stack-template.json

{
    "AWSTemplateFormatVersion" : "2010-09-09",

    "Description" : "CloudFormation template for the Geoscience Australia Experimental Environment",

    "Parameters" : {
        "SystemName" : {
            "Description" : "Name of the new Experimental Environment",
            "Type" : "String",
            "MinLength": "1",
            "MaxLength": "64",
            "Default" :  "EXPERIMENTAL ENVIRONMENT",
            "AllowedPattern" : "[-_ a-zA-Z0-9]*",
            "ConstraintDescription" : "can contain only alphanumeric characters, spaces, dashes and underscores."
        },   

        "KeyPairName" : {
            "Description" : "Name of an existing EC2 KeyPair (find or create here: https://console.aws.amazon.com/ec2/v2/home#KeyPairs )",
            "Type" : "String",
            "MinLength": "1",
            "MaxLength": "64",
            "AllowedPattern" : "[-_ a-zA-Z0-9@]*",
            "ConstraintDescription" : "can contain only alphanumeric characters, spaces, dashes and underscores."
        },

        "ServerAccess" : {
            "Description" : "CIDR IP range allowed to login to the NAT instance",
            "Type" : "String",
            "MinLength": "9",
            "MaxLength": "18",
            "Default" : "0.0.0.0/0",
            "AllowedPattern" : "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})",
            "ConstraintDescription" : "must be a valid CIDR range of the form x.x.x.x/x."
        }
    },

    "Mappings" : {
        "SubnetConfig" : {
            "VPC"     : { "CIDR" : "10.0.0.0/16" },
            "Public"  : { "CIDR" : "10.0.0.0/24" },
            "Private" : { "CIDR" : "10.0.1.0/24" }
        },

        "NatRegionMap" : {
            "us-east-1"      : { "AMI" : "ami-184dc970" },
            "us-west-1"      : { "AMI" : "ami-a98396ec" },
            "us-west-2"      : { "AMI" : "ami-290f4119" },
            "eu-west-1"      : { "AMI" : "ami-14913f63" },
            "eu-central-1"   : { "AMI" : "ami-ae380eb3" },
            "sa-east-1"      : { "AMI" : "ami-8122969c" },
            "ap-southeast-1" : { "AMI" : "ami-6aa38238" },
            "ap-southeast-2" : { "AMI" : "ami-893f53b3" },
            "ap-northeast-1" : { "AMI" : "ami-27d6e626" }
        },

        "Naming" : {
            "InstanceValues" : {
                "Environment" : "Experimental"
            }
        }
    },

    "Resources" : {
        "VPC" : {
            "Type" : "AWS::EC2::VPC",
            "Properties" : {
                "CidrBlock" : { "Fn::FindInMap" : [ "SubnetConfig", "VPC", "CIDR" ]},
                "Tags" : [
                    { "Key" : "Application", "Value" : { "Ref" : "AWS::StackName" } },
                    { "Key" : "Network", "Value" : "Public" },
                    { "Key" : "Name", "Value" : { "Fn::Join" : [ "_", [ { "Ref" : "SystemName" },"VPC" ] ] }},   
                    { "Key" : "SystemName", "Value": { "Ref" : "SystemName" }  },
                    { "Key": "Environment", "Value": { "Fn::FindInMap" : [ "Naming", "InstanceValues", "Environment" ]}}
                ]
            }
        },

        "PublicSubnet" : {
            "DependsOn" : ["VPC"],
            "Type" : "AWS::EC2::Subnet",
            "Properties" : {
                "VpcId" : { "Ref" : "VPC" },
                "CidrBlock" : { "Fn::FindInMap" : [ "SubnetConfig", "Public", "CIDR" ]},
                "Tags" : [
                    { "Key" : "Application", "Value" : { "Ref" : "AWS::StackName" } },
                    { "Key" : "Network", "Value" : "Public" },
                    { "Key" : "Name", "Value" : { "Fn::Join" : [ "_", [ { "Ref" : "SystemName" }, "PUBLIC_SUBNET" ] ] }},  
                    { "Key" : "SystemName", "Value": { "Ref" : "SystemName" }  },
                    { "Key": "Environment", "Value": { "Fn::FindInMap" : [ "Naming", "InstanceValues", "Environment" ]}}
                ]
            }
        },

        "InternetGateway" : {
            "Type" : "AWS::EC2::InternetGateway",
            "Properties" : {
                "Tags" : [
                    { "Key" : "Name", "Value" : { "Fn::Join" : [ "_", [ { "Ref" : "SystemName" }, "INTERNET_GATEWAY" ] ] }},
                    { "Key" : "Application", "Value" : { "Ref" : "AWS::StackName" } },
                    { "Key" : "Network", "Value" : "Public" },
                    { "Key" : "SystemName", "Value": { "Ref" : "SystemName" }  },
                    { "Key": "Environment", "Value": { "Fn::FindInMap" : [ "Naming", "InstanceValues", "Environment" ]}}
                ]
            }
        },

