free_x86_64_template.yaml

AWSTemplateFormatVersion: "2010-09-09"
Transform: "AWS::Serverless-2016-10-31"
Description: Cribl Stream Free Distributed Deployment (x86_64)

Parameters:
  workerCount:
    Description: "REQUIRED: Enter the number of worker nodes desired"
    Type: String
  vpcId:
    Description: "REQUIRED: ID of your existing VPC."
    Type: AWS::EC2::VPC::Id
  ImageId:
    Description: "REQUIRED: Name of the AMI for the EC2 Instance being used for your Cribl Deployment."
    Type: AWS::EC2::Image::Id
  subnetIds:
    Description: "REQUIRED: Select 2 subnet Ids in different AZs. These subnets must be in the same VPC as VPC ID above."
    Type: List<AWS::EC2::Subnet::Id>
  webAccessCidr:
    Type: String
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/x
    Description: "REQUIRED: The CIDR IP range permitted to access the Cribl Stream web console. We recommend you set this value to a trusted IP range."
  leaderInstanceType:
    Description: EC2 instance type to provision the Cribl Stream leader instance. If none specified, c5a.xlarge will be used.
    Type: String
    Default: c5a.xlarge
    AllowedValues:
      - t2.small
      - t2.medium
      - t2.large
      - t2.xlarge
      - t3.small
      - t3.medium
      - t3.large
      - t3.xlarge
      - t3a.small
      - t3a.medium
      - t3a.large
      - c5.large
      - c5.xlarge
      - c5d.large
      - c5d.xlarge
      - c5a.large
      - c5a.xlarge
      - c5ad.large
      - c5ad.xlarge
      - c5n.large
      - c5n.xlarge
      - m5a.large
      - m5a.xlarge
      - m5ad.large
      - m5ad.xlarge
      - m5d.large
      - m5d.xlarge
    ConstraintDescription: Must contain valid instance type
  workerInstanceType:
    Description: EC2 instance type to provision the Cribl Stream worker instance. If none specified, c5a.xlarge will be used.
    Type: String
    Default: c5a.xlarge
    AllowedValues:
      - t2.small
      - t2.medium
      - t2.large
      - t2.xlarge
      - t3.small
      - t3.medium
      - t3.large
      - t3.xlarge
      - t3a.small
      - t3a.medium
      - t3a.large
      - c5.large
      - c5.xlarge
      - c5d.large
      - c5d.xlarge
      - c5a.large
      - c5a.xlarge
      - c5ad.large
      - c5ad.xlarge
      - c5n.large
      - c5n.xlarge
      - m5a.large
      - m5a.xlarge
      - m5a.2xlarge
      - m5ad.large
      - m5ad.xlarge
      - m5d.large
      - m5d.xlarge
    ConstraintDescription: Must contain valid instance type
  AdditionalPolicies:
    Default: "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore,arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy"
    Description: A comma separated list of Policy ARNs to add to the IAM role used by Logstream instances. Append to defaults, DO NOT REMOVE!
    Type: CommaDelimitedList

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: leader Instance Configuration
        Parameters:
          - leaderInstanceType
      - Label:
          default: Worker Instance Configuration
        Parameters:
          - workerInstanceType
          - workerCount
      - Label:
          default: Network Configuration
        Parameters:
          - vpcId
          - subnetIds
          - webAccessCidr
      - Label:
          default: Advanced Settings
        Parameters:
          - AdditionalPolicies
    ParameterLabels:
      leaderInstanceType:
        default: leader Node EC2 Instance Type
      workerInstanceType:
        default: Worker Nodes EC2 Instance Type
      workerCount:
        default: Worker Count
      vpcId:
        default: VPC ID
      subnetIds:
        default: Subnet IDs
      webAccessCidr:
        default: Web Access CIDR
      AdditionalPolicies:
        default: IAM Policies for node instance profiles

Rules:
  SubnetsInVPC:
    Assertions:
      - Assert: !EachMemberIn
          - !ValueOfAll
            - AWS::EC2::Subnet::Id
            - VpcId
          - !RefAll "AWS::EC2::VPC::Id"
        AssertDescription: All subnets must in the VPC


