aws-cfm-utils

{ "AWSTemplateFormatVersion": "2010-09-09", "Description": "Some Example VPC that has two public subnets and two private subnets in different AZs NATs to enable instances in private subnets to access the internet and bastion hosts to moderate SSH access", "Parameters": { "KeyName": { "Description": "Name of an existing EC2 KeyPair to enable SSH access to the bastion host", "Type": "String", "MinLength": "1", "MaxLength": "64", "AllowedPattern": "[-_ a-zA-Z0-9]*", "ConstraintDescription": "can contain only alphanumeric characters, spaces, dashes and underscores.", "Default": "test-key-pair" }, "BastionInstanceType": { "Description": "Bastion instance type", "Type": "String", "Default": "t2.micro", "AllowedValues": ["t2.micro", "m4.small", "m4.medium", "m4.large"], "ConstraintDescription": "must be a valid and allowed EC2 instance type." }, "TestName": { "Description": "TestName", "Type": "String" }, "TestName2":{ "Description": "TestName2", "Type": "String" } }, "Mappings": { "AWSInstanceType2Arch": { "t2.micro": { "Arch": "64" }, "m4.small": { "Arch": "64" }, "m4.medium": { "Arch": "64" }, "m4.large": { "Arch": "64" } }, "AWSNATAMI": { "eu-west-1": { "AMI": "ami-785db401" } }, "AWSRegionArch2AMI": { "eu-west-1": { "64": "ami-785db401" } } }, "Resources": { "VPC": { "Type": "AWS::EC2::VPC", "Properties": { "CidrBlock": "10.0.0.0/16", "Tags": [ { "Key": "Application", "Value": { "Ref": "AWS::StackId" } }, { "Key": "Network", "Value": "Public" } ] } }, "PublicSubnet1": { "Type": "AWS::EC2::Subnet", "Properties": { "VpcId": { "Ref": "VPC" }, "CidrBlock": "10.0.0.0/24", "AvailabilityZone": { "Fn::Select": ["0", { "Fn::GetAZs": { "Ref": "AWS::Region" } }] }, "Tags": [ { "Key": "Application", "Value": { "Ref": "AWS::StackId" } }, { "Key": "Network", "Value": "Public" } ] } }, "PublicSubnet2": { "Type": "AWS::EC2::Subnet", "Properties": { "VpcId": { "Ref": "VPC" }, "CidrBlock": "10.0.2.0/24", "AvailabilityZone": { "Fn::Select": ["1", { "Fn::GetAZs": { "Ref": "AWS::Region" } }] }, "Tags": [ { "Key": "Application", "Value": { "Ref": "AWS::StackId" } }, { "Key": "Network", "Value": "Public" } ] } }, "InternetGateway": { "Type": "AWS::EC2::InternetGateway", "Properties": { "Tags": [ { "Key": "Application", "Value": { "Ref": "AWS::StackId" } }, { "Key": "Network", "Value": "Public" } ] } }, "GatewayToInternet": { "Type": "AWS::EC2::VPCGatewayAttachment", "Properties": { "VpcId": { "Ref": "VPC" }, "InternetGatewayId": { "Ref": "InternetGateway" } } }, "PublicRouteTable": { "Type": "AWS::EC2::RouteTable", "Properties": { "VpcId": { "Ref": "VPC" }, "Tags": [ { "Key": "Application", "Value": { "Ref": "AWS::StackId" } }, { "Key": "Network", "Value": "Public" } ] } }, "PublicRoute": { "Type": "AWS::EC2::Route", "DependsOn": "GatewayToInternet", "Properties": { "RouteTableId": { "Ref": "PublicRouteTable" }, "DestinationCidrBlock": "0.0.0.0/0", "GatewayId": { "Ref": "InternetGateway" } } }, "PublicSubnetRouteTableAssociation1": { "Type": "AWS::EC2::SubnetRouteTableAssociation", "Properties": { "SubnetId": { "Ref": "PublicSubnet1" }, "RouteTableId": { "Ref": "PublicRouteTable" } } }, "PublicSubnetRouteTableAssociation2": { "Type": "AWS::EC2::SubnetRouteTableAssociation", "Properties": { "SubnetId": { "Ref": "PublicSubnet2" }, "RouteTableId": { "Ref": "PublicRouteTable" } } }, "PublicNetworkAcl": { "Type": "AWS::EC2::NetworkAcl", "Properties": { "VpcId": { "Ref": "VPC" }, "Tags": [ { "Key": "Application", "Value": { "Ref": "AWS::StackId" } }, { "Key": "Network", "Value": "Public" } ] } }, "InboundHTTPPublicNetworkAclEntry": { "Type": "AWS::EC2::NetworkAclEntry", "Properties": { "NetworkAclId": { "Ref": "PublicNetworkAcl" }, "RuleNumber": "100", "Protocol": "6", "RuleAction": "allow", "Egress": "false", "CidrBlock": "0.0.0.0/0", "PortRange": { "From": "80", "To": "80" } } }, "InboundHTTPSPublicNetworkAclEntry": { "Type": "AWS::EC2::NetworkAclEntry", "Properties": { "NetworkAclId": { "Ref": "PublicNetworkAcl" }, "RuleNumber": "101", "Protocol": "6", "RuleAction": "allow", "Egress": "false", "CidrBlock": "0.0.0.0/0", "PortRange": { "From": "443", "To": "443" } } }, "InboundSSHPublicNetworkAclEntry": { "Type": "AWS::EC2::NetworkAclEntry", "Properties": { "NetworkAclId": { "Ref": "PublicNetworkAcl" }, "RuleNumber": "102", "Protocol": "6", "RuleAction": "allow", "Egress": "false", "CidrBlock": "0.0.0.0/0", "PortRange": { "From": "22", "To": "22" } } }, "InboundDynamicPortsPublicNetworkAclEntry": { "Type": "AWS::EC2::NetworkAclEntry", "Properties": { "NetworkAclId": { "Ref": "PublicNetworkAcl" }, "RuleNumber": "103", "Protocol": "6", "RuleAction": "allow", "Egress": "false", "CidrBlock": "0.0.0.0/0", "PortRange": { "From": "1024", "To": "65535" } } }, "OutboundPublicNetworkAclEntry": { "Type": "AWS::EC2::NetworkAclEntry", "Properties": { "NetworkAclId": { "Ref": "PublicNetworkAcl" }, "RuleNumber": "100", "Protocol": "6", "RuleAction": "allow", "Egress": "true", "CidrBlock": "0.0.0.0/0", "PortRange": { "From": "0", "To": "65535" } } }, "PublicSubnetNetworkAclAssociation1": { "Type": "AWS::EC2::SubnetNetworkAclAssociation", "Properties": { "SubnetId": { "Ref": "PublicSubnet1" }, "NetworkAclId": { "Ref": "PublicNetworkAcl" } } }, "PublicSubnetNetworkAclAssociation2": { "Type": "AWS::EC2::SubnetNetworkAclAssociation", "Properties": { "SubnetId": { "Ref": "PublicSubnet2" }, "NetworkAclId": { "Ref": "PublicNetworkAcl" } } }, "PrivateSubnet1": { "Type": "AWS::EC2::Subnet", "Properties": { "VpcId": { "Ref": "VPC" }, "CidrBlock": "10.0.10.0/24", "AvailabilityZone": { "Fn::Select": ["0", { "Fn::GetAZs": { "Ref": "AWS::Region" } }] }, "Tags": [ { "Key": "Application", "Value": { "Ref": "AWS::StackId" } }, { "Key": "Network", "Value": "Private" } ] } }, "PrivateSubnet2": { "Type": "AWS::EC2::Subnet", "Properties": { "VpcId": { "Ref": "VPC" }, "CidrBlock": "10.0.3.0/24", "AvailabilityZone": { "Fn::Select": ["1", { "Fn::GetAZs": { "Ref": "AWS::Region" } }] }, "Tags": [ { "Key": "Application", "Value": { "Ref": "AWS::StackId" } }, { "Key": "Network", "Value": "Private" } ] } }, "PrivateRouteTable1": { "Type": "AWS::EC2::RouteTable", "Properties": { "VpcId": { "Ref": "VPC" }, "Tags": [ { "Key": "Application", "Value": { "Ref": "AWS::StackId" } }, { "Key": "Network", "Value": "Private" } ] } }, "PrivateRouteTable2": { "Type": "AWS::EC2::RouteTable", "Properties": { "VpcId": { "Ref": "VPC" }, "Tags": [ { "Key": "Application", "Value": { "Ref": "AWS::StackId" } }, { "Key": "Network", "Value": "Private" } ] } }, "PrivateSubnetRouteTableAssociation1": { "Type": "AWS::EC2::SubnetRouteTableAssociation", "Properties": { "SubnetId": { "Ref": "PrivateSubnet1" }, "RouteTableId": { "Ref": "PrivateRouteTable1" } } }, "PrivateSubnetRouteTableAssociation2": { "Type": "AWS::EC2::SubnetRouteTableAssociation", "Properties": { "SubnetId": { "Ref": "PrivateSubnet2" }, "RouteTableId": { "Ref": "PrivateRouteTable2" } } }, "PrivateRoute1": { "Type": "AWS::EC2::Route", "Properties": { "RouteTableId": { "Ref": "PrivateRouteTable1" }, "DestinationCidrBlock": "0.0.0.0/0", "InstanceId": { "Ref": "NATDevice1" } } }, "PrivateRoute2": { "Type": "AWS::EC2::Route", "Properties": { "RouteTableId": { "Ref": "PrivateRouteTable2" }, "DestinationCidrBlock": "0.0.0.0/0", "InstanceId": { "Ref": "NATDevice2" } } }, "PrivateNetworkAcl": { "Type": "AWS::EC2::NetworkAcl", "Properties": { "VpcId": { "Ref": "VPC" }, "Tags": [ { "Key": "Application", "Value": { "Ref": "AWS::StackId" } }, { "Key": "Network", "Value": "Private" } ] } }, "InboundPrivateNetworkAclEntry": { "Type": "AWS::EC2::NetworkAclEntry", "Properties": { "NetworkAclId": { "Ref": "PrivateNetworkAcl" }, "RuleNumber": "100", "Protocol": "6", "RuleAction": "allow", "Egress": "false", "CidrBlock": "0.0.0.0/0", "PortRange": { "From": "0", "To": "65535" } } }, "OutboundPrivateNetworkAclEntry": { "Type": "AWS::EC2::NetworkAclEntry", "Properties": { "NetworkAclId": { "Ref": "PrivateNetworkAcl" }, "RuleNumber": "100", "Protocol": "6", "RuleAction": "allow", "Egress": "true", "CidrBlock": "0.0.0.0/0", "PortRange": { "From": "0", "To": "65535" } } }, "PrivateSubnetNetworkAclAssociation1": { "Type": "AWS::EC2::SubnetNetworkAclAssociation", "Properties": { "SubnetId": { "Ref": "PrivateSubnet1" }, "NetworkAclId": { "Ref": "PrivateNetworkAcl" } } }, "PrivateSubnetNetworkAclAssociation2": { "Type": "AWS::EC2::SubnetNetworkAclAssociation", "Properties": { "SubnetId": { "Ref": "PrivateSubnet2" }, "NetworkAclId": { "Ref": "PrivateNetworkAcl" } } }, "NATIPAddress1": { "Type": "AWS::EC2::EIP", "DependsOn": "GatewayToInternet", "Properties": { "Domain": "vpc", "InstanceId": { "Ref": "NATDevice1" } } }, "NATIPAddress2": { "Type": "AWS::EC2::EIP", "DependsOn": "GatewayToInternet", "Properties": { "Domain": "vpc", "InstanceId": { "Ref": "NATDevice2" } } }, "NATDevice1": { "Type": "AWS::EC2::Instance", "Properties": { "InstanceType": "t1.micro", "KeyName": { "Ref": "KeyName" }, "SubnetId": { "Ref": "PublicSubnet1" }, "SourceDestCheck": "false", "ImageId": { "Fn::FindInMap": ["AWSNATAMI", { "Ref": "AWS::Region" }, "AMI"] }, "SecurityGroupIds": [{ "Ref": "NATSecurityGroup" }], "Tags": [{ "Key": "Name", "Value": "NAT Device" }] } }, "NATDevice2": { "Type": "AWS::EC2::Instance", "Properties": { "InstanceType": "t1.micro", "KeyName": { "Ref": "KeyName" }, "SubnetId": { "Ref": "PublicSubnet2" }, "SourceDestCheck": "false", "ImageId": { "Fn::FindInMap": ["AWSNATAMI", { "Ref": "AWS::Region" }, "AMI"] }, "SecurityGroupIds": [{ "Ref": "NATSecurityGroup" }], "Tags": [{ "Key": "Name", "Value": "NAT Device" }] } }, "NATSecurityGroup": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "Enable