I Built an ECS Gateway and CloudFront VPC Origin Configuration Using CloudFormation and the CLI

AWSTemplateFormatVersion: "2010-09-09"
Description: >-
  Sample 1/7 network (ap-northeast-1). Minimal VPC for the ECS Gateway sample:
  3 private subnets, IGW, one regional NAT gateway, S3 gateway endpoint, and a security group for the tasks.

Resources:
  Vpc:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.20.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - { Key: Name, Value: gwcf-vpc }

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - { Key: Name, Value: gwcf-igw }

  InternetGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref Vpc
      InternetGatewayId: !Ref InternetGateway

  PrivateSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref Vpc
      AvailabilityZone: !Select [0, !GetAZs ""]
      CidrBlock: 10.20.0.0/24
      Tags:
        - { Key: Name, Value: gwcf-private-1 }
  PrivateSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref Vpc
      AvailabilityZone: !Select [1, !GetAZs ""]
      CidrBlock: 10.20.1.0/24
      Tags:
        - { Key: Name, Value: gwcf-private-2 }
  PrivateSubnet3:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref Vpc
      AvailabilityZone: !Select [2, !GetAZs ""]
      CidrBlock: 10.20.2.0/24
      Tags:
        - { Key: Name, Value: gwcf-private-3 }

  # Regional NAT gateway (auto AZ expansion). Only used so that the tasks can pull the public ECR image.
  NatGateway:
    Type: AWS::EC2::NatGateway
    DependsOn: InternetGatewayAttachment
    Properties:
      AvailabilityMode: regional
      ConnectivityType: public
      VpcId: !Ref Vpc
      Tags:
        - { Key: Name, Value: gwcf-natgw }

  PrivateRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref Vpc
      Tags:
        - { Key: Name, Value: gwcf-private-rt }

  PrivateDefaultRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway

  PrivateSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateSubnet1
      RouteTableId: !Ref PrivateRouteTable
  PrivateSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateSubnet2
      RouteTableId: !Ref PrivateRouteTable
  PrivateSubnet3RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateSubnet3
      RouteTableId: !Ref PrivateRouteTable

  S3GatewayEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcEndpointType: Gateway
      VpcId: !Ref Vpc
      ServiceName: !Sub com.amazonaws.${AWS::Region}.s3
      RouteTableIds:
        - !Ref PrivateRouteTable

  # Security group of the Nginx tasks. No inbound rule here.
  TaskSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: gwcf-task-sg
      GroupDescription: gwcf Nginx tasks
      VpcId: !Ref Vpc
      Tags:
        - { Key: Name, Value: gwcf-task-sg }

Outputs:
  VpcId:
    Value: !Ref Vpc
  PrivateSubnet1Id:
    Value: !Ref PrivateSubnet1
  PrivateSubnet2Id:
    Value: !Ref PrivateSubnet2
  PrivateSubnet3Id:
    Value: !Ref PrivateSubnet3
  TaskSecurityGroupId:
    Value: !GetAtt TaskSecurityGroup.GroupId

AWSTemplateFormatVersion: "2010-09-09"
Description: >-
  Sample 2/7 gateway (ap-northeast-1). ECS Gateway (internal ALB, HTTPS 443), the ALB security group, the cluster and
  the gateway-cluster association. The ALB itself is created by ECS when the first service connects.

Parameters:
  CloudFrontPrefixListId:
    Type: String
    Description: ID of com.amazonaws.global.cloudfront.origin-facing in this Region (taken with the AWS CLI).
  VpcOriginSecurityGroupId:
    Type: String
    Default: ""
    Description: >-
      ID of CloudFront-VPCOrigins-Service-SG (taken with the AWS CLI after the VPC origin exists).
      Empty = allow the CloudFront managed prefix list. Set = allow only this security group.

  DeletionProtection:
    Type: String
    Default: "true"
    AllowedValues: ["true", "false"]
    Description: Deletion protection of the gateway. Set to "false" (stack update) before deleting the stack.

