gwfcore-launch-template.template-docker_creds_from_s3.yaml

gwfcore-launch-template.template-docker_creds_from_s3.yaml

# taken from https://github.com/aws-samples/aws-genomics-workflows/blob/master/src/templates/gwfcore/gwfcore-launch-template.template.yaml 
# Attempted to add Docker credentials

---
AWSTemplateFormatVersion: "2010-09-09"
Description: >-
  (WWPS-GLS-WF-GWFCORE-LT) Creates an EC2 Launch Template for AWS Batch based
  genomics workflows

Mappings:
  TagMap:
    default:
      architecture: "genomics-workflows"
      solution: "default"
      tags:
        - Key: "architecture"
          Value: "genomics-workflows"
        - Key: "solution"
          Value: "default"

Parameters:
  Namespace:
    Type: String
    Description: Namespace (e.g. project name) to use to label resources
  LaunchTemplateNamePrefix:
    Type: String
    Default: gwfcore
    Description: Name of the launch template. This will be made unique using the Stack ID.
  DockerStorageVolumeSize:
    Type: Number
    Default: 100
    Description: The initial size of the volume Docker will use for image and metadata storage (GB)
  ProjectNumber:
    Type: String
    Description: RTI project charge code

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "Required"
        Parameters:
          - Namespace
      - Label:
          default: "Optional"
        Parameters:
          - LaunchTemplateNamePrefix
          - DockerStorageVolumeSize

Conditions:
  NoNamespace: !Equals [ !Ref Namespace, "" ]

Resources:
  EC2LaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    Properties:
      LaunchTemplateName: 
        Fn::Join: 
          - "-"
          - - !Ref LaunchTemplateNamePrefix
            - Fn::If:
                - NoNamespace
                - !Select [2, !Split ["/", !Ref "AWS::StackId" ]]
                - !Ref Namespace
        
      LaunchTemplateData:
        # Used in tandem with UserData to check if the instance is provisioned
        # correctly. It is important to terminate mis-provisioned instances before
        # jobs are placed on them
        InstanceInitiatedShutdownBehavior: terminate
        TagSpecifications:
          - ResourceType: instance
            Tags:
            - Key: architecture
              Value: !FindInMap ["TagMap", "default", "architecture"]
            - Key: project-number
              Value: !Ref ProjectNumber
        BlockDeviceMappings:
          - Ebs:
              DeleteOnTermination: True
              VolumeSize: 50
              VolumeType: gp2
            DeviceName: /dev/xvda
          - Ebs:
              Encrypted: True
              DeleteOnTermination: True
              VolumeSize: 22
              VolumeType: gp2
            DeviceName: /dev/xvdcz
          - Ebs:
              Encrypted: True
              DeleteOnTermination: True
              VolumeSize: !Ref DockerStorageVolumeSize
              VolumeType: gp2
            DeviceName: /dev/xvdba
        UserData:
          Fn::Base64:
            Fn::Sub: |
                MIME-Version: 1.0
                Content-Type: multipart/mixed; boundary="==BOUNDARY=="

                --==BOUNDARY==
                Content-Type: text/cloud-config; charset="us-ascii"

                packages:
                - jq
                - btrfs-progs
                - sed
                - git
                - amazon-ssm-agent
                - unzip

                runcmd:
                # install aws-cli v2 and copy the static binary in an easy to find location for bind-mounts into containers
                - curl -s "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "/tmp/awscliv2.zip"
                - unzip -q /tmp/awscliv2.zip -d /tmp
                - /tmp/aws/install -b /usr/bin

                # check that the aws-cli was actually installed. if not shutdown (terminate) the instance
                - command -v aws || shutdown -P now

                - mkdir -p /opt/aws-cli/bin
                - cp -a $(dirname $(find /usr/local/aws-cli -name 'aws' -type f))/. /opt/aws-cli/bin/

                # set environment variables for provisioning
                - export GWFCORE_NAMESPACE=${Namespace}
                - export INSTALLED_ARTIFACTS_S3_ROOT_URL=$(aws ssm get-parameter --name /gwfcore/${Namespace}/installed-artifacts/s3-root-url --query 'Parameter.Value' --output text)

                # enable ecs spot instance draining
                - echo ECS_ENABLE_SPOT_INSTANCE_DRAINING=true >> /etc/ecs/ecs.config

                - cd /opt
                - aws s3 sync $INSTALLED_ARTIFACTS_S3_ROOT_URL/ecs-additions ./ecs-additions
                - chmod a+x /opt/ecs-additions/provision.sh
                - /opt/ecs-additions/provision.sh

                # Docker defualt use local image cache before attempting remote pull
                - echo ECS_IMAGE_PULL_BEHAVIOR=prefer-cached >> /etc/ecs/ecs.config

                # Get Docker credentials from S3
                - aws s3 cp s3://<s3-bucket>/docker-creds.txt docker-creds.txt
                - cat docker-creds.txt | docker login --username <username> --password-stdin

                --==BOUNDARY==--

Outputs:
  LaunchTemplateId:
    Description: >-
      EC2 Launch Template ID to use when creating AWS Batch compute environments
      for genomics workflows
    Value: !Ref EC2LaunchTemplate
...