module.yml

---
# Copyright 2019 widdix GmbH
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
AWSTemplateFormatVersion: '2010-09-09'
Description: 'cfn-modules: ElastiCache redis'
# cfn-modules:implements(ExposeName, ExposeDnsName)
Parameters:
  VpcModule:
    Description: 'Stack name of vpc module.'
    Type: String
  ClientSgModule:
    Description: 'Stack name of client-sg module.'
    Type: String
  AlertingModule:
    Description: 'Optional but recommended stack name of alerting module.'
    Type: String
    Default: ''
  BastionModule:
    Description: 'Optional but recommended stack name of module implementing Bastion.'
    Type: String
    Default: ''
  KmsKeyModule:
    Description: 'Optional but recommended stack name of kms-key module (ignored when DBSnapshotIdentifier is set, value used from snapshot).'
    Type: String
    Default: ''
  EngineVersion:
    Description: 'Redis version'
    Type: String
    Default: '5.0.5'
    AllowedValues: # aws elasticache describe-cache-engine-versions --engine redis --query "CacheEngineVersions[].EngineVersion"
    - '5.0.5'
    - '5.0.6'
    - '6.0'
    - '6.2'
  CacheNodeType:
    Description: 'The compute and memory capacity of the nodes in the node group (shard).'
    Type: 'String'
    Default: 'cache.t2.micro'
  TransitEncryption:
    Description: 'Enable encryption for data in transit? (see https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/in-transit-encryption.html)'
    Type: 'String'
    Default: 'true'
    AllowedValues:
    - 'true'
    - 'false'
  AuthToken:
    Description: 'Optional password (16 to 128 characters) used to authenticate against Redis (requires TransitEncryption := true; leave blank to disable password-protection).'
    Type: 'String'
    NoEcho: true
    Default: ''
    MaxLength: 128
  SnapshotRetentionLimit:
    Description: 'The number of days for which ElastiCache retains automatic snapshots before deleting them (set to 0 to disable backups).'
    Type: Number
    Default: 35
    MinValue: 0
    MaxValue: 35
  SnapshotName:
    Description: 'Optional name of a snapshot from which you want to restore (leave blank to create an empty cache).'
    Type: 'String'
    Default: ''
  NumShards:
    Description: 'Number of shards in the cluster.'
    Type: 'Number'
    Default: 1
    MinValue: 1
    MaxValue: 250
  NumReplicas:
    Description: 'Number of replicas per shard.'
    Type: 'Number'
    Default: 1
    MinValue: 0
    MaxValue: 5
  CacheParameterGroupName:
    Description: 'Optional name of a cache parameter group.'
    Type: 'String'
    Default: ''
Conditions:
  HasAlertingModule: !Not [!Equals [!Ref AlertingModule, '']]
  HasBastionModule: !Not [!Equals [!Ref BastionModule, '']]
  HasKmsKeyModule: !Not [!Equals [!Ref KmsKeyModule, '']]
  HasAuthToken: !Not [!Equals [!Ref AuthToken, '']]
  HasSnapshotName: !Not [!Equals [!Ref SnapshotName, '']]
  HasAutomaticFailoverEnabled: !Not [!Equals [!Ref NumReplicas, 0]]
  HasCacheParameterGroupName: !Not [!Equals [!Ref CacheParameterGroupName, '']]
  HasNotCacheParameterGroupName: !Not [!Condition HasCacheParameterGroupName]
Mappings:
  EngineVersionMap:
    '5.0.5':
      CacheParameterGroupFamily: 'redis5.0'
    '5.0.6':
      CacheParameterGroupFamily: 'redis5.0'
    '6.0':
      CacheParameterGroupFamily: 'redis6.x'
    '6.2':
      CacheParameterGroupFamily: 'redis6.x'
Resources:
  CacheParameterGroup:
    Condition: HasNotCacheParameterGroupName
    Type: 'AWS::ElastiCache::ParameterGroup'
    Properties:
      CacheParameterGroupFamily: !FindInMap [EngineVersionMap, !Ref EngineVersion, CacheParameterGroupFamily]
      Description: !Ref 'AWS::StackName'
      Properties: {}
  CacheSubnetGroupName:
    Type: 'AWS::ElastiCache::SubnetGroup'
    Properties:
      Description: !Ref 'AWS::StackName'
      SubnetIds: !Split [',', {'Fn::ImportValue': !Sub '${VpcModule}-SubnetIdsPrivate'}]
  SecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: !Ref 'AWS::StackName'
      VpcId: {'Fn::ImportValue': !Sub '${VpcModule}-Id'}
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 6379
        ToPort: 6379
        SourceSecurityGroupId: {'Fn::ImportValue': !Sub '${ClientSgModule}-SecurityGroupId'}
  SecurityGroupInSSHBastion:
    Type: 'AWS::EC2::SecurityGroupIngress'
    Condition: HasBastionModule
    Properties:
      GroupId: !Ref SecurityGroup
      IpProtocol: tcp
      FromPort: 6379
      ToPort: 6379
      SourceSecurityGroupId: {'Fn::ImportValue': !Sub '${BastionModule}-SecurityGroupId'}
  ReplicationGroup:
    DeletionPolicy: Snapshot
    UpdateReplacePolicy: Snapshot
    Type: 'AWS::ElastiCache::ReplicationGroup'
    Properties:
      ReplicationGroupDescription: !Ref 'AWS::StackName'
      AtRestEncryptionEnabled: true
      AuthToken: !If [HasAuthToken, !Ref AuthToken, !Ref 'AWS::NoValue']
      AutomaticFailoverEnabled: !If [HasAutomaticFailoverEnabled, true, false]
      CacheNodeType: !Ref CacheNodeType
      CacheParameterGroupName: !If [HasCacheParameterGroupName, !Ref CacheParameterGroupName, !Ref CacheParameterGroup]
      CacheSubnetGroupName: !Ref CacheSubnetGroupName
      Engine: redis
      EngineVersion: !Ref EngineVersion
      KmsKeyId: !If [HasKmsKeyModule, {'Fn::ImportValue': !Sub '${KmsKeyModule}-Arn'}, !Ref 'AWS::NoValue']
      NotificationTopicArn: !If [HasAlertingModule, {'Fn::ImportValue': !Sub '${AlertingModule}-Arn'}, !Ref 'AWS::NoValue']