Resources:
  ec2leaderSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Cribl Stream Access
      VpcId: !Ref vpcId
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 9000
          ToPort: 9000
          CidrIp: !Ref webAccessCidr
          Description: UI access to the Cribl Stream leader instance
        - IpProtocol: tcp
          FromPort: 4200
          ToPort: 4200
          CidrIp: !Ref webAccessCidr
          #SourceSecurityGroupId: !GetAtt ec2WorkerSecurityGroup.GroupId
          Description: Cluster communications between leader and workers
      SecurityGroupEgress:
        - IpProtocol: "-1"
          CidrIp: 0.0.0.0/0
          Description: Egress access
  LeaderLoadBalancerExternal:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Type: application
      Scheme: internet-facing
      IpAddressType: ipv4
      SecurityGroups:
        - !Ref ec2leaderSecurityGroup
      Subnets:
       - !Select [0, !Ref 'subnetIds']
       - !Select [1, !Ref 'subnetIds']

  LeaderLoadBalancerInternal:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Type: network
      LoadBalancerAttributes:
        - Key: load_balancing.cross_zone.enabled 
          Value: "true"
      Scheme: internal
      IpAddressType: ipv4
      Subnets:
       - !Select [0, !Ref 'subnetIds']
       - !Select [1, !Ref 'subnetIds']
  
  LeaderCriblTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    DependsOn: LeaderLoadBalancerExternal
    Properties:
      HealthCheckPort: '9000'
      HealthCheckProtocol: HTTP
      Port: 9000
      Protocol: HTTP
      TargetType: instance
      VpcId: !Ref vpcId
  
  CriblLeaderWebListener:
      Type: AWS::ElasticLoadBalancingV2::Listener
      Properties:
        DefaultActions:
          - Type: forward
            TargetGroupArn: !Ref LeaderCriblTargetGroup
        LoadBalancerArn: !Ref LeaderLoadBalancerExternal
        Port: 9000
        Protocol: HTTP

  WorkerCriblTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    DependsOn: LeaderLoadBalancerInternal
    Properties:
      HealthCheckPort: '4200'
      HealthCheckProtocol: TCP
      Port: 4200
      Protocol: TCP
      TargetType: instance
      VpcId: !Ref vpcId
 
  CriblWorkerAdminListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref WorkerCriblTargetGroup
      LoadBalancerArn: !Ref LeaderLoadBalancerInternal
      Port: 4200
      Protocol: TCP

  WorkerCriblTCPJSONTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    DependsOn: LeaderLoadBalancerInternal
    Properties:
      HealthCheckPort: '10001'
      HealthCheckProtocol: TCP
      Port: 10001
      Protocol: TCP
      TargetType: instance
      VpcId: !Ref vpcId
  
  CriblWorkerTCPJSONListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref WorkerCriblTCPJSONTargetGroup
      LoadBalancerArn: !Ref LeaderLoadBalancerInternal
      Port: 10001
      Protocol: TCP

  WorkerCriblTCPRAWTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    DependsOn: LeaderLoadBalancerInternal
    Properties:
      HealthCheckPort: '7777'
      HealthCheckProtocol: TCP
      Port: 7777
      Protocol: TCP
      TargetType: instance
      VpcId: !Ref vpcId

  CriblWorkerTCPRAWListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref WorkerCriblTCPRAWTargetGroup
      LoadBalancerArn: !Ref LeaderLoadBalancerInternal
      Port: 7777
      Protocol: TCP

  CriblLeaderWebListenerRule1:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      Actions:
        - Type: forward
          TargetGroupArn: !Ref LeaderCriblTargetGroup
      Conditions:
        - Field: http-request-method
          HttpRequestMethodConfig:
            Values:
              - GET_OR_HEAD
      ListenerArn: !Ref CriblLeaderWebListener
      Priority: 1

  ec2WorkerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Cribl Stream Ingress and Egress for Ports
      VpcId: !Ref vpcId
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 10001
          ToPort: 10001
          CidrIp: !Ref webAccessCidr
          Description: TCP-raw Data Collection Ingress
        - IpProtocol: tcp
          FromPort: 7777
          ToPort: 7777
          CidrIp: !Ref webAccessCidr
          Description: TCP-json Data Collection Ingress
      SecurityGroupEgress:   
        - IpProtocol: "-1"
          CidrIp: 0.0.0.0/0
          Description: Egress access

  s3DefaultDestinationBucket:
    Type: AWS::S3::Bucket
    Properties:
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      Tags:
        - Key: Name
          Value: Cribl Stream default destination bucket