Conditions:
  UseVpcOriginSecurityGroup: !Not [!Equals [!Ref VpcOriginSecurityGroupId, ""]]

Resources:
  InfrastructureRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: gwcf-ecs-gateway-infra-role
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal: { Service: ecs.amazonaws.com }
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonECSInfrastructureRoleForGatewayHostSharedALB

  # Inbound security group of the ALB (ours, so the gateway creates no inbound rules on it).
  AlbSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: gwcf-gateway-alb-sg
      GroupDescription: gwcf ECS Gateway ALB inbound (HTTPS 443 from CloudFront)
      VpcId:
        Fn::GetStackOutput:
          StackName: gwcf-network
          OutputName: VpcId
          Region: ap-northeast-1
      SecurityGroupIngress:
        - !If
          - UseVpcOriginSecurityGroup
          - IpProtocol: tcp
            FromPort: 443
            ToPort: 443
            SourceSecurityGroupId: !Ref VpcOriginSecurityGroupId
            Description: HTTPS from the CloudFront VPC origin (managed SG)
          - !Ref AWS::NoValue
        - !If
          - UseVpcOriginSecurityGroup
          - !Ref AWS::NoValue
          - IpProtocol: tcp
            FromPort: 443
            ToPort: 443
            SourcePrefixListId: !Ref CloudFrontPrefixListId
            Description: HTTPS from the CloudFront managed prefix list
      Tags:
        - { Key: Name, Value: gwcf-gateway-alb-sg }

  Cluster:
    Type: AWS::ECS::Cluster
    Properties:
      ClusterName: gwcf-cluster

  Gateway:
    Type: AWS::ECS::Gateway
    DependsOn: InfrastructureRole
    Properties:
      GatewayName: gwcf-gateway
      InfrastructureRoleArn: !GetAtt InfrastructureRole.Arn
      DeletionProtection: !Ref DeletionProtection
      PropagateTags: GATEWAY
      Configuration:
        HostSharedAlb:
          Scheme: internal
          Protocol: HTTPS
          Port: 443
          HttpDesync: defensive
          MaxAlbCount: 2
          NetworkConfiguration:
            IpAddressType: ipv4
            InboundSecurityGroup: !GetAtt AlbSecurityGroup.GroupId
            Subnets:
              - Fn::GetStackOutput:
                  StackName: gwcf-network
                  OutputName: PrivateSubnet1Id
                  Region: ap-northeast-1
              - Fn::GetStackOutput:
                  StackName: gwcf-network
                  OutputName: PrivateSubnet2Id
                  Region: ap-northeast-1
              - Fn::GetStackOutput:
                  StackName: gwcf-network
                  OutputName: PrivateSubnet3Id
                  Region: ap-northeast-1
      Tags:
        - { Key: Name, Value: gwcf-gateway }

  GatewayAssociation:
    Type: AWS::ECS::GatewayClusterAssociations
    Properties:
      Cluster: !Ref Cluster
      Gateway: !GetAtt Gateway.Arn

Outputs:
  GatewayArn:
    Value: !GetAtt Gateway.Arn
  ClusterName:
    Value: !Ref Cluster
  AlbSecurityGroupId:
    Value: !GetAtt AlbSecurityGroup.GroupId

AWSTemplateFormatVersion: "2010-09-09"
Description: >-
  Sample 3/7 nginx (ap-northeast-1). Nginx Fargate service(s) connected to the internal ECS Gateway.
  Nginx answers with the host name it sees and the BASE_URL environment variable.

Parameters:
  BaseUrl:
    Type: String
    Default: https://example.invalid
    Description: Public URL of the app (the CloudFront domain). A placeholder at first, replaced after CloudFront exists.
  UseCloudFrontDomain:
    Type: String
    Default: "false"
    AllowedValues: ["true", "false"]
    Description: >-
      "true" = BASE_URL is https:// + the CloudFront domain, read from the cloudfront stack (us-east-1) with Fn::GetStackOutput.
      "false" = BASE_URL is the BaseUrl parameter.

