serverless-resources.yml

rBuildsSecurityGroup:
  Type: AWS::EC2::SecurityGroup
  Properties:
    GroupDescription: RBuilds jobs - ${self:provider.stage}
    GroupName: RBuildsJobs-${self:provider.stage}
    VpcId: ${self:custom.vpcId}
    Tags: ${self:provider.tagsList}

rBuildsSpotFleetIamRole:
  Type: AWS::IAM::Role
  Properties:
    Path: /service-role/
    AssumeRolePolicyDocument:
      Version: '2012-10-17'
      Statement:
        - Effect: Allow
          Principal:
            Service:
              - spotfleet.amazonaws.com
          Action: sts:AssumeRole
    ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AmazonEC2SpotFleetTaggingRole
rBuildsInstanceIamRole:
  Type: AWS::IAM::Role
  Properties:
    AssumeRolePolicyDocument:
      Version: '2012-10-17'
      Statement:
        - Effect: 'Allow'
          Principal:
            Service:
              - 'ec2.amazonaws.com'
          Action:
            - 'sts:AssumeRole'
    Path: '/'
    ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role

rBuildsIamInstanceProfile:
  Type: AWS::IAM::InstanceProfile
  Properties:
    Path: '/'
    Roles:
      - Ref: rBuildsInstanceIamRole
rBuildsEcsTaskIamRole:
  Type: AWS::IAM::Role
  Properties:
    Path: /service-role/
    AssumeRolePolicyDocument:
      Version: '2012-10-17'
      Statement:
        - Effect: Allow
          Principal:
            Service:
              - ecs-tasks.amazonaws.com
          Action: sts:AssumeRole
    ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
    Policies:
      - PolicyName: 's3-r-builds-bucket'
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - s3:*
              Resource:
                - arn:aws:s3:::${self:custom.${self:provider.stage}.s3Bucket}
                - arn:aws:s3:::${self:custom.${self:provider.stage}.s3Bucket}/*

rBuildsEcsLaunchTemplate:
  Type: AWS::EC2::LaunchTemplate
  Properties:
    LaunchTemplateName: r-builds-${self:provider.stage}-batch-managed-ecs-larger-volume
    LaunchTemplateData:
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            VolumeType: gp3
            VolumeSize: 96
            Encrypted: true
      MetadataOptions:
        HttpTokens: required
        HttpPutResponseHopLimit: 2

rBuildsBatchComputeEnvironment:
  Type: AWS::Batch::ComputeEnvironment
  Properties:
    Type: MANAGED
    ComputeResources:
      AllocationStrategy: BEST_FIT_PROGRESSIVE
      Ec2Configuration:
        - ImageType: ECS_AL2023
      LaunchTemplate:
        LaunchTemplateId:
          Ref: rBuildsEcsLaunchTemplate
        Version: '$Latest'
      SpotIamFleetRole:
        "Fn::GetAtt": [ rBuildsSpotFleetIamRole, Arn ]
      SecurityGroupIds:
        - "Fn::GetAtt": [ rBuildsSecurityGroup, GroupId ]
      Subnets: ${self:custom.subnets}
      Type: SPOT
      BidPercentage: 100
      InstanceRole:
        "Fn::GetAtt": [ rBuildsIamInstanceProfile, Arn ]
      InstanceTypes:
        - r5.xlarge
        - r5.2xlarge
        - r5a.xlarge
        - r5a.2xlarge
        - c6i.xlarge
        - c5.xlarge
        - c5.2xlarge
        - c5a.xlarge
        - c5a.2xlarge
      Ec2KeyPair: ${self:custom.ec2KeyPair}
      Tags: ${self:provider.tagsMap}
      MinvCpus: 0
      DesiredvCpus: 0
      MaxvCpus: 256
      UpdateToLatestImageVersion: true

rBuildsBatchJobQueue:
  Type: AWS::Batch::JobQueue
  Properties:
    ComputeEnvironmentOrder:
      - Order: 1
        ComputeEnvironment:
          Ref: rBuildsBatchComputeEnvironment
    State: ENABLED
    Priority: 1

