup1BFB21EC
      - SonarServiceLBPublicListenerD6C54638
    Metadata:
      aws:cdk:path: CdkPythoncStack/SonarService/Service/Service
  CDKMetadata:
    Type: AWS::CDK::Metadata
    Properties:
      Analytics: v2:deflate64:H4sIAAAAAAAA/31TTW/bMAz9Lb0rGuABBXZMm24rEGBBkntBy7TDRZYMfXQIDP/30XKUqe3Qk/j4SJF8lCp5X8nqDv74lWrOK021HA8B1Fns0dvoFArmXkZUFROooqNw+eFsHMRjaz53PJvOofcf/E/JPQnXeDluIEANHh919AGdOMTaYLhduHkoHTmYr3MYFj4nJvBsfACjcBI+hfgeDHTo5Lg0MWctxxFch2EdeNZTjyaIW8B7ZhKouNGiTjafVHUEf95gS4YCWTOT7z3WBCCDrvBx3gHdK7G4qWoyJwExWK9Ak+nkuGZwWMBNjC1Eo058Y0tddJArfgjdUovqojT+tPacEkvHJAh6Oe6tTuXTubOa1GWG/6ys5c7ZljT3p6GvG5Djd+4i1y7tHbqevGfE8huWjFfnlaMhB7zBRzuQSoLNRhL5ZYDAunLqehi4jTTh1kLzAHrupCmEQw0+kNLM1onl6V/5jf4/M63tDS7jiLdprjHZLvjlQdy2UEDWxHY86NYWS7ra05Q0AQc9Xt/NrxiGmF5a/lyT2F3CyZovX+U3eX/32xOtXDSBepT75fwLv85WN6IDAAA=
    Metadata:
      aws:cdk:path: CdkPythoncStack/CDKMetadata/Default
Parameters:
  SsmParameterValueawsserviceecsoptimizedamiamazonlinux2recommendedimageidC96584B6F00A464EAD1953AFF4B05118Parameter:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ecs/optimized-ami/amazon-linux-2/recommended/image_id
  BootstrapVersion:
    Type: AWS::SSM::Parameter::Value<String>
    Default: /cdk-bootstrap/hnb659fds/version
    Description: Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]
Outputs:
  SonarServiceLoadBalancerDNSF086EBD2:
    Value:
      Fn::GetAtt:
        - SonarServiceLBEE839818
        - DNSName
  SonarServiceServiceURL18C7E97E:
    Value:
      Fn::Join:
        - ""
        - - http://
          - Fn::GetAtt:
              - SonarServiceLBEE839818
              - DNSName
Rules:
  CheckBootstrapVersion:
    Assertions:
      - Assert:
          Fn::Not:
            - Fn::Contains:
                - - "1"
                  - "2"
                  - "3"
                  - "4"
                  - "5"
                - Ref: BootstrapVersion
        AssertDescription: CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI.