castle.yml

# stacks/apps/castle.yml
# 200A
AWSTemplateFormatVersion: "2010-09-09"

Description: >-
  Creates an ECS service for Castle, along with target group and listener rule
  for the shared ALB. Also creates a Redis cluster for the service to use.

Parameters:
  kContainerName:
    Type: String
    Default: castle-phoenix
  kApplicationPort:
    Type: Number
    Default: 4000
  #######
  NestedChangeSetScrubbingResourcesState: { Type: String }
  AlbFullName: { Type: String }
  AlbHttpsListenerArn: { Type: String }
  EcsClusterArn: { Type: String }
  EnvironmentType: { Type: String }
  EnvironmentTypeAbbreviation: { Type: String }
  RegionMode: { Type: String }
  RootStackName: { Type: String }
  RootStackId: { Type: String }
  CloudWatchAlarmTaggerServiceToken: { Type: String }
  VpcId: { Type: AWS::EC2::VPC::Id }
  VpcPrivateSubnet1Id: { Type: AWS::EC2::Subnet::Id }
  VpcPrivateSubnet2Id: { Type: AWS::EC2::Subnet::Id }
  VpcPrivateSubnet3Id: { Type: AWS::EC2::Subnet::Id }
  NewRelicApiKeyPrxLite: { Type: String }
  EcrImageTag: { Type: AWS::SSM::Parameter::Value<String> }
  AlbListenerRulePriorityPrefix: { Type: String }
  CastlePostgresUsername: { Type: AWS::SSM::Parameter::Value<String> }
  CastlePostgresUserPassword: { Type: AWS::SSM::Parameter::Value<String>, NoEcho: true }
  SharedRedisReplicationGroupEndpointAddress: { Type: String }
  SharedRedisReplicationGroupEndpointPort: { Type: String }
  SharedEcsAsgInstanceSecurityGroupId: { Type: AWS::EC2::SecurityGroup::Id }
  FeederHostname: { Type: String }
  IdHostname: { Type: String }

Conditions:
  IsProduction: !Equals [!Ref EnvironmentType, Production]
  IsPrimaryRegion: !Equals [!Ref RegionMode, Primary]
  EnableNestedChangeSetScrubbingResources: !Equals [!Ref NestedChangeSetScrubbingResourcesState, Enabled]

Resources:
  NestedChangeSetScrubber: { Type: AWS::SNS::Topic, Condition: EnableNestedChangeSetScrubbingResources }

  HostHeaderListenerRule:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      Actions:
        - TargetGroupArn: !Ref TargetGroup
          Type: forward
      Conditions:
        - Field: host-header
          Values:
            - castle.*
      ListenerArn: !Ref AlbHttpsListenerArn
      Priority: !Join ["", [!Ref AlbListenerRulePriorityPrefix, "00"]]

  TargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckIntervalSeconds: 15
      HealthCheckPath: /api/v1
      HealthCheckTimeoutSeconds: 5
      HealthyThresholdCount: 3
      Port: 80
      Protocol: HTTP
      TargetGroupAttributes:
        - Key: deregistration_delay.timeout_seconds
          Value: "30"
      Tags:
        - { Key: Name, Value: !Sub "${RootStackName}_castle" }
        - { Key: prx:meta:tagging-version, Value: "2021-04-07" }
        - { Key: prx:cloudformation:stack-name, Value: !Ref AWS::StackName }
        - { Key: prx:cloudformation:stack-id, Value: !Ref AWS::StackId }
        - { Key: prx:cloudformation:root-stack-name, Value: !Ref RootStackName }
        - { Key: prx:cloudformation:root-stack-id, Value: !Ref RootStackId }
        - { Key: prx:ops:environment, Value: !Ref EnvironmentType }
        - { Key: prx:dev:family, Value: Dovetail }
        - { Key: prx:dev:application, Value: Castle }
      TargetType: instance
      UnhealthyThresholdCount: 3
      VpcId: !Ref VpcId
  TargetGroupHttp5xxAlarm:
    Type: AWS::CloudWatch::Alarm
    Condition: IsProduction
    Properties:
      AlarmName: !Sub ERROR [Castle] Web server <${EnvironmentTypeAbbreviation}> RETURNING 5XX ERRORS (${RootStackName})
      AlarmDescription: !Sub >-
        ${EnvironmentType} Castle's Elixer server is returning 5XX errors from
        the ECS service to the load balancer.
      ComparisonOperator: GreaterThanThreshold
      Dimensions:
        - Name: LoadBalancer
          Value: !Ref AlbFullName
        - Name: TargetGroup
          Value: !GetAtt TargetGroup.TargetGroupFullName
      EvaluationPeriods: 3
      MetricName: HTTPCode_Target_5XX_Count
      Namespace: AWS/ApplicationELB
      Period: 60
      Statistic: Sum
      Threshold: 0
      TreatMissingData: notBreaching
  TargetGroupHttp5xxAlarmTags:
    Type: Custom::CloudWatchAlarmTags
    Condition: IsProduction
    Properties:
      ServiceToken: !Ref CloudWatchAlarmTaggerServiceToken
      AlarmArn: !GetAtt TargetGroupHttp5xxAlarm.Arn
      Tags:
        - { Key: prx:meta:tagging-version, Value: "2021-04-07" }
        - { Key: prx:cloudformation:stack-name, Value: !Ref AWS::StackName }
        - { Key: prx:cloudformation:stack-id, Value: !Ref AWS::StackId }
        - { Key: prx:cloudformation:root-stack-name, Value: !Ref RootStackName }
        - { Key: prx:cloudformation:root-stack-id, Value: !Ref RootStackId }
        - { Key: prx:ops:environment, Value: !Ref EnvironmentType }
        - { Key: prx:ops:cloudwatch-log-group-name, Value: !Ref TaskLogGroup }
        - { Key: prx:dev:family, Value: Dovetail }
        - { Key: prx:dev:application, Value: Castle }

  EcsService:
    Type: AWS::ECS::Service
    Properties:
      Cluster: !Ref EcsClusterArn
      DeploymentConfiguration:
        MaximumPercent: 200
        MinimumHealthyPercent: 50
      DesiredCount: !If [IsPrimaryRegion, 2, 0]
      EnableECSManagedTags: true
      LoadBalancers:
        - ContainerName: !Ref kContainerName
          ContainerPort: !Ref kApplicationPort
          TargetGroupArn: !Ref TargetGroup
      PropagateTags: TASK_DEFINITION
      Tags:
        - { Key: prx:meta:tagging-version, Value: "2021-04-07" }
        - { Key: prx:cloudformation:stack-name, Value: !Ref AWS::StackName }
        - { Key: prx:cloudformation:stack-id, Value: !Ref AWS::StackId }
        - { Key: prx:cloudformation:root-stack-name, Value: !Ref RootStackName }
        - { Key: prx:cloudformation:root-stack-id, Value: !Ref RootStackId }
        - { Key: prx:ops:environment, Value: !Ref EnvironmentType }
        - { Key: prx:dev:family, Value: Dovetail }
        - { Key: prx:dev:application, Value: Castle }
      TaskDefinition: !Ref TaskDefinition

  TaskLogGroup:
    Type: AWS::Logs::LogGroup
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      RetentionInDays: 14
      Tags:
        - { Key: prx:meta:tagging-version, Value: "2021-04-07" }
        - { Key: prx:cloudformation:stack-name, Value: !Ref AWS::StackName }
        - { Key: prx:cloudformation:stack-id, Value: !Ref AWS::StackId }
        - { Key: prx:cloudformation:root-stack-name, Value: !Ref RootStackName }
        - { Key: prx:cloudformation:root-stack-id, Value: !Ref RootStackId }
        - { Key: prx:ops:environment, Value: !Ref EnvironmentType }
        - { Key: prx:dev:family, Value: Dovetail }
        - { Key: prx:dev:application, Value: Castle }
  ExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
        Version: "2012-10-17"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
      Policies:
        - PolicyDocument:
            Statement:
              - Action: ssm:GetParameters
                Effect: Allow
                Resource: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/prx/${EnvironmentTypeAbbreviation}/Spire/Dovetail-Castle/*
                Sid: AllowAppParameterRead
            Version: "2012-10-17"
          PolicyName: ContainerSecrets
      Tags:
        - { Key: prx:meta:tagging-version, Value: "2021-04-07" }
        - { Key: prx:cloudformation:stack-name, Value: !Ref AWS::StackName }
        - { Key: prx:cloudformation:stack-id, Value: !Ref AWS::StackId }
        - { Key: prx:cloudformation:root-stack-name, Value: !Ref RootStackName }
        - { Key: prx:cloudformation:root-stack-id, Value: !Ref RootStackId }
        - { Key: prx:ops:environment, Value: !Ref EnvironmentType }
        - { Key: prx:dev:family, Value: Dovetail }
        - { Key: prx:dev:application, Value: Castle }
  TaskRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
        Version: "2012-10-17"
      Tags:
        - { Key: prx:meta:tagging-version, Value: "2021-04-07" }
        - { Key: prx:cloudformation:stack-name, Value: !Ref AWS::StackName }
        - { Key: prx:cloudformation:stack-id, Value: !Ref AWS::StackId }
        - { Key: prx:cloudformation:root-stack-name, Value: !Ref RootStackName }
        - { Key: prx:cloudformation:root-stack-id, Value: !Ref RootStackId }
        - { Key: prx:ops:environment, Value: !Ref EnvironmentType }
        - { Key: prx:dev:family, Value: Dovetail }
        - { Key: prx:dev:application, Value: Castle }
  TaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        - Command:
            - web
          Cpu: !If [IsProduction, 200, 128]
          Environment:
            - Name: APP_NAME
              Value: castle
            - Name: APP_ENV
              Value: !Ref EnvironmentTypeAbbreviation
            - Name: AWS_DEFAULT_REGION
              Value: !Ref AWS::Region
            - Name: REDIS_HOST
              Value: !Ref SharedRedisReplicationGroupEndpointAddress
            - Name: REDIS_PORT
              Value: !Ref SharedRedisReplicationGroupEndpointPort
            - Name: REDIS_NAMESPACE
              Value: castle
            - Name: REDIS_POOL_SIZE
              Value: "5"
            - Name: PORT
              Value: !Ref kApplicationPort
            - Name: BQ_PROJECT_ID
              Value: prx-metrics
            - Name: BQ_DATASET
              Value: !If [IsProduction, production, staging]
            - Name: FEEDER_HOST
              Value: !Ref FeederHostname
            - Name: ID_HOST
              Value: !Ref IdHostname
            - Name: NEW_RELIC_LICENSE_KEY
              Value: !Ref NewRelicApiKeyPrxLite
            - Name: NEW_RELIC_APP_NAME
              Value: !If [IsProduction, Castle Production, Castle Staging]
            - Name: PG_HOST
              Value: !GetAtt PostgresInstance.Endpoint.Address
            - Name: PG_PORT
              Value: !GetAtt PostgresInstance.Endpoint.Port
            - Name: PG_POOL_SIZE
              Value: !If [IsProduction, "25", "10"]
          Essential: true
          Image: !Sub ${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${EcrImageTag}
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: !Ref TaskLogGroup
              awslogs-region: !Ref AWS::Region
              awslogs-stream-prefix: ecs
          Memory: !If [IsProduction, 2000, 1000]
          MemoryReservation: !If [IsProduction, 1000, 500]
          Name: !Ref kContainerName
          PortMappings:
            - ContainerPort: !Ref kApplicationPort
              HostPort: 0
          Secrets:
            - Name: SECRET_KEY_BASE
              ValueFrom: !Sub /prx/${EnvironmentTypeAbbreviation}/Spire/Dovetail-Castle/secret-key-base
            - Name: BQ_CLIENT_EMAIL
              ValueFrom: !Sub /prx/${EnvironmentTypeAbbreviation}/Spire/Dovetail-Castle/bigquery-client-email
            - Name: BQ_PRIVATE_KEY
              ValueFrom: !Sub /prx/${EnvironmentTypeAbbreviation}/Spire/Dovetail-Castle/bigquery-client-key
            - Name: CLIENT_ID
              ValueFrom: !Sub /prx/${EnvironmentTypeAbbreviation}/Spire/Dovetail-Castle/id-auth-client-id
            - Name: CLIENT_SECRET
              ValueFrom: !Sub /prx/${EnvironmentTypeAbbreviation}/Spire/Dovetail-Castle/id-auth-client-secret
            - Name: MAXMIND_LICENSE_KEY
              ValueFrom: !Sub /prx/${EnvironmentTypeAbbreviation}/Spire/Dovetail-Castle/maxmind-license-key
            - Name: PG_DATABASE
              ValueFrom: !Sub /prx/${EnvironmentTypeAbbreviation}/Spire/Dovetail-Castle/database-name
            - Name: PG_PASSWORD
              ValueFrom: !Sub /prx/${EnvironmentTypeAbbreviation}/Spire/Dovetail-Castle/database-password
            - Name: PG_USER
              ValueFrom: !Sub /prx/${EnvironmentTypeAbbreviation}/Spire/Dovetail-Castle/database-username
      ExecutionRoleArn: !GetAtt ExecutionRole.Arn
      NetworkMode: bridge
      Tags:
        - { Key: prx:meta:tagging-version, Value: "2021-04-07" }
        - { Key: prx:cloudformation:stack-name, Value: !Ref AWS::StackName }
        - { Key: prx:cloudformation:stack-id, Value: !Ref AWS::StackId }
        - { Key: prx:cloudformation:root-stack-name, Value: !Ref RootStackName }
        - { Key: prx:cloudformation:root-stack-id, Value: !Ref RootStackId }
        - { Key: prx:ops:environment, Value: !Ref EnvironmentType }
        - { Key: prx:dev:family, Value: Dovetail }
        - { Key: prx:dev:application, Value: Castle }
      TaskRoleArn: !GetAtt TaskRole.Arn

  QuicksightVpcSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      GroupDescription: !Sub Castle QuickSight ${EnvironmentType} Security Group
      Tags:
        - { Key: Name, Value: !Sub "${RootStackName}_castle_postgresql-quicksight" }
        - { Key: prx:meta:tagging-version, Value: "2021-04-07" }
        - { Key: prx:cloudformation:stack-name, Value: !Ref AWS::StackName }
        - { Key: prx:cloudformation:stack-id, Value: !Ref AWS::StackId }
        - { Key: prx:cloudformation:root-stack-name, Value: !Ref RootStackName }
        - { Key: prx:cloudformation:root-stack-id, Value: !Ref RootStackId }
        - { Key: prx:ops:environment, Value: !Ref EnvironmentType }
        - { Key: prx:dev:family, Value: Dovetail }
        - { Key: prx:dev:application, Value: Castle }
      VpcId: !Ref VpcId
  QuicksightVpcSecurityGroupPostgresEgress:
    Type: AWS::EC2::SecurityGroupEgress
    Properties:
      Description: !Sub >-
        Allows outbound PostgreSQL traffic from Quicksight to the
        ${EnvironmentType} Castle DB
      DestinationSecurityGroupId: !GetAtt PostgresSecurityGroup.GroupId
      FromPort: 5432
      GroupId: !GetAtt QuicksightVpcSecurityGroup.GroupId
      IpProtocol: tcp
      ToPort: 5432

