subnet-o7t-alpha.template.yaml

#
# Subnet creation for US-EAST-1
#
# NB: because the number of CIDRs associated with a prefixListId varies by region and because
# there is no way for CloudFormation to handle this variable number of ACL Rules, this script
# is region specific.
#

AWSTemplateFormatVersion: 2010-09-09
Description: 'Provides subnet configuration for an Openshift alpha environment with NACL rules (qs-1nb14cqcl).'
Metadata:
    AWS::CloudFormation::Interface:
        ParameterGroups:
          - Label:
                default: Subnet Configuration
            Parameters:
              - pVPCName
              - pClusterName
              - pPublicCIDR
              - pPrivateCIDR
        ParameterLabels:
            pClusterName:
                default: Cluster Name
            pPublicCIDR:
                default: Public Subnet CIDR
            pPrivateCIDR:
                default: Private Subnet CIDR

Parameters:
    pVPCName:
        Description: VPC Name
        Type: String
        Default: "o7t-alpha"
    pClusterName:
        Description: (a-z[a-z|0-9]*)
        Type: String
        Default: (your initials)
    pPublicCIDR:
        Description: CIDR block for Public Subnet
        Type: String
        Default: 10.250.0.0/24
    pPrivateCIDR:
        Description: CIDR block for Private Subnet
        Type: String
        Default: 10.250.1.0/24

Resources:
  rPublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
        AvailabilityZone:
          Fn::ImportValue: !Sub ${pVPCName}-az
        CidrBlock: !Ref pPublicCIDR
        MapPublicIpOnLaunch: true
        Tags:
          - Key: Name
            Value: !Sub ${pClusterName}-public
          - Key: StackName
            Value: !Ref AWS::StackName
          - Key: Cluster
            Value: !Ref pClusterName
        VpcId:
          Fn::ImportValue: !Sub ${pVPCName}-vpcid

  # the public subnet can use the public route table (with IGW)
  rPublicRouteAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    DependsOn: rPublicSubnet
    Properties:
      RouteTableId:
        Fn::ImportValue: !Sub ${pVPCName}-publicRT
      SubnetId: !Ref rPublicSubnet

  rPrivateSubnet:
    Type: AWS::EC2::Subnet
    Properties:
        AvailabilityZone:
          Fn::ImportValue: !Sub ${pVPCName}-az
        CidrBlock: !Ref pPrivateCIDR
        MapPublicIpOnLaunch: false
        Tags:
          - Key: Name
            Value: !Sub ${pClusterName}-private
          - Key: StackName
            Value: !Ref AWS::StackName
          - Key: Cluster
            Value: !Ref pClusterName
        VpcId:
          Fn::ImportValue: !Sub ${pVPCName}-vpcid

  # the private subnets can use the private route table
  rPrivateRouteAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    DependsOn: rPrivateSubnet
    Properties:
      RouteTableId:
        Fn::ImportValue: !Sub ${pVPCName}-privateRT
      SubnetId: !Ref rPrivateSubnet

  #
  # Network ACL Definition for the Public Subnet
  #

  rACL:
    Type: AWS::EC2::NetworkAcl
    Properties:
      VpcId:
        Fn::ImportValue: !Sub ${pVPCName}-vpcid
      Tags:
      - Key: Name
        Value: !Sub ${pClusterName}-pub
      - Key: Cluster
        Value: !Ref pClusterName

  rACLRule100:
    Type: "AWS::EC2::NetworkAclEntry"
    DependsOn: rACL
    Properties:
      CidrBlock: 170.40.0.0/16
      Egress: false
      NetworkAclId: !Ref rACL
      PortRange:
        From: 22
        To: 8443
      Protocol: 6
      RuleAction: allow
      RuleNumber: 100

  rACLRuleEgress100:
    Type: "AWS::EC2::NetworkAclEntry"
    DependsOn: rACL
    Properties:
      CidrBlock: 170.40.0.0/16
      Egress: true
      NetworkAclId: !Ref rACL
      PortRange:
        From: 32768
        To: 60999
      Protocol: 6
      RuleAction: allow
      RuleNumber: 100

