vpc_cloudformation_template.yaml

Description: Create a VPC, Internet Gateway, Subnets, Route Tables, Security Groups and EC2 Instances running the Cockroach Database
AWSTemplateFormatVersion: '2010-09-09'
#
#  ToDo:
#    Cluster Name
#
# MyIP      72.132.195.192
# Creating a security group that references itself
# https://gist.github.com/alanwill/9254414
#
# Using parameters
# https://curiousorbit.com/blog/cloudformation-using-parameters/
# 
# AWS Parameters
# https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/parameters-section-structure.html
#
# AWS Subnet Configuration
# https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-subnet.html
#
# AWS Route Table Configuration
# https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-routetable.html
#
# AWS Routes Configuration
# https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-route.html
#
# AWS Referencing resource attributes in cloud formation to build a user data script
# https://stackoverflow.com/questions/48625737/userdata-script-with-resource-attribute-cloudformation
Mappings:
  amazonLinuxAmi:
    us-east-1:
      AMI: ami-0ed9277fb7eb570c9
    us-east-2:
      AMI: ami-002068ed284fb165b
    us-west-1:
      AMI: ami-03af6a70ccd8cb578
    us-west-2:
      AMI: ami-00f7e5c52c0f43726
Parameters: 
  VpcCidrParameter: 
    Description: "CIDR Block For the VPC"
    Type: String
    Default: "10.173.12.0/24"
  VpcNamePrefix:
    Description: "VPC Name Prefix.  The name will be the prefix plus the region name.  Ex: vpc01-us-west-2"
    Type: String
    Default: "vpc01"
  # See the following function which splits the /24 CIDR range into 6 CIDRs with a subnet mask "/27"
  # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-cidr.html
  VpcAzs:
    Type: List<AWS::EC2::AvailabilityZone::Name>
    Description: "Comma-delimited list of three AZs"
    Default: "us-west-2a,us-west-2b,us-west-2c"
  MyIP:
    Type: String
    Description: "Your IP address.  This will be used in the security group configuration to provide SSH/RDP access to EC2 instances. A CIDR range of /32 will be appended."
    Default: "0.0.0.0"
    AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})
    ConstraintDescription: must be a valid IP address of the form x.x.x.x.
  KeyPairName: 
    Description: "Key Pair Name (specific to a region) to be used for the EC2 instances.  This keypair must already exist prior to runing this CloudFormation script."
    Type: "AWS::EC2::KeyPair::KeyName"

Resources:
  CreateVPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref "VpcCidrParameter"
      EnableDnsSupport: true
      EnableDnsHostnames: true
      InstanceTenancy: default
      Tags:
      - Key: Name
        Value: !Join ['-', [ !Ref 'VpcNamePrefix', !Ref 'AWS::Region']]

  InternetGateway01:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
      - Key: Name
        Value: !Join ['-', [ "ig01", !Ref 'VpcNamePrefix', !Ref 'AWS::Region']]

  VPCGatewayAttachment01:
    DependsOn: 
    - CreateVPC
    - InternetGateway01
    Type: AWS::EC2::VPCGatewayAttachment
    Properties: 
      InternetGatewayId: !Ref InternetGateway01
      VpcId: !Ref CreateVPC