Conditions:
  UseCloudFrontDomainCondition: !Equals [!Ref UseCloudFrontDomain, "true"]

Resources:
  LogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /ecs/gwcf-nginx
      RetentionInDays: 3

  TaskExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: gwcf-task-execution-role
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal: { Service: ecs-tasks.amazonaws.com }
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy

  # ---------------------------------------------------------------- service 1
  TaskDefinition1:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: gwcf-nginx-1
      RequiresCompatibilities: [FARGATE]
      NetworkMode: awsvpc
      Cpu: "256"
      Memory: "512"
      RuntimePlatform:
        CpuArchitecture: X86_64
        OperatingSystemFamily: LINUX
      ExecutionRoleArn: !GetAtt TaskExecutionRole.Arn
      ContainerDefinitions:
        - Name: nginx
          Image: public.ecr.aws/docker/library/nginx:stable
          Essential: true
          PortMappings:
            - { Name: http, ContainerPort: 80, Protocol: tcp, AppProtocol: http }
          Environment:
            - { Name: SERVICE_NAME, Value: gwcf-nginx-1 }
            - Name: BASE_URL
              Value: !If
                - UseCloudFrontDomainCondition
                - !Join
                  - ""
                  - - https://
                    - Fn::GetStackOutput:
                        StackName: gwcf-cloudfront
                        OutputName: DistributionDomainName
                        Region: us-east-1
                - !Ref BaseUrl
          # The official image expands ${VAR} in /etc/nginx/templates/*.template at start-up.
          EntryPoint: [/bin/sh, -c]
          Command:
            - |
              mkdir -p /etc/nginx/templates
              cat > /etc/nginx/templates/default.conf.template <<'EOF'
              server {
                listen 80;
                location / {
                  default_type text/plain;
                  return 200 "service=${SERVICE_NAME}\nhost=$host\nhttp_host=$http_host\nx_forwarded_host=$http_x_forwarded_host\nx_forwarded_proto=$http_x_forwarded_proto\nx_forwarded_for=$http_x_forwarded_for\nBASE_URL=${BASE_URL}\n";
                }
              }
              EOF
              exec /docker-entrypoint.sh nginx -g 'daemon off;'
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: !Ref LogGroup
              awslogs-region: !Ref AWS::Region
              awslogs-stream-prefix: nginx1

  Service1:
    Type: AWS::ECS::Service
    Properties:
      ServiceName: gwcf-nginx-1
      Cluster:
        Fn::GetStackOutput:
          StackName: gwcf-gateway
          OutputName: ClusterName
          Region: ap-northeast-1
      TaskDefinition: !Ref TaskDefinition1
      LaunchType: FARGATE
      DesiredCount: 1
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: DISABLED
          SecurityGroups:
            - Fn::GetStackOutput:
                StackName: gwcf-network
                OutputName: TaskSecurityGroupId
                Region: ap-northeast-1
          Subnets:
            - Fn::GetStackOutput:
                StackName: gwcf-network
                OutputName: PrivateSubnet1Id
                Region: ap-northeast-1
            - Fn::GetStackOutput:
                StackName: gwcf-network
                OutputName: PrivateSubnet2Id
                Region: ap-northeast-1
            - Fn::GetStackOutput:
                StackName: gwcf-network
                OutputName: PrivateSubnet3Id
                Region: ap-northeast-1
      GatewayConnectors:
        - PortName: http
          Filters:
            AccessTypes: [PRIVATE]
          HealthCheck:
            HealthCheckPath: /

Outputs:
  Service1Name:
    Value: !GetAtt Service1.Name

AWSTemplateFormatVersion: "2010-09-09"
Description: >-
  Sample 6/7 alb-logs (ap-northeast-1). ALB access logs v2 (CloudWatch Logs vended logs delivery) to S3.
  Added after the gateway exists; the ALB attributes (access_logs.s3.*) are not touched.

Parameters:
  AlbArn:
    Type: String
    Description: ARN of the ALB created by the ECS Gateway.