internal access to the NAT device", "VpcId": { "Ref": "VPC" }, "SecurityGroupIngress": [ { "IpProtocol": "tcp", "FromPort": "80", "ToPort": "80", "CidrIp": "0.0.0.0/0" }, { "IpProtocol": "tcp", "FromPort": "443", "ToPort": "443", "CidrIp": "0.0.0.0/0" }, { "IpProtocol": "tcp", "FromPort": "22", "ToPort": "22", "SourceSecurityGroupId": { "Ref": "BastionSecurityGroup" } }, { "IpProtocol": "tcp", "FromPort": "1", "ToPort": "65535", "SourceSecurityGroupId": { "Ref": "InternalSshSecurityGroup" } } ], "SecurityGroupEgress": [ { "IpProtocol": "tcp", "FromPort": "1", "ToPort": "65535", "CidrIp": "0.0.0.0/0" } ] } }, "BastionHost1": { "Type": "AWS::EC2::Instance", "DependsOn": "GatewayToInternet", "Properties": { "InstanceType": { "Ref": "BastionInstanceType" }, "KeyName": { "Ref": "KeyName" }, "ImageId": { "Fn::FindInMap": [ "AWSRegionArch2AMI", { "Ref": "AWS::Region" }, { "Fn::FindInMap": [ "AWSInstanceType2Arch", { "Ref": "BastionInstanceType" }, "Arch" ] } ] }, "NetworkInterfaces": [ { "GroupSet": [{ "Ref": "BastionSecurityGroup" }], "AssociatePublicIpAddress": "true", "DeviceIndex": "0", "DeleteOnTermination": "true", "SubnetId": { "Ref": "PublicSubnet1" } } ], "Tags": [ { "Key": "Name", "Value": "Bastion Host" }, { "Key": "Bastion", "Value": "true" } ] } }, "BastionHost2": { "Type": "AWS::EC2::Instance", "DependsOn": "GatewayToInternet", "Properties": { "InstanceType": { "Ref": "BastionInstanceType" }, "KeyName": { "Ref": "KeyName" }, "ImageId": { "Fn::FindInMap": [ "AWSRegionArch2AMI", { "Ref": "AWS::Region" }, { "Fn::FindInMap": [ "AWSInstanceType2Arch", { "Ref": "BastionInstanceType" }, "Arch" ] } ] }, "NetworkInterfaces": [ { "GroupSet": [{ "Ref": "BastionSecurityGroup" }], "AssociatePublicIpAddress": "true", "DeviceIndex": "0", "DeleteOnTermination": "true", "SubnetId": { "Ref": "PublicSubnet2" } } ], "Tags": [ { "Key": "Name", "Value": "Bastion Host" }, { "Key": "Bastion", "Value": "true" } ] } }, "BastionSecurityGroup": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "Enable access to the bastion host", "VpcId": { "Ref": "VPC" }, "SecurityGroupIngress": [ { "IpProtocol": "tcp", "FromPort": "22", "ToPort": "22", "CidrIp": "0.0.0.0/0" } ] } }, "InternalSshSecurityGroup": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "Allow ssh access from bastion", "VpcId": { "Ref": "VPC" }, "SecurityGroupIngress": [ { "IpProtocol": "tcp", "FromPort": "22", "ToPort": "22", "SourceSecurityGroupId": { "Ref": "BastionSecurityGroup" } } ], "SecurityGroupEgress": [] } } }, "Outputs": { "VpcId": { "Description": "VPC", "Value": { "Ref": "VPC" } }, "PublicSubnets": { "Description": "Public subnet", "Value": { "Fn::Join": [ ",", [{ "Ref": "PublicSubnet1" }, { "Ref": "PublicSubnet2" }] ] } }, "PrivateSubnets": { "Description": "Private subnet", "Value": { "Fn::Join": [ ",", [{ "Ref": "PrivateSubnet1" }, { "Ref": "PrivateSubnet2" }] ] } }, "AZs": { "Description": "Availability zones", "Value": { "Fn::Join": [ ",", [ { "Fn::GetAtt": ["PrivateSubnet1", "AvailabilityZone"] }, { "Fn::GetAtt": ["PrivateSubnet2", "AvailabilityZone"] } ] ] } }, "InternalSshSecurityGroupId": { "Description": "Internal ssh security group", "Value": { "Ref": "InternalSshSecurityGroup" } } } }