stack.cf.yml

AWSTemplateFormatVersion: 2010-09-09
Description: WireGuard VPN server, inside its own VPC, with sensible networking defaults

Parameters:

  #TODO: Allow for use of a specific (Ubuntu) AMI instead of the preconfigured ones (use a condition)
  #AMIID:
  #  Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
  #  Type: String

  InstanceTypeParameter:
    Description: WireGuard server EC2 instance type
    Type: String
    Default: t3a.nano
    AllowedValues:
      - t2.nano
      - t2.micro
      - t3.nano
      - t3.micro
      - t3a.nano
      - t3a.micro
    ConstraintDescription: must be a valid EC2 instance type.

  KeyName: #TODO: remove the use of SSH?
    Description: Name of an existing EC2 KeyPair to enable SSH access to the instance
    Type: 'AWS::EC2::KeyPair::KeyName'
    ConstraintDescription: must be the name of an existing EC2 KeyPair.
  
  VPNDomainHostedZoneId:
    Description: Route53 zone
    Type: 'AWS::Route53::HostedZone::Id'
    ConstraintDescription: must be an existing Route53 hosted zone in the region of the server
  
  VPNServerDomainName:
    Description: Full domain name (FQDN) used by the server
    Type: String
    AllowedPattern: '((?=[a-z0-9-]{1,63}\.)([a-z0-9-]{1,63}\.)[a-z0-9]+(-[a-z0-9]+)*\.)+[a-z]{2,63}'
    ConstraintDescription: must be a valid domain name including the host part (e.g vpn.example.net)

  TunnelServerIP:
    Description: WireGuard server VPN tunnel IP address
    Type: String
    Default: 10.1.2.1
    AllowedPattern: '(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})'
    ConstraintDescription: must be a valid IP address in the form of x.x.x.x

  TunnelPeerIP:
    Description: WireGuard client VPN tunnel IP address
    Type: String
    Default: 10.1.2.2
    AllowedPattern: '(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})'
    ConstraintDescription: must be a valid IP address in the form of x.x.x.x

  WireGuardPort:
    Description: WireGuard port
    Type: Number
    Default: 51820
    MinValue: 1024
    MaxValue: 65535
    ConstraintDescription: must be a valid port (1024-65535)

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      -
        Label:
          default: "Instance Configuration"
        Parameters:
          - InstanceTypeParameter
          - KeyName #TODO: remove the use of SSH?
          - VPNDomainHostedZoneId
          - VPNServerDomainName
      -
        Label:
          default: "WireGuard Configuration"
        Parameters:
          - WireGuardPort
          - TunnelServerIP
          - TunnelPeerIP
  
    ParameterLabels: 
      InstanceTypeParameter: 
        default: "Instance Type"
      VPNDomainHostedZoneId: 
        default: "Domain Hosted Zone"
      VPNServerDomainName: 
        default: "Server domain name"

Mappings:
  AWSRegionArch2AMI: #Id of the official Ubuntu Focal Fossa 20.04 AMI
    us-east-1:
      HVM64: ami-068663a3c619dd892
    us-west-2:
      HVM64: ami-09dd2e08d601bff67
    us-west-1:
      HVM64: ami-075fd582acf0c0128
    eu-west-1:
      HVM64: ami-0dad359ff462124ca
    eu-west-2:
      HVM64: ami-0917237b4e71c5759
    eu-west-3:
      HVM64: ami-0e60c6afa19d896ee
    eu-central-1:
      HVM64: ami-05c26ae4789875080
    eu-north-1:
      HVM64: ami-0d4e2b57f569e9daa

Resources:

  wgVPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.1.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: false
      InstanceTenancy: default
      Tags:
        - Key: Name
          Value: !Ref AWS::StackName

  wgInternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: !Ref AWS::StackName

  wgVPCGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    DependsOn:
      - wgVPC
      - wgInternetGateway
    Properties:
      VpcId: !Ref wgVPC
      InternetGatewayId: !Ref wgInternetGateway

  wgRouteTable:
    Type: AWS::EC2::RouteTable
    DependsOn:
      - wgVPC
    Properties:
      VpcId: !Ref wgVPC
      Tags:
        - Key: Name
          Value: !Ref AWS::StackName