  # for now, permit any internal traffic in/out thru the rACLPrivate and depend on security groups
  rACLRule200:
    Type: "AWS::EC2::NetworkAclEntry"
    DependsOn: rACL
    Properties:
      CidrBlock: !Ref pPrivateCIDR
      Egress: false
      NetworkAclId: !Ref rACL
      PortRange:
        From: 22
        To: 64000
      Protocol: -1
      RuleAction: allow
      RuleNumber: 200

  rACLRuleEgress200:
    Type: "AWS::EC2::NetworkAclEntry"
    DependsOn: rACL
    Properties:
      CidrBlock: !Ref pPrivateCIDR
      Egress: true
      NetworkAclId: !Ref rACL
      PortRange:
        From: 32768
        To: 60999
      Protocol: -1
      RuleAction: allow
      RuleNumber: 200

  rACLRule250:
    Type: "AWS::EC2::NetworkAclEntry"
    DependsOn: rACL
    Properties:
      CidrBlock:
        Fn::ImportValue: !Sub ${pVPCName}-mgmtCIDR
      Egress: false
      NetworkAclId: !Ref rACL
      PortRange:
        From: 22
        To: 64000
      Protocol: -1
      RuleAction: allow
      RuleNumber: 250

  rACLRuleEgress250:
    Type: "AWS::EC2::NetworkAclEntry"
    DependsOn: rACL
    Properties:
      CidrBlock:
        Fn::ImportValue: !Sub ${pVPCName}-mgmtCIDR
      Egress: true
      NetworkAclId: !Ref rACL
      PortRange:
        From: 32768
        To: 60999
      Protocol: -1
      RuleAction: allow
      RuleNumber: 250

  # these rules allow access to the s3 vpc endpoint and are specific to us-east-1
  rACLRule300:
    Type: "AWS::EC2::NetworkAclEntry"
    DependsOn: rACL
    Properties:
      CidrBlock: 54.231.0.0/17
      Egress: false
      NetworkAclId: !Ref rACL
      PortRange:
        From: 32768
        To: 60999
      Protocol: 6
      RuleAction: allow
      RuleNumber: 300

  rACLRuleEgress300:
    Type: "AWS::EC2::NetworkAclEntry"
    DependsOn: rACL
    Properties:
      CidrBlock: 54.231.0.0/17
      Egress: true
      NetworkAclId: !Ref rACL
      PortRange:
        From: 443
        To: 443
      Protocol: 6
      RuleAction: allow
      RuleNumber: 300

  rACLRule301:
    Type: "AWS::EC2::NetworkAclEntry"
    DependsOn: rACL
    Properties:
      CidrBlock: 52.216.0.0/15
      Egress: false
      NetworkAclId: !Ref rACL
      PortRange:
        From: 32768
        To: 60999
      Protocol: 6
      RuleAction: allow
      RuleNumber: 301

  rACLRuleEgress301:
    Type: "AWS::EC2::NetworkAclEntry"
    DependsOn: rACL
    Properties:
      CidrBlock: 52.216.0.0/15
      Egress: true
      NetworkAclId: !Ref rACL
      PortRange:
        From: 443
        To: 443
      Protocol: 6
      RuleAction: allow
      RuleNumber: 301

  rPublicSubnetACLAssociation:
    Type: "AWS::EC2::SubnetNetworkAclAssociation"
    DependsOn:
    - rACL
    - rPublicSubnet
    Properties:
      SubnetId: !Ref rPublicSubnet
      NetworkAclId: !Ref rACL

  #
  # Network ACL Definition for the Private Subnet
  #

  rACLPrivate:
    Type: AWS::EC2::NetworkAcl
    Properties:
      VpcId:
        Fn::ImportValue: !Sub ${pVPCName}-vpcid
      Tags:
      - Key: Name
        Value: !Sub ${pClusterName}-priv
      - Key: Cluster
        Value: !Ref pClusterName

