Repository: pagopa/pn-delayer
Pull request #25: PN-14502: infra batch added
Author: login: ViVeniero
Created: 2025-04-18T10:44:20Z | Merged: 2025-04-22T15:42:36Z



Diff:
diff --git a/scripts/aws/cfn/microservice.yml b/scripts/aws/cfn/microservice.yml
index 2572bdc2..92e801c2 100644
--- a/scripts/aws/cfn/microservice.yml
+++ b/scripts/aws/cfn/microservice.yml
@@ -113,77 +113,196 @@ Parameters:
     Description: 'Interval for deliveryDate setting'
     Default: 1d
 
+  VpcCidr:
+    Type: String
+    Description: 'VPC Cidr default'
+
   # Log group parameters
-  EcsLogGroup:
+  BatchLogGroup:
+    Type: String
+    Description: 'Batch log group name'
+
+  MaxvCpus:   ##TODEFINE in order to set the max number of parallel jobs
+    Type: String
+    Default: 8
+    Description: The maximum number of Amazon EC2 vCPUs that an environment can reach.
+
+  VCPU:     ##TODEFINE in order to set the max number of parallel jobs
+    Type: String
+    Default: 0.25
+    Description: The number of vCPUs reserved for the container.
+
+  ComputeResourceType:
+    Type: String
+    Default: FARGATE
+    AllowedValues:
+      - FARGATE_SPOT
+      - FARGATE
+    Description: Enter FARGATE_SPOT or FARGATE.
+
+  Memory:
     Type: String
-    Description: 'Ecs log group name'
+    Default: 2048
+    Description: The memory hard limit (in MiB) present to the container.
 
 Resources:
 
