apache.yaml

AWSTemplateFormatVersion: '2010-09-09'

Description: >
  Apache VPC with a bastion host, auto scaling group, and a load balancer.

Metadata:

  Authors:
    Description: Mark Richman (mark@linuxacademy.com)
  License:
    Description: Copyright 2019 Linux Academy. All Rights Reserved.

Parameters:
  LatestAmiId:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Description: Latest Amazon Linux 2 AMI ID
    Default: /aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2
  KeyName:
    Type: String
    Description: Optional key pair of the ec2-user to establish a SSH connection to the EC2 instances
    Default: ''

Conditions:
  HasKeyName: !Not [!Equals [!Ref KeyName, '']]

Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.99.0.0/16
      EnableDnsHostnames: true
      EnableDnsSupport: true
      Tags:
        - Key: Name
          Value: ApacheVPC

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties: {}

  VPCGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref 'InternetGateway'

  DMZ1public:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Select
        - '0'
        - !GetAZs ''
      CidrBlock: 10.99.1.0/24
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: DMZ1public

  DMZ2public:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Select
        - '1'
        - !GetAZs ''
      CidrBlock: 10.99.2.0/24
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: DMZ2public

  AppLayer1private:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Select
        - '0'
        - !GetAZs ''
      CidrBlock: 10.99.11.0/24
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: AppLayer1private

  AppLayer2private:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Select
        - '1'
        - !GetAZs ''
      CidrBlock: 10.99.12.0/24
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: AppLayer2private

  PublicRT:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: PublicRT

  RouteTableAssociationA:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref 'DMZ1public'
      RouteTableId: !Ref 'PublicRT'

  RouteTableAssociationB:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref 'DMZ2public'
      RouteTableId: !Ref 'PublicRT'

  RoutePublicNATToInternet:
    Type: AWS::EC2::Route
    DependsOn: VPCGatewayAttachment
    Properties:
      RouteTableId: !Ref 'PublicRT'
      DestinationCidrBlock: '0.0.0.0/0'
      GatewayId: !Ref 'InternetGateway'

  NATElasticIP:
    Type: AWS::EC2::EIP
    DependsOn: VPCGatewayAttachment
    Properties:
      Domain: vpc

  NATGateway:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt 'NATElasticIP.AllocationId'
      SubnetId: !Ref 'DMZ2public'
      Tags:
      - Key: Name
        Value: !Sub '${AWS::StackName}-NATGateway'

  NATGatewayRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref 'PrivateRT'
      DestinationCidrBlock: '0.0.0.0/0'
      NatGatewayId: !Ref 'NATGateway'

  PrivateRT:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: PrivateRT

  RouteTableAssociationC:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref 'AppLayer1private'
      RouteTableId: !Ref 'PrivateRT'

  RouteTableAssociationD:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref 'AppLayer2private'
      RouteTableId: !Ref 'PrivateRT'

  DMZNACL:
    Type: AWS::EC2::NetworkAcl
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: DMZNACL

  SubnetNetworkAclAssociationA:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    Properties:
      SubnetId: !Ref 'DMZ1public'
      NetworkAclId: !Ref 'DMZNACL'

  SubnetNetworkAclAssociationB:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    Properties:
      SubnetId: !Ref 'DMZ2public'
      NetworkAclId: !Ref 'DMZNACL'

  DMZNACLEntryIngress100:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: !Ref 'DMZNACL'
      RuleNumber: 100
      Protocol: 6
      PortRange:
        From: 22
        To: 22
      RuleAction: allow
      Egress: false
      CidrBlock: '0.0.0.0/0'

  DMZNACLEntryIngress110:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: !Ref 'DMZNACL'
      RuleNumber: 110
      Protocol: 6
      PortRange:
        From: 80
        To: 80
      RuleAction: allow
      Egress: false
      CidrBlock: '0.0.0.0/0'

  DMZNACLEntryIngress120:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: !Ref DMZNACL
      RuleNumber: 120
      Protocol: 6
      PortRange:
        From: 443
        To: 443
      RuleAction: allow
      Egress: false
      CidrBlock: '0.0.0.0/0'

