template.yaml

Description:  Deploys a VPC, with a public and private subnet in on AZ,
  along with an IG, NAT, Route Tables, VPCEndpoints

Parameters:
  ProjectName:
    Type: String
    Description: Name of the project these resources belongs to
    Default: data-derp
  ModuleName:
    Type: String
    Description: Name of the module these resources belongs to
    Default: base
  VpcCIDR:
    Description: Please enter the IP range (CIDR notation) for this VPC
    Type: String
    Default: 10.11.0.0/16
  PublicSubnetCIDR:
    Description: Please enter the IP range (CIDR notation) for the public subnet in the first Availability Zone
    Type: String
    Default: 10.11.1.0/24
  PrivateSubnetCIDR:
    Description: Please enter the IP range (CIDR notation) for the private subnet in the first Availability Zone
    Type: String
    Default: 10.11.9.0/24
  GithubRepoUrl:
    Type: String
    Description: The Url of the Github repo (https://github.com/user/repo)
  InstanceType:
    Type: String
    Default: "t3.small"
    Description: Instance Type of the Github Runner EC2 Instance
  VolumeSize:
    Type: String
    Default: "8"
    Description: Volume Size of the Github Runner EBS Volume
  LatestAmiId:
    Description: Region specific image from the Parameter Store
    Type: 'AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>'
    Default: '/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2'

Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCIDR
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: !Sub "${ProjectName}-${ModuleName}-githubrunner"

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: !Sub "${ProjectName}-${ModuleName}-githubrunner"

  InternetGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref VPC

  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 0, !GetAZs '' ]
      CidrBlock: !Ref PublicSubnetCIDR
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub "${ProjectName} ${ModuleName} GithubRunner Public Subnet"

  PrivateSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 0, !GetAZs  '' ]
      CidrBlock: !Ref PrivateSubnetCIDR
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub "${ProjectName} ${ModuleName} GithubRunner Private Subnet"

  NatGateway1EIP:
    Type: AWS::EC2::EIP
    DependsOn: InternetGatewayAttachment
    Properties:
      Domain: vpc

  NatGateway1:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt NatGateway1EIP.AllocationId
      SubnetId: !Ref PublicSubnet

  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub "${ProjectName} ${ModuleName} GithubRunner Public Routes"

  DefaultPublicRoute:
    Type: AWS::EC2::Route
    DependsOn: InternetGatewayAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  PublicSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref PublicSubnet

  PrivateRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub "${ProjectName} ${ModuleName} GithubRunner Private Routes"

  DefaultPrivateRoute1:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway1

  PrivateSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateRouteTable
      SubnetId: !Ref PrivateSubnet

  NoIngressSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Sub "${ProjectName}${ModuleName}NoIngress"
      GroupDescription: "Security group with no ingress rules"
      VpcId: !Ref VPC

  S3VPCEndpoint:
    Type: 'AWS::EC2::VPCEndpoint'
    Properties:
      RouteTableIds:
        - !Ref PrivateRouteTable
      ServiceName:
        'Fn::Sub': 'com.amazonaws.${AWS::Region}.s3'
      VpcId: !Ref VPC

  VPCEndpointSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Sub "${ProjectName}${ModuleName}VpcEndpoints"
      GroupDescription: "Security group for VPC Endpoints"
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: !Ref PrivateSubnetCIDR

  CloudwatchVPCEndpoint:
    Type: 'AWS::EC2::VPCEndpoint'
    Properties:
      ServiceName:
        'Fn::Sub': 'com.amazonaws.${AWS::Region}.monitoring'
      VpcId: !Ref VPC
      VpcEndpointType: "Interface"
      PrivateDnsEnabled: true
      SecurityGroupIds:
        - !GetAtt VPCEndpointSecurityGroup.GroupId
      SubnetIds:
        - !Ref PrivateSubnet

  LogsVPCEndpoint:
    Type: 'AWS::EC2::VPCEndpoint'
    Properties:
      ServiceName:
        'Fn::Sub': 'com.amazonaws.${AWS::Region}.logs'
      VpcId: !Ref VPC
      VpcEndpointType: "Interface"
      PrivateDnsEnabled: true
      SecurityGroupIds:
        - !GetAtt VPCEndpointSecurityGroup.GroupId
      SubnetIds:
        - !Ref PrivateSubnet

  SSMVPCEndpoint:
    Type: 'AWS::EC2::VPCEndpoint'
    Properties:
      ServiceName:
        'Fn::Sub': 'com.amazonaws.${AWS::Region}.ssm'
      VpcId: !Ref VPC
      VpcEndpointType: "Interface"
      PrivateDnsEnabled: true
      SecurityGroupIds:
        - !GetAtt VPCEndpointSecurityGroup.GroupId
      SubnetIds:
        - !Ref PrivateSubnet