-  # pn-delayer microservice
-  DelayerMicroservice:
-    Type: AWS::CloudFormation::Stack
+  ## Compute Environment
+  ComputeEnvironment:
+    Type: AWS::Batch::ComputeEnvironment
     Properties:
-      TemplateURL: !Sub "${TemplateBucketBaseUrl}/fragments/ecs-service.yaml"
-      Parameters:
-        MicroServiceUniqueName: !Sub '${ProjectName}-delayer'
-        CpuValue: 512
-        MemoryAmount: 2GB
-        AlarmSNSTopicArn: !Ref AlarmSNSTopicArn
-        ContainerImageURI: !Sub '${ContainerImageUri}'
-        ContainerEnvEntry1: !Sub 'AWS_REGIONCODE=${AWS::Region}'
-        ContainerEnvEntry2: !Sub 'PN_DELAYER_DAO_PAPERDELIVERYDRIVERCAPACITIESTABLENAME=${PaperDeliveryDriverCapacitiesTableName}'
-        ContainerEnvEntry3: !Sub 'PN_DELAYER_DAO_PAPERDELIVERYDRIVERUSEDCAPACITIESTABLENAME=${PaperDeliveryDriverUsedCapacitiesTableName}'
-        ContainerEnvEntry4: !Sub 'PN_DELAYER_DAO_PAPERDELIVERYHIGHPRIORITYTABLENAME=${PaperDeliveryHighPriorityTableName}'
-        ContainerEnvEntry5: !Sub 'PN_DELAYER_DAO_PAPERDELIVERYREAYTOSENDTABLENAME=${PaperDeliveryReadyToSendTableName}'
-        ContainerEnvEntry6: !Sub 'PN_DELAYER_HIGHPRIORITYQUERYLIMIT =${HighPriorityQueryLimit}'
-        ContainerEnvEntry7: !Sub 'PN_DELAYER_DELIVERYDATEDAYOFWEEK=${DeliveryDateDayOfWeek}'
-        ContainerEnvEntry8: !Sub 'PN_DELAYER_DELIVERYDATEINTERVAL=${DeliveryDateInterval}'
-        MappedPaths: '/delayer/*'
-        ECSClusterName: !Ref ECSClusterName
-        Subnets: !Ref SubnetsIds
-        VpcId: !Ref VpcId
-        EcsDefaultSecurityGroup: !Ref EcsDefaultSecurityGroup
-        LoadBalancerListenerArn: !Ref ApplicationLoadBalancerListenerArn
-        LoadbalancerRulePriority: !Ref MicroserviceNumber
-        CloudwatchLogKinesisStreamArn: !Ref LogsKinesisSourceStreamArn
-        EcsLogGroup: !Ref EcsLogGroup
-
-  # Grant operational rights to pn-Delayer microservice
-  DelayerMicroserviceTaskManagedPolicy:
-    Type: AWS::IAM::ManagedPolicy
+      Type: MANAGED
+      ServiceRole: !Ref BatchServiceRole
+      ComputeEnvironmentName: !Sub '${ProjectName}-delayer-compute-environment'
+      ComputeResources:
+        MaxvCpus: !Ref MaxvCpus
+        Type: !Ref ComputeResourceType
+        SecurityGroupIds:
+          - !Ref BatchSecurityGroup
+        Subnets: !Split [",", !Ref SubnetsIds]
+      State: ENABLED
+
+  BatchProcessingJobDefinition:
+    Type: AWS::Batch::JobDefinition
+    Properties:
+      Type: container
+      PropagateTags: true
+      JobDefinitionName: !Sub '${ProjectName}-delayer-job-definition'
+      ContainerProperties:
+        Image: !Ref ContainerImageUri
+        FargatePlatformConfiguration:
+          PlatformVersion: LATEST
+        ResourceRequirements:
+          - Value: !Ref VCPU
+            Type: VCPU
+          - Value: !Ref Memory
+            Type: MEMORY
+        JobRoleArn: !GetAtt "BatchTaskExecutionRole.Arn"
+        ExecutionRoleArn: !GetAtt "BatchTaskExecutionRole.Arn"
+        LogConfiguration:
+          LogDriver: awslogs
+          Options:
+            awslogs-group: !Ref "BatchLogGroup"
+            awslogs-region: !Ref AWS::Region
+            awslogs-stream-prefix: !Sub '${ProjectName}-delayer-logs'
+        Environment:
+          - Name: PN_DELAYER_DAO_PAPERDELIVERYDRIVERCAPACITIESTABLENAME
+            Value: !Ref PaperDeliveryDriverCapacitiesTableName
+          - Name: PN_DELAYER_DAO_PAPERDELIVERYDRIVERUSEDCAPACITIESTABLENAME
+            Value: !Ref PaperDeliveryDriverUsedCapacitiesTableName
+          - Name: PN_DELAYER_DAO_PAPERDELIVERYHIGHPRIORITYTABLENAME
+            Value: !Ref PaperDeliveryHighPriorityTableName
+          - Name: PN_DELAYER_DAO_PAPERDELIVERYREAYTOSENDTABLENAME
+            Value: !Ref PaperDeliveryReadyToSendTableName
+          - Name: PN_DELAYER_HIGHPRIORITYQUERYLIMIT
+            Value: !Ref HighPriorityQueryLimit
+          - Name: PN_DELAYER_DELIVERYDATEDAYOFWEEK
+            Value: !Ref DeliveryDateDayOfWeek
+          - Name: PN_DELAYER_DELIVERYDATEINTERVAL
+            Value: !Ref DeliveryDateInterval
+          - Name: AWS_REGIONCODE
+            Value: !Ref AWS::Region
+      PlatformCapabilities:
+        - FARGATE
+      Tags:
+        Service: Batch
+        Name: JobDefinitionTag
+        Expected: MergeTag
+
+  ## JobQueue