  subnet2Public:
    DependsOn: CreateVPC
    Type: AWS::EC2::Subnet
    Properties:
      # To be clear, the first line sets up the AZ, the second line substitues the AZ (a, b, c, etc) with the reference parameter value
      # AvailabilityZone: !Sub
      #   - "${AWS::Region}${AZ}"
      #   - AZ: !Select [0, !Ref VpcAzs]
      AvailabilityZone: !Select [0, !Ref VpcAzs]
      # AvailabilityZone: "us-west-2a"
      VpcId: !Ref CreateVPC
      # CidrBlock: !Select [0, !Ref SubnetIpBlocks]
      CidrBlock: !Select [ 0, !Cidr [ !Ref VpcCidrParameter, 6, 5 ]]
      Tags:
      - Key: Name
        Value: aza-pub-subnet2
      MapPublicIpOnLaunch: true
  subnet1Private:
    DependsOn: CreateVPC
    Type: AWS::EC2::Subnet
    Properties:
      # To be clear, the first line sets up the AZ, the second line substitues the AZ (a, b, c, etc) with the reference parameter value
      # AvailabilityZone: !Sub
      #   - "${AWS::Region}${AZ}"
      #   - AZ: !Select [0, !Ref VpcAzs]
      AvailabilityZone: !Select [0, !Ref VpcAzs]
      # AvailabilityZone: "us-west-2a"
      VpcId: !Ref CreateVPC
      # CidrBlock: !Select [0, !Ref SubnetIpBlocks]
      CidrBlock: !Select [ 1, !Cidr [ !Ref VpcCidrParameter, 6, 5 ]]
      Tags:
      - Key: Name
        Value: aza-pri-subnet1
      MapPublicIpOnLaunch: false
  subnet4Public:
    DependsOn: CreateVPC
    Type: AWS::EC2::Subnet
    Properties:
      # To be clear, the first line sets up the AZ, the second line substitues the AZ (a, b, c, etc) with the reference parameter value
      # AvailabilityZone: !Sub
      #   - "${AWS::Region}${AZ}"
      #   - AZ: !Select [0, !Ref VpcAzs]
      AvailabilityZone: !Select [1, !Ref VpcAzs]
      # AvailabilityZone: "us-west-2a"
      VpcId: !Ref CreateVPC
      # CidrBlock: !Select [0, !Ref SubnetIpBlocks]
      CidrBlock: !Select [ 2, !Cidr [ !Ref VpcCidrParameter, 6, 5 ]]
      Tags:
      - Key: Name
        Value: azb-pub-subnet4
      MapPublicIpOnLaunch: True
  subnet3Private:
    DependsOn: CreateVPC
    Type: AWS::EC2::Subnet
    Properties:
      # To be clear, the first line sets up the AZ, the second line substitues the AZ (a, b, c, etc) with the reference parameter value
      # AvailabilityZone: !Sub
      #   - "${AWS::Region}${AZ}"
      #   - AZ: !Select [0, !Ref VpcAzs]
      AvailabilityZone: !Select [1, !Ref VpcAzs]
      # AvailabilityZone: "us-west-2a"
      VpcId: !Ref CreateVPC
      # CidrBlock: !Select [0, !Ref SubnetIpBlocks]
      CidrBlock: !Select [ 3, !Cidr [ !Ref VpcCidrParameter, 6, 5 ]]
      Tags:
      - Key: Name
        Value: azb-pri-subnet3
      MapPublicIpOnLaunch: false
  subnet6Public:
    DependsOn: CreateVPC
    Type: AWS::EC2::Subnet
    Properties:
      # To be clear, the first line sets up the AZ, the second line substitues the AZ (a, b, c, etc) with the reference parameter value
      # AvailabilityZone: !Sub
      #   - "${AWS::Region}${AZ}"
      #   - AZ: !Select [0, !Ref VpcAzs]
      AvailabilityZone: !Select [2, !Ref VpcAzs]
      # AvailabilityZone: "us-west-2a"
      VpcId: !Ref CreateVPC
      # CidrBlock: !Select [0, !Ref SubnetIpBlocks]
      CidrBlock: !Select [ 4, !Cidr [ !Ref VpcCidrParameter, 6, 5 ]]
      Tags:
      - Key: Name
        Value: azc-pub-subnet6
      MapPublicIpOnLaunch: True
  subnet5Private:
    DependsOn: CreateVPC
    Type: AWS::EC2::Subnet
    Properties:
      # To be clear, the first line sets up the AZ, the second line substitues the AZ (a, b, c, etc) with the reference parameter value
      # AvailabilityZone: !Sub
      #   - "${AWS::Region}${AZ}"
      #   - AZ: !Select [0, !Ref VpcAzs]
      AvailabilityZone: !Select [2, !Ref VpcAzs]
      # AvailabilityZone: "us-west-2a"
      VpcId: !Ref CreateVPC
      # CidrBlock: !Select [0, !Ref SubnetIpBlocks]
      CidrBlock: !Select [ 5, !Cidr [ !Ref VpcCidrParameter, 6, 5 ]]
      Tags:
      - Key: Name
        Value: azc-pri-subnet5
      MapPublicIpOnLaunch: false

