stack.yaml

Description: >
    Oluwafemi Akinde for Udacity Cloud DevOps Engineer Class
    This template deploys a VPC, with a pair of public and private subnets
    across two Availability Zones. It deploys an Internet Gateway, with
    route on the public subnets. It deploys a pair of NAT Gateways (one 
    and default routes for them in the private subnets.) It deploys
    Security groups for a Ubuntu launch configuration,
    Auto-Scaling group, Load Balancer, Target Group with Listener
    and Listener Rule.

Parameters:

    EnvironmentName:
        Description: An environment name that will be prefixed to resource
        Type: String

    VpcCIDR:
        Description: IP range (CIDR notation) for this VPC
        Type: String
        Default: 10.0.0.0/16

    PublicSubnet1CIDR:
        Description: IP range (CIDR notation) for the Subnet
        Type: String
        Default: 10.0.0.0/24

    PublicSubnet2CIDR:
        Description: IP range (CIDR notation) for the Subnet
        Type: String
        Default: 10.0.1.0/24

    PrivateSubnet1CIDR:
        Description: IP range (CIDR notation) for the Subnet
        Type: String
        Default: 10.0.2.0/24

    PrivateSubnet2CIDR:
        Description: IP range (CIDR notation) for the Subnet
        Type: String
        Default: 10.0.3.0/24

Resources:

    VPC:
        Type: AWS::EC2::VPC
        Properties:
            CidrBlock: !Ref VpcCIDR
            EnableDnsHostnames: true
            Tags:
                - Key: Name
                  Value: !Ref EnvironmentName

    InternetGateway:
        Type: AWS::EC2::InternetGateway
        Properties: 
            Tags: 
                - Key: Name
                  Value: !Ref EnvironmentName

    InternetGatewayAttachment:
        Type: AWS::EC2::VPCGatewayAttachment
        Properties: 
            InternetGatewayId: !Ref InternetGateway
            VpcId: !Ref VPC

    PublicSubnet1:
        Type: AWS::EC2::Subnet
        Properties:
            VpcId: !Ref VPC
            AvailabilityZone: !Select [0, !GetAZs '']
            CidrBlock: !Ref PublicSubnet1CIDR
            MapPublicIpOnLaunch: false
            Tags: 
                -   Key: Name
                    Value: !Sub ${EnvironmentName} Public Subnet (AZ1)

    PublicSubnet2:
        Type: AWS::EC2::Subnet
        Properties:
            VpcId: !Ref VPC
            AvailabilityZone: !Select [1, !GetAZs '']
            CidrBlock: !Ref PublicSubnet2CIDR
            MapPublicIpOnLaunch: false
            Tags: 
                -   Key: Name
                    Value: !Sub ${EnvironmentName} Public Subnet (AZ2)

    PrivateSubnet1:
        Type: AWS::EC2::Subnet
        Properties:
            VpcId: !Ref VPC
            AvailabilityZone: !Select [0, !GetAZs '']
            CidrBlock: !Ref PrivateSubnet1CIDR
            MapPublicIpOnLaunch: false
            Tags: 
                -   Key: Name
                    Value: !Sub ${EnvironmentName} Private Subnet (AZ1)

    PrivateSubnet2:
        Type: AWS::EC2::Subnet
        Properties:
            VpcId: !Ref VPC
            AvailabilityZone: !Select [1, !GetAZs '']
            CidrBlock: !Ref PrivateSubnet2CIDR
            MapPublicIpOnLaunch: false
            Tags: 
                -   Key: Name
                    Value: !Sub ${EnvironmentName} Private Subnet (AZ2)
    
    NatGateway1EIP:
        Type: AWS::EC2::EIP
        DependsOn: InternetGatewayAttachment
        Properties: 
            Domain: vpc

    NatGateway2EIP:
        Type: AWS::EC2::EIP
        DependsOn: InternetGatewayAttachment
        Properties:
            Domain: vpc

    NatGateway1: 
        Type: AWS::EC2::NatGateway
        Properties: 
            AllocationId: !GetAtt NatGateway1EIP.AllocationId
            SubnetId: !Ref PublicSubnet1

    NatGateway2: 
        Type: AWS::EC2::NatGateway
        Properties:
            AllocationId: !GetAtt NatGateway2EIP.AllocationId
            SubnetId: !Ref PublicSubnet2
    
    PublicRouteTable:
        Type: AWS::EC2::RouteTable
        Properties: 
            VpcId: !Ref VPC
            Tags: 
                - Key: Name 
                  Value: !Sub ${EnvironmentName} Public Routes

    DefaultPublicRoute: 
        Type: AWS::EC2::Route
        DependsOn: InternetGatewayAttachment
        Properties: 
            RouteTableId: !Ref PublicRouteTable
            DestinationCidrBlock: 0.0.0.0/0
            GatewayId: !Ref InternetGateway
    
    PublicSubnet1RouteTableAssociation:
        Type: AWS::EC2::SubnetRouteTableAssociation
        Properties:
            RouteTableId: !Ref PublicRouteTable
            SubnetId: !Ref PublicSubnet1