+  JobQueue:
+    Type: AWS::Batch::JobQueue
+    Properties:
+      ComputeEnvironmentOrder:
+        - Order: 1
+          ComputeEnvironment: !Ref ComputeEnvironment
+      State: ENABLED
+      Priority: 1
+      JobQueueName: !Sub '${ProjectName}-delayer-job-queue'
+
+  BatchServiceRole:
+    Type: AWS::IAM::Role
     Properties:
-      PolicyDocument:
-        Version: 2012-10-17
+      AssumeRolePolicyDocument:
+        Version: "2012-10-17"
         Statement:
           - Effect: Allow
-            Action:
-              - dynamodb:GetItem
-              - dynamodb:UpdateItem
-              - dynamodb:Query
-              - dynamodb:BatchGetItem
-            Resource:
-              - !Sub "${PaperDeliveryDriverUsedCapacitiesTableArn}"
-              - !Sub "${PaperDeliveryDriverUsedCapacitiesTableArn}/*"
-          - Effect: Allow
-            Action:
-              - dynamodb:GetItem
-              - dynamodb:Query
-            Resource:
-              - !Sub "${PaperDeliveryDriverCapacitiesTableArn}"
-              - !Sub "${PaperDeliveryDriverCapacitiesTableArn}/*"
+            Principal:
+              Service: batch.amazonaws.com
+            Action: sts:AssumeRole
+            Condition:
+              StringEquals:
+                aws:SourceAccount: !Ref "AWS::AccountId"
+      ManagedPolicyArns:
+        - arn:aws:iam::aws:policy/service-role/AWSBatchServiceRole
+
+  BatchTaskExecutionRole:
+    Type: AWS::IAM::Role
+    Properties:
+      RoleName: !Sub '${ProjectName}-delayer-taskexec-role'
+      AssumeRolePolicyDocument:
+        Statement:
           - Effect: Allow
-            Action:
-              - dynamodb:GetItem
-              - dynamodb:PutItem
-              - dynamodb:DeleteItem
-              - dynamodb:Query
-              - dynamodb:TransactWriteItems
-            Resource:
-              - !Sub "${PaperDeliveryHighPriorityTableArn}"
-              - !Sub "${PaperDeliveryHighPriorityTableArn}/*"
-              - !Sub "${PaperDeliveryReadyToSendTableArn}"
-              - !Sub "${PaperDeliveryReadyToSendTableArn}/*"
+            Principal:
+              Service: ecs-tasks.amazonaws.com
+            Action: "sts:AssumeRole"
+            Condition:
+              StringEquals:
+                aws:SourceAccount: !Ref "AWS::AccountId"
+      Path: /
+      Policies:
+        - PolicyName: AmazonECSTaskExecutionRolePolicy
+          PolicyDocument:
+            Statement:
+            - Effect: Allow
+              Action:
+                - "ecr:GetAuthorizationToken"
+                - "ecr:BatchCheckLayerAvailability"
+                - "ecr:GetDownloadUrlForLayer"
+                - "ecr:BatchGetImage"
+                - "logs:CreateLogStream"
+                - "logs:PutLogEvents"
+              Resource: "*"
+            - Effect: Allow
+              Action:
+                - dynamodb:GetItem
+                - dynamodb:UpdateItem
+                - dynamodb:Query
+                - dynamodb:BatchGetItem
+              Resource:
+                - !Sub "${PaperDeliveryDriverUsedCapacitiesTableArn}"
+                - !Sub "${PaperDeliveryDriverUsedCapacitiesTableArn}/*"
+            - Effect: Allow
+              Action:
+                - dynamodb:GetItem
+                - dynamodb:Query
+              Resource:
+                - !Sub "${PaperDeliveryDriverCapacitiesTableArn}"
+                - !Sub "${PaperDeliveryDriverCapacitiesTableArn}/*"
+            - Effect: Allow
+              Action:
+                - dynamodb:GetItem
+                - dynamodb:PutItem
+                - dynamodb:DeleteItem
+                - dynamodb:Query
+                - dynamodb:TransactWriteItems
+              Resource:
+                - !Sub "${PaperDeliveryHighPriorityTableArn}"
+                - !Sub "${PaperDeliveryHighPriorityTableArn}/*"
+                - !Sub "${PaperDeliveryReadyToSendTableArn}"
+                - !Sub "${PaperDeliveryReadyToSendTableArn}/*"
+    
+  BatchSecurityGroup:
+    Type: AWS::EC2::SecurityGroup
+    Properties:
+      GroupDescription: Batch Security Group
+      VpcId: !Ref VpcId
+      SecurityGroupIngress:
+        - IpProtocol: -1
+          CidrIp: !Ref VpcCidr
+      SecurityGroupEgress:
+        - IpProtocol: -1
+          CidrIp: "0.0.0.0/0"
 
