-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathvpc.yaml
175 lines (171 loc) · 3.93 KB
/
vpc.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
Resources:
######################
## VPC basics
######################
VPC:
Type: AWS::EC2::VPC
Properties:
CidrBlock: 10.56.0.0/16
EnableDnsSupport: true
EnableDnsHostnames: true
Tags:
- Key: Name
Value: reeves-lambda-vpc
InternetGateway:
Type: AWS::EC2::InternetGateway
Properties:
Tags:
- Key: Name
Value: reeves-lambda-igw
InternetGatewayAttachment:
Type: AWS::EC2::VPCGatewayAttachment
Properties:
InternetGatewayId:
Ref: InternetGateway
VpcId:
Ref: VPC
######################
## Subnet Public
######################
PublicSubnet1:
Type: AWS::EC2::Subnet
Properties:
VpcId:
Ref: VPC
AvailabilityZone: ap-southeast-2a
CidrBlock: 10.56.11.0/24
MapPublicIpOnLaunch: true
Tags:
- Key: Name
Value: reeves-lambda-pub-sub
PublicRouteTable:
Type: AWS::EC2::RouteTable
Properties:
VpcId:
Ref: VPC
Tags:
- Key: Name
Value: reeves-lambda-pub-rt
PublicRouteTableRoute1:
Type: AWS::EC2::Route
DependsOn: InternetGateway
Properties:
RouteTableId:
Ref: PublicRouteTable
DestinationCidrBlock: 0.0.0.0/0
GatewayId:
Ref: InternetGateway
PublicRouteTableAssociation1:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
SubnetId:
Ref: PublicSubnet1
RouteTableId:
Ref: PublicRouteTable
PublicElasticIP:
Type: AWS::EC2::EIP
Properties:
Domain:
Ref: VPC
NatGateway:
Type: AWS::EC2::NatGateway
Properties:
AllocationId:
Fn::GetAtt: PublicElasticIP.AllocationId
SubnetId:
Ref: PublicSubnet1
Tags:
- Key: Name
Value: reeves-lambda-nat-gw
######################
## Subnet Private
######################
PrivateSubnet1:
Type: AWS::EC2::Subnet
Properties:
VpcId:
Ref: VPC
AvailabilityZone: ap-southeast-2a
CidrBlock: 10.56.21.0/24
MapPublicIpOnLaunch: false
Tags:
- Key: Name
Value: reeves-lambda-pri-sub
PrivateRouteTable:
Type: AWS::EC2::RouteTable
Properties:
VpcId:
Ref: VPC
Tags:
- Key: Name
Value: reeves-lambda-pri-rt
PrivateRouteTableRoute1:
Type: AWS::EC2::Route
DependsOn: NatGateway
Properties:
RouteTableId:
Ref: PrivateRouteTable
DestinationCidrBlock: 0.0.0.0/0
NatGatewayId:
Ref: NatGateway
PrivateRouteTableAssociation1:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
SubnetId:
Ref: PrivateSubnet1
RouteTableId:
Ref: PrivateRouteTable
######################
## Security NACL
######################
NetworkAcl:
Type: AWS::EC2::NetworkAcl
Properties:
VpcId:
Ref: VPC
Tags:
- Key: Name
Value: reeves-lambda-nacl
NetworkAclEntryfn100:
Type: AWS::EC2::NetworkAclEntry
Properties:
CidrBlock: 0.0.0.0/0
Egress: 'false'
NetworkAclId:
Ref: NetworkAcl
Protocol: "-1"
RuleAction: allow
RuleNumber: "100"
NetworkAclEntryOutbound100:
Type: AWS::EC2::NetworkAclEntry
Properties:
CidrBlock: 0.0.0.0/0
Egress: 'true'
NetworkAclId:
Ref: NetworkAcl
Protocol: "-1"
RuleAction: allow
RuleNumber: "100"
PrivateSubnetNetworkAclAssociation1:
Type: AWS::EC2::SubnetNetworkAclAssociation
Properties:
SubnetId:
Ref: PrivateSubnet1
NetworkAclId:
Ref: NetworkAcl
######################
## Security Group(s)
######################
LambdaSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupName: reeves-lambda-sg
GroupDescription: reeves-lambda-sg
SecurityGroupIngress:
- IpProtocol: -1
CidrIp: 0.0.0.0/0
VpcId:
Ref: VPC
Tags:
- Key: Name
Value: reeves-lambda-sg