stack.yaml

Description:
    David Walton - Udacity Cloud DevOps Engineer - Project 2
Parameters:
    EnvironmentName:
        Description: An Environment name that will be prefixed to resources
        Type: String
    VpcCIDR:
        Description: Please enter the IP range (CIDR notation) for this
        Type: String
        Default: 10.0.0.0/16
    PrivateSubnet1CIDR:
        Description: Please enter the IP range (CIDR notation) for this
        Type: String
        Default: 10.0.3.0/24
    PrivateSubnet2CIDR:
        Description: Please enter the IP range (CIDR notation) for this
        Type: String
        Default: 10.0.4.0/24
    PublicSubnet1CIDR:
        Description: Please enter the IP range (CIDR notation) for this - Public Subnet
        Type: String
        Default: 10.0.30.0/24
    PublicSubnet2CIDR:
        Description: Please enter the IP range (CIDR notation) for this - Public Subnet
        Type: String
        Default: 10.0.40.0/24

Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCIDR
      EnableDnsHostnames: true
      EnableDnsSupport: true
      Tags:
          -   Key: Name
              Value: !Sub ${EnvironmentName}-vpc
  PrivateSub1:
    Type: AWS::EC2::Subnet
    Properties:
        VpcId: !Ref VPC
        AvailabilityZone: !Select [ 0, !GetAZs '' ]
        CidrBlock: !Ref PrivateSubnet1CIDR
        MapPublicIpOnLaunch: false
        Tags:
            -   Key: Name
                Value: !Sub ${EnvironmentName}-private-subnet-AZ1
  PrivateSub2:
     Type: AWS::EC2::Subnet
     Properties:
         VpcId: !Ref VPC
         AvailabilityZone: !Select [ 1, !GetAZs '' ]
         CidrBlock: !Ref PrivateSubnet2CIDR
         MapPublicIpOnLaunch: false
         Tags:
            -   Key: Name
                Value: !Sub ${EnvironmentName}-private-subnet-AZ2
  PublicSub1:
    Type: AWS::EC2::Subnet
    Properties:
        VpcId: !Ref VPC
        AvailabilityZone: !Select [ 0, !GetAZs '' ]
        CidrBlock: !Ref PublicSubnet1CIDR
        MapPublicIpOnLaunch: true
        Tags:
            -   Key: Name
                Value: !Sub ${EnvironmentName}-public-subnet-AZ1
  PublicSub2:
     Type: AWS::EC2::Subnet
     Properties:
         VpcId: !Ref VPC
         AvailabilityZone: !Select [ 1, !GetAZs '' ]
         CidrBlock: !Ref PublicSubnet2CIDR
         MapPublicIpOnLaunch: true
         Tags:
            -   Key: Name
                Value: !Sub ${EnvironmentName}-public-subnet-AZ2
  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
         - Key: Name
           Value: !Sub ${EnvironmentName}-igw
  GatewayAttachement:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref VPC
  NatGateway1EIP:
    Type: AWS::EC2::EIP
    DependsOn: GatewayAttachement
    Properties:
      Domain: vpc
  NatGateway2EIP:
    Type: AWS::EC2::EIP
    DependsOn: GatewayAttachement
    Properties:
      Domain: vpc
  NatGateway1:
    Type: AWS::EC2::NatGateway
    Properties:
        AllocationId: !GetAtt NatGateway1EIP.AllocationId
        SubnetId: !Ref PublicSub1
        Tags:
           -   Key: Name
               Value: !Sub ${EnvironmentName}-nat-gateway-1
  NatGateway2:
    Type: AWS::EC2::NatGateway
    Properties:
        AllocationId: !GetAtt NatGateway2EIP.AllocationId
        SubnetId: !Ref PublicSub2
        Tags:
           -   Key: Name
               Value: !Sub ${EnvironmentName}-nat-gateway-2
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref 'VPC'
      Tags:
         -   Key: Name
             Value: !Sub ${EnvironmentName}-public-route-table
  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: GatewayAttachement
    Properties:
      RouteTableId: !Ref 'PublicRouteTable'
      DestinationCidrBlock: '0.0.0.0/0'
      GatewayId: !Ref 'InternetGateway'
  PublicSubnetOneRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSub1
      RouteTableId: !Ref PublicRouteTable
  PublicSubnetTwoRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSub2
      RouteTableId: !Ref PublicRouteTable
  PrivateRouteTable1:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref 'VPC'
      Tags:
        -   Key: Name
            Value: !Sub ${EnvironmentName}-private-route-table-AZ1
  PrivateRoute1:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref 'PrivateRouteTable1'
      NatGatewayId: !Ref 'NatGateway1'
      DestinationCidrBlock: '0.0.0.0/0'
  PrivateSubnetOneRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateSub1
      RouteTableId: !Ref PrivateRouteTable1
  PrivateRouteTable2:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref 'VPC'
      Tags:
        -   Key: Name
            Value: !Sub ${EnvironmentName}-private-route-table-AZ2
  PrivateRoute2:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref 'PrivateRouteTable2'
      NatGatewayId: !Ref 'NatGateway2'
      DestinationCidrBlock: '0.0.0.0/0'
  PrivateSubnetTwoRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateSub2
      RouteTableId: !Ref PrivateRouteTable2



##### Security Groups
  SecurityGroupBastion:
    Type: AWS::EC2::SecurityGroup
    Properties:
      VpcId: !Ref 'VPC'
      GroupDescription: Bastion security group
      SecurityGroupIngress:
        - CidrIp: 0.0.0.0/0
          IpProtocol: tcp
          FromPort: 22
          ToPort: 22
      Tags:
        -   Key: Name
            Value: !Sub ${EnvironmentName}-bastion-sg