  SSMMessagesVPCEndpoint:
    Type: 'AWS::EC2::VPCEndpoint'
    Properties:
      ServiceName:
        'Fn::Sub': 'com.amazonaws.${AWS::Region}.ssmmessages'
      VpcId: !Ref VPC
      VpcEndpointType: "Interface"
      PrivateDnsEnabled: true
      SecurityGroupIds:
        - !GetAtt VPCEndpointSecurityGroup.GroupId
      SubnetIds:
        - !Ref PrivateSubnet

  CloudTrailVPCEndpoint:
    Type: 'AWS::EC2::VPCEndpoint'
    Properties:
      ServiceName:
        'Fn::Sub': 'com.amazonaws.${AWS::Region}.cloudtrail'
      VpcId: !Ref VPC
      VpcEndpointType: "Interface"
      PrivateDnsEnabled: true
      SecurityGroupIds:
        - !GetAtt VPCEndpointSecurityGroup.GroupId
      SubnetIds:
        - !Ref PrivateSubnet

  EC2VPCEndpoint:
    Type: 'AWS::EC2::VPCEndpoint'
    Properties:
      ServiceName:
        'Fn::Sub': 'com.amazonaws.${AWS::Region}.ec2'
      VpcId: !Ref VPC
      VpcEndpointType: "Interface"
      PrivateDnsEnabled: true
      SecurityGroupIds:
        - !GetAtt VPCEndpointSecurityGroup.GroupId
      SubnetIds:
        - !Ref PrivateSubnet

  EC2MessagesVPCEndpoint:
    Type: 'AWS::EC2::VPCEndpoint'
    Properties:
      ServiceName:
        'Fn::Sub': 'com.amazonaws.${AWS::Region}.ec2messages'
      VpcId: !Ref VPC
      VpcEndpointType: "Interface"
      PrivateDnsEnabled: true
      SecurityGroupIds:
        - !GetAtt VPCEndpointSecurityGroup.GroupId
      SubnetIds:
        - !Ref PrivateSubnet


  VPCFlowLogsRole:
    Type: AWS::IAM::Role
    Properties:
      Tags:
        - Key: Project
          Value: !Ref ProjectName
      AssumeRolePolicyDocument:
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Sid": "",
              "Effect": "Allow",
              "Principal": {
                "Service": "vpc-flow-logs.amazonaws.com"
              },
              "Action": "sts:AssumeRole"
            }
          ]
        }
      Policies:
        - PolicyName: write-to-vpc-logs
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - "logs:CreateLogGroup"
                  - "logs:CreateLogStream"
                  - "logs:PutLogEvents"
                  - "logs:DescribeLogGroups"
                  - "logs:DescribeLogStreams"
                Resource:
                  - "*"

  VPCFlowLogs:
    Type: AWS::EC2::FlowLog
    Properties:
      DeliverLogsPermissionArn: !GetAtt VPCFlowLogsRole.Arn
      LogGroupName: VPCFlowLogs
      LogFormat: '${version} ${vpc-id} ${subnet-id} ${instance-id} ${interface-id} ${account-id} ${type} ${srcaddr} ${dstaddr} ${srcport} ${dstport} ${pkt-srcaddr} ${pkt-dstaddr} ${protocol} ${bytes} ${packets} ${start} ${end} ${action} ${tcp-flags} ${log-status}'
      ResourceId: !Ref VPC
      ResourceType: VPC
      TrafficType: ALL
      Tags:
        - Key: Name
          Value: !Ref ProjectName

  AutoscalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      MinSize: '1'
      MaxSize: '1'
      DesiredCapacity: '1'
      HealthCheckGracePeriod: 300
      HealthCheckType: "EC2"
      LaunchConfigurationName: !Ref LaunchConfiguration
      VPCZoneIdentifier: [ !Ref PrivateSubnet ]
      Tags:
        - Key: Name
          Value: !Sub "${ProjectName}-${ModuleName}"
          PropagateAtLaunch: true
        - Key: Project
          Value: !Ref ProjectName
          PropagateAtLaunch: true
        - Key: Module
          Value: !Ref ModuleName
          PropagateAtLaunch: true
    UpdatePolicy:
      AutoScalingReplacingUpdate:
        WillReplace: true
      AutoScalingRollingUpdate:
        WaitOnResourceSignals: true
  LaunchConfiguration:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      ImageId: !Ref LatestAmiId
      SecurityGroups:
        - !Ref RunnerSecurityGroup
      InstanceType: !Ref InstanceType
      IamInstanceProfile: !Ref InstanceProfile
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            VolumeSize: !Ref VolumeSize
            VolumeType: "gp2"
            DeleteOnTermination: true
            Encrypted: true
      UserData:
        Fn::Base64:
          !Sub |
          #!/bin/bash
          set -ex

