CloudFormation Template for EC2 running Postgres on Docker

postgres-stack.yml

AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  PostgresVpcId:
    Type: 'AWS::EC2::VPC::Id'
  Subnet1:
    Type: String
  Subnet2:
    Type: String
  HostedZoneId:
    Type: String
  HostName:
    Type: String
  SecretId:
      Type: String
      Default: PostgresSecret
Resources:
  PostgresSecret:
    Type: 'AWS::SecretsManager::Secret'
    Properties:
      Name: !Sub ${SecretId}
      GenerateSecretString:
        GenerateStringKey: "POSTGRES_PASSWORD"
        SecretStringTemplate: '{ "POSTGRES_USER": "postgres" }'
        PasswordLength: 30
        ExcludeCharacters: '"@/\'
  EC2Instance:
    Type: "AWS::EC2::Instance"
    DeletionPolicy: Delete
    Properties:
      InstanceType: t2.micro
      ImageId: ami-087c17d1fe0178315
      AvailabilityZone: us-east-1a
      SecurityGroupIds:
        - !GetAtt SGPostgres.GroupId
      BlockDeviceMappings: 
        - DeviceName: "/dev/xvda"
          Ebs: 
            VolumeSize: "8"
      IamInstanceProfile: !Ref EC2InstanceProfile
      Tags:
        - Key: Name
          Value: staffing-postgres
      UserData:
        Fn::Base64: !Sub
          |
          #!/bin/bash -xe
          sudo yum update -y
          sudo amazon-linux-extras install docker
          sudo service docker start
          sudo usermod -a -G docker ec2-user
          sudo curl -L https://github.com/docker/compose/releases/download/1.29.2/docker-compose-$(uname -s)-$(uname -m) -o /usr/local/bin/docker-compose
          sudo chmod +x /usr/local/bin/docker-compose
          sudo ln -s /usr/local/bin/docker-compose /usr/bin/docker-compose
          sudo yum install -y jq
          mkdir -p /app
          cd /app
          echo version: \'3.8\' >> docker-compose.yml
          echo services: >> docker-compose.yml
          echo "  postgres:" >> docker-compose.yml
          echo "    container_name: 'foxbox-staff-db'" >> docker-compose.yml
          echo "    image: postgres:latest" >> docker-compose.yml
          echo "    restart: always" >> docker-compose.yml
          echo "    environment:" >> docker-compose.yml
          echo "      - POSTGRES_USER=postgres" >> docker-compose.yml
          echo "      - POSTGRES_DB=staffing" >> docker-compose.yml
          echo "      - POSTGRES_PASSWORD=\${!POSTGRES_PASSWORD}" >> docker-compose.yml
          echo "    ports:" >> docker-compose.yml
          echo "      - '5432:5432'" >> docker-compose.yml
          echo "    volumes:"  >> docker-compose.yml
          echo "      - pgdata:/var/lib/postgresql/data" >> docker-compose.yml
          echo "volumes:" >> docker-compose.yml
          echo "  pgdata:" >> docker-compose.yml
          echo -n POSTGRES_PASSWORD= > .env
          aws --region ${AWS::Region} secretsmanager get-secret-value --secret-id ${SecretId} --query SecretString --output text | jq -r .POSTGRES_PASSWORD >> .env
          /usr/local/bin/docker-compose --env-file .env up -d --remove-orphans
#          rm -f .env
  EC2Role:
    Type: "AWS::IAM::Role"
    DependsOn: PostgresSecret
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "ec2.amazonaws.com" 
            Action: 
              - "sts:AssumeRole"
      Path: "/"
      Policies:
        - PolicyName: "GetPostgresSecretPolicy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action: "secretsmanager:GetSecretValue"
                Resource: !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:${SecretId}-??????"
  EC2InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: "/"
      Roles:
        - !Ref EC2Role
  Route53Record:
    Type: AWS::Route53::RecordSet
    Properties: 
      HostedZoneId: !Ref HostedZoneId
      Type: A
      Name: !Ref HostName
      ResourceRecords:
        - !GetAtt EC2Instance.PublicIp
      TTL: 300
  SGPostgres:
    Type: AWS::EC2::SecurityGroup
    DeletionPolicy: Delete
    Properties:
      GroupDescription: 'Postgres'
      VpcId: !Ref PostgresVpcId
      SecurityGroupIngress:
# In case you want to open up to internet:
#        - IpProtocol: tcp
#          FromPort: 5432
#          ToPort: 5432
#          CidrIp: 0.0.0.0/0
#          Description: 'all internet'
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 18.206.107.24/29
          Description: 'AWS EC2 Connect'
        # Google Data Studio:
        - IpProtocol: tcp
          FromPort: 5432
          ToPort: 5432
          CidrIp: 64.18.0.0/20
        - IpProtocol: tcp
          FromPort: 5432
          ToPort: 5432
          CidrIp: 64.233.160.0/19
        - IpProtocol: tcp
          FromPort: 5432
          ToPort: 5432
          CidrIp: 66.102.0.0/20
        - IpProtocol: tcp
          FromPort: 5432
          ToPort: 5432
          CidrIp: 66.249.80.0/20
        - IpProtocol: tcp
          FromPort: 5432
          ToPort: 5432
          CidrIp: 72.14.192.0/18
        - IpProtocol: tcp
          FromPort: 5432
          ToPort: 5432
          CidrIp: 74.125.0.0/16
        - IpProtocol: tcp
          FromPort: 5432
          ToPort: 5432
          CidrIp: 108.177.8.0/21
        - IpProtocol: tcp
          FromPort: 5432
          ToPort: 5432
          CidrIp: 142.251.74.0/23
        - IpProtocol: tcp
          FromPort: 5432
          ToPort: 5432
          CidrIp: 173.194.0.0/16
        - IpProtocol: tcp
          FromPort: 5432
          ToPort: 5432
          CidrIp: 207.126.144.0/20
        - IpProtocol: tcp
          FromPort: 5432
          ToPort: 5432
          CidrIp: 209.85.128.0/17
        - IpProtocol: tcp
          FromPort: 5432
          ToPort: 5432
          CidrIp: 216.58.192.0/19
        - IpProtocol: tcp
          FromPort: 5432
          ToPort: 5432
          CidrIp: 216.239.32.0/19
      SecurityGroupEgress:
      - IpProtocol: -1
        CidrIp: 0.0.0.0/0