template.yml

AWSTemplateFormatVersion: 2010-09-09
Description: >-
  Buildkite On-Demand Agent Scheduler

Transform:
- AWS::Serverless-2016-10-31

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      -
        Label:
          default: Buildkite
        Parameters:
          - BuildkiteAgentTokenParameterPath
          - BuildkiteQueue
      -
        Label:
          default: AWS
        Parameters:
          - EventBridgeBusName
          - VpcSubnetIds
          - EcsClusterName
    ParameterLabels:
      VpcSubnetIds:
        default: "Which VPC subnets should agent containers be scheduled in?"

Parameters:
  EventBridgeBusName:
    Type: String
    Description: Name of an EventBridge Bus in this region that receives Buildkite Partner Events, see https://buildkite.com/docs/integrations/amazon-eventbridge.
    AllowedPattern: ^[a-zA-Z0-9\-\._/]+
  BuildkiteQueue:
    Type: String
    Description: Queue name that agents will be scheduled for on-demand, targeted in pipeline steps using an agent query rule "queue={value}".
    AllowedPattern: ^[a-zA-Z0-9\-_]{1,50}
  BuildkiteAgentTokenParameterPath:
    Type: AWS::SSM::Parameter::Name
    Description: Buildkite Agent registration token parameter path, can be a String or SecureString.
    Default: /buildkite/agent-token
  VpcSubnetIds:
    Type: List<AWS::EC2::Subnet::Id>
    Description: List of VPC subnets to launch agent containers in.
  EcsClusterName:
    Type: String
    Description: Name of the ECS Cluster to schedule task definitions in.
  EcsLaunchType:
    Type: String
    Description: How to launch the task definition containers.
    AllowedValues:
      - FARGATE
      - EC2
    Default: FARGATE
  SshAgentBackend:
    Type: String
    Default: ''
    Description: (Optional) API Gateway Stage ARN for an iam-ssh-agent backend.
  ExecutionRolePrefix:
    Type: String
    Default: '/BuildkiteAgentExecution/'
    AllowedPattern: (\u002F[\u0021-\u007F]+\u002F)
  TaskRolePrefix:
    Type: String
    Default: '/BuildkiteAgentTask/'
    AllowedPattern: (\u002F[\u0021-\u007F]+\u002F)

Conditions:
  IncludeSshAgent: !Not [ !Equals [  !Ref SshAgentBackend, '' ] ]

Resources:
  RunTaskQueue:
    Type: AWS::SQS::Queue
    Properties:
      VisibilityTimeout: 300

  BuildkiteJobScheduledRule:
    Type: AWS::Events::Rule
    Properties:
      # Using BuildkiteQueue enforces that only one scheduler per queue is
      # attached to the EventBridge Bus.
      #
      # BuildkiteQueue can be 50, AWS::Events::Rule Name is limited to 64
      Name: !Sub "${BuildkiteQueue}-Queue"
      Description: Enqueue Job Scheduled events on an SQS queue.
      EventBusName: !Ref EventBridgeBusName
      EventPattern:
        account:
          - !Ref 'AWS::AccountId'
        detail-type:
          - "Job Scheduled"
        detail:
          job:
            agent_query_rules:
              - !Sub "queue=${BuildkiteQueue}"
      Targets:
        - Id: Queue
          Arn: !GetAtt RunTaskQueue.Arn
          InputPath: $.detail
  
  RunTaskQueuePolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      Queues:
        - !Ref RunTaskQueue
      PolicyDocument:
        Version: "2012-10-17"
        Id:
          !Sub
            - "${Queue}/SQSDefaultPolicy"
            - Queue: !GetAtt RunTaskQueue.Arn
        Statement:
          - Effect: "Allow"
            Principal:
              Service: "events.amazonaws.com"
            Action: "sqs:SendMessage"
            Resource: !GetAtt RunTaskQueue.Arn
            Condition:
              ArnEquals:
                "aws:SourceArn": !GetAtt BuildkiteJobScheduledRule.Arn

