gwfcore-launch-template.template-docker_creds_ecs_config.yaml

gwfcore-launch-template.template-docker_creds_ecs_config.yaml

# taken from https://github.com/aws-samples/aws-genomics-workflows/blob/master/src/templates/gwfcore/gwfcore-launch-template.template.yaml 
# Attempted to add Docker credentials

---
AWSTemplateFormatVersion: "2010-09-09"
Description: >-
  (WWPS-GLS-WF-GWFCORE-LT) Creates an EC2 Launch Template for AWS Batch based
  genomics workflows

Mappings:
  TagMap:
    default:
      architecture: "genomics-workflows"
      solution: "default"
      tags:
        - Key: "architecture"
          Value: "genomics-workflows"
        - Key: "solution"
          Value: "default"

Parameters:
  Namespace:
    Type: String
    Description: Namespace (e.g. project name) to use to label resources
  LaunchTemplateNamePrefix:
    Type: String
    Default: gwfcore
    Description: Name of the launch template. This will be made unique using the Stack ID.
  DockerStorageVolumeSize:
    Type: Number
    Default: 100
    Description: The initial size of the volume Docker will use for image and metadata storage (GB)

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "Required"
        Parameters:
          - Namespace
      - Label:
          default: "Optional"
        Parameters:
          - LaunchTemplateNamePrefix
          - DockerStorageVolumeSize

Conditions:
  NoNamespace: !Equals [ !Ref Namespace, "" ]

Resources:
  EC2LaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    Properties:
      LaunchTemplateName: 
        Fn::Join: 
          - "-"
          - - !Ref LaunchTemplateNamePrefix
            - Fn::If:
                - NoNamespace
                - !Select [2, !Split ["/", !Ref "AWS::StackId" ]]
                - !Ref Namespace
        
      LaunchTemplateData:
        # Used in tandem with UserData to check if the instance is provisioned
        # correctly. It is important to terminate mis-provisioned instances before
        # jobs are placed on them
        InstanceInitiatedShutdownBehavior: terminate
        TagSpecifications:
          - ResourceType: instance
            Tags:
            - Key: architecture
              Value: !FindInMap ["TagMap", "default", "architecture"]
        BlockDeviceMappings:
          - Ebs:
              DeleteOnTermination: True
              VolumeSize: 50
              VolumeType: gp2
            DeviceName: /dev/xvda
          - Ebs:
              Encrypted: True
              DeleteOnTermination: True
              VolumeSize: 22
              VolumeType: gp2
            DeviceName: /dev/xvdcz
          - Ebs:
              Encrypted: True
              DeleteOnTermination: True
              VolumeSize: !Ref DockerStorageVolumeSize
              VolumeType: gp2
            DeviceName: /dev/xvdba
        UserData:
          Fn::Base64:
            Fn::Sub: |
                MIME-Version: 1.0
                Content-Type: multipart/mixed; boundary="==BOUNDARY=="

                --==BOUNDARY==
                Content-Type: text/cloud-config; charset="us-ascii"

                #cloud-config
                repo_update: true
                repo_upgrade: security

                packages:
                - jq
                - btrfs-progs
                - sed
                - git
                - amazon-ssm-agent
                - unzip
                - amazon-cloudwatch-agent

                write_files:
                - permissions: '0644'
                  path: /opt/aws/amazon-cloudwatch-agent/etc/config.json
                  content: |
                    {
                      "agent": {
                        "logfile": "/opt/aws/amazon-cloudwatch-agent/logs/amazon-cloudwatch-agent.log"
                      },
                      "logs": {
                        "logs_collected": {
                          "files": {
                            "collect_list": [
                              {
                                "file_path": "/opt/aws/amazon-cloudwatch-agent/logs/amazon-cloudwatch-agent.log",
                                "log_group_name": "/aws/ecs/container-instance/${Namespace}",
                                "log_stream_name": "/aws/ecs/container-instance/${Namespace}/{instance_id}/amazon-cloudwatch-agent.log"
                              },
                              {
                                "file_path": "/var/log/cloud-init.log",
                                "log_group_name": "/aws/ecs/container-instance/${Namespace}",
                                "log_stream_name": "/aws/ecs/container-instance/${Namespace}/{instance_id}/cloud-init.log"
                              },
                              {
                                "file_path": "/var/log/cloud-init-output.log",
                                "log_group_name": "/aws/ecs/container-instance/${Namespace}",
                                "log_stream_name": "/aws/ecs/container-instance/${Namespace}/{instance_id}/cloud-init-output.log"
                              },
                              {
                                "file_path": "/var/log/ecs/ecs-init.log",
                                "log_group_name": "/aws/ecs/container-instance/${Namespace}",
                                "log_stream_name": "/aws/ecs/container-instance/${Namespace}/{instance_id}/ecs-init.log"
                              },
                              {
                                "file_path": "/var/log/ecs/ecs-agent.log",
                                "log_group_name": "/aws/ecs/container-instance/${Namespace}",
                                "log_stream_name": "/aws/ecs/container-instance/${Namespace}/{instance_id}/ecs-agent.log"
                              },
                              {
                                "file_path": "/var/log/ecs/ecs-volume-plugin.log",
                                "log_group_name": "/aws/ecs/container-instance/${Namespace}",
                                "log_stream_name": "/aws/ecs/container-instance/${Namespace}/{instance_id}/ecs-volume-plugin.log"
                              }
                            ]
                          }
                        }
                      }
                    }

                runcmd:

                # start the amazon-cloudwatch-agent
                - /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -s -c file:/opt/aws/amazon-cloudwatch-agent/etc/config.json

                # install aws-cli v2 and copy the static binary in an easy to find location for bind-mounts into containers
                - curl -s "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "/tmp/awscliv2.zip"
                - unzip -q /tmp/awscliv2.zip -d /tmp
                - /tmp/aws/install -b /usr/bin

                # check that the aws-cli was actually installed. if not shutdown (terminate) the instance
                - command -v aws || shutdown -P now

                - mkdir -p /opt/aws-cli/bin
                - cp -a $(dirname $(find /usr/local/aws-cli -name 'aws' -type f))/. /opt/aws-cli/bin/

                # set environment variables for provisioning
                - export GWFCORE_NAMESPACE=${Namespace}
                - export INSTALLED_ARTIFACTS_S3_ROOT_URL=$(aws ssm get-parameter --name /gwfcore/${Namespace}/installed-artifacts/s3-root-url --query 'Parameter.Value' --output text)

                # enable ecs spot instance draining
                - echo ECS_ENABLE_SPOT_INSTANCE_DRAINING=true >> /etc/ecs/ecs.config

                # pull docker images only if missing
                - echo ECS_IMAGE_PULL_BEHAVIOR=prefer-cached >> /etc/ecs/ecs.config

                # Add docker credentials to config
                - echo 'ECS_ENGINE_AUTH_TYPE=docker' >> /etc/ecs/ecs.config
                - echo 'ECS_ENGINE_AUTH_DATA={"https://index.docker.io/v1/":{"username":"<username>","password":"<docker-hub-token>","email":"<docker-hub-email>"}}' >> /etc/ecs/ecs.config

                - cd /opt
                - aws s3 sync $INSTALLED_ARTIFACTS_S3_ROOT_URL/ecs-additions ./ecs-additions
                - chmod a+x /opt/ecs-additions/provision.sh
                - /opt/ecs-additions/provision.sh

                --==BOUNDARY==--

Outputs:
  LaunchTemplateId:
    Description: >-
      EC2 Launch Template ID to use when creating AWS Batch compute environments
      for genomics workflows
    Value: !Ref EC2LaunchTemplate
...