AWSTemplateFormatVersion: '2010-09-09'
Description: 'Neptune BG Solution'
Parameters:
  LatestAmiId: 
    Description: Latest AMI Identifier
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: "/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2"
  NeptuneSourceClusterId:
    Description: Neptune Source (Blue) Cluster Id
    Type: String
  NeptuneTargetClusterVersion:
    Description: Neptune Target (green) cluster engine version
    Type: String
  DeploymentID:
    Description: Deployment identifier for BG solution. The same identifier used for creating green cluster.
    Type: String
    MinLength: 1
    MaxLength: 40
  DeploymentMode:
    Description: BG Deployment Mode. Permitted values new, resume.
    Type: String
    Default: new
    AllowedValues:
      - new
      - resume
  GraphQueryType:
    Description: Graph Query Type. Permitted values gremlin, sparql, propertygraph, pg, rdf. Default is gremlin.
    Type: String
    Default: gremlin
    AllowedValues:
      - gremlin
      - sparql
      - propertygraph
      - pg
      - rdf
  SubnetId:
    Description: Must be the name of an existing subnet id in the same VPC as Neptune database
    Type: AWS::EC2::Subnet::Id
    ConstraintDescription: must be the name of an existing subnet id in the same VPC as Neptune database
  InstanceSecurityGroup:
    Description: Instance Security Group should allow access to Neptune
    Type: AWS::EC2::SecurityGroup::Id
  InstanceType:
    Description: EC2 instance type used for kicking off BG solution
    Type: String
    Default: t2.small
    AllowedValues:
    - t1.micro
    - t2.nano
    - t2.micro
    - t2.small
    - t2.medium
    - t2.large
    - t3.large
    - t3.medium
    - t3.micro
    - t3.nano
    - t3.small
    - t3.xlarge
    - t3a.large
    - t3a.medium
    - t3a.micro
    - t3a.nano
    - t3a.small
    - t3a.xlarge
    - t4g.large
    - t4g.medium
    - t4g.micro
    - t4g.nano
    - t4g.small
    - t4g.xlarge
    ConstraintDescription: must be a valid EC2 instance type.
Resources:
  EC2InstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/NeptuneFullAccess
        - arn:aws:iam::aws:policy/AWSLambda_FullAccess
        - arn:aws:iam::aws:policy/CloudWatchFullAccess
        - arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess
        - arn:aws:iam::aws:policy/AmazonEC2FullAccess
        - arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
        - arn:aws:iam::aws:policy/AWSStepFunctionsFullAccess
        - arn:aws:iam::aws:policy/CloudWatchEventsFullAccess
      Policies:
        - PolicyName: NeptuneBGCustomPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                 - 'iam:CreateRole'
                 - 'iam:CreatePolicy'
                 - 'iam:DeleteRole'
                 - 'iam:DeleteRolePolicy'
                 - 'iam:PutRolePolicy'
                 - 'iam:GetRole'
                 - 'iam:GetRolePolicy'
                 - 'iam:AttachRolePolicy'
                 - 'iam:TagRole'
                Resource: '*'
              - Effect: Allow
                Action:
                 - 'iam:PassRole'
                Resource:
                    - 'arn:aws:iam::*:role/*'
              - Effect: Allow
                Action:
                  - 'cloudformation:DescribeStacks'
                  - 'cloudformation:CreateStack'
                Resource: '*'
  EC2InstanceProfile: 
    Type: AWS::IAM::InstanceProfile
    Properties: 
      Path: /
      Roles: 
        - !Ref EC2InstanceRole
  EC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: !Ref InstanceType
      SecurityGroupIds: [!Ref InstanceSecurityGroup]
      IamInstanceProfile: !Ref EC2InstanceProfile
      UserData:
        Fn::Base64: !Sub |
                #!/bin/bash 
                cd /home/ec2-user/
                yum update -y
                yum -y install tmux screen
                curl https://aws-neptune-customer-samples-us-east-1.s3.amazonaws.com/neptune-bg/bg.zip --output bg.zip
                unzip bg.zip
                chmod 700 bg.py
                pip3 install schedule boto3 aws_requests_auth requests uuid watchtower urllib3==1.26
                echo $PWD
                python3 bg.py -s ${NeptuneSourceClusterId}  -t ${NeptuneTargetClusterVersion} -d ${DeploymentID} -g ${GraphQueryType} -m ${DeploymentMode}
      ImageId: !Ref LatestAmiId
      SubnetId: !Ref SubnetId
      Tags:
        - Key: Name
          Value: !Ref DeploymentID
        - Key: CloudformationStackName
          Value: !Ref 'AWS::StackName'
        - Key: Application
          Value: "BlueGreenDeployment"

Outputs:
  InstanceId:
    Description: InstanceId of the newly created EC2 instance
    Value:
      Ref: EC2Instance

  CloudWatchLogLink:
    Description: CloudWatch Log Link
    Value: !Join
      - ''
      - - 'https://'
        - !Ref 'AWS::Region'
        - '.console.aws.amazon.com/cloudwatch/home?region='
        - !Ref 'AWS::Region'
        - '#logsV2:log-groups/log-group/$252Faws$252Fneptune$252F'
        - !Ref DeploymentID