   DelayerMicroserviceCloudWatchDashboard:
     Type: AWS::CloudFormation::Stack
@@ -201,6 +320,99 @@ Resources:
           - ','
           - - !Sub '/aws/ecs/${ProjectName}-delayer'
 
-
-
-
+  PnDelayerAlarmTopicPublisherRole:
+    Type: AWS::IAM::Role
+    Properties:
+      RoleName: !Sub '${ProjectName}-delayer-alarm-topic-publisher-role'
+      AssumeRolePolicyDocument:
+        Statement:
+          - Effect: Allow
+            Principal:
+              Service: events.amazonaws.com 
+            Action: "sts:AssumeRole" 
+            Condition:
+              StringEquals:
+                aws:SourceAccount: !Ref "AWS::AccountId"
+      Path: /
+      Policies:
+        - PolicyName: !Sub '${ProjectName}-delayer-alarm-topic-publisher-policy'
+          PolicyDocument:
+            Statement:
+              - Effect: Allow
+                Action:
+                  - "sns:Publish"
+                Resource: !Ref AlarmSNSTopicArn
+
+    ### Enable sending notifications to SNS topic when the job is in failed status.
+  BatchBridgeStateRule:
+   Type: AWS::Events::Rule
+   Properties:
+     Description: The EventBridge rule to match Batch state change
+     RoleArn: !GetAtt PnDelayerAlarmTopicPublisherRole.Arn
+     EventPattern:
+       source:
+         - aws.batch
+       detail-type:
+         - Batch Job State Change
+       detail:
+         status:
+           - FAILED
+         jobDefinition:
+          - !Ref BatchProcessingJobDefinition
+     State: ENABLED
+     Targets:
+       - Arn: !Ref AlarmSNSTopicArn
+         Id: !Sub "${ProjectName}-delayer"
+
+  # Create alarm
+  FailedInvocationMetricAlarm:
+    Type: AWS::CloudWatch::Alarm
+    Properties:
+      AlarmName: !Sub "${ProjectName}-delayer-FailedInvocation-Alarm"
+      AlarmDescription: "CloudWatch alarm for when pn-delayer job fails."
+      TreatMissingData: notBreaching
+      AlarmActions:
+        - !Ref AlarmSNSTopicArn
+      OKActions:
+        - !Ref AlarmSNSTopicArn
+      Dimensions:
+        - Name: RuleName
+          Value: !Ref BatchBridgeStateRule
+      DatapointsToAlarm: 1
+      MetricName: "Invocations"
+      Namespace: "AWS/Events"
+      ComparisonOperator: GreaterThanOrEqualToThreshold
+      EvaluationPeriods: 12 # 1 hour
+      Period: 300 # 5 minutes
+      Statistic: Sum
+      Threshold: 1
+
+  ErrorFatalLogsMetricFilter:
+    Type: AWS::Logs::MetricFilter
+    Properties:
+      LogGroupName: !Ref BatchLogGroup
+      FilterPattern: '?ERROR ?FATAL ?CRITICAL'
+      MetricTransformations:
+        - MetricValue: 1
+          MetricNamespace: "ErrorFatalLogs"
+          MetricName: !Sub "${ProjectName}-delayer-ErrorFatalMetric"
+
+  ErrorFatalLogsMetricAlarm:
+    Type: AWS::CloudWatch::Alarm
+    DependsOn: ErrorFatalLogsMetricFilter
+    Properties:
+      AlarmName: !Sub "${ProjectName}-delayer-ErrorFatalLogs-Alarm"
+      AlarmDescription: "CloudWatch alarm for when LogSaver LogGroup has ERROR or FATAL line."
+      TreatMissingData: notBreaching
+      AlarmActions:
+        - !Ref AlarmSNSTopicArn
+      OKActions:
+        - !Ref AlarmSNSTopicArn
+      DatapointsToAlarm: 1
+      MetricName: !Sub "${ProjectName}-delayer-ErrorFatalMetric"
+      Namespace: "ErrorFatalLogs"
+      ComparisonOperator: GreaterThanOrEqualToThreshold
+      EvaluationPeriods: 60
+      Period: 60
+      Statistic: Sum
+      Threshold: 1
\ No newline at end of file
diff --git a/scripts/aws/cfn/storage.yml b/scripts/aws/cfn/storage.yml
index def5a83e..0be03bcb 100644
--- a/scripts/aws/cfn/storage.yml
+++ b/scripts/aws/cfn/storage.yml
@@ -159,5 +159,5 @@ Outputs:
     Value: !Sub '${PaperDeliveryReadyToSendTable.Arn}'
 
   # Log group exports
-  EcsLogGroup:
+  BatchLogGroup:
     Value: !GetAtt PnDelayerLogGroup.Outputs.LogGroupName
\ No newline at end of file


Reviews:
user: login: fdammassa
state: CHANGES_REQUESTED
author_association: NONE
submitted_at: 2025-04-22T09:56:47Z
user: login: fdammassa
state: APPROVED
author_association: NONE
submitted_at: 2025-04-22T15:29:07Z

Review comments:
diff_hunk: @@ -113,41 +113,151 @@ Parameters:
     Description: 'Interval for deliveryDate setting'
     Default: 1d
 
+  VpcCidr:
+    Type: String
+    Description: 'VPC Cidr default'
+
   # Log group parameters
-  EcsLogGroup:
+  BatchLogGroup:
+    Type: String
+    Description: 'Batch log group name'
+
+  MaxvCpus:   ##TODEFINE in order to set the max number of parallel jobs
+    Type: String
+    Default: 128
path: scripts/aws/cfn/microservice.yml
user: login: fdammassa
body: @ViVeniero mettiamo un valore più basso di default :)
created_at: 2025-04-22T09:50:45Z
author_association: NONE
diff_hunk: @@ -113,41 +113,151 @@ Parameters:
     Description: 'Interval for deliveryDate setting'
     Default: 1d
 
+  VpcCidr:
+    Type: String
+    Description: 'VPC Cidr default'
+
   # Log group parameters
-  EcsLogGroup:
+  BatchLogGroup:
+    Type: String
+    Description: 'Batch log group name'
+
+  MaxvCpus:   ##TODEFINE in order to set the max number of parallel jobs
+    Type: String
+    Default: 128
+    Description: The maximum number of Amazon EC2 vCPUs that an environment can reach.
+
+  VCPU:     ##TODEFINE in order to set the max number of parallel jobs
+    Type: String
+    Default: 0.25
+    Description: The number of vCPUs reserved for the container.
+
+  ComputeResourceType:
     Type: String
-    Description: 'Ecs log group name'
+    Default: FARGATE
+    AllowedValues:
+      - FARGATE_SPOT
+      - FARGATE
+    Description: Enter FARGATE_SPOT or FARGATE.
+
+  Memory:
+    Type: String
+    Default: 2048
+    Description: The memory hard limit (in MiB) present to the container.
 
