udagram-server.yml

Description: >
    Udagram Server/2022

Parameters:
  EnvironmentName:
      Description: An environment name that will be prefixed to resource names
      Type: String

Resources:
  # *** Udagram: Creating servers with required security groups ***
  # Create Role to access S3 bucket for downloading the application archive
  RoleForS3Access: 
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonS3FullAccess
  # Attach created S3 access Role to InstanceProfile
  ServerInstanceProfile: 
    Type: "AWS::IAM::InstanceProfile"
    Properties:
      Roles:
        - !Ref RoleForS3Access
  LBSecGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow http to our load balancer
      VpcId:
        Fn::ImportValue:
          !Sub "${EnvironmentName}-VPCID"
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 80
        ToPort: 80
        CidrIp: 0.0.0.0/0
      SecurityGroupEgress:
      - IpProtocol: tcp
        FromPort: 80
        ToPort: 80
        CidrIp: 0.0.0.0/0
  WebServerSecGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow http to our hosts and SSH from local only
      VpcId:
        Fn::ImportValue:
          !Sub "${EnvironmentName}-VPCID"
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 80
        ToPort: 80
        CidrIp: 0.0.0.0/0
      - IpProtocol: tcp
        FromPort: 22
        ToPort: 22
        CidrIp: 0.0.0.0/0
      SecurityGroupEgress:
      - IpProtocol: tcp
        FromPort: 0
        ToPort: 65535
        CidrIp: 0.0.0.0/0
  WebAppLaunchConfig:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      UserData:
       Fn::Base64: !Sub |
         #!/bin/bash
         apt-get update -y
         apt-get install apache2 -y
         systemctl start apache2.service
         cd /var/www/html
         echo "It works! Udagram, Udacity" > index.html
      ImageId: ami-0e472ba40eb589f49
      SecurityGroups:
      - Ref: WebServerSecGroup
      InstanceType: t3.medium
      IamInstanceProfile:
        !Ref ServerInstanceProfile
      BlockDeviceMappings:
      - DeviceName: "/dev/sdk"
        Ebs:
          VolumeSize: '10'
  WebAppGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      VPCZoneIdentifier:
      - Fn::ImportValue: 
          !Sub "${EnvironmentName}-PRIV-NETS"
      LaunchConfigurationName:
        Ref: WebAppLaunchConfig
      MinSize: '3'
      MaxSize: '5'
      TargetGroupARNs:
      - Ref: WebAppTargetGroup
  WebAppLB:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Subnets:
      - Fn::ImportValue: !Sub "${EnvironmentName}-PUB1-SN"
      - Fn::ImportValue: !Sub "${EnvironmentName}-PUB2-SN"
      SecurityGroups:
      - Ref: LBSecGroup
  Listener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
      - Type: forward
        TargetGroupArn:
          Ref: WebAppTargetGroup
      LoadBalancerArn:
        Ref: WebAppLB
      Port: '80'
      Protocol: HTTP
  ALBListenerRule:
      Type: AWS::ElasticLoadBalancingV2::ListenerRule
      Properties:
        Actions:
        - Type: forward
          TargetGroupArn: !Ref 'WebAppTargetGroup'
        Conditions:
        - Field: path-pattern
          Values: [/]
        ListenerArn: !Ref 'Listener'
        Priority: 1
  WebAppTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckIntervalSeconds: 10
      HealthCheckPath: /
      HealthCheckProtocol: HTTP
      HealthCheckTimeoutSeconds: 8
      HealthyThresholdCount: 2
      Port: 80
      Protocol: HTTP
      UnhealthyThresholdCount: 5
      VpcId:
        Fn::ImportValue:
          !Sub "${EnvironmentName}-VPCID"

Outputs:
  RoleForS3Acces:
    Description: Role for Full Access to S3 bucket
    Value: !Ref RoleForS3Access
    Export:
      Name: !Sub ${EnvironmentName}-S3AccessRole
  LoadBalancerSecurityGroup:
    Description: Security Group for Load Balancer
    Value: !Ref LBSecGroup
    Export:
      Name: !Sub ${EnvironmentName}-LB-SecGroup
  ServersSecurityGroup:
    Description: Secirity group for application servers
    Value: !Ref WebServerSecGroup
    Export:
      Name: !Sub ${EnvironmentName}-Server-SecGroup
  WebApplicaitonLoadBalancer:
    Description: Load Balancer of application
    Value: !Ref WebAppLB
    Export:
      Name: !Sub ${EnvironmentName}-LB
  LoadBalancerDNS:
    Description: 'DNS of Load Balancer'
    Value: !Join ["", ["http://", !GetAtt WebAppLB.DNSName]]