  SecurityGroupWeb:
    Type: AWS::EC2::SecurityGroup
    Properties:
      VpcId: !Ref 'VPC'
      GroupDescription: Web Server security group
      SecurityGroupIngress:
        - SourceSecurityGroupId: !Ref SecurityGroupBastion
          IpProtocol: tcp
          FromPort: 22
          ToPort: 22
        - CidrIp: 0.0.0.0/0
          IpProtocol: tcp
          FromPort: 80
          ToPort: 80
      Tags:
        -   Key: Name
            Value: !Sub ${EnvironmentName}-web-server-sg

### Elastic Load Balancer

  LoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Subnets:
        - Ref: PublicSub1
        - Ref: PublicSub2
      SecurityGroups:
        - Ref: SecurityGroupWeb
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-lb

  LoadBalancerListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: !Ref LoadBalancer
      Port: 80
      Protocol: HTTP
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref WebServerTargetGroup


  WebServerTargetGroup:
     Type: AWS::ElasticLoadBalancingV2::TargetGroup
     Properties:
      TargetType: instance
      Tags:
         - Key: Name
           Value: !Sub ${EnvironmentName}-web-server-tg
      HealthCheckIntervalSeconds: 35
      HealthCheckPath: /
      HealthCheckProtocol: HTTP
      HealthCheckTimeoutSeconds: 30
      HealthyThresholdCount: 2
      Port: 80
      Protocol: HTTP
      UnhealthyThresholdCount: 5
      VpcId: !Ref 'VPC'




####  Bastion
  BastionNode:
    Type: AWS::EC2::Instance
    Properties:
      BlockDeviceMappings:
        - DeviceName: "/dev/xvda"
          Ebs:
            VolumeSize: 24
            VolumeType: gp2
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-bastion
      ImageId: ami-0bbc25e23a7640b9b
      InstanceType: t2.micro
      SubnetId:
        Ref: PublicSub1
      AvailabilityZone: !Select [ 0, !GetAZs '' ]
      SecurityGroupIds:
        - Ref: SecurityGroupBastion


##### Web Servers Auto Scaling + Launch Config
  WebServerAutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      Cooldown: 100
      TargetGroupARNs:
        - !Ref WebServerTargetGroup
      VPCZoneIdentifier:
        - Ref: "PrivateSub1"
        - Ref: "PrivateSub2"
      LaunchConfigurationName:
        Ref: "WebServerLaunchConfig"
      MinSize: "4"
      MaxSize: "4"
      MetricsCollection:
        - Granularity: "1Minute"
          Metrics:
            - "GroupMinSize"
            - "GroupMaxSize"
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-web-server-asg
          PropagateAtLaunch: "true"


  WebServerLaunchConfig:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      UserData:
        Fn::Base64: !Sub |
            #!/bin/bash
            apt-get -y  update
            apt-get -y install unzip awscli
            apt-get -y install apache2

            systemctl start apache2

            cd /var/www/html
            aws s3 cp s3://udacity-deploy-iac-project-2/code.tgz .
            tar -xzvf code.tgz
            chown -R www-data:www-data .
      ImageId: ami-01e6a0b85de033c99
      IamInstanceProfile:
        Ref: ListS3BucketsInstanceProfile
      SecurityGroups:
        - Ref: SecurityGroupWeb
      InstanceType: t2.micro
      BlockDeviceMappings:
        - DeviceName: "/dev/xvda"
          Ebs:
            VolumeSize: 24
            VolumeType: gp2





#### EC2 Instance bucket policy
  ListS3BucketsInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: "/"
      Roles:
      - Ref: ListS3BucketsRole
  ListS3BucketsPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: ListS3BucketsPolicy
      PolicyDocument:
        Statement:
        - Effect: Allow
          Action:
          - s3:List*
          Resource: "*"
      Roles:
      - Ref: ListS3BucketsRole
  ListS3BucketsRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - ec2.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: "/"






Outputs:
  VPC:
    Description: AWS VPC ID
    Value: !Ref VPC
    Export:
      Name: !Sub "${AWS::StackName}-VPCID"
  PrivateSub1:
    Description: Private Subnet 1
    Value: !Ref PrivateSubnet1CIDR
    Export:
      Name: !Sub "${AWS::StackName}-PRIVSUBNET1"
  PrivateSub2:
    Description: Private Subnet 2
    Value: !Ref PrivateSubnet2CIDR
    Export:
      Name: !Sub "${AWS::StackName}-PRIVSUBNET2"
  PublicSub1:
    Description: Public Subnet 1
    Value: !Ref PublicSubnet1CIDR
    Export:
      Name: !Sub "${AWS::StackName}-PUBSUBNET1"
  PublicSub2:
    Description: Public Subnet 2
    Value: !Ref PublicSubnet2CIDR
    Export:
      Name: !Sub "${AWS::StackName}-PUBSUBNET2"
  StackIGW:
    Description: Stack IGW ID
    Value: !Ref InternetGateway
    Export:
      Name: !Sub "${AWS::StackName}-IGW"
  BastionIP:
    Description: Bastion Public IP
    Value: !GetAtt BastionNode.PublicIp
    Export:
      Name: !Sub "${AWS::StackName}-bastion-public-ip"
  BastionDNS:
    Description: Bastion DNS
    Value: !GetAtt BastionNode.PublicDnsName
    Export:
      Name: !Sub "${AWS::StackName}-bastion-public-dns"
  LoadBalancerDNS:
    Description: LoadBalancer DNS
    Value: !Join [ "", [ "http://", !GetAtt LoadBalancer.DNSName ] ]
    Export:
      Name: !Sub "${AWS::StackName}-lb-dns"