infraproject2.yml

# this is my 2nd Project (IAC Project) Deploy Infrastructure as Code (IAC) using CloudFormation 
#     Created by Abdul-Rahman Alpha 
Parameters:
  # Paramenters are entirely optional.
  # but using them will make your cloudformation templates more reusable
  # use them for things that may change over time, such as instance type,
  # VPCs and so on.
    EnvironmentName:
        Description: An environment name that will be prefixed to resources
        Type: String

    myVpc:
        Description: Enter the IP range for the Subnet
        Type: String
        Default: 10.0.0.0/16

    myPublicSubnet1:
        Description: Enter the IP range for the Subnet
        Type: String
        Default: 10.0.0.0/24

    myPublicSubnet2:
        Description: Enter the IP range for the Subnet
        Type: String
        Default: 10.0.1.0/24
        
    myPrivateSubnet1:
        Description: Enter the IP range for the Subnet
        Type: String
        Default: 10.0.2.0/24

    myPrivateSubnet2:
        Description: Enter the IP range for the Subnet
        Type: String
        Default: 10.0.3.0/24

    InstanceType:
        Description: The EC2 instance type of general purpose
        Type: String
        AllowedValues: [t2.medium, t3.small, t3.nano, t3.micro, t3.medium, t3.large, t3.xlarge, t3.2xlarge]

