ibm-mq-broker.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: Deploys an IBM MQ broker as Amazon ECS task in AWS Fargate.

Parameters:
  Stage:
    Type: String
    Default: DEV
    Description: The stage into we deploy this template.

  IBMMQBrokerPassword:
    NoEcho: true
    Type: String
    Default: passw0rd
    Description: The password of the IBM MQ application user.

  IBMMQBrokerQueueManager:
    Type: String
    Default: QMGR
    Description: The IBM MQ broker queue manager name.

Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.11.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
      - Key: Name
        Value: !Join [ ':', [ !Ref 'AWS::StackName', 'VPC' ] ]

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
      - Key: Name
        Value: !Join [ ':', [ !Ref 'AWS::StackName', 'InternetGateway' ] ]

  VPCGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
      - Key: Name
        Value: !Join [ ':', [ !Ref 'AWS::StackName', 'RouteTable' ] ]

  Route:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref RouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.11.0.0/24
      AvailabilityZone: !Select [0, !GetAZs '']
      Tags:
      - Key: Name
        Value: !Join [ ':', [ !Ref 'AWS::StackName', 'PublicSubnet1' ] ]

  PublicSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.11.1.0/24
      AvailabilityZone: !Select [1, !GetAZs '']
      Tags:
      - Key: Name
        Value: !Join [ ':', [ !Ref 'AWS::StackName', 'PublicSubnet2' ] ]

  PublicSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet1
      RouteTableId: !Ref RouteTable

  PublicSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet2
      RouteTableId: !Ref RouteTable

  JmsBridgeSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Limits security group ingress and egress traffic for the JMS bridge
      VpcId: !Ref VPC
      SecurityGroupEgress:
      - IpProtocol: tcp
        FromPort: 8162
        ToPort: 8162
        SourceSecurityGroupId: !Ref IBMMQSecurityGroup

  IBMMQSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Limits security group ingress and egress traffic for the WebSphere MQ instance
      VpcId: !Ref VPC
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 9443
        ToPort: 9443
        CidrIp: 0.0.0.0/0
      - IpProtocol: tcp
        FromPort: 1414
        ToPort: 1414
        CidrIp: 0.0.0.0/0

  ECSTaskExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service: [ecs-tasks.amazonaws.com]
          Action: ['sts:AssumeRole']
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy

  IBMMQECSCluster:
    Type: AWS::ECS::Cluster
    Properties:
      ClusterName: ibm-mq-cluster

  IBMMQECSTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: ibm-mq-broker-task
      Cpu: 2048
      Memory: 4096
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      ExecutionRoleArn: !Ref ECSTaskExecutionRole
      ContainerDefinitions:
        - Name: mqadvanced-server-dev
          Cpu: 2048
          Memory: 4096
          Image: !Join [ '', [ !Ref 'AWS::AccountId', '.dkr.ecr.', !Ref 'AWS::Region', '.amazonaws.com/amazon-mq-to-websphere-mq-bridge/mqadvanced-server-dev:latest' ] ]
          PortMappings:
            - ContainerPort: 1414
            - ContainerPort: 9443
          Environment:
            - Name: LICENSE
              Value: accept
            - Name: MQ_QMGR_NAME
              Value: !Ref IBMMQBrokerQueueManager
            - Name: MQ_ADMIN_PASSWORD
              Value: !Ref IBMMQBrokerPassword
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: !Ref CloudWatchLogsGroup
              awslogs-region: !Ref AWS::Region
              awslogs-stream-prefix: ibm-mq-broker-task

  CloudWatchLogsGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: cmr/ecs/ibm-mq-cluster
      RetentionInDays: 30

  IBMMQECSService:
    Type: AWS::ECS::Service
    Properties:
      ServiceName: ibm-mq-broker-service
      Cluster: !Ref IBMMQECSCluster
      LaunchType: FARGATE
      DeploymentConfiguration:
        MaximumPercent: 200
        MinimumHealthyPercent: 100
      DesiredCount: 1
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: ENABLED
          SecurityGroups:
            - !Ref IBMMQSecurityGroup
          Subnets:
            - !Ref PublicSubnet1
            - !Ref PublicSubnet2
      TaskDefinition: !Ref IBMMQECSTaskDefinition

Outputs:
  IBMMQBrokerUserNameRef:
    Description: The reference to the IBM MQ broker application user name.
    Value: 'admin'
    Export:
      Name: !Sub '${Stage}:JMS-BRIDGE:IBMMQBrokerUserName'

  IBMMQBrokerPasswordRef:
    Description: The reference to the IBM MQ broker application user password.
    Value: !Ref IBMMQBrokerPassword
    Export:
      Name: !Sub '${Stage}:JMS-BRIDGE:IBMMQBrokerPassword'

  IBMMQBrokerQueueManagerRef:
    Description: The reference to the IBM MQ broker queue manager.
    Value: !Ref IBMMQBrokerQueueManager
    Export:
      Name: !Sub '${Stage}:JMS-BRIDGE:IBMMQBrokerQueueManager'

  IBMMQBrokerChannelRef:
    Description: The reference to the IBM MQ broker channel.
    Value: 'DEV.ADMIN.SVRCONN'
    Export:
      Name: !Sub '${Stage}:JMS-BRIDGE:IBMMQBrokerChannel'