 Resources:
 
-  # pn-delayer microservice
-  DelayerMicroservice:
-    Type: AWS::CloudFormation::Stack
+  ## Compute Environment
+  ComputeEnvironment:
+    Type: AWS::Batch::ComputeEnvironment
     Properties:
-      TemplateURL: !Sub "${TemplateBucketBaseUrl}/fragments/ecs-service.yaml"
-      Parameters:
-        MicroServiceUniqueName: !Sub '${ProjectName}-delayer'
-        CpuValue: 512
-        MemoryAmount: 2GB
-        AlarmSNSTopicArn: !Ref AlarmSNSTopicArn
-        ContainerImageURI: !Sub '${ContainerImageUri}'
-        ContainerEnvEntry1: !Sub 'AWS_REGIONCODE=${AWS::Region}'
-        ContainerEnvEntry2: !Sub 'PN_DELAYER_DAO_PAPERDELIVERYDRIVERCAPACITIESTABLENAME=${PaperDeliveryDriverCapacitiesTableName}'
-        ContainerEnvEntry3: !Sub 'PN_DELAYER_DAO_PAPERDELIVERYDRIVERUSEDCAPACITIESTABLENAME=${PaperDeliveryDriverUsedCapacitiesTableName}'
-        ContainerEnvEntry4: !Sub 'PN_DELAYER_DAO_PAPERDELIVERYHIGHPRIORITYTABLENAME=${PaperDeliveryHighPriorityTableName}'
-        ContainerEnvEntry5: !Sub 'PN_DELAYER_DAO_PAPERDELIVERYREAYTOSENDTABLENAME=${PaperDeliveryReadyToSendTableName}'
-        ContainerEnvEntry6: !Sub 'PN_DELAYER_HIGHPRIORITYQUERYLIMIT =${HighPriorityQueryLimit}'
-        ContainerEnvEntry7: !Sub 'PN_DELAYER_DELIVERYDATEDAYOFWEEK=${DeliveryDateDayOfWeek}'
-        ContainerEnvEntry8: !Sub 'PN_DELAYER_DELIVERYDATEINTERVAL=${DeliveryDateInterval}'
-        MappedPaths: '/delayer/*'
-        ECSClusterName: !Ref ECSClusterName
-        Subnets: !Ref SubnetsIds
-        VpcId: !Ref VpcId
-        EcsDefaultSecurityGroup: !Ref EcsDefaultSecurityGroup
-        LoadBalancerListenerArn: !Ref ApplicationLoadBalancerListenerArn
-        LoadbalancerRulePriority: !Ref MicroserviceNumber
-        CloudwatchLogKinesisStreamArn: !Ref LogsKinesisSourceStreamArn
-        EcsLogGroup: !Ref EcsLogGroup
+      Type: MANAGED
+      ServiceRole: !Ref BatchServiceRole
+      ComputeEnvironmentName: !Sub '${ProjectName}-delayer-compute-environment'
+      ComputeResources:
+        MaxvCpus: !Ref MaxvCpus
+        Type: !Ref ComputeResourceType
+        SecurityGroupIds:
+          - !Ref BatchSecurityGroup
+        Subnets: !Split [",", !Ref SubnetsIds]
+      State: ENABLED
+
+  BatchProcessingJobDefinition:
+    Type: AWS::Batch::JobDefinition
+    Properties:
+      Type: container
+      PropagateTags: true
+      JobDefinitionName: !Sub '${ProjectName}-delayer-job-definition'
+      ContainerProperties:
+        Image: !Ref ContainerImageUri
+        FargatePlatformConfiguration:
+          PlatformVersion: LATEST
+        ResourceRequirements:
+          - Value: !Ref VCPU
+            Type: VCPU
+          - Value: !Ref Memory
+            Type: MEMORY
+        JobRoleArn: !GetAtt "BatchTaskExecutionRole.Arn"
+        ExecutionRoleArn: !GetAtt "BatchTaskExecutionRole.Arn"
+        LogConfiguration:
+          LogDriver: awslogs
+          Options:
+            awslogs-group: !Ref "BatchLogGroup"
+            awslogs-region: !Ref AWS::Region
+            awslogs-stream-prefix: !Sub '${ProjectName}-delayer-logs'
+        Environment:
+          - Name: PN_DELAYER_DAO_PAPERDELIVERYDRIVERCAPACITIESTABLENAME
+            Value: !Ref PaperDeliveryDriverCapacitiesTableName
+          - Name: PN_DELAYER_DAO_PAPERDELIVERYDRIVERUSEDCAPACITIESTABLENAME
+            Value: !Ref PaperDeliveryDriverUsedCapacitiesTableName
+          - Name: PN_DELAYER_DAO_PAPERDELIVERYHIGHPRIORITYTABLENAME
+            Value: !Ref PaperDeliveryHighPriorityTableName
+          - Name: PN_DELAYER_DAO_PAPERDELIVERYREAYTOSENDTABLENAME
+            Value: !Ref PaperDeliveryReadyToSendTableName
+          - Name: PN_DELAYER_HIGHPRIORITYQUERYLIMIT
+            Value: !Ref HighPriorityQueryLimit
+          - Name: PN_DELAYER_DELIVERYDATEDAYOFWEEK
+            Value: !Ref DeliveryDateDayOfWeek
+          - Name: PN_DELAYER_DELIVERYDATEINTERVAL
+            Value: !Ref DeliveryDateInterval
+          - Name: AWS_REGIONCODE
+            Value: !Ref AWS::Region
+      PlatformCapabilities:
+        - FARGATE
+      Tags:
+        Service: Batch
+        Name: JobDefinitionTag
+        Expected: MergeTag
+
+  ## JobQueue
+  JobQueue:
+    Type: AWS::Batch::JobQueue
+    Properties:
+      ComputeEnvironmentOrder:
+        - Order: 1
+          ComputeEnvironment: !Ref ComputeEnvironment
+      State: ENABLED
+      Priority: 1
+      JobQueueName: !Sub '${ProjectName}-delayer-job-queue'
+
+  BatchServiceRole:
+    Type: AWS::IAM::Role
+    Properties:
+      AssumeRolePolicyDocument:
+        Version: "2012-10-17"
+        Statement:
+          - Effect: Allow
+            Principal:
+              Service: batch.amazonaws.com
path: scripts/aws/cfn/microservice.yml
user: login: fdammassa
body: @ViVeniero applicare https://docs.aws.amazon.com/batch/latest/userguide/cross-service-confused-deputy-prevention.html
created_at: 2025-04-22T09:52:25Z
author_association: NONE
diff_hunk: @@ -113,41 +113,151 @@ Parameters:
     Description: 'Interval for deliveryDate setting'
     Default: 1d
 