  LogstreamRole:
    Type: AWS::IAM::Role
    Properties:
      Path: !Sub "/logstream/${AWS::StackName}/"
      Description: Cribl Stream  IAM role
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns: !Ref AdditionalPolicies
      Policies:
        - PolicyName: S3Destinations
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:ListBucket
                  - s3:GetBucketLocation
                Resource:
                  - !Sub ${s3DefaultDestinationBucket.Arn}
                  - !Sub ${s3DefaultDestinationBucket.Arn}/*
        - PolicyName: S3Sources
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:GetBucketLocation
                Resource:
                  - !Sub ${s3DefaultDestinationBucket.Arn}
                  - !Sub ${s3DefaultDestinationBucket.Arn}/*
        - PolicyName: KinesisSources
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - kinesis:GetRecords
                  - kinesis:GetShardIterator
                  - kinesis:ListShards
                NotResource: "*"
        - PolicyName: SecretsManagerRead
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - secretsmanager:GetSecretValue
                Resource: 
                  - !Ref clusterAuthToken
      Tags:
        - Key: Name
          Value: Cribl Stream default IAM role

  LogstreamInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: !Sub "/logstream/${AWS::StackName}/"
      Roles:
        - !Ref LogstreamRole

  ec2LeaderAutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      VPCZoneIdentifier:   
       - !Select [0, !Ref 'subnetIds']
       - !Select [1, !Ref 'subnetIds']
      TargetGroupARNs: 
        - !Ref LeaderCriblTargetGroup
        - !Ref WorkerCriblTargetGroup
      DesiredCapacity: "1"
      MaxSize: "1"
      MinSize: "0"
      HealthCheckType: EC2
      LaunchTemplate:
        LaunchTemplateId: !Ref ec2leaderlaunchTemplate
        Version: !GetAtt ec2leaderlaunchTemplate.LatestVersionNumber
      Tags:
        - Key: Name
          Value: Cribl Stream Leader Nodes ASG
          PropagateAtLaunch: false
     
  ec2LeaderAutoScalingGroupLifecycleHook:
    Type: AWS::AutoScaling::LifecycleHook
    Properties:
      AutoScalingGroupName: !Ref ec2LeaderAutoScalingGroup
      DefaultResult: ABANDON
      HeartbeatTimeout: 3600
      LifecycleHookName: cribl-logstream-leader-shutdown
      LifecycleTransition: "autoscaling:EC2_INSTANCE_TERMINATING"

  ec2leaderlaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    Properties:
      LaunchTemplateData:
        InstanceInitiatedShutdownBehavior: terminate
        ImageId: !Ref ImageId
        InstanceType: !Ref leaderInstanceType
        IamInstanceProfile:
          Arn: !GetAtt LogstreamInstanceProfile.Arn
        SecurityGroupIds:
          - !Ref ec2leaderSecurityGroup
        UserData: !Base64
          Fn::Sub:
            - |
              #cloud-config

              runcmd:
                - export AWS_DEFAULT_REGION=${Region}
                - /usr/local/bin/configure_logstream.sh -m master -b ${s3DefaultDestinationBucket} -u ${clusterAuthToken}
                - sleep 10
                - cloud-init query -f "$(cat /opt/cribl_build/users.json.j2)" > /opt/cribl/local/cribl/auth/users.json
                - chown -R cribl:cribl /opt/cribl
            - clusterAuthToken: !Ref clusterAuthToken
              Region: !Ref AWS::Region
        TagSpecifications:
          - ResourceType: instance
            Tags:
              - Key: Name
                Value: Cribl Stream Leader Node   

  leaderShutdownEventRule:
    Type: AWS::Events::Rule
    Properties:
      Description: "Cribl Stream Leader Shutdown Event"
      EventPattern:
        source:
          - "aws.autoscaling"
        detail-type:
          - "EC2 Instance-terminate Lifecycle Action"
        detail:
          AutoScalingGroupName:
            - !Ref ec2LeaderAutoScalingGroup
      State: "ENABLED"
      Targets:
        - Arn: !GetAtt functionLeaderShutdown.Arn
          Id: "WorkerShutdownFunction"

  lamdbaPermissionLeaderShutdownEventRule:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref functionLeaderShutdown
      Action: "lambda:InvokeFunction"
      Principal: "events.amazonaws.com"
      SourceArn: !GetAtt workerShutdownEventRule.Arn

  functionLeaderShutdown:
    Type: AWS::Serverless::Function
    Properties:
      Description: Cribl Stream Leader Shutdown
      InlineCode: |
        import boto3
        import logging
        import json
        import time
        import os

        ssm = boto3.client('ssm')
        autoscaling = boto3.client('autoscaling')