          sudo yum install -y git

          sudo yum install -y perl-Switch perl-DateTime perl-Sys-Syslog perl-LWP-Protocol-https perl-Digest-SHA.x86_64
          curl -o ~/CloudWatchMonitoringScripts-1.2.2.zip https://aws-cloudwatch.s3.amazonaws.com/downloads/CloudWatchMonitoringScripts-1.2.2.zip
          unzip ~/CloudWatchMonitoringScripts-1.2.2.zip -d ~ && rm -f ~/CloudWatchMonitoringScripts-1.2.2.zip
          (crontab -l || true; echo "*/2 * * * * ~/aws-scripts-mon/mon-put-instance-data.pl --mem-used-incl-cache-buff --mem-util --mem-used --mem-avail --disk-space-used --disk-space-avail --disk-space-util --disk-path=/ --from-cron") | crontab -

          sudo amazon-linux-extras enable docker
          sudo yum install -y docker jq
          sudo service docker start

          mkdir actions-runner && cd actions-runner
          curl -o actions-runner-linux-x64-2.277.1.tar.gz -L https://github.com/actions/runner/releases/download/v2.277.1/actions-runner-linux-x64-2.277.1.tar.gz
          tar xzf ./actions-runner-linux-x64-2.277.1.tar.gz

          get-token() {
              key="/${ProjectName}/${ModuleName}/github-runner-reg-token"
              aws ssm get-parameters --name ${!key} --region ${AWS::Region} --with-decryption | jq -r .Parameters[0].Value
          }

          set +x
          token=$(get-token)

          if [ "${!token}" == "null" ]; then
              echo "Registration Token not available in Parameter Store. Exiting"
              exit 1
          fi

          RUNNER_ALLOW_RUNASROOT=1 ./config.sh --url ${GithubRepoUrl} --token "${!token}" --unattended
          RUNNER_ALLOW_RUNASROOT=1 ./run.sh
          set -x


  RunnerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Sub "${ProjectName}${ModuleName}GithubRunner"
      GroupDescription: !Sub "${ProjectName} ${ModuleName} Security group Github Runner"
      VpcId: !Ref VPC

  EgressToVPCEndpoints:
    Type: AWS::EC2::SecurityGroupEgress
    Properties:
      IpProtocol: tcp
      FromPort: 443
      ToPort: 443
      GroupId: !Ref RunnerSecurityGroup
      DestinationSecurityGroupId: !GetAtt VPCEndpointSecurityGroup.GroupId

  Egress80:
    Type: AWS::EC2::SecurityGroupEgress
    Properties:
      IpProtocol: tcp
      FromPort: 80
      ToPort: 80
      GroupId: !Ref RunnerSecurityGroup
      CidrIp: "0.0.0.0/0"

  Egress443:
    Type: AWS::EC2::SecurityGroupEgress
    Properties:
      IpProtocol: tcp
      FromPort: 443
      ToPort: 443
      GroupId: !Ref RunnerSecurityGroup
      CidrIp: "0.0.0.0/0"
  InstanceRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${ProjectName}-${ModuleName}-github-runner"
      Tags:
        - Key: Module
          Value: !Ref ModuleName
        - Key: Project
          Value: !Ref ProjectName
      AssumeRolePolicyDocument:
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Sid": "",
              "Effect": "Allow",
              "Principal": {
                "Service": "ec2.amazonaws.com"
              },
              "Action": "sts:AssumeRole"
            }
          ]
        }
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
      Policies:
        - PolicyName: !Sub "${ProjectName}-${ModuleName}-get-parameter"
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - "ssm:GetParameters"
                Resource:
                  - !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${ProjectName}/${ModuleName}/github-runner-reg-token"
              - Effect: Allow
                Action:
                  - "kms:Decrypt"
                  - "kms:GenerateDataKey"
                Resource:
                  - !Sub "arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/alias/aws/ssm"
        - PolicyName: !Sub "${ProjectName}-${ModuleName}-put-cloudwatch-metrics"
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - "cloudwatch:PutMetricData"
                  - "cloudwatch:GetMetricStatistics"
                  - "cloudwatch:ListMetrics"
                Resource:
                  - "*"
              - Effect: Allow
                Action:
                  - "ec2:DescribeTags"
                Resource:
                  - "*"
                Condition:
                  StringEquals:
                    ec2:ResourceTag/Name: !Sub "${ProjectName}-${ModuleName}"