Resources:
  #--------------------------------------------------------------------------
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref myVpc
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: !Ref EnvironmentName
  #--------------------------------------------------------------------------
  PublicSubnet1:
        Type: AWS::EC2::Subnet
        Properties:
          VpcId: !Ref VPC 
          AvailabilityZone: !Select [ 0, !GetAZs '' ]
          CidrBlock: !Ref myPublicSubnet1
          MapPublicIpOnLaunch: false
          Tags: 
              - Key: Name
                Value: !Sub ${EnvironmentName} Public Subnet (AZ1)
  #--------------------------------------------------------------------------
  PublicSubnet2:
        Type: AWS::EC2::Subnet
        Properties:
          VpcId: !Ref VPC
          AvailabilityZone: !Select [ 1, !GetAZs '' ]
          CidrBlock: !Ref myPublicSubnet2
          MapPublicIpOnLaunch: false
          Tags: 
              - Key: Name
                Value: !Sub ${EnvironmentName} Public Subnet (AZ2)
  #--------------------------------------------------------------------------
  PrivateSubnet1:
        Type: AWS::EC2::Subnet
        Properties:
          VpcId: !Ref VPC 
          AvailabilityZone: !Select [ 0, !GetAZs '' ]
          CidrBlock: !Ref myPrivateSubnet1
          MapPublicIpOnLaunch: false
          Tags: 
              - Key: Name
                Value: !Sub ${EnvironmentName} Private Subnet (AZ1)
  #--------------------------------------------------------------------------
  PrivateSubnet2:
        Type: AWS::EC2::Subnet
        Properties:
          VpcId: !Ref VPC
          AvailabilityZone: !Select [ 1, !GetAZs '' ]
          CidrBlock: !Ref myPrivateSubnet2
          MapPublicIpOnLaunch: false
          Tags: 
              - Key: Name
                Value: !Sub ${EnvironmentName} Private Subnet (AZ2)
  #--------------------------------------------------------------------------
  InternetGateway: 
        Type: AWS::EC2::InternetGateway
  #--------------------------------------------------------------------------
  InternetGatewayAttachment:
        Type:  AWS::EC2::VPCGatewayAttachment 
        Properties: 
          VpcId: !Ref VPC 
          InternetGatewayId: !Ref InternetGateway
  #--------------------------------------------------------------------------
  NatGateway1EIP:
        Type: AWS::EC2::EIP
        DependsOn: InternetGatewayAttachment
        Properties: 
            Domain: vpc
  #--------------------------------------------------------------------------
  NatGateway2EIP:
        Type: AWS::EC2::EIP
        DependsOn: InternetGatewayAttachment
        Properties:
            Domain: vpc
  #--------------------------------------------------------------------------
  NatGateway1: 
        Type: AWS::EC2::NatGateway
        Properties: 
            AllocationId: !GetAtt NatGateway1EIP.AllocationId
            SubnetId: !Ref PublicSubnet1
  #--------------------------------------------------------------------------
  NatGateway2: 
        Type: AWS::EC2::NatGateway
        Properties:
            AllocationId: !GetAtt NatGateway2EIP.AllocationId
            SubnetId: !Ref PublicSubnet2
  #--------------------------------------------------------------------------
  PublicRouteTable:
        Type: AWS::EC2::RouteTable
        Properties: 
            VpcId: !Ref VPC
            Tags: 
                - Key: Name 
                  Value: !Sub ${EnvironmentName} Public Routes
  #--------------------------------------------------------------------------
  DefaultPublicRoute: 
        Type: AWS::EC2::Route
        DependsOn: InternetGatewayAttachment
        Properties: 
            RouteTableId: !Ref PublicRouteTable
            DestinationCidrBlock: 0.0.0.0/0
            GatewayId: !Ref InternetGateway
  #----------------------------------------------------------------------------
  PublicSubnet1RouteTableAssociation:
        Type: AWS::EC2::SubnetRouteTableAssociation
        Properties:
            RouteTableId: !Ref PublicRouteTable
            SubnetId: !Ref PublicSubnet1
  #----------------------------------------------------------------------------
  PublicSubnet2RouteTableAssociation:
        Type: AWS::EC2::SubnetRouteTableAssociation
        Properties:
            RouteTableId: !Ref PublicRouteTable
            SubnetId: !Ref PublicSubnet2
  #----------------------------------------------------------------------------
  PrivateRouteTable1:
        Type: AWS::EC2::RouteTable
        Properties: 
            VpcId: !Ref VPC
            Tags: 
                - Key: Name 
                  Value: !Sub ${EnvironmentName} Private Routes (AZ1)
  #------------------------------------------------------------------------------
  DefaultPrivateRoute1:
        Type: AWS::EC2::Route
        Properties:
            RouteTableId: !Ref PrivateRouteTable1
            DestinationCidrBlock: 0.0.0.0/0
            NatGatewayId: !Ref NatGateway1
  #------------------------------------------------------------------------------
  PrivateSubnet1RouteTableAssociation:
        Type: AWS::EC2::SubnetRouteTableAssociation
        Properties:
            RouteTableId: !Ref PrivateRouteTable1
            SubnetId: !Ref PrivateSubnet1
  #------------------------------------------------------------------------------
  PrivateRouteTable2:
        Type: AWS::EC2::RouteTable
        Properties: 
            VpcId: !Ref VPC
            Tags: 
                - Key: Name 
                  Value: !Sub ${EnvironmentName} Private Routes (AZ2)
  #------------------------------------------------------------------------------
  DefaultPrivateRoute2:
        Type: AWS::EC2::Route
        Properties:
            RouteTableId: !Ref PrivateRouteTable2
            DestinationCidrBlock: 0.0.0.0/0
            NatGatewayId: !Ref NatGateway2
  #------------------------------------------------------------------------------
  PrivateSubnet2RouteTableAssociation:
        Type: AWS::EC2::SubnetRouteTableAssociation
        Properties:
            RouteTableId: !Ref PrivateRouteTable2
            SubnetId: !Ref PrivateSubnet2
  #------------------------------------------------------------------------------
  UdacityS3ReadOnlyEC2:
        Type: AWS::IAM::Role
        Properties:
            RoleName: 
                !Sub ${EnvironmentName}-Role
            AssumeRolePolicyDocument:
                Version: "2012-10-17"
                Statement:
                -   Effect: Allow
                    Principal:
                        Service:
                        - ec2.amazonaws.com
                    Action:
                    - sts:AssumeRole
            Path: "/"
  #------------------------------------------------------------------------------
  RolePolicies:
        Type: AWS::IAM::Policy
        Properties:
            PolicyName: AmazonS3ReadOnlyAccess
            PolicyDocument:
                Version: '2012-10-17'
                Statement:
                - 
                    Effect: Allow
                    Action: 
                    -   s3:Get*
                    -   s3:List*
                    Resource: 
                    -   arn:aws:s3:::udacity-demo-1
                    -   arn:aws:s3:::udacity-demo-1/*
            Roles:
            -   Ref: UdacityS3ReadOnlyEC2
  #---------------------------------------------------------------------------------
  # instace profile contains the IAM Role name(s) that we want to associate to our auto scaling EC2 Servers
  # never give too much permissions to your EC2 instances! if they get hacked, the permissions get hacked also!
  # I create a Role called UdacityS3ReadOnlyEC2 and just give it a policy of S3 Read-Only Access
  #---------------------------------------------------------------------------------
  ProfileWithRolesForOurApp:
        Type: AWS::IAM::InstanceProfile
        Properties:
            Path: "/"
            Roles:
            - Ref: UdacityS3ReadOnlyEC2
  #----------------------------------------------------------------------------------
  LoadBalancerSecGroup:
            Type: AWS::EC2::SecurityGroup
            Properties:
                GroupDescription: Allow traffic to/from load balancer
                VpcId: !Ref VPC
                SecurityGroupIngress:
                -   IpProtocol: tcp
                    FromPort: 80
                    ToPort: 80
                    CidrIp: 0.0.0.0/0
                SecurityGroupEgress:
                -   IpProtocol: tcp
                    FromPort: 80
                    ToPort: 80
                    CidrIp: 0.0.0.0/0
  #------------------------------------------------------------------------------
  WebServerSecGroup:
        Type: AWS::EC2::SecurityGroup
        Properties:
            GroupDescription: Allow http and SSH to my load balancer
            VpcId: !Ref VPC
            SecurityGroupIngress:
            -   IpProtocol: tcp
                FromPort: 80
                ToPort: 80
                CidrIp: 0.0.0.0/0
            -   IpProtocol: tcp
                FromPort: 22
                ToPort: 22
                CidrIp: 0.0.0.0/0
            SecurityGroupEgress:
            -   IpProtocol: tcp
                FromPort: 0
                ToPort: 65535
                CidrIp: 0.0.0.0/0
  #---------------------------------------------------------------------------
  WebAppLaunchConfig: 
        Type: AWS::AutoScaling::LaunchConfiguration
        Properties:
            UserData:
                Fn::Base64: !Sub |
                    #!/bin/bash
                    apt-get update -y
                    apt-get install unzip awscli -y
                    apt-get install apache2 -y
                    systemctl start apache2.service
                    cd /var/www/html
                    aws s3 cp s3://udacity-demo-1/udacity.zip .
                    unzip -o udacity.zip
            ImageId: ami-0729e439b6769d6ab
            IamInstanceProfile: !Ref ProfileWithRolesForOurApp
            SecurityGroups:
            -   Ref: WebServerSecGroup
            InstanceType: !Ref InstanceType
            BlockDeviceMappings:
            -   DeviceName: "/dev/sdk"
                Ebs:
                    VolumeSize: 10 #10GB
  #-----------------------------------------------------------------------
  WebAppTargetGroup:
        Type: AWS::ElasticLoadBalancingV2::TargetGroup
        Properties:
            HealthCheckIntervalSeconds: 10
            HealthCheckPath: /
            HealthCheckProtocol: HTTP
            HealthCheckTimeoutSeconds: 8
            HealthyThresholdCount: 2
            Port: 80
            Protocol: HTTP
            UnhealthyThresholdCount: 5
            VpcId: !Ref VPC
  #------------------------------------------------------------------------------------------------
  WebAppGroup:
        Type: AWS::AutoScaling::AutoScalingGroup
        Properties:
            VPCZoneIdentifier:  
            - !Ref PrivateSubnet1
            - !Ref PrivateSubnet2 
            LaunchConfigurationName:
                Ref: WebAppLaunchConfig
            MinSize: '4'
            MaxSize: '6'
            TargetGroupARNs:
            -   Ref: WebAppTargetGroup
  #------------------------------------------------------------------------------------------------
  WebAppLB:
        Type: AWS::ElasticLoadBalancingV2::LoadBalancer
        Properties:
            SecurityGroups:
            - Ref: LoadBalancerSecGroup
            Subnets:
            - !Ref PublicSubnet1
            - !Ref PublicSubnet2
  #----------------------------------------------------------------------------------------------
  Listener:
        Type: AWS::ElasticLoadBalancingV2::Listener
        Properties:
            DefaultActions:
            -   Type: forward
                TargetGroupArn:
                    Ref: WebAppTargetGroup
            LoadBalancerArn:
                Ref: WebAppLB
            Port: 80
            Protocol: HTTP
  #-------------------------------------------------------------------------------------------
  ALBListenerRule:
        Type: AWS::ElasticLoadBalancingV2::ListenerRule
        Properties:
            Actions:
            -   Type: forward
                TargetGroupArn: !Ref 'WebAppTargetGroup'
            Conditions:
            -   Field: path-pattern
                Values: [/]
            ListenerArn: !Ref 'Listener'
            Priority: 1
  #--------------------------------------------------------------------------------------------
Outputs: 

