This setup only focuses on providing bare minimal setup for durable Jenkins server. It does not take into account added features that you should use in production e.g. how you can do SSL termination ( you can use AWS ALB or ELB in front of this Jenkins to terminate the SSL connection.)

  JenkinsIamRole: 
 Type: 
 AWS::IAM::Role 
 Properties: 
 AssumeRolePolicyDocument: 
 Version: 
 2012 
 -10 
 -17 
 Statement: 
 - 
 Effect: 
 Allow 
 Principal: 
 Service: 
 - 
 ec2.amazonaws.com 
 Action: 
 - sts: 
 AssumeRole 
 Policies: 
 - 
 PolicyName: 
 Attach-Volume-and-Update-Route53-AND-S3 
 PolicyDocument: 
 Version: 
 2012 
 -10 
 -17 
 Statement: 
 - 
 Effect: 
 Allow 
 Action: 
 - route53: 
 ChangeResourceRecordSets 
 Resource: 
 !Sub 
 "arn:aws:route53:::hostedzone/${Route53HostedZoneId}" 
 - 
 Effect: 
 Allow 
 Action: 
 - route53: 
 GetHostedZone 
 - route53: 
 ListHostedZones 
 Resource: 
 "*" 
 - 
 Effect: 
 Allow 
 Action: 
 - ec2: 
 AttachVolume 
 - ec2: 
 DescribeVolumeAttribute 
 - ec2: 
 DescribeVolumeStatus 
 - ec2: 
 DescribeVolumes 
 Resource: 
 "*" 
 RoleName: 
 jenkins-role 
 

  # Volume /dev/sdh (which will get created as /dev/xvdh on Amazon Linux) 
MOUNT_STATE= "unknown" 
until [ " ${!MOUNT_STATE} 
" 
== "attached" 
]; do 
MOUNT_STATE=$(aws ec2 describe-volumes \
                --region ${AWS::Region} 
\
                --filters \
                    Name=attachment.instance-id,Values= ${!INSTANCE_ID} 
\
                    Name=attachment.device,Values=/dev/sdh \
                --query Volumes[].Attachments[].State \
                --output text)
              sleep 5 done 
 # Format /dev/xvdh if it does not contain a partition yet 
 if 
[ " $(file -b -s /dev/xvdh) 
" 
== "data" 
]; then 
mkfs -t ext4 /dev/xvdh fi 
mkdir -p /var/lib/jenkins
            mount /dev/xvdh /var/lib/jenkins # Persist the volume in /etc/fstab so it gets mounted again 
 echo 
 '/dev/xvdh /var/lib/jenkins ext4 defaults,nofail 0 2' 
>> /etc/fstab 

1. This script first queries the  EC2 metadata  to get the instance id.
2. Then it calls AWS api to attach the EBS volume to it.
3. It waits until the volume has been attached and then, if this is first mount, formats it
4. Finally it mounts the formatted volume into  var/lib/jenkins  folder where Jenkins will persists its data.

  # Register jenkins to DNS 
HOSTED_ZONE_ID= ${HOSTED_ZONE_ID} 
DOMAIN=$(aws route53 get-hosted-zone --id " $HOSTED_ZONE_ID 
" 
--query "HostedZone.Name" 
--output text)
            PUBLIC_IP=$( curl https://169.254.169.254/latest/meta-data/public-ipv4 ) echo 
 "Registering $IP 
to hostedzone $HOSTED_ZONE_ID 
as jenkins. ${!DOMAIN} 
" 
cat << EOF >> update-route53.json
            { "Comment" 
: "Update Jenkins DNS to match IP of new EC2 instance" 
, "Changes" 
: [
                { "Action" 
: "UPSERT" 
, "ResourceRecordSet" 
: { "Name" 
: "jenkins. ${!DOMAIN} 
" 
, "Type" 
: "A" 
, "TTL" 
: 300, "ResourceRecords" 
: [{ "Value" 
: " $PUBLIC_IP 
" 
}]
                  }
                }
              ]
            }
            EOF
            aws route53 change-resource-record-sets --hosted-zone-id " $HOSTED_ZONE_ID 
" 
--change-batch file://update-route53.json 

1. This script first calls AWS api to get the domain name of the given Hosted zone.
2. Then it resolves its own public IP address via instance metadata and calls Route53 api to register the instance public ip under jenkins.{your domain} domain name.
3. After the DNS cache is refreshed, you should see the up and running Jenkins in  https://jenkins.{your domain}:8080

  if 
[ -e /var/lib/jenkins/secrets/initialAdminPassword ]; then 
JENKINS_PASSWORD=$(cat /var/lib/jenkins/secrets/initialAdminPassword) echo 
 "Your Jenkins Password $JENKINS_PASSWORD 
" 
 else 
 echo 
 "No initial password Jenkins has allready been initialized" 
 fi