  routeTable01Private:
    DependsOn: CreateVPC
    Type: AWS::EC2::RouteTable
    Properties: 
      Tags: 
      - Key: Name
        Value: rt01-private
      VpcId: !Ref CreateVPC
  routeTable02Public:
    DependsOn: CreateVPC
    Type: AWS::EC2::RouteTable
    Properties: 
      Tags: 
      - Key: Name
        Value: rt02-public
      VpcId: !Ref CreateVPC
  privateSubnetRouteAssociations1:
    DependsOn: 
    - subnet1Private
    - routeTable01Private
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId:
        Ref: subnet1Private
      RouteTableId:
        Ref: routeTable01Private
  privateSubnetRouteAssociations2:
    DependsOn:
    - routeTable01Private
    - subnet3Private
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId:
        Ref: subnet3Private
      RouteTableId:
        Ref: routeTable01Private
  privateSubnetRouteAssociations3:
    DependsOn:
    - routeTable01Private
    - subnet5Private
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId:
        Ref: subnet5Private
      RouteTableId:
        Ref: routeTable01Private
  publicSubnetRouteAssociations1:
    DependsOn:
    - routeTable02Public
    - subnet2Public
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId:
        Ref: subnet2Public
      RouteTableId:
        Ref: routeTable02Public
  publicSubnetRouteAssociations2:
    DependsOn:
    - routeTable02Public
    - subnet4Public
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId:
        Ref: subnet4Public
      RouteTableId:
        Ref: routeTable02Public
  publicSubnetRouteAssociations3:
    DependsOn:
    - routeTable02Public
    - subnet6Public
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId:
        Ref: subnet6Public
      RouteTableId:
        Ref: routeTable02Public

  InternetRoute:
    Type: AWS::EC2::Route
    DependsOn: 
    - VPCGatewayAttachment01
    - routeTable02Public
    Properties:
       RouteTableId:
         Ref: routeTable02Public
       DestinationCidrBlock: 0.0.0.0/0
       GatewayId:
         Ref: InternetGateway01

  InstanceSecurityGroup01:
    Type: AWS::EC2::SecurityGroup
    DependsOn: CreateVPC
    Properties:
      Tags: 
      - Key: Name
        Value: sg01
      GroupDescription: Allow desktop access (SSH, RDP, Database, HTTP) to EC2 instances
      VpcId:
        Ref: CreateVPC
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 22
        ToPort: 22
        CidrIp: !Join ['/', [ !Ref 'MyIP', '32']]
        Description: "SSH"
      - IpProtocol: tcp
        FromPort: 3389
        ToPort: 3389
        CidrIp: !Join ['/', [ !Ref 'MyIP', '32']]
        Description: "RDP"
      - IpProtocol: tcp
        FromPort: 26257
        ToPort: 26257
        CidrIp: !Join ['/', [ !Ref 'MyIP', '32']]
        Description: "CockroachDB"
      - IpProtocol: tcp
        FromPort: 8080
        ToPort: 8080
        CidrIp: !Join ['/', [ !Ref 'MyIP', '32']]
        Description: "CockroachDB UI"
  InstanceSecurityGroup02:
    Type: AWS::EC2::SecurityGroup
    DependsOn: CreateVPC
    Properties:
      Tags: 
        - Key: Name
          Value: sg02
      GroupDescription: Allow http to client host
      VpcId:
        Ref: CreateVPC
  InstanceSecurityGroup02Ingress:
    Type: AWS::EC2::SecurityGroupIngress
    DependsOn: InstanceSecurityGroup02
    Properties: 
      GroupId: !Ref InstanceSecurityGroup02
      IpProtocol: tcp
      FromPort: 0
      ToPort: 65535
      SourceSecurityGroupId: !Ref InstanceSecurityGroup02
      Description: "Intra Node Communication"