rBuildsBatchJobDefinitionUbuntu2004:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
      Image: !Sub "${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/r-builds:ubuntu-2004"
    Timeout:
      AttemptDurationSeconds: 7200
rBuildsBatchJobDefinitionUbuntu2204:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
      Image: !Sub "${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/r-builds:ubuntu-2204"
    Timeout:
      AttemptDurationSeconds: 7200
rBuildsBatchJobDefinitionUbuntu2404:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
      Image: !Sub "${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/r-builds:ubuntu-2404"
    Timeout:
      AttemptDurationSeconds: 7200
rBuildsBatchJobDefinitionDebian10:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
      Image: !Sub "${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/r-builds:debian-10"
    Timeout:
      AttemptDurationSeconds: 7200
rBuildsBatchJobDefinitionDebian11:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
      Image: !Sub "${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/r-builds:debian-11"
    Timeout:
      AttemptDurationSeconds: 7200
rBuildsBatchJobDefinitionDebian12:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
      Image: !Sub "${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/r-builds:debian-12"
    Timeout:
      AttemptDurationSeconds: 7200
rBuildsBatchJobDefinitionCentos7:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
      Image: !Sub "${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/r-builds:centos-7"
    Timeout:
      AttemptDurationSeconds: 7200
rBuildsBatchJobDefinitionCentos8:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
      Image: !Sub "${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/r-builds:centos-8"
    Timeout:
      AttemptDurationSeconds: 7200
rBuildsBatchJobDefinitionRhel9:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
      Image: !Sub "${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/r-builds:rhel-9"
    Timeout:
      AttemptDurationSeconds: 7200
rBuildsBatchJobDefinitionOpensuse155:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
      Image: !Sub "${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/r-builds:opensuse-155"
    Timeout:
      AttemptDurationSeconds: 7200
rBuildsBatchJobDefinitionOpensuse156:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
      Image: !Sub "${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/r-builds:opensuse-156"
    Timeout:
      AttemptDurationSeconds: 7200
rBuildsBatchJobDefinitionFedora38:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
      Image: !Sub "${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/r-builds:fedora-38"
    Timeout:
      AttemptDurationSeconds: 7200
rBuildsBatchJobDefinitionFedora39:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
      Image: !Sub "${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/r-builds:fedora-39"
    Timeout:
      AttemptDurationSeconds: 7200
rBuildsBatchJobDefinitionFedora40:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
      Image: !Sub "${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/r-builds:fedora-40"
    Timeout:
      AttemptDurationSeconds: 7200

# step function cloudwatch event trigger resources
rBuildsEventRuleIamRole:
  Type: AWS::IAM::Role
  Properties:
    Path: /service-role/
    AssumeRolePolicyDocument:
      Version: '2012-10-17'
      Statement:
        - Effect: Allow
          Principal:
            Service:
              - events.amazonaws.com
          Action: sts:AssumeRole
    Policies:
      - PolicyName: 'allow-step-function-execution'
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - states:StartExecution
              Resource:
                Ref: RBuildsStepFunction

rBuildsEventRule:
  Type: AWS::Events::Rule
  Properties:
    Description: Check for New R Versions
    ScheduleExpression: rate(1 hour)
    State: ${self:custom.${self:provider.stage}.eventRuleState}
    Targets:
      - Id: rbuilds
        Input: '{}'
        RoleArn:
          Fn::GetAtt: [ rBuildsEventRuleIamRole, Arn ]
        Arn:
          Ref: RBuildsStepFunction

rBuildsDevelEventRule:
  Type: AWS::Events::Rule
  Properties:
    Description: Build R-devel
    ScheduleExpression: cron(0 4 * * ? *)
    State: ${self:custom.${self:provider.stage}.eventRuleState}
    Targets:
      - Id: rbuilds
        Input: '{"force": true, "versions": ["next", "devel"]}'
        RoleArn:
          Fn::GetAtt: [ rBuildsEventRuleIamRole, Arn ]
        Arn:
          Ref: RBuildsStepFunction

rBuildsTopic:
  Type: AWS::SNS::Topic
  Properties:
    DisplayName: R Builds
    TopicName: ${self:custom.${self:provider.stage}.snsTopicName}