rBuildsBatchIamRole:
  Type: AWS::IAM::Role
  Properties:
    Path: /service-role/
    AssumeRolePolicyDocument:
      Version: '2012-10-17'
      Statement:
        - Effect: Allow
          Principal:
            Service:
              - batch.amazonaws.com
          Action: sts:AssumeRole
    ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AWSBatchServiceRole
rBuildsSpotFleetIamRole:
  Type: AWS::IAM::Role
  Properties:
    Path: /service-role/
    AssumeRolePolicyDocument:
      Version: '2012-10-17'
      Statement:
        - Effect: Allow
          Principal:
            Service:
              - spotfleet.amazonaws.com
          Action: sts:AssumeRole
    ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AmazonEC2SpotFleetTaggingRole
rBuildsInstanceIamRole:
  Type: AWS::IAM::Role
  Properties:
    AssumeRolePolicyDocument:
      Version: '2012-10-17'
      Statement:
        - Effect: 'Allow'
          Principal:
            Service:
              - 'ec2.amazonaws.com'
          Action:
            - 'sts:AssumeRole'
    Path: '/'
    ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role

rBuildsIamInstanceProfile:
  Type: AWS::IAM::InstanceProfile
  Properties:
    Path: '/'
    Roles:
      - Ref: rBuildsInstanceIamRole
rBuildsEcsTaskIamRole:
  Type: AWS::IAM::Role
  Properties:
    Path: /service-role/
    AssumeRolePolicyDocument:
      Version: '2012-10-17'
      Statement:
        - Effect: Allow
          Principal:
            Service:
              - ecs-tasks.amazonaws.com
          Action: sts:AssumeRole
    ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
    Policies:
      - PolicyName: 's3-r-builds-bucket'
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - s3:*
              Resource:
                - arn:aws:s3:::${self:custom.${self:provider.stage}.s3Bucket}
                - arn:aws:s3:::${self:custom.${self:provider.stage}.s3Bucket}/*

rBuildsEcsLaunchTemplate:
  Type: AWS::EC2::LaunchTemplate
  Properties:
    LaunchTemplateName: r-builds-${self:provider.stage}-batch-managed-ecs-larger-volume
    LaunchTemplateData:
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            VolumeType: gp3
            VolumeSize: 96
            Encrypted: true
      MetadataOptions:
        HttpTokens: required
        HttpPutResponseHopLimit: 2

rBuildsBatchComputeEnvironment:
  Type: AWS::Batch::ComputeEnvironment
  DependsOn: rBuildsBatchIamRole
  Properties:
    Type: MANAGED
    ServiceRole:
      "Fn::GetAtt": [ rBuildsBatchIamRole, Arn ]
    ComputeResources:
      LaunchTemplate:
        LaunchTemplateId:
          Ref: rBuildsEcsLaunchTemplate
        Version: '$Latest'
      SpotIamFleetRole:
        "Fn::GetAtt": [ rBuildsSpotFleetIamRole, Arn ]
      SecurityGroupIds: ${self:custom.securityGroupIds}
      Subnets: ${self:custom.subnets}
      Type: SPOT
      BidPercentage: 100
      InstanceRole:
        "Fn::GetAtt": [ rBuildsIamInstanceProfile, Arn ]
      InstanceTypes:
        - r5.xlarge
        - r5.2xlarge
        - r5a.xlarge
        - r5a.2xlarge
        - c6i.xlarge
        - c5.xlarge
        - c5.2xlarge
        - c5a.xlarge
        - c5a.2xlarge
      Ec2KeyPair: ${self:custom.ec2KeyPair}
      Tags: ${self:provider.stackTags}
      MinvCpus: 0
      DesiredvCpus: 0
      MaxvCpus: 256

rBuildsBatchJobQueue:
  Type: AWS::Batch::JobQueue
  Properties:
    ComputeEnvironmentOrder:
      - Order: 1
        ComputeEnvironment:
          Ref: rBuildsBatchComputeEnvironment
    State: ENABLED
    Priority: 1