  VPC:
        Description: A reference to the created VPC
        Value: !Ref VPC
        Export:
          Name: !Sub ${EnvironmentName}-VPCID
  #---------------------------------------------------------------------------------------------
  PublicSubnets:
        Description: A list of the public subnets
        Value: !Join [ ",", [ !Ref PublicSubnet1, !Ref PublicSubnet2 ]]
        Export:
          Name: !Sub ${EnvironmentName}-PUB-NETS
  #---------------------------------------------------------------------------------------------
  PrivateSubnets:
        Description: A list of the private subnets
        Value: !Join [ ",", [ !Ref PrivateSubnet1, !Ref PrivateSubnet2 ]]
        Export:
          Name: !Sub ${EnvironmentName}-PRIV-NETS
  #--------------------------------------------------------------------------------------------
  WebAppLoadBalancerDNSName:
        Description: DNS name or Public URL of the Load Balancer
        Value: !Join [ "", [ 'http://', !GetAtt WebAppLB.DNSName ]]
        Export:
            Name: !Sub ${EnvironmentName}-LB-DNSName
  # output the URL to it here, so that we don't have to go to the console to get it.

# Sample UserData
# When creating your Launch Configuration, you may need a UserData script
# here's one that you can use for Ubuntu Linux that will:
# Install Apache Web Server, Start it, and create an index.html that will be displayed
# when you visit the IP address of this server with your web browser
#Here it is:
#
#          #!/bin/bash
#          apt-get update -y
#          apt-get install apache2 -y
#          systemctl start apache2.service
#          cd /var/www/html
#          echo "Udacity Demo Web Server Up and Running!" > index.html