        "GatewayToInternet" : {
            "DependsOn" : ["VPC", "InternetGateway"],
            "Type" : "AWS::EC2::VPCGatewayAttachment",
            "Properties" : {
                "VpcId" : { "Ref" : "VPC" },
                "InternetGatewayId" : { "Ref" : "InternetGateway" }
            }
        },

        "PublicRouteTable" : {
            "DependsOn" : ["VPC"],
            "Type" : "AWS::EC2::RouteTable",
            "Properties" : {
                "VpcId" : { "Ref" : "VPC" },
                "Tags" : [
                    { "Key" : "Name", "Value" : { "Fn::Join" : [ "_", [ { "Ref" : "SystemName" }, "PUBLIC_ROUTE_TABLE" ] ] }},
                    { "Key" : "Application", "Value" : { "Ref" : "AWS::StackName" } },
                    { "Key" : "Network", "Value" : "Public" },
                    { "Key" : "SystemName", "Value": { "Ref" : "SystemName" }  },
                    { "Key": "Environment", "Value": { "Fn::FindInMap" : [ "Naming", "InstanceValues", "Environment" ]}}
                ]
            }
        },

        "PublicRoute" : {
            "DependsOn" : ["PublicRouteTable", "InternetGateway"],
            "Type" : "AWS::EC2::Route",
            "Properties" : {
                "RouteTableId" : { "Ref" : "PublicRouteTable" },
                "DestinationCidrBlock" : "0.0.0.0/0",
                "GatewayId" : { "Ref" : "InternetGateway" }
            }
        },

        "PublicSubnetRouteTableAssociation" : {
            "DependsOn" : ["PublicSubnet", "PublicRouteTable"],
            "Type" : "AWS::EC2::SubnetRouteTableAssociation",
            "Properties" : {
                "SubnetId" : { "Ref" : "PublicSubnet" },
                "RouteTableId" : { "Ref" : "PublicRouteTable" }
            }
        },

        "PrivateSubnet" : {
            "DependsOn" : ["VPC"],
            "Type" : "AWS::EC2::Subnet",
            "Properties" : {
                "VpcId" : { "Ref" : "VPC" },
                "CidrBlock" : { "Fn::FindInMap" : [ "SubnetConfig", "Private", "CIDR" ]},
                "Tags" : [
                    { "Key" : "Application", "Value" : { "Ref" : "AWS::StackName" } },
                    { "Key" : "Network", "Value" : "Private" },
                    { "Key" : "Name", "Value" : { "Fn::Join" : [ "_", [ { "Ref" : "SystemName" }, "PRIVATE_SUBNET" ] ] }},
                    { "Key" : "SystemName", "Value": { "Ref" : "SystemName" }  },
                    { "Key" : "Environment", "Value": { "Fn::FindInMap" : [ "Naming", "InstanceValues", "Environment" ]}}
                ]
            }
        },

        "PrivateRouteTable" : {
            "DependsOn" : ["VPC"],
            "Type" : "AWS::EC2::RouteTable",
            "Properties" : {
                "VpcId" : { "Ref" : "VPC" },
                "Tags" : [
                    { "Key" : "Name", "Value" : { "Fn::Join" : [ "_", [ { "Ref" : "SystemName" }, "PRIVATE_ROUTE_TABLE" ] ] }},
                    { "Key" : "Application", "Value" : { "Ref" : "AWS::StackName" } },
                    { "Key" : "Network", "Value" : "Private" },
                    { "Key" : "SystemName", "Value": { "Ref" : "SystemName" }  },
                    { "Key" : "Environment", "Value": { "Fn::FindInMap" : [ "Naming", "InstanceValues", "Environment" ]}}
                ]
            }
        },

        "PrivateSubnetRouteTableAssociation" : {
            "DependsOn" : ["PrivateSubnet", "PrivateRouteTable"],
            "Type" : "AWS::EC2::SubnetRouteTableAssociation",
            "Properties" : {
                "SubnetId" : { "Ref" : "PrivateSubnet" },
                "RouteTableId" : { "Ref" : "PrivateRouteTable" }
            }
        },