rBuildsBatchJobDefinitionUbuntu2004:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
      Image: "#{AWS::AccountId}.dkr.ecr.#{AWS::Region}.amazonaws.com/r-builds:ubuntu-2004"
      ReadonlyRootFilesystem: true
    Timeout:
      AttemptDurationSeconds: 7200
rBuildsBatchJobDefinitionUbuntu2204:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
      Image: "#{AWS::AccountId}.dkr.ecr.#{AWS::Region}.amazonaws.com/r-builds:ubuntu-2204"
      ReadonlyRootFilesystem: true
    Timeout:
      AttemptDurationSeconds: 7200
rBuildsBatchJobDefinitionDebian10:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
      Image: "#{AWS::AccountId}.dkr.ecr.#{AWS::Region}.amazonaws.com/r-builds:debian-10"
      ReadonlyRootFilesystem: true
    Timeout:
      AttemptDurationSeconds: 7200
rBuildsBatchJobDefinitionDebian11:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
      Image: "#{AWS::AccountId}.dkr.ecr.#{AWS::Region}.amazonaws.com/r-builds:debian-11"
      ReadonlyRootFilesystem: true
    Timeout:
      AttemptDurationSeconds: 7200
rBuildsBatchJobDefinitionDebian12:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
      Image: "#{AWS::AccountId}.dkr.ecr.#{AWS::Region}.amazonaws.com/r-builds:debian-12"
      ReadonlyRootFilesystem: true
    Timeout:
      AttemptDurationSeconds: 7200
rBuildsBatchJobDefinitionCentos7:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
      Image: "#{AWS::AccountId}.dkr.ecr.#{AWS::Region}.amazonaws.com/r-builds:centos-7"
      ReadonlyRootFilesystem: true
    Timeout:
      AttemptDurationSeconds: 7200
rBuildsBatchJobDefinitionCentos8:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
      Image: "#{AWS::AccountId}.dkr.ecr.#{AWS::Region}.amazonaws.com/r-builds:centos-8"
      ReadonlyRootFilesystem: true
    Timeout:
      AttemptDurationSeconds: 7200
rBuildsBatchJobDefinitionRhel9:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
      Image: "#{AWS::AccountId}.dkr.ecr.#{AWS::Region}.amazonaws.com/r-builds:rhel-9"
      ReadonlyRootFilesystem: true
    Timeout:
      AttemptDurationSeconds: 7200
rBuildsBatchJobDefinitionOpensuse154:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
      Image: "#{AWS::AccountId}.dkr.ecr.#{AWS::Region}.amazonaws.com/r-builds:opensuse-154"
      ReadonlyRootFilesystem: true
    Timeout:
      AttemptDurationSeconds: 7200
rBuildsBatchJobDefinitionFedora37:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
      Image: "#{AWS::AccountId}.dkr.ecr.#{AWS::Region}.amazonaws.com/r-builds:fedora-37"
      ReadonlyRootFilesystem: true
    Timeout:
      AttemptDurationSeconds: 7200
rBuildsBatchJobDefinitionFedora38:
  Type: AWS::Batch::JobDefinition
  Properties:
    Type: container
    ContainerProperties:
      Command:
        - ./build.sh
      Vcpus: 4
      Memory: 4096
      JobRoleArn:
        "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
      Image: "#{AWS::AccountId}.dkr.ecr.#{AWS::Region}.amazonaws.com/r-builds:fedora-38"
      ReadonlyRootFilesystem: true
    Timeout:
      AttemptDurationSeconds: 7200

# step function cloudwatch event trigger resources
rBuildsEventRuleIamRole:
  Type: AWS::IAM::Role
  Properties:
    Path: /service-role/
    AssumeRolePolicyDocument:
      Version: '2012-10-17'
      Statement:
        - Effect: Allow
          Principal:
            Service:
              - events.amazonaws.com
          Action: sts:AssumeRole
    Policies:
      - PolicyName: 'allow-step-function-execution'
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - states:StartExecution
              Resource:
                Ref: RBuildsStepFunction

rBuildsEventRule:
  Type: AWS::Events::Rule
  Properties:
    Description: Check for New R Versions
    ScheduleExpression: rate(1 hour)
    State: ${self:custom.${self:provider.stage}.eventRuleState}
    Targets:
      - Id: rbuilds
        Input: '{}'
        RoleArn:
          Fn::GetAtt: [ rBuildsEventRuleIamRole, Arn ]
        Arn:
          Ref: RBuildsStepFunction

rBuildsDevelEventRule:
  Type: AWS::Events::Rule
  Properties:
    Description: Build R-devel
    ScheduleExpression: cron(0 4 * * ? *)
    State: ${self:custom.${self:provider.stage}.eventRuleState}
    Targets:
      - Id: rbuilds
        Input: '{"force": true, "versions": ["next", "devel"]}'
        RoleArn:
          Fn::GetAtt: [ rBuildsEventRuleIamRole, Arn ]
        Arn:
          Ref: RBuildsStepFunction

rBuildsTopic:
  Type: AWS::SNS::Topic
  Properties:
    DisplayName: R Builds
    TopicName: ${self:custom.${self:provider.stage}.snsTopicName}