  BuildkiteRunTask:
    Type: AWS::Serverless::Function
    Properties:
      Description: A Lambda function that dequeues Buildkite Job Scheduled notifications from an SQS queue and runs an ECS task for them.
      Runtime: nodejs12.x
      Handler: buildkite-run-task.handler
      CodeUri: src/handlers/
      Events:
        SQSQueueEvent:
          Type: SQS
          Properties:
            Queue: !GetAtt RunTaskQueue.Arn
            BatchSize: 1
      MemorySize: 128
      Timeout: 105
      Policies:
        - AWSLambdaBasicExecutionRole
        - SQSPollerPolicy:
            QueueName: !GetAtt RunTaskQueue.QueueName
        - Statement:
          - Effect: Allow
            Action:
              - ecs:RunTask
              - ecs:RegisterTaskDefinition
            Resource: "*"
          - Effect: Allow
            Action: iam:PassRole
            Resource:
              - !Sub arn:aws:iam::${AWS::AccountId}:role${ExecutionRolePrefix}*
              - !Sub arn:aws:iam::${AWS::AccountId}:role${TaskRolePrefix}*
          Version: "2012-10-17"
      Environment:
        Variables:
          ECS_CLUSTER_NAME: !Ref EcsClusterName
          VPC_SUBNETS: !Join [ ',', !Ref VpcSubnetIds ]
          LAUNCH_TYPE: !Ref EcsLaunchType
          TASK_ROLE_ARN_PREFIX: !Sub "arn:aws:iam::${AWS::AccountId}:role${TaskRolePrefix}"
          DEFAULT_EXECUTION_ROLE_ARN: !GetAtt DefaultExecutionRole.Arn
          BUILDKITE_AGENT_TOKEN_PARAMETER_PATH: !Ref BuildkiteAgentTokenParameterPath
          IAM_SSH_AGENT_BACKEND_URL:
            !If
              - IncludeSshAgent
              - {
                  "Fn::Sub": [
                    "https://${ApiId}.execute-api.${Region}.amazonaws.com/${Stage}",
                    {
                      ApiId: {
                        "Fn::Select": [
                          5,
                          { "Fn::Split": [ ":", { "Fn::Select": [ 0, { "Fn::Split": [ "/", !Ref SshAgentBackend ] } ] } ] }
                        ]
                      },
                      Region: {
                        "Fn::Select": [
                          3,
                          { "Fn::Split": [ ":", { "Fn::Select": [ 0, { "Fn::Split": [ "/", !Ref SshAgentBackend ] } ] } ] }
                        ]
                      },
                      Stage: {
                        "Fn::Select": [
                          1,
                          { "Fn::Split": [ "/", !Ref SshAgentBackend ] }
                        ]
                      },
                    },
                  ]
                }
              - !Ref AWS::NoValue
  RunTaskLogGroup:
    Type: AWS::Logs::LogGroup
    DependsOn: BuildkiteRunTask
    Properties:
      RetentionInDays: 1
      LogGroupName:
        !Sub
        - '/aws/lambda/${LambdaName}'
        - LambdaName: !Ref BuildkiteRunTask

  DefaultExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: [ecs-tasks.amazonaws.com]
            Action: ['sts:AssumeRole']
      Path: !Ref ExecutionRolePrefix
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
      Policies:
        - PolicyName: FetchDecryptSecrets
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - 'ssm:GetParameter'
                  - 'ssm:GetParameters'
                Resource: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter${BuildkiteAgentTokenParameterPath}
              - Effect: Allow
                Action: kms:Decrypt
                Resource: !Sub arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/aws/ssm
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                  - logs:DescribeLogStreams
                Resource:
                  - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/ecs/ondemand-*
                  - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/ecs/ondemand-*:log-stream:*

  BuildkiteEventsLog:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub /aws/events/buildkite/${AWS::StackName}
      RetentionInDays: 1

  BuildkiteEventsLogRule:
    Type: AWS::Events::Rule
    Properties:
      # Using BuildkiteQueue enforces that only one scheduler per queue is
      # attached to the EventBridge Bus.
      #
      # BuildkiteQueue can be 50, AWS::Events::Rule Name is limited to 64
      Name: !Sub "${BuildkiteQueue}-Log"
      Description: Log all Buildkite events to a CloudWatch Log Group
      EventBusName: !Ref EventBridgeBusName
      EventPattern:
        account:
          - !Ref 'AWS::AccountId'
      Targets:
        - Id: Log
          Arn: !GetAtt BuildkiteEventsLog.Arn