        "NatSecurityGroup" : {
            "DependsOn" : ["VPC"],
            "Type" : "AWS::EC2::SecurityGroup",
            "Properties" : {
                "GroupDescription" : "External Access Security Group",
                "VpcId" : { "Ref" : "VPC" },
                "SecurityGroupIngress" : [{
                    "IpProtocol" : "tcp",
                    "FromPort" : "22",
                    "ToPort" : "22",
                    "CidrIp" : { "Ref" : "ServerAccess" }
                }],
                "Tags" : [
                    { "Key" : "Name", "Value" : { "Fn::Join" : [ "_", [ { "Ref" : "SystemName" }, "EXTERNAL_ACCESS_SECURITY_GROUP" ] ] }},
                    { "Key" : "SystemName", "Value": { "Ref" : "SystemName" }  },
                    { "Key": "Environment", "Value": { "Fn::FindInMap" : [ "Naming", "InstanceValues", "Environment" ]}}
                ]
            }
        },

        "NatSecurityGroupIngress1" : {
            "DependsOn" : ["NatSecurityGroup"],
            "Type": "AWS::EC2::SecurityGroupIngress",
            "Properties": {
                "GroupId": { "Ref": "NatSecurityGroup" },
                "IpProtocol": "icmp",
                "FromPort": "-1",
                "ToPort": "-1",
                "SourceSecurityGroupId": { "Ref": "NatSecurityGroup" }
            }
        },

        "NatSecurityGroupIngress22" : {
            "DependsOn" : ["NatSecurityGroup"],
            "Type": "AWS::EC2::SecurityGroupIngress",
            "Properties": {
                "GroupId": { "Ref": "NatSecurityGroup" },
                "IpProtocol": "tcp",
                "FromPort": "22",
                "ToPort": "22",
                "SourceSecurityGroupId": { "Ref": "NatSecurityGroup" }
            }
        },

        "NatSecurityGroupIngress80" : {
            "DependsOn" : ["NatSecurityGroup"],
            "Type": "AWS::EC2::SecurityGroupIngress",
            "Properties": {
                "GroupId": { "Ref": "NatSecurityGroup" },
                "IpProtocol": "tcp",
                "FromPort": "80",
                "ToPort": "80",
                "SourceSecurityGroupId": { "Ref": "NatSecurityGroup" }
            }
        },

        "NatSecurityGroupIngress443" : {
            "DependsOn" : ["NatSecurityGroup"],
            "Type": "AWS::EC2::SecurityGroupIngress",
            "Properties": {
                "GroupId": { "Ref": "NatSecurityGroup" },
                "IpProtocol": "tcp",
                "FromPort": "443",
                "ToPort": "443",
                "SourceSecurityGroupId": { "Ref": "NatSecurityGroup" }
            }
        },

        "NAT" : {
            "DependsOn" : ["PublicSubnet", "NatSecurityGroup"],
            "Type" : "AWS::EC2::Instance",
            "Properties" : {
                "InstanceType" : "t2.micro",
                "KeyName"  : { "Ref" : "KeyPairName" },
                "SourceDestCheck" : "false",
                "ImageId" : { "Fn::FindInMap" : [ "NatRegionMap", { "Ref" : "AWS::Region" }, "AMI" ]},
                "NetworkInterfaces" : [{
                    "GroupSet"                 : [{ "Ref" : "NatSecurityGroup" }],
                    "AssociatePublicIpAddress" : "true",
                    "DeviceIndex"              : "0",
                    "DeleteOnTermination"      : "true",
                    "SubnetId"                 : { "Ref" : "PublicSubnet" }
                }],
                "Tags" : [
                    { "Key" : "Name", "Value" : { "Fn::Join" : [ "_", [ { "Ref" : "SystemName" }, "NAT" ] ] }},  
                    { "Key" : "SystemName", "Value": { "Ref" : "SystemName" }  },
                    { "Key": "Environment", "Value": { "Fn::FindInMap" : [ "Naming", "InstanceValues", "Environment" ]}}
                ],
                "UserData" : { "Fn::Base64" : { "Fn::Join" : ["", [
                    "#!/bin/bash\n",
                    "yum update -y && yum install -y yum-cron && chkconfig yum-cron on"
                ]]}}
            }
        },

        "PrivateRoute" : {
            "DependsOn" : ["PrivateRouteTable", "NAT"],
            "Type" : "AWS::EC2::Route",
            "Properties" : {
                "RouteTableId" : { "Ref" : "PrivateRouteTable" },
                "DestinationCidrBlock" : "0.0.0.0/0",
                "InstanceId" : { "Ref" : "NAT" }
            }
        }
    },

    "Outputs" : {
        "NATIP" : {
            "Description" : "NAT IP address",
            "Value" : { "Fn::GetAtt" : [ "NAT", "PublicIp" ] }
        }
    }
}