Used AWS Copilot to Generate an ECS Cluster Environment

Used AWS Copilot to Generate a Highly Available, Durable ECS Cluster Environment

In this blog article, I will explore how AWS Copilot enables me to effortlessly create and deploy a robust 3-tier environment for a WordPress application on Amazon Elastic Container Service (ECS) with AWS Fargate. The architecture includes Elasticache Redis, Aurora DB for MySQL, Amazon EFS for the application’s file system, and an Application Load Balancer (ALB) to distribute traffic. Additionally, I will utilize various AWS services like Route 53 for DNS, CloudFront for CDN, ACM for SSL certificates, and CloudWatch for monitoring. AWS Copilot will automate the deployment process through CodePipeline and manage container resources in Amazon Elastic Container Registry (ECR) efficiently. MySQL credentials will be securely stored in Secrets Manager, and Redis will operate in a multi-AZ environment with a Primary and Replica node.

AWS Copilot Introduction:
AWS Copilot is an open-source command-line interface (CLI) tool that simplifies the deployment and management of containerized applications on AWS. It abstracts the complexities of infrastructure provisioning, deployment, scaling, and monitoring, making it an ideal choice for efficiently managing a 3-tier environment.

Setting up the Environment:
First, I set up the environment using AWS Copilot CLI. I create a new application and service, specifying that I want to use ECS and Fargate. Copilot will handle the ECS cluster and task definition creation automatically.

Deploying WordPress on ECS and Fargate:
Using the Copilot CLI, I deploy the WordPress application as a service on ECS with Fargate. Copilot generates the necessary task definitions and launches containers for the application.

Using Elasticache Redis:
I integrate Elasticache Redis into the WordPress application to enhance performance and caching capabilities. Copilot helps configure the Redis cluster, including setting up a Redis Primary node complemented by a Redis Replica in another Availability Zone (AZ) for high availability.

Aurora MySQL Database:
Next, I set up an Aurora MySQL database using Copilot, creating a Primary DB in one AZ and a Standby DB in another AZ for redundancy and disaster recovery.

Amazon EFS for File Storage:
Copilot enables me to utilize Amazon EFS as the shared file storage for our WordPress application, allowing seamless file access from multiple ECS tasks and ensuring data persistence.

Application Load Balancer (ALB):
I leverage an ALB in front of the ECS service to distribute incoming traffic across multiple containers and ensure high availability.

Route 53 and CloudFront Integration:
Copilot facilitates integrating Route 53 for DNS management and CloudFront for content delivery, providing global availability and accelerated content delivery through CDN.

ACM for SSL Certificates:
Using ACM, I automatically generate and manage SSL certificates to secure communications between the clients and the WordPress application.

Auto Scaling with Spot Instances:
With Copilot, I configure auto scaling for the ECS service, utilizing a mix of on-demand and spot instances. The scaling group will maintain a minimum of 1 to 4 instances, with 2-4 of them being spot instances when available. When spot instances are not available, additional standard instances will supplement the cluster for high availability until spot instances are available.

CloudWatch Metrics Activation:
Copilot automatically activates CloudWatch metrics, allowing me to monitor the performance of our ECS tasks, services, and containers.

CodePipeline for Automation:
AWS Copilot simplifies the CI/CD process by generating a CodePipeline. This pipeline automates the workflow, building Docker images, pushing them to ECR, and deploying the changes to the ECS environment.

MySQL Credentials in Secrets Manager:
Copilot ensures the secure management of MySQL credentials by storing them in AWS Secrets Manager, adding an extra layer of protection to sensitive data.

# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: MIT-0
AWSTemplateFormatVersion: 2010-09-09
Description: Configure the AWSCloudFormationStackSetAdministrationRole to enable use of AWS CloudFormation StackSets.
Metadata:
  TemplateVersion: 'v1.2.0'
Parameters:
  AdminRoleName:
    Type: String
  ExecutionRoleName:
    Type: String
  DNSDelegationRoleName:
    Type: String
    Default: ""
  AppDNSDelegatedAccounts:
    Type: CommaDelimitedList
    Default: ""
  AppDomainName:
    Type: String
    Default: ""
  AppDomainHostedZoneID:
    Type: String
    Default: ""
  AppName:
    Type: String
Conditions:
  DelegateDNS:
    !Not [!Equals [ !Ref AppDomainName, "" ]]

