mobile-application-direct-transmission-service.yml

ROSTemplateFormatVersion: '2015-09-01'
Description:
  zh-cn: 创建RAM角色与用户，配置ECS实例，安装App服务器，开放安全组端口，通过EIP和7080端口获取STS临时Token。
  en: Create RAM roles and users, configure ECS instances, install the application
    server, open security group ports, and acquire STS temporary Tokens through EIP
    on port 7080.
Parameters:
  ZoneId:
    Type: String
    AssociationProperty: ALIYUN::ECS::Instance::ZoneId
    AssociationPropertyMetadata:
      AutoSelectFirst: true
    Label:
      en: Availability Zone
      zh-cn: 可用区
  InstanceType:
    Type: String
    Label:
      en: Instance Type
      zh-cn: 实例类型
    AssociationProperty: ALIYUN::ECS::Instance::InstanceType
    AssociationPropertyMetadata:
      InstanceChargeType: PostPaid
      SystemDiskCategory: cloud_essd
      ZoneId: ${ZoneId}
    Label:
      en: Instance Type
      zh-cn: 实例规格
  Password:
    NoEcho: true
    Type: String
    Description:
      en: Server login password, Length 8-30, must contain three(Capital letters, lowercase letters, numbers, ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/ Special symbol in)
      zh-cn: 服务器登录密码，长度8-30，必须包含三项（大写字母、小写字母、数字、 ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/ 中的特殊符号）
    Label:
      en: ECS Instance Password
      zh-cn: ECS实例密码
    ConstraintDescription:
      en: Length 8-30, must contain three(Capital letters, lowercase letters, numbers, ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/ Special symbol in)
      zh-cn: 长度8-30，必须包含三项（大写字母、小写字母、数字、 ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/ 中的特殊符号）
    AssociationProperty: ALIYUN::ECS::Instance::Password
Resources:
  Role:
    Type: ALIYUN::RAM::Role
    Properties:
      RoleName: AliyunOSSTokenGeneratorRoleByRos
      Description: 访问OSS的权限
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              RAM:
                - Fn::Sub: acs:ram::${ALIYUN::TenantId}:root
        Version: '1'
      Policies:
        - PolicyName: AliyunOSSTokenGeneratorRolePolicyByRos
          Description: 此Policy由ROS创建，用于限制角色AliyunOSSTokenGeneratorRole的权限
          PolicyDocument:
            Version: '1'
            Statement:
              - Effect: Allow
                Action:
                  - oss:*
                Resource:
                  - '*'
  User:
    Type: ALIYUN::RAM::User
    Properties:
      UserName: AliyunOSSTokenGeneratorUserByRos
      Policies:
        - PolicyName: AliyunOSSTokenGeneratorUserPolicyByRos
          PolicyDocument:
            Version: '1'
            Statement:
              - Effect: Allow
                Action:
                  - sts:AssumeRole
                Resource:
                  - Fn::GetAtt:
                      - Role
                      - Arn
  AccessKey:
    Type: ALIYUN::RAM::AccessKey
    Properties:
      UserName:
        Fn::GetAtt:
          - User
          - UserName
  Vpc:
    Type: ALIYUN::ECS::VPC
    Properties:
      CidrBlock: 192.168.0.0/16
  SecurityGroup:
    Type: ALIYUN::ECS::SecurityGroup
    Properties:
      VpcId:
        Ref: Vpc
  VSwitch:
    Type: ALIYUN::ECS::VSwitch
    Properties:
      ZoneId:
        Ref: ZoneId
      VpcId:
        Ref: Vpc
      CidrBlock: 192.168.0.0/24
  InstanceGroup:
    Type: ALIYUN::ECS::InstanceGroup
    Properties:
      ZoneId:
        Ref: ZoneId
      VpcId:
        Ref: Vpc
      VSwitchId:
        Ref: VSwitch
      SecurityGroupId:
        Ref: SecurityGroup
      ImageId: centos_7
      InstanceType:
        Ref: InstanceType
      SystemDiskCategory: cloud_essd
      SystemDiskSize: 40
      MaxAmount: 1
      InternetMaxBandwidthOut: 5
      Password:
        Ref: Password
      AllocatePublicIP: false