Resources:
  LogBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Delete
    Properties:
      BucketName: !Sub gwcf-alb-logs-${AWS::AccountId}-${AWS::Region}
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerEnforced
      LifecycleConfiguration:
        Rules:
          - Id: expire-logs
            Status: Enabled
            ExpirationInDays: 7

  LogBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref LogBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: AllowLogDeliveryPutObject
            Effect: Allow
            Principal: { Service: delivery.logs.amazonaws.com }
            Action: s3:PutObject
            Resource: !Sub ${LogBucket.Arn}/*
            Condition:
              StringEquals:
                aws:SourceAccount: !Ref AWS::AccountId
              ArnLike:
                aws:SourceArn: !Sub arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:delivery-source:*
          - Sid: AllowLogDeliveryGetBucketAcl
            Effect: Allow
            Principal: { Service: delivery.logs.amazonaws.com }
            Action: s3:GetBucketAcl
            Resource: !GetAtt LogBucket.Arn
            Condition:
              StringEquals:
                aws:SourceAccount: !Ref AWS::AccountId
              ArnLike:
                aws:SourceArn: !Sub arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:delivery-source:*

  DeliverySource:
    Type: AWS::Logs::DeliverySource
    Properties:
      Name: gwcf-alb-access-logs
      ResourceArn: !Ref AlbArn
      LogType: ALB_ACCESS_LOGS

  DeliveryDestination:
    Type: AWS::Logs::DeliveryDestination
    DependsOn: LogBucketPolicy
    Properties:
      Name: gwcf-alb-logs-s3-json
      DeliveryDestinationType: S3
      OutputFormat: json
      DestinationResourceArn: !GetAtt LogBucket.Arn

  Delivery:
    Type: AWS::Logs::Delivery
    Properties:
      DeliverySourceName: !Ref DeliverySource
      DeliveryDestinationArn: !GetAtt DeliveryDestination.Arn
      S3SuffixPath: "alb/{yyyy}/{MM}/{dd}"

Outputs:
  BucketName:
    Value: !Ref LogBucket

AWSTemplateFormatVersion: "2010-09-09"
Description: >-
  Sample 7/7 cf-logs (us-east-1). CloudFront standard logging v2 to S3, added to an existing distribution
  from a separate stack. The distribution ARN comes from the cloudfront stack through Fn::GetStackOutput.

Resources:
  LogBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Delete
    Properties:
      BucketName: !Sub gwcf-cf-logs-${AWS::AccountId}-${AWS::Region}
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerEnforced
      LifecycleConfiguration:
        Rules:
          - Id: expire-logs
            Status: Enabled
            ExpirationInDays: 7

  LogBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref LogBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: AllowLogDeliveryPutObject
            Effect: Allow
            Principal: { Service: delivery.logs.amazonaws.com }
            Action: s3:PutObject
            Resource: !Sub ${LogBucket.Arn}/*
            Condition:
              StringEquals:
                aws:SourceAccount: !Ref AWS::AccountId
              ArnLike:
                aws:SourceArn: !Sub arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:delivery-source:*
          - Sid: AllowLogDeliveryGetBucketAcl
            Effect: Allow
            Principal: { Service: delivery.logs.amazonaws.com }
            Action: s3:GetBucketAcl
            Resource: !GetAtt LogBucket.Arn
            Condition:
              StringEquals:
                aws:SourceAccount: !Ref AWS::AccountId
              ArnLike:
                aws:SourceArn: !Sub arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:delivery-source:*

  DeliverySource:
    Type: AWS::Logs::DeliverySource
    Properties:
      Name: gwcf-cf-access-logs
      ResourceArn:
        Fn::GetStackOutput:
          StackName: gwcf-cloudfront
          OutputName: DistributionArn
          Region: us-east-1
      LogType: ACCESS_LOGS

  DeliveryDestination:
    Type: AWS::Logs::DeliveryDestination
    DependsOn: LogBucketPolicy
    Properties:
      Name: gwcf-cf-logs-s3-json
      DeliveryDestinationType: S3
      OutputFormat: json
      DestinationResourceArn: !GetAtt LogBucket.Arn

  Delivery:
    Type: AWS::Logs::Delivery
    Properties:
      DeliverySourceName: !Ref DeliverySource
      DeliveryDestinationArn: !GetAtt DeliveryDestination.Arn
      S3SuffixPath: "cf/{yyyy}/{MM}/{dd}"

Outputs:
  BucketName:
    Value: !Ref LogBucket