+  VpcCidr:
+    Type: String
+    Description: 'VPC Cidr default'
+
   # Log group parameters
-  EcsLogGroup:
+  BatchLogGroup:
+    Type: String
+    Description: 'Batch log group name'
+
+  MaxvCpus:   ##TODEFINE in order to set the max number of parallel jobs
+    Type: String
+    Default: 128
+    Description: The maximum number of Amazon EC2 vCPUs that an environment can reach.
+
+  VCPU:     ##TODEFINE in order to set the max number of parallel jobs
+    Type: String
+    Default: 0.25
+    Description: The number of vCPUs reserved for the container.
+
+  ComputeResourceType:
     Type: String
-    Description: 'Ecs log group name'
+    Default: FARGATE
+    AllowedValues:
+      - FARGATE_SPOT
+      - FARGATE
+    Description: Enter FARGATE_SPOT or FARGATE.
+
+  Memory:
+    Type: String
+    Default: 2048
+    Description: The memory hard limit (in MiB) present to the container.
 
 Resources:
 
-  # pn-delayer microservice
-  DelayerMicroservice:
-    Type: AWS::CloudFormation::Stack
+  ## Compute Environment
+  ComputeEnvironment:
+    Type: AWS::Batch::ComputeEnvironment
     Properties:
-      TemplateURL: !Sub "${TemplateBucketBaseUrl}/fragments/ecs-service.yaml"
-      Parameters:
-        MicroServiceUniqueName: !Sub '${ProjectName}-delayer'
-        CpuValue: 512
-        MemoryAmount: 2GB
-        AlarmSNSTopicArn: !Ref AlarmSNSTopicArn
-        ContainerImageURI: !Sub '${ContainerImageUri}'
-        ContainerEnvEntry1: !Sub 'AWS_REGIONCODE=${AWS::Region}'
-        ContainerEnvEntry2: !Sub 'PN_DELAYER_DAO_PAPERDELIVERYDRIVERCAPACITIESTABLENAME=${PaperDeliveryDriverCapacitiesTableName}'
-        ContainerEnvEntry3: !Sub 'PN_DELAYER_DAO_PAPERDELIVERYDRIVERUSEDCAPACITIESTABLENAME=${PaperDeliveryDriverUsedCapacitiesTableName}'
-        ContainerEnvEntry4: !Sub 'PN_DELAYER_DAO_PAPERDELIVERYHIGHPRIORITYTABLENAME=${PaperDeliveryHighPriorityTableName}'
-        ContainerEnvEntry5: !Sub 'PN_DELAYER_DAO_PAPERDELIVERYREAYTOSENDTABLENAME=${PaperDeliveryReadyToSendTableName}'
-        ContainerEnvEntry6: !Sub 'PN_DELAYER_HIGHPRIORITYQUERYLIMIT =${HighPriorityQueryLimit}'
-        ContainerEnvEntry7: !Sub 'PN_DELAYER_DELIVERYDATEDAYOFWEEK=${DeliveryDateDayOfWeek}'
-        ContainerEnvEntry8: !Sub 'PN_DELAYER_DELIVERYDATEINTERVAL=${DeliveryDateInterval}'
-        MappedPaths: '/delayer/*'
-        ECSClusterName: !Ref ECSClusterName
-        Subnets: !Ref SubnetsIds
-        VpcId: !Ref VpcId
-        EcsDefaultSecurityGroup: !Ref EcsDefaultSecurityGroup
-        LoadBalancerListenerArn: !Ref ApplicationLoadBalancerListenerArn
-        LoadbalancerRulePriority: !Ref MicroserviceNumber
-        CloudwatchLogKinesisStreamArn: !Ref LogsKinesisSourceStreamArn
-        EcsLogGroup: !Ref EcsLogGroup
+      Type: MANAGED
+      ServiceRole: !Ref BatchServiceRole
+      ComputeEnvironmentName: !Sub '${ProjectName}-delayer-compute-environment'
+      ComputeResources:
+        MaxvCpus: !Ref MaxvCpus
+        Type: !Ref ComputeResourceType
+        SecurityGroupIds:
+          - !Ref BatchSecurityGroup
+        Subnets: !Split [",", !Ref SubnetsIds]
+      State: ENABLED
+
+  BatchProcessingJobDefinition:
+    Type: AWS::Batch::JobDefinition