      NumNodeGroups: !Ref NumShards
      ReplicasPerNodeGroup: !Ref NumReplicas
      PreferredMaintenanceWindow: 'sat:07:00-sat:08:00'
      SecurityGroupIds:
      - !Ref SecurityGroup
      SnapshotName: !If [HasSnapshotName, !Ref SnapshotName, !Ref 'AWS::NoValue']
      SnapshotRetentionLimit: !Ref SnapshotRetentionLimit
      SnapshotWindow: '00:00-03:00'
      TransitEncryptionEnabled: !Ref TransitEncryption
    UpdatePolicy:
      UseOnlineResharding: true
  Node1CPUUtilizationTooHighAlarm:
    Condition: HasAlertingModule
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      AlarmDescription: 'Average CPU utilization over last 10 minutes higher than 80%'
      Namespace: 'AWS/ElastiCache'
      OKActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      MetricName: CPUUtilization
      Statistic: Average
      Period: 600
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: 80
      Dimensions:
      - Name: CacheClusterId
        Value: !Sub '${ReplicationGroup}-001'
  Node2CPUUtilizationTooHighAlarm:
    Condition: HasAlertingModule
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      AlarmDescription: 'Average CPU utilization over last 10 minutes higher than 80%'
      Namespace: 'AWS/ElastiCache'
      OKActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      MetricName: CPUUtilization
      Statistic: Average
      Period: 600
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: 80
      Dimensions:
      - Name: CacheClusterId
        Value: !Sub '${ReplicationGroup}-002'
  Node1SwapUsageTooHighAlarm:
    Condition: HasAlertingModule
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      AlarmDescription: 'Average swap usage over last 10 minutes higher than 64 MB, performance may suffer'
      Namespace: 'AWS/ElastiCache'
      OKActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      MetricName: SwapUsage
      Statistic: Average
      Period: 600
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: 67108864 # 64 MB in Bytes
      Dimensions:
      - Name: CacheClusterId
        Value: !Sub '${ReplicationGroup}-001'
  Node2SwapUsageTooHighAlarm:
    Condition: HasAlertingModule
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      AlarmDescription: 'Average swap usage over last 10 minutes higher than 64 MB, performance may suffer'
      Namespace: 'AWS/ElastiCache'
      OKActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      MetricName: SwapUsage
      Statistic: Average
      Period: 600
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: 67108864 # 64 MB in Bytes
      Dimensions:
      - Name: CacheClusterId
        Value: !Sub '${ReplicationGroup}-002'
  Node1EvictionsTooHighAlarm:
    Condition: HasAlertingModule
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      AlarmDescription: 'Average evictions over last 10 minutes higher than 1000, may enough memory for all keys'
      Namespace: 'AWS/ElastiCache'
      OKActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      MetricName: Evictions
      Statistic: Average
      Period: 600
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: 1000
      Dimensions:
      - Name: CacheClusterId
        Value: !Sub '${ReplicationGroup}-001'
  Node2EvictionsTooHighAlarm:
    Condition: HasAlertingModule
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      AlarmDescription: 'Average evictions over last 10 minutes higher than 1000, may enough memory for all keys'
      Namespace: 'AWS/ElastiCache'
      OKActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      MetricName: Evictions
      Statistic: Average
      Period: 600
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: 1000
      Dimensions:
      - Name: CacheClusterId
        Value: !Sub '${ReplicationGroup}-002'
  Node1ReplicationLagTooHighAlarm:
    Condition: HasAlertingModule
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      AlarmDescription: 'Average replication lag over last 10 minutes higher than 30 seconds'
      Namespace: 'AWS/ElastiCache'
      OKActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      MetricName: ReplicationLag
      Statistic: Average
      Period: 600
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: 30
      Dimensions:
      - Name: CacheClusterId
        Value: !Sub '${ReplicationGroup}-001'
  Node2ReplicationLagTooHighAlarm:
    Condition: HasAlertingModule
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      AlarmDescription: 'Average replication lag over last 10 minutes higher than 30 seconds'
      Namespace: 'AWS/ElastiCache'
      OKActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      MetricName: ReplicationLag
      Statistic: Average
      Period: 600
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: 30
      Dimensions:
      - Name: CacheClusterId
        Value: !Sub '${ReplicationGroup}-002'
Outputs:
  ModuleId:
    Value: 'elasticache-redis'
  ModuleVersion:
    Value: '1.1.0'
  StackName:
    Value: !Ref 'AWS::StackName'
  Name:
    Description: 'The name of the cluster'
    Value: !Ref ReplicationGroup
    Export:
      Name: !Sub '${AWS::StackName}-Name'
  DnsName:
    Description: 'The DNS address of the primary read-write cache node.'
    Value: !GetAtt 'ReplicationGroup.PrimaryEndPoint.Address'
    Export:
      Name: !Sub '${AWS::StackName}-DnsName'