  wgRoute:
    Type: AWS::EC2::Route
    DependsOn:
      - wgInternetGateway
      - wgRouteTable
      - wgVPCGatewayAttachment
    Properties:
      RouteTableId: !Ref wgRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref wgInternetGateway

  wgSubnet:
    Type: AWS::EC2::Subnet
    DependsOn:
      - wgVPC
    Properties:
      CidrBlock: 10.1.1.0/28
      MapPublicIpOnLaunch: true
      VpcId: !Ref wgVPC
      Tags:
        - Key: Name
          Value: !Ref AWS::StackName

  wgSubnetRouteTableAssociation:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    DependsOn:
      - wgRouteTable
      - wgSubnet
      - wgRoute
    Properties:
      RouteTableId: !Ref wgRouteTable
      SubnetId: !Ref wgSubnet


  wgSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    DependsOn:
      - wgVPC
    Properties:
      VpcId: !Ref wgVPC
      GroupDescription: Wireguard Security Group
      SecurityGroupEgress:
        - IpProtocol: -1
          CidrIp: 0.0.0.0/0
      SecurityGroupIngress:
        - IpProtocol: udp
          FromPort: !Ref WireGuardPort
          ToPort: !Ref WireGuardPort
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp #TODO: remove the use of SSH?
          FromPort: '22'
          ToPort: '22'
          CidrIp: 0.0.0.0/0
      Tags:
        - Key: Name
          Value: !Ref AWS::StackName

  wgEC2Instance:
    Type: AWS::EC2::Instance
    DependsOn:
      - wgSubnetRouteTableAssociation
      - wgSecurityGroup
    Metadata:
      'AWS::CloudFormation::Init':
        configSets:
          Install:
            - Install
        Install:
          packages:
            apt:
              wireguard: []

    Properties:
      InstanceType:
        Ref: InstanceTypeParameter
      BlockDeviceMappings:
        - DeviceName: /dev/sda1
          Ebs:
            DeleteOnTermination: true
            VolumeSize: 8
            Encrypted: true
      InstanceInitiatedShutdownBehavior: terminate
      SecurityGroupIds:
        - Ref: wgSecurityGroup
      ImageId: !FindInMap 
        - AWSRegionArch2AMI
        - !Ref 'AWS::Region'
        - HVM64
      SubnetId: !Ref wgSubnet
      KeyName: !Ref KeyName #TODO: remove the use of SSH?
      Tags:
        - Key: Name
          Value: !Ref AWS::StackName
      UserData:
        Fn::Base64:
          !Sub |
            #!/bin/bash
            set -euxo pipefail
            apt-get update && apt-get upgrade -y

            mkdir -p /tmp/aws-cfn-bootstrap-latest
            curl https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-latest.tar.gz | tar xzv -C /tmp/aws-cfn-bootstrap-latest --strip-components 1
            cd /tmp/aws-cfn-bootstrap-latest
            # cfn-bootstrap not compatible with python3
            # hack based on https://github.com/aws-cloudformation/aws-cloudformation-coverage-roadmap/issues/151#issuecomment-619835104
            apt-get install -y python2 python-setuptools
            python2 setup.py install
            # replace shebang to specify python2
            sed -i "s~/usr/bin/env python~/usr/bin/env python2~" /usr/local/bin/cfn-*

            /usr/local/bin/cfn-init -v --stack ${AWS::StackName} --resource wgEC2Instance --configsets Install --region ${AWS::Region}
            /usr/local/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource wgEC2Instance --region ${AWS::Region}
    CreationPolicy:
      ResourceSignal:
        Timeout: PT5M

  wgDNSRecord:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneId: !Ref VPNDomainHostedZoneId
      Comment: !Ref AWS::StackName
      Name: !Ref VPNServerDomainName
      TTL: 300
      Type: A
      ResourceRecords:
        - !GetAtt wgEC2Instance.PublicIp

Outputs:
  wgServerIP:
    Description: Public IP address of the WireGuard VPN server
    Value: !GetAtt wgEC2Instance.PublicIp
    Export:
      Name: !Sub "${AWS::StackName}-PublicIP"
  wgServerDomainName:
    Description: FQDN of the WireGuard VPN server
    Value: !Ref wgDNSRecord
    Export:
      Name: !Sub "${AWS::StackName}-DomainName"