Resources:
  AdministrationRole:
    Metadata:
      'aws:copilot:description': 'A StackSet admin role assumed by CloudFormation to manage regional stacks'
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref AdminRoleName
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: cloudformation.amazonaws.com
            Action:
              - sts:AssumeRole 
      Path: /
      Policies:
        - PolicyName: AssumeRole-AWSCloudFormationStackSetExecutionRole
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - sts:AssumeRole
                Resource:
                  - !Sub 'arn:${AWS::Partition}:iam::*:role/${ExecutionRoleName}'
  ExecutionRole:
    Metadata:
      'aws:copilot:description': 'An IAM role assumed by the admin role to create ECR repositories, KMS keys, and S3 buckets'
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref ExecutionRoleName
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !GetAtt AdministrationRole.Arn
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
      - PolicyName: ExecutionRolePolicy
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
              - Sid: StackSetRequiredPermissions # https://go.aws/3Sa5Tcf
                Effect: Allow
                Action:
                  - cloudformation:*
                  - s3:*
                  - sns:*
                Resource: "*"
              - Sid: KeyAdminPermissions # https://go.aws/3BIqf7a
                Effect: Allow
                Action:
                  - kms:Create*
                  - kms:Describe*
                  - kms:Enable*
                  - kms:List*
                  - kms:Put*
                  - kms:Update*
                  - kms:Revoke*
                  - kms:Disable*
                  - kms:Get*
                  - kms:Delete*
                  - kms:TagResource
                  - kms:UntagResource
                  - kms:ScheduleKeyDeletion
                  - kms:CancelKeyDeletion
                Resource: "*"
              - Sid: ManageECRRepos
                Effect: Allow
                Action:
                  - ecr:DescribeImageScanFindings
                  - ecr:GetLifecyclePolicyPreview
                  - ecr:CreateRepository
                  - ecr:GetDownloadUrlForLayer
                  - ecr:GetAuthorizationToken
                  - ecr:ListTagsForResource
                  - ecr:ListImages
                  - ecr:DeleteLifecyclePolicy
                  - ecr:DeleteRepository
                  - ecr:SetRepositoryPolicy
                  - ecr:BatchGetImage
                  - ecr:DescribeImages
                  - ecr:DescribeRepositories
                  - ecr:BatchCheckLayerAvailability
                  - ecr:GetRepositoryPolicy
                  - ecr:GetLifecyclePolicy
                  - ecr:TagResource
                Resource: "*"

  DNSDelegationRole:
    Metadata:
      'aws:copilot:description': 'A DNS delegation role to allow accounts: 723540195465 to manage your domain'
    Type: AWS::IAM::Role
    Condition: DelegateDNS
    Properties:
      RoleName: !Ref DNSDelegationRoleName
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS:  !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:root
            Action:
              - sts:AssumeRole
          - Effect: Allow
            Principal:
              AWS:
                - !Sub arn:${AWS::Partition}:iam::723540195465:root
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
      - PolicyName: DNSDelegationPolicy
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
              - Sid: HostedZoneReadRecords
                Effect: Allow
                Action:
                  - route53:Get*
                  - route53:List*
                Resource: "*"
              - Sid: HostedZoneUpdate
                Effect: Allow
                Action:
                  - route53:ChangeResourceRecordSets
                Resource:
                  - !Sub arn:${AWS::Partition}:route53:::hostedzone/${AppHostedZone}
                  - !Sub arn:${AWS::Partition}:route53:::hostedzone/${AppDomainHostedZoneID}

  AppHostedZone:
    Metadata:
      'aws:copilot:description': 'A hosted zone for wordpress.'
    Type: AWS::Route53::HostedZone
    Condition: DelegateDNS
    Properties:
      HostedZoneConfig:
        Comment: !Sub "Hosted zone for copilot application ${AppName}: ${AppName}.${AppDomainName}"
      Name: !Sub ${AppName}.${AppDomainName}

  AppDomainDelegationRecordSet:
    Metadata:
      'aws:copilot:description': 'Add NS records to delegate responsibility to the wordpress. subdomain'
    Type: AWS::Route53::RecordSet
    Condition: DelegateDNS
    Properties:
      HostedZoneName: !Sub ${AppDomainName}.
      Comment: !Sub "Record for copilot domain delegation for application ${AppDomainName}"
      Name: !Sub ${AppName}.${AppDomainName}.
      Type: NS
      TTL: '900'
      ResourceRecords: !GetAtt AppHostedZone.NameServers

Outputs:
  ExecutionRoleARN:
    Description: ExecutionRole used by this application to set up ECR Repos, KMS Keys and S3 buckets
    Value: !GetAtt ExecutionRole.Arn
  AdministrationRoleARN:
    Description: AdministrationRole used by this application to manage this application's StackSet
    Value: !GetAtt AdministrationRole.Arn
  TemplateVersion:
    Description: Required output to force the stack to update if mutating version.
    Value: v1.2.0

Ralph Quick Cloud Engineer

Ralph Quick is a professional Cloud Engineer specializing in the management, maintenance, and deployment of web service applications and infrastructure for operations. His experience ensures services are running efficiently and securely meeting the needs of your organization or clients.

Dockerfile

code

Startup.sh

code

Manifest.yml

code

Wp.yml (AWS Copilot addon CloudFormation template)

code

Redis.yml (AWS Copilot addon CloudFormation template)

code

CloudFormation Package YAML Template (AWS Copilot’s Template Generated After Deployment)

code

Cross-regional resources to support CodePipeline (Template Generated After Deployment)

code

Roles and Delegations Stackset (Template Generated After Deployment)

code

Ralph Quick Cloud Engineer

Ready to Chat?

Let’s Socialize!

+1 (754) 214-7728

Click or Scan for PDF of Full Resume