        # Logging
        log = logging.getLogger()
        log.setLevel(logging.DEBUG)

        def handler(event, context):
          log.debug("Received event {}".format(json.dumps(event)))

          command = ssm.send_command(
            InstanceIds=[event['detail']['EC2InstanceId'],],
            DocumentName='AWS-RunShellScript',
            Comment='Gracefully terminate Cribl Stream leader node',
            Parameters={"commands":["systemctl disable cribl","systemctl daemon-reload","systemctl stop cribl"],"workingDirectory":[""],"executionTimeout":["3600"]},
            CloudWatchOutputConfig={
                'CloudWatchOutputEnabled': True
            }
          )

          command_id = command['Command']['CommandId']

          for x in range(0,59):
            time.sleep(10)
            response = ssm.get_command_invocation(
                CommandId=command_id,
                InstanceId=event['detail']['EC2InstanceId'],
            )
            if response.get('Status') == 'Success':
              break
            else:
              continue

          autoscaling.complete_lifecycle_action(
            LifecycleHookName=event['detail']['LifecycleHookName'],
            AutoScalingGroupName=event['detail']['AutoScalingGroupName'],
            LifecycleActionToken=event['detail']['LifecycleActionToken'],
            LifecycleActionResult='CONTINUE',
            InstanceId=event['detail']['EC2InstanceId']
          )
      Policies:
        - Statement:
            - Action: ["ssm:SendCommand"]
              Effect: Allow
              Resource: "*"
              Condition:
                StringEquals:
                  "aws:ResourceTag/aws:ec2launchtemplate:id": !Ref ec2leaderlaunchTemplate
            - Action: ["ssm:SendCommand"]
              Effect: Allow
              Resource: !Sub "arn:${AWS::Partition}:ssm:${AWS::Region}::document/AWS-RunShellScript"
            - Action: ["autoscaling:CompleteLifecycleAction"]
              Effect: Allow
              Resource: !Sub "arn:${AWS::Partition}:autoscaling:${AWS::Region}:${AWS::AccountId}:autoScalingGroup:*:autoScalingGroupName/${ec2WorkersAutoScalingGroup}"
            - Action: ["ssm:GetCommandInvocation"]
              Effect: Allow
              Resource: "*"
      Runtime: python3.12
      Timeout: 600
      Handler: index.handler

  clusterAuthToken:
    Type: 'AWS::SecretsManager::Secret'
    Properties:
      Description: "Cribl Logstream Cluster Auth Token"
      GenerateSecretString:
        PasswordLength: 30
        ExcludePunctuation: true

  ec2WorkersAutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      DesiredCapacity: !Ref workerCount
      MaxSize: !Ref workerCount
      MinSize: !Ref workerCount
      HealthCheckType: EC2
      LaunchTemplate:
        LaunchTemplateId: !Ref ec2WorkerslaunchTemplate
        Version: !GetAtt ec2WorkerslaunchTemplate.LatestVersionNumber
      VPCZoneIdentifier:
        - !Select [0, !Ref subnetIds]
        - !Select [1, !Ref subnetIds]
      Tags:
        - Key: Name
          Value: Cribl Stream Worker Nodes ASG
          PropagateAtLaunch: false

  ec2WorkersAutoScalingGroupLifecycleHook:
    Type: AWS::AutoScaling::LifecycleHook
    Properties:
      AutoScalingGroupName: !Ref ec2WorkersAutoScalingGroup
      DefaultResult: ABANDON
      HeartbeatTimeout: 3600
      LifecycleHookName: cribl-logstream-worker-shutdown
      LifecycleTransition: "autoscaling:EC2_INSTANCE_TERMINATING"

  ec2WorkerslaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    Properties:
      LaunchTemplateData:
        InstanceInitiatedShutdownBehavior: terminate
        ImageId: !Ref ImageId
        InstanceType: !Ref workerInstanceType
        IamInstanceProfile:
          Arn: !GetAtt LogstreamInstanceProfile.Arn
        SecurityGroupIds:
          - !Ref ec2WorkerSecurityGroup
        UserData: !Base64
          Fn::Sub:
            - |
              #cloud-config