  # for now, permit any internal traffic in/out thru the rACLPrivate and depend on security groups
  rACLPrivateRule100:
    Type: "AWS::EC2::NetworkAclEntry"
    DependsOn: rACLPrivate
    Properties:
      CidrBlock: !Ref pPublicCIDR
      Egress: false
      NetworkAclId: !Ref rACLPrivate
      PortRange:
        From: 22
        To: 64000
      Protocol: -1
      RuleAction: allow
      RuleNumber: 100

  rACLPrivateRuleEgress100:
    Type: "AWS::EC2::NetworkAclEntry"
    DependsOn: rACLPrivate
    Properties:
      CidrBlock: !Ref pPublicCIDR
      Egress: true
      NetworkAclId: !Ref rACLPrivate
      PortRange:
        From: 32768
        To: 60999
      Protocol: -1
      RuleAction: allow
      RuleNumber: 100

  rACLPrivateRule200:
    Type: "AWS::EC2::NetworkAclEntry"
    DependsOn: rACLPrivate
    Properties:
      CidrBlock:
        Fn::ImportValue: !Sub ${pVPCName}-mgmtCIDR
      Egress: false
      NetworkAclId: !Ref rACLPrivate
      PortRange:
        From: 22
        To: 64000
      Protocol: -1
      RuleAction: allow
      RuleNumber: 200

  rACLPrivateRuleEgress200:
    Type: "AWS::EC2::NetworkAclEntry"
    DependsOn: rACLPrivate
    Properties:
      CidrBlock:
        Fn::ImportValue: !Sub ${pVPCName}-mgmtCIDR
      Egress: true
      NetworkAclId: !Ref rACLPrivate
      PortRange:
        From: 0
        To: 64000
      Protocol: -1
      RuleAction: allow
      RuleNumber: 200

  # these rules allow access to the s3 vpc endpoint and are specific to us-east-1
  rACLPrivateRule300:
    Type: "AWS::EC2::NetworkAclEntry"
    DependsOn: rACLPrivate
    Properties:
      CidrBlock: 54.231.0.0/17
      Egress: false
      NetworkAclId: !Ref rACLPrivate
      PortRange:
        From: 32768
        To: 60999
      Protocol: 6
      RuleAction: allow
      RuleNumber: 300

  rACLPrivateRuleEgress300:
    Type: "AWS::EC2::NetworkAclEntry"
    DependsOn: rACLPrivate
    Properties:
      CidrBlock: 54.231.0.0/17
      Egress: true
      NetworkAclId: !Ref rACLPrivate
      PortRange:
        From: 443
        To: 443
      Protocol: 6
      RuleAction: allow
      RuleNumber: 300

  rACLPrivateRule301:
    Type: "AWS::EC2::NetworkAclEntry"
    DependsOn: rACLPrivate
    Properties:
      CidrBlock: 52.216.0.0/15
      Egress: false
      NetworkAclId: !Ref rACLPrivate
      PortRange:
        From: 32768
        To: 60999
      Protocol: 6
      RuleAction: allow
      RuleNumber: 301

  rACLPrivateRuleEgress301:
    Type: "AWS::EC2::NetworkAclEntry"
    DependsOn: rACLPrivate
    Properties:
      CidrBlock: 52.216.0.0/15
      Egress: true
      NetworkAclId: !Ref rACLPrivate
      PortRange:
        From: 443
        To: 443
      Protocol: 6
      RuleAction: allow
      RuleNumber: 301

  rPrivateSubnetACLAssociation:
    Type: "AWS::EC2::SubnetNetworkAclAssociation"
    DependsOn:
    - rACLPrivate
    - rPrivateSubnet
    Properties:
      SubnetId: !Ref rPrivateSubnet
      NetworkAclId: !Ref rACLPrivate

Outputs:
    rPublicSubnet:
        Value: !Ref rPublicSubnet
        Export:
          Name: !Sub ${pClusterName}-public-subnet
    rPrivateSubnet:
        Value: !Ref rPrivateSubnet
        Export:
          Name: !Sub ${pClusterName}-private-subnet