  PostgresParameterGroup:
    Type: AWS::RDS::DBParameterGroup
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      Description: !Sub Castle ${EnvironmentType} Parameter Group
      Family: postgres13 # aws rds describe-db-engine-versions --query "DBEngineVersions[].DBParameterGroupFamily"
      Parameters:
        shared_preload_libraries: pg_stat_statements,auto_explain
        auto_explain.log_min_duration: "10000"
        auto_explain.log_timing: "1"
        pg_stat_statements.track: ALL
        track_activity_query_size: "4096"
        track_io_timing: "1"
      Tags:
        - { Key: prx:meta:tagging-version, Value: "2021-04-07" }
        - { Key: prx:cloudformation:stack-name, Value: !Ref AWS::StackName }
        - { Key: prx:cloudformation:stack-id, Value: !Ref AWS::StackId }
        - { Key: prx:cloudformation:root-stack-name, Value: !Ref RootStackName }
        - { Key: prx:cloudformation:root-stack-id, Value: !Ref RootStackId }
        - { Key: prx:ops:environment, Value: !Ref EnvironmentType }
        - { Key: prx:dev:family, Value: Dovetail }
        - { Key: prx:dev:application, Value: Castle }
  PostgresSubnetGroup:
    Type: AWS::RDS::DBSubnetGroup
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      DBSubnetGroupDescription: !Sub Castle ${EnvironmentType} Postgres13 Subnet Group
      SubnetIds:
        - !Ref VpcPrivateSubnet1Id
        - !Ref VpcPrivateSubnet2Id
        - !Ref VpcPrivateSubnet3Id
      Tags:
        - { Key: prx:meta:tagging-version, Value: "2021-04-07" }
        - { Key: prx:cloudformation:stack-name, Value: !Ref AWS::StackName }
        - { Key: prx:cloudformation:stack-id, Value: !Ref AWS::StackId }
        - { Key: prx:cloudformation:root-stack-name, Value: !Ref RootStackName }
        - { Key: prx:cloudformation:root-stack-id, Value: !Ref RootStackId }
        - { Key: prx:ops:environment, Value: !Ref EnvironmentType }
        - { Key: prx:dev:family, Value: Dovetail }
        - { Key: prx:dev:application, Value: Castle }

  PostgresSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      GroupDescription: !Sub Castle ${EnvironmentType} Security Group
      SecurityGroupIngress:
        - FromPort: 5432
          IpProtocol: tcp
          SourceSecurityGroupId: !Ref SharedEcsAsgInstanceSecurityGroupId
          ToPort: 5432
        - FromPort: 5432
          IpProtocol: tcp
          SourceSecurityGroupId: !GetAtt QuicksightVpcSecurityGroup.GroupId
          ToPort: 5432
      Tags:
        - { Key: Name, Value: !Sub "${RootStackName}_castle_postgresql" }
        - { Key: prx:meta:tagging-version, Value: "2021-04-07" }
        - { Key: prx:cloudformation:stack-name, Value: !Ref AWS::StackName }
        - { Key: prx:cloudformation:stack-id, Value: !Ref AWS::StackId }
        - { Key: prx:cloudformation:root-stack-name, Value: !Ref RootStackName }
        - { Key: prx:cloudformation:root-stack-id, Value: !Ref RootStackId }
        - { Key: prx:ops:environment, Value: !Ref EnvironmentType }
        - { Key: prx:dev:family, Value: Dovetail }
        - { Key: prx:dev:application, Value: Castle }
      VpcId: !Ref VpcId
  PostgresSecurityGroupClientIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      Description: Allows inbound traffic from DB client resources
      FromPort: 5432
      GroupId: !GetAtt PostgresSecurityGroup.GroupId
      IpProtocol: tcp
      SourceSecurityGroupId: !GetAtt PostgresClientSecurityGroup.GroupId
      ToPort: 5432