  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - !Ref InstanceRole
  Boundary:
    Type: AWS::IAM::ManagedPolicy
    #    DeletionPolicy: Retain
    Properties:
      ManagedPolicyName: !Sub "${ProjectName}-${ModuleName}-delegated-boundary"
      Path: !Sub "/${ProjectName}-${ModuleName}/"
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            NotAction:
              - "iam:*"
              - "organizations:*"
              - "account:*"
              - "billing:*"
            Resource:
              - "*"
          - Effect: Allow
            Action:
              - "iam:PassRole"
            Resource:
              - "*"
            Condition:
              ForAnyValue:StringLike:
                iam:PassedToService: "ecs-tasks.amazonaws.com"
  Role:
    Type: AWS::IAM::Role
    #    DeletionPolicy: Retain
    Properties:
      RoleName: !Sub "${ProjectName}-${ModuleName}-github-runner-aws"
      Tags:
        - Key: Module
          Value: !Ref ModuleName
        - Key: Project
          Value: !Ref ProjectName
      AssumeRolePolicyDocument:
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Sid": "",
              "Effect": "Allow",
              "Principal": {
                "AWS": !GetAtt InstanceRole.Arn
              },
              "Action": "sts:AssumeRole"
            }
          ]
        }
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/PowerUserAccess"
      Policies:
        - PolicyName: !Sub "${ProjectName}${ModuleName}DenyInPath"
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Deny
                Action:
                  - "*"
                Resource:
                  - !Sub "arn:aws:iam::*:group/${ProjectName}-${ModuleName}/*"
                  - !Sub "arn:aws:iam::*:instance-profile/${ProjectName}-${ModuleName}/*"
                  - !Sub "arn:aws:iam::*:policy/${ProjectName}-${ModuleName}/*"
                  - !Sub "arn:aws:iam::*:role/${ProjectName}-${ModuleName}/*"
                  - !Sub "arn:aws:iam::*:user/${ProjectName}-${ModuleName}/*"
        - PolicyName: !Sub "${ProjectName}${ModuleName}AllowManagingRolesWithBoundary"
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - "iam:AttachRolePolicy"
                  - "iam:CreateRole"
                  - "iam:DeleteRolePolicy"
                  - "iam:DetachRolePolicy"
                  - "iam:PutRolePermissionsBoundary"
                  - "iam:DeleteRolePermissionsBoundary"
                  - "iam:PutRolePolicy"
                Resource:
                  - "*"
                Condition:
                  ForAnyValue:StringEquals:
                    iam:PermissionsBoundary: !Ref Boundary
              - Effect: Allow
                Action:
                  - "iam:AttachUserPolicy"
                  - "iam:CreateUser"
                  - "iam:DetachUserPolicy"
                  - "iam:PutUserPermissionsBoundary"
                  - "iam:PutUserPolicy"
                Resource:
                  - "*"
                Condition:
                  ForAnyValue:StringEquals:
                    iam:PermissionsBoundary: !Ref Boundary
              - Effect: Allow
                Action:
                  - "iam:DeleteRole"
                  - "iam:GetRole"
                  - "iam:GetRolePolicy"
                  - "iam:ListAttachedRolePolicies"
                  - "iam:ListInstanceProfilesForRole"
                  - "iam:ListRolePolicies"
                  - "iam:ListRoleTags"
                  - "iam:ListRoles"
                  - "iam:PassRole"
                  - "iam:TagRole"
                  - "iam:UntagRole"
                  - "iam:UpdateAssumeRolePolicy"
                  - "iam:UpdateRole"
                  - "iam:UpdateRoleDescription"
                Resource:
                  - "*"
              - Effect: Allow
                Action:
                  - "iam:AddUserToGroup"
                  - "iam:CreateAccessKey"
                  - "iam:DeleteAccessKey"
                  - "iam:DeleteUser"
                  - "iam:GetUser"
                  - "iam:GetUserPolicy"
                  - "iam:ListAccessKeys"
                  - "iam:ListAttachedUserPolicies"
                  - "iam:ListGroupsForUser"
                  - "iam:ListUsers"
                  - "iam:ListUserPolicies"
                  - "iam:TagUser"
                  - "iam:UntagUser"
                Resource:
                  - "*"
              - Effect: Allow
                Action:
                  - "iam:CreatePolicy"
                  - "iam:CreatePolicyVersion"
                  - "iam:DeletePolicy"
                  - "iam:DeletePolicyVersion"
                  - "iam:GetPolicy"
                  - "iam:GetPolicyVersion"
                  - "iam:ListEntitiesForPolicy"
                  - "iam:ListPolicies"
                  - "iam:ListPolicyVersions"
                  - "iam:SetDefaultPolicyVersion"
                Resource:
                  - "*"
              - Effect: Allow
                Action:
                  - "iam:AddRoleToInstanceProfile"
                  - "iam:CreateInstanceProfile"
                  - "iam:DeleteInstanceProfile"
                  - "iam:GetInstanceProfile"
                  - "iam:ListInstanceProfiles"
                  - "iam:RemoveRoleFromInstanceProfile"
                  - "iam:GetServiceLinkedRoleDeletionStatus"
                Resource:
                  - "*"