  DMZNACLEntryIngress130:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: !Ref DMZNACL
      RuleNumber: 130
      Protocol: 6
      PortRange:
        From: 1024
        To: 65535
      RuleAction: allow
      Egress: false
      CidrBlock: '0.0.0.0/0'

  DMZNACLEntryEgress100:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: !Ref DMZNACL
      RuleNumber: 100
      Protocol: 6
      PortRange:
        From: 22
        To: 22
      RuleAction: allow
      Egress: true
      CidrBlock: '0.0.0.0/0'

  DMZNACLEntryEgress110:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: !Ref 'DMZNACL'
      RuleNumber: 110
      Protocol: 6
      PortRange:
        From: 80
        To: 80
      RuleAction: allow
      Egress: true
      CidrBlock: '0.0.0.0/0'

  DMZNACLEntryEgress120:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: !Ref DMZNACL
      RuleNumber: 120
      Protocol: 6
      PortRange:
        From: 443
        To: 443
      RuleAction: allow
      Egress: true
      CidrBlock: '0.0.0.0/0'

  DMZNACLEntryEgress130:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: !Ref DMZNACL
      RuleNumber: 130
      Protocol: 6
      PortRange:
        From: 1024
        To: 65535
      RuleAction: allow
      Egress: true
      CidrBlock: '0.0.0.0/0'

  AppNACL:
    Type: AWS::EC2::NetworkAcl
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: AppNACL

  SubnetNetworkAclAssociationC:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    Properties:
      SubnetId: !Ref 'AppLayer1private'
      NetworkAclId: !Ref 'AppNACL'

  SubnetNetworkAclAssociationD:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    Properties:
      SubnetId: !Ref 'AppLayer2private'
      NetworkAclId: !Ref 'AppNACL'

  AppNACLEntryIngress100:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: !Ref AppNACL
      RuleNumber: 100
      Protocol: 6
      PortRange:
        From: 22
        To: 22
      RuleAction: allow
      Egress: false
      CidrBlock: 10.99.0.0/16

  AppNACLEntryIngress110:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: !Ref 'AppNACL'
      RuleNumber: 110
      Protocol: 6
      PortRange:
        From: 80
        To: 80
      RuleAction: allow
      Egress: false
      CidrBlock: 10.99.0.0/16

  AppNACLEntryIngress120:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: !Ref 'AppNACL'
      RuleNumber: 120
      Protocol: 6
      PortRange:
        From: 443
        To: 443
      RuleAction: allow
      Egress: false
      CidrBlock: 10.99.0.0/16

  AppNACLEntryIngress130:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: !Ref AppNACL
      RuleNumber: 130
      Protocol: 6
      PortRange:
        From: 1024
        To: 65535
      RuleAction: allow
      Egress: false
      CidrBlock: '0.0.0.0/0'

  AppNACLEntryEgress110:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: !Ref AppNACL
      RuleNumber: 110
      Protocol: 6
      PortRange:
        From: 80
        To: 80
      RuleAction: allow
      Egress: true
      CidrBlock: '0.0.0.0/0'

  AppNACLEntryEgress120:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: !Ref AppNACL
      RuleNumber: 120
      Protocol: 6
      PortRange:
        From: 443
        To: 443
      RuleAction: allow
      Egress: true
      CidrBlock: '0.0.0.0/0'

  AppNACLEntryEgress130:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: !Ref AppNACL
      RuleNumber: 130
      Protocol: 6
      PortRange:
        From: 1024
        To: 65535
      RuleAction: allow
      Egress: true
      CidrBlock: 10.99.0.0/16

  LoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Subnets:
        - !Ref 'DMZ1public'
        - !Ref 'DMZ2public'
      Name: !Sub '${AWS::StackName}-ALB'
      Type: application
      Scheme: internet-facing
      SecurityGroups:
        - !Ref 'LoadBalancerSecurityGroup'
      IpAddressType: ipv4

  Listener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref 'TargetGroup'
      LoadBalancerArn: !Ref 'LoadBalancer'
      Port: 80
      Protocol: HTTP

  TargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckIntervalSeconds: 10
      HealthCheckPath: /
      HealthCheckPort: '80'
      HealthCheckProtocol: HTTP
      HealthyThresholdCount: 2
      Matcher:
        HttpCode: '200,301,302,403'
      Name: !Sub '${AWS::StackName}-ApacheTG'
      Port: 80
      Protocol: HTTP
      UnhealthyThresholdCount: 2
      VpcId: !Ref VPC

  WebInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - !Ref 'WebInstanceRole'

  WebInstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: awscli
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - s3:*
                  - ec2:*
                  - rds:*
                  - elasticfilesystem:*
                  - logs:*
                  - cloudwatch:*
                Resource: '*'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM
        - arn:aws:iam::aws:policy/AmazonSSMFullAccess

  BastionSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: apache-bastion
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: BastionSG
      SecurityGroupIngress:
        - CidrIp: '0.0.0.0/0'
          FromPort: 22
          IpProtocol: tcp
          ToPort: 22

  LoadBalancerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: apache-elb
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: LoadBalancerSG
      SecurityGroupIngress:
        - CidrIp: '0.0.0.0/0'
          FromPort: 80
          IpProtocol: tcp
          ToPort: 80
        - CidrIp: '0.0.0.0/0'
          FromPort: 443
          IpProtocol: tcp
          ToPort: 443

  WebServerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: apache-ec2
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: WebServerSG
      SecurityGroupIngress:
        - FromPort: 22
          IpProtocol: tcp
          SourceSecurityGroupId: !Ref 'BastionSecurityGroup'
          ToPort: 22
        - FromPort: 80
          IpProtocol: tcp
          SourceSecurityGroupId: !Ref 'LoadBalancerSecurityGroup'
          ToPort: 80

  LaunchConfiguration:
    Type: AWS::AutoScaling::LaunchConfiguration
    Metadata:
      'AWS::CloudFormation::Init':
        configSets:
          default: [install_apache]
        install_apache:
          packages:
            yum:
              httpd: []
          services:
            sysvinit:
              httpd:
                enabled: true
                ensureRunning: true
    Properties:
      ImageId: !Ref LatestAmiId
      InstanceType: t3.micro
      KeyName: !If [HasKeyName, !Ref KeyName, !Ref 'AWS::NoValue']
      IamInstanceProfile: !Ref 'WebInstanceProfile'
      SecurityGroups:
        - !Ref 'WebServerSecurityGroup'
      AssociatePublicIpAddress: false
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash -xe
          trap '/opt/aws/bin/cfn-signal -e 1 --stack ${AWS::StackName} --resource AutoScalingGroup --region ${AWS::Region}' ERR
          /opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource LaunchConfiguration --region ${AWS::Region}
          /opt/aws/bin/cfn-signal -e 0 --stack ${AWS::StackName} --resource AutoScalingGroup --region ${AWS::Region}
      InstanceMonitoring: true

  AutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      TargetGroupARNs:
        - !Ref 'TargetGroup'
      LaunchConfigurationName: !Ref 'LaunchConfiguration'
      MinSize: '1'
      MaxSize: '2'
      DesiredCapacity: '2'
      Cooldown: '300'
      HealthCheckGracePeriod: 300
      HealthCheckType: ELB
      VPCZoneIdentifier:
        - !Ref 'AppLayer1private'
        - !Ref 'AppLayer2private'
      Tags:
        - PropagateAtLaunch: true
          Value: instance-apache
          Key: Name

  BastionLaunchConfig:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      ImageId: !Ref LatestAmiId
      InstanceType: t3.micro
      KeyName: !If [HasKeyName, !Ref KeyName, !Ref 'AWS::NoValue']
      IamInstanceProfile: !Ref 'WebInstanceProfile'
      SecurityGroups:
        - !Ref 'BastionSecurityGroup'
      AssociatePublicIpAddress: true
      InstanceMonitoring: true

  BastionAutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      LaunchConfigurationName: !Ref 'BastionLaunchConfig'
      MinSize: '1'
      MaxSize: '1'
      DesiredCapacity: '1'
      Cooldown: '300'
      HealthCheckGracePeriod: 300
      HealthCheckType: EC2
      VPCZoneIdentifier:
        - !Ref 'DMZ1public'
        - !Ref 'DMZ2public'
      Tags:
        - PropagateAtLaunch: true
          Value: bastion-host
          Key: Name

Outputs:

  LoadBalancerDNSName:
    Value: !Sub 'http://${LoadBalancer.DNSName}'