              runcmd:
                - export AWS_DEFAULT_REGION=${Region}
                - /usr/local/bin/configure_logstream.sh -m worker -u ${clusterAuthToken} -H ${LeaderLoadBalancerInternal.DNSName} -p 4200
                - sed -i 's/false/true/g' /opt/cribl/local/_system/instance.yml
                - sleep 60
                - systemctl restart cribl
            - clusterAuthToken: !Ref clusterAuthToken
              Region: !Ref AWS::Region
        TagSpecifications:
          - ResourceType: instance
            Tags:
              - Key: Name
                Value: Cribl Stream Worker Instance

  workerShutdownEventRule:
    Type: AWS::Events::Rule
    Properties:
      Description: "Cribl Stream Worker Shutdown Event"
      EventPattern:
        source:
          - "aws.autoscaling"
        detail-type:
          - "EC2 Instance-terminate Lifecycle Action"
        detail:
          AutoScalingGroupName:
            - !Ref ec2WorkersAutoScalingGroup
      State: "ENABLED"
      Targets:
        - Arn: !GetAtt functionWorkerShutdown.Arn
          Id: "WorkerShutdownFunction"

  lamdbaPermissionWorkerShutdownEventRule:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref functionWorkerShutdown
      Action: "lambda:InvokeFunction"
      Principal: "events.amazonaws.com"
      SourceArn: !GetAtt workerShutdownEventRule.Arn

  functionWorkerShutdown:
    Type: AWS::Serverless::Function
    Properties:
      Description: Cribl Stream Worker Shutdown
      InlineCode: |
        import boto3
        import logging
        import json
        import time
        import os

        ssm = boto3.client('ssm')
        autoscaling = boto3.client('autoscaling')

        # Logging
        log = logging.getLogger()
        log.setLevel(logging.DEBUG)

        def handler(event, context):
          log.debug("Received event {}".format(json.dumps(event)))

          command = ssm.send_command(
            InstanceIds=[event['detail']['EC2InstanceId'],],
            DocumentName='AWS-RunShellScript',
            Comment='Gracefully terminate Cribl Stream worker node',
            Parameters={"commands":["systemctl disable cribl","systemctl daemon-reload","systemctl stop cribl"],"workingDirectory":[""],"executionTimeout":["3600"]},
            CloudWatchOutputConfig={
                'CloudWatchOutputEnabled': True
            }
          )

          command_id = command['Command']['CommandId']

          for x in range(0,59):
            time.sleep(10)
            response = ssm.get_command_invocation(
                CommandId=command_id,
                InstanceId=event['detail']['EC2InstanceId'],
            )
            if response.get('Status') == 'Success':
              break
            else:
              continue

          autoscaling.complete_lifecycle_action(
            LifecycleHookName=event['detail']['LifecycleHookName'],
            AutoScalingGroupName=event['detail']['AutoScalingGroupName'],
            LifecycleActionToken=event['detail']['LifecycleActionToken'],
            LifecycleActionResult='CONTINUE',
            InstanceId=event['detail']['EC2InstanceId']
          )
      Policies:
        - Statement:
            - Action: ["ssm:SendCommand"]
              Effect: Allow
              Resource: "*"
              Condition:
                StringEquals:
                  "aws:ResourceTag/aws:ec2launchtemplate:id": !Ref ec2WorkerslaunchTemplate
            - Action: ["ssm:SendCommand"]
              Effect: Allow
              Resource: !Sub "arn:${AWS::Partition}:ssm:${AWS::Region}::document/AWS-RunShellScript"
            - Action: ["autoscaling:CompleteLifecycleAction"]
              Effect: Allow
              Resource: !Sub "arn:${AWS::Partition}:autoscaling:${AWS::Region}:${AWS::AccountId}:autoScalingGroup:*:autoScalingGroupName/${ec2WorkersAutoScalingGroup}"
            - Action: ["ssm:GetCommandInvocation"]
              Effect: Allow
              Resource: "*"
      Runtime: python3.12
      Timeout: 600
      Handler: index.handler

Outputs:
  logstreamWebUrlPublic:
    Value: !Sub http://${LeaderLoadBalancerExternal.DNSName}:9000/login
    Description: Cribl Stream Web URL
  logstreamWebAccessCreds:
    Value: "admin / Leader EC2 Instance ID"
    Description: Default Web Access Credentials