  Eip:
    Type: ALIYUN::VPC::EIP
    Properties:
      Name: create_by_document
      InternetChargeType: PayByTraffic
      Bandwidth: 5
  EipAssociation:
    Type: ALIYUN::VPC::EIPAssociation
    Properties:
      InstanceId:
        Fn::Select:
          - 0
          - Fn::GetAtt:
              - InstanceGroup
              - InstanceIds
      AllocationId:
        Fn::GetAtt:
          - Eip
          - AllocationId
  ServerCommand:
    Type: ALIYUN::ECS::RunCommand
    Properties:
      InstanceIds:
        Fn::GetAtt:
          - InstanceGroup
          - InstanceIds
      Type: RunShellScript
      Sync: true
      Timeout: 3600
      CommandContent:
        Fn::Sub: |-
          yum -y install unzip java
          wget -O AppTokenServerDemo.zip 'https://gosspublic.alicdn.com/doc31920servercode/AppTokenServerDemo.zip?spm=a2c4g.31920.0.0.65f768f3jSxBXC&file=AppTokenServerDemo.zip'
          unzip -o AppTokenServerDemo.zip
          cd AppTokenServerDemo
          echo -e '{\n  "AccessKeyID": "${AccessKey.AccessKeyId}",\n  "AccessKeySecret": "${AccessKey.AccessKeySecret}",\n  "RoleArn": "${Role.Arn}",\n  "TokenExpireTime": "3600",\n  "PolicyFile": "policy/bucket_write_policy.txt"\n}' > config.json
          nohup java -jar app-token-server.jar &
  SecurityGroupIngress_22:
    Type: ALIYUN::ECS::SecurityGroupIngress
    Properties:
      SecurityGroupId:
        Ref: SecurityGroup
      SourceCidrIp: 0.0.0.0/0
      IpProtocol: tcp
      NicType: intranet
      PortRange: 22/22
  SecurityGroupIngress_80:
    Type: ALIYUN::ECS::SecurityGroupIngress
    Properties:
      SecurityGroupId:
        Ref: SecurityGroup
      SourceCidrIp: 0.0.0.0/0
      IpProtocol: tcp
      NicType: intranet
      PortRange: 80/80
  SecurityGroupIngress_443:
    Type: ALIYUN::ECS::SecurityGroupIngress
    Properties:
      SecurityGroupId:
        Ref: SecurityGroup
      SourceCidrIp: 0.0.0.0/0
      IpProtocol: tcp
      NicType: intranet
      PortRange: 443/443
  SecurityGroupIngress_7080:
    Type: ALIYUN::ECS::SecurityGroupIngress
    Properties:
      SecurityGroupId:
        Ref: SecurityGroup
      SourceCidrIp: 0.0.0.0/0
      IpProtocol: tcp
      NicType: intranet
      PortRange: 7080/7080
Outputs:
  RoleArn:
    Description:
      en: Role ARN.
      zh-cn: 角色的ARN。
    Value:
      Fn::GetAtt:
        - Role
        - Arn
  AccessKeyId:
    Description: AccessKey ID.
    Value:
      Fn::GetAtt:
        - AccessKey
        - AccessKeyId
  Console.ApplicationServerAddress:
    Label:
      en: Application server address
      zh-cn: 应用服务端地址
    Value:
      Fn::Sub: http://${Eip.EipAddress}:7080
  EcsInstanceId:
    Description:
      en: Ecs instance id.
      zh-cn: ECS实例id。
    Value:
      Fn::Select:
        - 0
        - Fn::GetAtt:
            - InstanceGroup
            - InstanceIds
  EipAllocationId:
    Description:
      en: Eip allocation id.
      zh-cn: EIP实例id。
    Value:
      Fn::GetAtt:
        - Eip
        - AllocationId
  EcsLoginAddress:
    Description:
      en: Ecs login address.
      zh-cn: ECS登录地址。
    Value:
      Fn::Sub:
        - https://ecs-workbench.aliyun.com/?from=EcsConsole&instanceType=ecs&regionId=${Region}&instanceId=${InstanceId}
        - Region:
            Ref: ALIYUN::Region
          InstanceId:
            Fn::Select:
              - 0
              - Fn::GetAtt:
                  - InstanceGroup
                  - InstanceIds
Metadata:
  ALIYUN::ROS::Interface:
    ParameterGroups:
      - Parameters:
          - ZoneId
          - InstanceType
          - Password
        Label:
          default:
            zh-cn: ECS实例配置信息
            en: Instance
    TemplateTags:
      - acs:document-help:oss:快速搭建移动应用直传服务