+    Properties:
+      Type: container
+      PropagateTags: true
+      JobDefinitionName: !Sub '${ProjectName}-delayer-job-definition'
+      ContainerProperties:
+        Image: !Ref ContainerImageUri
+        FargatePlatformConfiguration:
+          PlatformVersion: LATEST
+        ResourceRequirements:
+          - Value: !Ref VCPU
+            Type: VCPU
+          - Value: !Ref Memory
+            Type: MEMORY
+        JobRoleArn: !GetAtt "BatchTaskExecutionRole.Arn"
+        ExecutionRoleArn: !GetAtt "BatchTaskExecutionRole.Arn"
+        LogConfiguration:
+          LogDriver: awslogs
+          Options:
+            awslogs-group: !Ref "BatchLogGroup"
+            awslogs-region: !Ref AWS::Region
+            awslogs-stream-prefix: !Sub '${ProjectName}-delayer-logs'
+        Environment:
+          - Name: PN_DELAYER_DAO_PAPERDELIVERYDRIVERCAPACITIESTABLENAME
+            Value: !Ref PaperDeliveryDriverCapacitiesTableName
+          - Name: PN_DELAYER_DAO_PAPERDELIVERYDRIVERUSEDCAPACITIESTABLENAME
+            Value: !Ref PaperDeliveryDriverUsedCapacitiesTableName
+          - Name: PN_DELAYER_DAO_PAPERDELIVERYHIGHPRIORITYTABLENAME
+            Value: !Ref PaperDeliveryHighPriorityTableName
+          - Name: PN_DELAYER_DAO_PAPERDELIVERYREAYTOSENDTABLENAME
+            Value: !Ref PaperDeliveryReadyToSendTableName
+          - Name: PN_DELAYER_HIGHPRIORITYQUERYLIMIT
+            Value: !Ref HighPriorityQueryLimit
+          - Name: PN_DELAYER_DELIVERYDATEDAYOFWEEK
+            Value: !Ref DeliveryDateDayOfWeek
+          - Name: PN_DELAYER_DELIVERYDATEINTERVAL
+            Value: !Ref DeliveryDateInterval
+          - Name: AWS_REGIONCODE
+            Value: !Ref AWS::Region
+      PlatformCapabilities:
+        - FARGATE
+      Tags:
+        Service: Batch
+        Name: JobDefinitionTag
+        Expected: MergeTag
+
+  ## JobQueue
+  JobQueue:
+    Type: AWS::Batch::JobQueue
+    Properties:
+      ComputeEnvironmentOrder:
+        - Order: 1
+          ComputeEnvironment: !Ref ComputeEnvironment
+      State: ENABLED
+      Priority: 1
+      JobQueueName: !Sub '${ProjectName}-delayer-job-queue'
+
+  BatchServiceRole:
+    Type: AWS::IAM::Role
+    Properties:
+      AssumeRolePolicyDocument:
+        Version: "2012-10-17"
+        Statement:
+          - Effect: Allow
+            Principal:
+              Service: batch.amazonaws.com
+            Action: sts:AssumeRole
+      ManagedPolicyArns:
+        - arn:aws:iam::aws:policy/service-role/AWSBatchServiceRole
+
+  BatchTaskExecutionRole:
+    Type: AWS::IAM::Role
+    Properties:
+      RoleName: !Sub '${ProjectName}-delayer-taskexec-role'
+      AssumeRolePolicyDocument:
+        Statement:
+          - Effect: Allow
+            Principal:
+              Service: [ ecs-tasks.amazonaws.com ]
path: scripts/aws/cfn/microservice.yml
user: login: fdammassa
body: @ViVeniero https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html specificare il source account nelle condition
created_at: 2025-04-22T09:54:04Z
author_association: NONE
diff_hunk: @@ -201,6 +311,96 @@ Resources:
           - ','
           - - !Sub '/aws/ecs/${ProjectName}-delayer'
 