Outputs:
  StackVPC:
    Description: The ID of the VPC
    Value: !Ref CreateVPC
    Export:
      Name:  !Sub "${AWS::StackName}-VPCID"
  # SubnetPublic1:    
  #   Description: The ID of the a public subnet
  #   Value: !Ref subnet2Public
  #   Export:
  #     Name:  !Sub "${AWS::StackName}-PublicSubnet1"
  # SubnetPublic2:    
  #   Description: The ID of the a public subnet
  #   Value: !Ref subnet4Public
  #   Export:
  #     Name:  !Sub "${AWS::StackName}-PublicSubnet2"
  # SubnetPublic3:    
  #   Description: The ID of the a public subnet
  #   Value: !Ref subnet6Public
  #   Export:
  #     Name:  !Sub "${AWS::StackName}-PublicSubnet3"
  SecurityGroup1:    
    Description: The ID of the security group 1 (local access to the resources)
    Value: !Ref InstanceSecurityGroup01
    Export:
      Name:  !Sub "${AWS::StackName}-SecurityGroup1"
  SecurityGroup2:    
    Description: The ID of the security group 2 (intranode communication)
    Value: !Ref InstanceSecurityGroup02
    Export:
      Name:  !Sub "${AWS::StackName}-SecurityGroup2"
  PubSubnet01:
    Description: The ID of the 1st Public Subnet created by this CF Template
    Value: !Ref subnet2Public
    Export:
      Name: !Sub "${AWS::StackName}-PubSubnet01"
  PubSubnet02:
    Description: The ID of the 2nd Public Subnet created by this CF Template
    Value: !Ref subnet4Public
    Export:
      Name: !Sub "${AWS::StackName}-PubSubnet02"
  PubSubnet03:
    Description: The ID of the 3rd Public Subnet created by this CF Template
    Value: !Ref subnet6Public
    Export:
      Name: !Sub "${AWS::StackName}-PubSubnet03"
  # PublicSubnet01WouldBe:
  #   Description:  This is what the Private IP Would be
  #   # Get the CIDR range of the 1st public subnet, then generate 16 CIDRs (for the whole range) with a /32 and select the 4th IP address
  #   Value: !Select [ 0, !Cidr [ !Ref VpcCidrParameter, 6, 5 ]]
  # PrivateIP01WouldBe:
  #   Description:  This is what the Private IP Would be
  #   # Get the CIDR range of the 1st public subnet, then generate 16 CIDRs (for the whole range) with a /32 and select the 4th IP address
  #   Value: !Select [0, !Split ['.', !Select [0, !Cidr [ !Select [ 0, !Cidr [ !Ref VpcCidrParameter, 6, 5 ]], 16, 1] ] ] ]
  # PrivateIP02WouldBe:
  #   Description:  This is what the Private IP Would be
  #   # Get the CIDR range of the 1st public subnet, then generate 16 CIDRs (for the whole range) with a /32 and select the 4th IP address
  #   Value: !Select [1, !Split ['.', !Select [0, !Cidr [ !Select [ 0, !Cidr [ !Ref VpcCidrParameter, 6, 5 ]], 16, 1] ] ] ]
  # PrivateIP03WouldBe:
  #   Description:  This is what the Private IP Would be
  #   # Get the CIDR range of the 1st public subnet, then generate 16 CIDRs (for the whole range) with a /32 and select the 4th IP address
  #   Value: !Select [2, !Split ['.', !Select [0, !Cidr [ !Select [ 0, !Cidr [ !Ref VpcCidrParameter, 6, 5 ]], 16, 1] ] ] ]
  # PrivateIPCombined:
  #   Value: !Join 
  #   - '.' 
  #   - - !Select [0, !Split ['.', !Select [0, !Cidr [ !Select [ 0, !Cidr [ !Ref VpcCidrParameter, 6, 5 ]], 16, 1] ] ] ]
  #     - !Select [1, !Split ['.', !Select [0, !Cidr [ !Select [ 0, !Cidr [ !Ref VpcCidrParameter, 6, 5 ]], 16, 1] ] ] ]
  #     - !Select [2, !Split ['.', !Select [0, !Cidr [ !Select [ 0, !Cidr [ !Ref VpcCidrParameter, 6, 5 ]], 16, 1] ] ] ]
  # PrivateIP02WouldBe:
  #   Description:  This is what the Private IP Would be
  #   # Get the CIDR range of the 1st public subnet, then generate 16 CIDRs (for the whole range) with a /32 and select the 4th IP address
  #   Value: !Select [1, !Cidr [ !Select [ 0, !Cidr [ !Ref VpcCidrParameter, 6, 5 ]], 16, 0] ]
  # PrivateIP03WouldBe:
  #   Description:  This is what the Private IP Would be
  #   # Get the CIDR range of the 1st public subnet, then generate 16 CIDRs (for the whole range) with a /32 and select the 4th IP address
  #   Value: !Select [2, !Cidr [ !Select [ 0, !Cidr [ !Ref VpcCidrParameter, 6, 5 ]], 16, 0] ]
  # PrivateIP04WouldBe:
  #   Description:  This is what the Private IP Would be
  #   # Get the CIDR range of the 1st public subnet, then generate 16 CIDRs (for the whole range) with a /32 and select the 4th IP address
  #   Value: !Select [3, !Cidr [ !Select [ 0, !Cidr [ !Ref VpcCidrParameter, 6, 5 ]], 16, 0] ]
  # PrivateIP16WouldBe:
  #   Description:  This is what the Private IP Would be
  #   # Get the CIDR range of the 1st public subnet, then generate 16 CIDRs (for the whole range) with a /32 and select the 4th IP address
  #   Value: !Select [15, !Cidr [ !Select [ 0, !Cidr [ !Ref VpcCidrParameter, 6, 5 ]], 16, 0] ]