  PostgresInstance:
    Type: AWS::RDS::DBInstance
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      AllocatedStorage: !If [IsProduction, "400", "100"]
      AllowMajorVersionUpgrade: false
      AutoMinorVersionUpgrade: false
      BackupRetentionPeriod: 7
      CopyTagsToSnapshot: true
      DBInstanceClass: !If [IsProduction, db.r6g.2xlarge, db.t4g.medium] # NOTE Changing classes will cause ~10 minutes of downtime
      DBName: !If [IsProduction, castle_production, castle_staging]
      DBParameterGroupName: !Ref PostgresParameterGroup
      DBSubnetGroupName: !Ref PostgresSubnetGroup
      DeleteAutomatedBackups: true
      DeletionProtection: true
      EnablePerformanceInsights: !If [IsProduction, true, false]
      Engine: postgres
      EngineVersion: "13.4" # aws rds describe-db-engine-versions --engine postgres --query "DBEngineVersions[*].{Engine:Engine,EngineVersion:EngineVersion}" --output text
      MasterUsername: !Ref CastlePostgresUsername # Must be 1 to 63 letters or numbers
      MasterUserPassword: !Ref CastlePostgresUserPassword # Must contain from 8 to 128 characters
      MultiAZ: false
      PerformanceInsightsRetentionPeriod: !If [IsProduction, 7, !Ref "AWS::NoValue"]
      PreferredBackupWindow: 08:00-08:30
      PreferredMaintenanceWindow: tue:06:15-tue:06:45
      PubliclyAccessible: false
      StorageType: gp2
      Tags:
        - { Key: prx:meta:tagging-version, Value: "2021-04-07" }
        - { Key: prx:cloudformation:stack-name, Value: !Ref AWS::StackName }
        - { Key: prx:cloudformation:stack-id, Value: !Ref AWS::StackId }
        - { Key: prx:cloudformation:root-stack-name, Value: !Ref RootStackName }
        - { Key: prx:cloudformation:root-stack-id, Value: !Ref RootStackId }
        - { Key: prx:ops:environment, Value: !Ref EnvironmentType }
        - { Key: prx:dev:family, Value: Dovetail }
        - { Key: prx:dev:application, Value: Castle }
      VPCSecurityGroups:
        - !GetAtt PostgresSecurityGroup.GroupId
  PostgresInstanceDiskSpaceAlarm:
    Type: AWS::CloudWatch::Alarm
    Condition: IsProduction
    Properties:
      ActionsEnabled: true
      AlarmName: !Sub ERROR [Castle] Database <${EnvironmentTypeAbbreviation}> DISK SPACE LOW (${RootStackName})
      AlarmDescription: !Sub >-
        ${EnvironmentType} Castle's RDS Postgres database instance is running
        low on free storage space. If it runs out of space, the Castle app
        may encounter operational issues.
      ComparisonOperator: LessThanOrEqualToThreshold
      Dimensions:
        - Name: DBInstanceIdentifier
          Value: !Ref PostgresInstance
      EvaluationPeriods: 1
      MetricName: FreeStorageSpace
      Namespace: AWS/RDS
      Period: 300
      Statistic: Average
      Threshold: 50000000000
      Unit: Bytes
      TreatMissingData: notBreaching

  # Resources that need access to the Castle DB (clients) belong to this
  # security group. It allows traffic to the cluster security group.
  # NOTE: This security group can only be used in stacks 300A and higher
  PostgresClientSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: !Sub >-
        ${EnvironmentType} Castle PostgreSQL client security group
      Tags:
        - { Key: Name, Value: !Sub "${RootStackName}_castle_postgresql-client" }
        - { Key: prx:meta:tagging-version, Value: "2021-04-07" }
        - { Key: prx:cloudformation:stack-name, Value: !Ref AWS::StackName }
        - { Key: prx:cloudformation:stack-id, Value: !Ref AWS::StackId }
        - { Key: prx:cloudformation:root-stack-name, Value: !Ref RootStackName }
        - { Key: prx:cloudformation:root-stack-id, Value: !Ref RootStackId }
        - { Key: prx:ops:environment, Value: !Ref EnvironmentType }
        - { Key: prx:dev:family, Value: Dovetail }
        - { Key: prx:dev:application, Value: Castle }
      VpcId: !Ref VpcId
  PostgresClientSecurityGroupClusterEgress:
    Type: AWS::EC2::SecurityGroupEgress
    Properties:
      Description: >-
        Allow traffic to the Castle DB security group
      DestinationSecurityGroupId: !GetAtt PostgresSecurityGroup.GroupId
      FromPort: 5432
      GroupId: !GetAtt PostgresClientSecurityGroup.GroupId
      IpProtocol: tcp
      ToPort: 5432

Outputs:
  TargetGroupFullName:
    Value: !GetAtt TargetGroup.TargetGroupFullName
  PostgresInstanceEndpointAddress:
    Value: !GetAtt PostgresInstance.Endpoint.Address
  PostgresInstanceEndpointPort:
    Value: !GetAtt PostgresInstance.Endpoint.Port
  PostgresInstanceId:
    Value: !Ref PostgresInstance
  QuicksightVpcSecurityGroupId:
    Value: !GetAtt QuicksightVpcSecurityGroup.GroupId
  PostgresClientSecurityGroupId:
    Value: !GetAtt PostgresClientSecurityGroup.GroupId