-
-
-
+  PnDelayerAlarmTopicPublisherRole:
+    Type: AWS::IAM::Role
+    Properties:
+      RoleName: !Sub '${ProjectName}-delayer-alarm-topic-publisher-role'
+      AssumeRolePolicyDocument:
+        Statement:
+          - Effect: Allow
+            Principal:
+              Service: [ events.amazonaws.com ]
path: scripts/aws/cfn/microservice.yml
user: login: fdammassa
body: @ViVeniero https://docs.aws.amazon.com/eventbridge/latest/userguide/cross-service-confused-deputy-prevention.html
created_at: 2025-04-22T09:54:38Z
author_association: NONE
diff_hunk: @@ -201,6 +311,96 @@ Resources:
           - ','
           - - !Sub '/aws/ecs/${ProjectName}-delayer'
 
-
-
-
+  PnDelayerAlarmTopicPublisherRole:
+    Type: AWS::IAM::Role
+    Properties:
+      RoleName: !Sub '${ProjectName}-delayer-alarm-topic-publisher-role'
+      AssumeRolePolicyDocument:
+        Statement:
+          - Effect: Allow
+            Principal:
+              Service: [ events.amazonaws.com ]
+            Action: [ "sts:AssumeRole" ]
+      Path: /
+      Policies:
+        - PolicyName: !Sub '${ProjectName}-delayer-alarm-topic-publisher-policy'
+          PolicyDocument:
+            Statement:
+              - Effect: Allow
+                Action:
+                  - "sns:Publish"
+                Resource: !Ref AlarmSNSTopicArn
+
+    ### Enable sending notifications to SNS topic when the job is in failed status.
+  BatchBridgeStateRule:
+   Type: AWS::Events::Rule
+   Properties:
+     Description: The EventBridge rule to match Batch state change
+     RoleArn: !GetAtt PnDelayerAlarmTopicPublisherRole.Arn
+     EventPattern:
+       source:
+         - aws.batch
+       detail-type:
+         - Batch Job State Change
+       detail:
+         status:
+           - FAILED
+         jobDefinition:
+          - !Ref BatchProcessingJobDefinition
+     State: ENABLED
+     Targets:
+       - Arn: !Ref AlarmSNSTopicArn
+         Id: !Sub "${ProjectName}-delayer"
path: scripts/aws/cfn/microservice.yml
user: login: fdammassa
body: @ViVeniero non credo che questo faccia scattare un allarme, è da verificare
created_at: 2025-04-22T09:55:25Z
author_association: NONE

PR comments:
user: login: sonarqubecloud[bot]
created_at: 2025-04-22T15:49:33Z
body: ## [![Quality Gate Passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-passed-20px.png 'Quality Gate Passed')](https://sonarcloud.io/dashboard?id=pagopa_pn-delayer&pullRequest=25) **Quality Gate passed**  
Issues  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 New issues](https://sonarcloud.io/project/issues?id=pagopa_pn-delayer&pullRequest=25&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/accepted-16px.png '') [0 Accepted issues](https://sonarcloud.io/project/issues?id=pagopa_pn-delayer&pullRequest=25&issueStatuses=ACCEPTED)

Measures  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=pagopa_pn-delayer&pullRequest=25&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=pagopa_pn-delayer&pullRequest=25&metric=new_coverage&view=list)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=pagopa_pn-delayer&pullRequest=25&metric=new_duplicated_lines_density&view=list)  
  
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=pagopa_pn-delayer&pullRequest=25)


author_association: NONE