    PublicSubnet2RouteTableAssociation:
        Type: AWS::EC2::SubnetRouteTableAssociation
        Properties:
            RouteTableId: !Ref PublicRouteTable
            SubnetId: !Ref PublicSubnet2
    
    PrivateRouteTable1:
        Type: AWS::EC2::RouteTable
        Properties: 
            VpcId: !Ref VPC
            Tags: 
                - Key: Name 
                  Value: !Sub ${EnvironmentName} Private Routes (AZ1)

    DefaultPrivateRoute1:
        Type: AWS::EC2::Route
        Properties:
            RouteTableId: !Ref PrivateRouteTable1
            DestinationCidrBlock: 0.0.0.0/0
            NatGatewayId: !Ref NatGateway1

    PrivateSubnet1RouteTableAssociation:
        Type: AWS::EC2::SubnetRouteTableAssociation
        Properties:
            RouteTableId: !Ref PrivateRouteTable1
            SubnetId: !Ref PrivateSubnet1
    
    PrivateRouteTable2:
        Type: AWS::EC2::RouteTable
        Properties: 
            VpcId: !Ref VPC
            Tags: 
                - Key: Name 
                  Value: !Sub ${EnvironmentName} Private Routes (AZ2)

    DefaultPrivateRoute2:
        Type: AWS::EC2::Route
        Properties:
            RouteTableId: !Ref PrivateRouteTable2
            DestinationCidrBlock: 0.0.0.0/0
            NatGatewayId: !Ref NatGateway2
    
    PrivateSubnet2RouteTableAssociation:
        Type: AWS::EC2::SubnetRouteTableAssociation
        Properties:
            RouteTableId: !Ref PrivateRouteTable2
            SubnetId: !Ref PrivateSubnet2
    
    UdacityS3ReadOnlyEC2:
        Type: AWS::IAM::Role
        Properties:
            RoleName: 
                !Sub ${EnvironmentName}-Role
            AssumeRolePolicyDocument:
                Version: "2012-10-17"
                Statement:
                -   Effect: Allow
                    Principal:
                        Service:
                        - ec2.amazonaws.com
                    Action:
                    - sts:AssumeRole
            Path: "/"
    
    RolePolicies:
        Type: AWS::IAM::Policy
        Properties:
            PolicyName: AmazonS3ReadOnlyAccess
            PolicyDocument:
                Version: '2012-10-17'
                Statement:
                - 
                    Effect: Allow
                    Action: 
                    -   s3:Get*
                    -   s3:List*
                    Resource: 
                    -   arn:aws:s3:::udagram-project
                    -   arn:aws:s3:::udagram-project/*
            Roles:
            -   Ref: UdacityS3ReadOnlyEC2

    ProfileWithRoles:
        Type: AWS::IAM::InstanceProfile
        Properties:
            Path: "/"
            Roles:
            - Ref: UdacityS3ReadOnlyEC2
    
    LBSecGroup:
        Type: AWS::EC2::SecurityGroup
        Properties: 
            GroupDescription: Allow http to our load balancer
            VpcId: !Ref VPC
            SecurityGroupIngress: 
            - IpProtocol: tcp
              FromPort: 80
              ToPort: 80
              CidrIp: 0.0.0.0/0
            SecurityGroupEgress: 
            - IpProtocol: tcp
              FromPort: 80
              ToPort: 80
              CidrIp: 0.0.0.0/0

    WebServerSecGroup:
        Type: AWS::EC2::SecurityGroup
        Properties: 
            GroupDescription: Allow http to our hosts and SSH from local only
            VpcId: !Ref VPC
            SecurityGroupIngress: 
            - IpProtocol: tcp
              FromPort: 80
              ToPort: 80
              CidrIp: 0.0.0.0/0
            - IpProtocol: tcp
              FromPort: 22
              ToPort: 22
              CidrIp: 0.0.0.0/0
            SecurityGroupEgress: 
            - IpProtocol: tcp
              FromPort: 0
              ToPort: 65535
              CidrIp: 0.0.0.0/0
    
    WebAppTargetGroup:
        Type: AWS::ElasticLoadBalancingV2::TargetGroup
        Properties:
          HealthCheckIntervalSeconds: 35
          HealthCheckPath: /
          HealthCheckProtocol: HTTP
          HealthCheckTimeoutSeconds: 30
          HealthyThresholdCount: 2
          Port: 80
          Protocol: HTTP
          UnhealthyThresholdCount: 5
          VpcId: !Ref VPC

    WebAppLaunchConfig:
        Type: AWS::AutoScaling::LaunchConfiguration
        Properties:
          UserData:
            Fn::Base64: !Sub |
              #!/bin/bash
              apt-get update -y
              apt-get install unzip awscli -y
              apt-get install apache2 -y
              systemctl start apache2.service
              cd /var/www/html
              aws s3 cp s3://udagram-project/udacity-starter-website.zip .
              unzip -o udacity-starter-website.zip
          ImageId: ami-0df32f8302dfe67df
          IamInstanceProfile: !Ref ProfileWithRoles
          SecurityGroups:
          - Ref: WebServerSecGroup
          InstanceType: t3.medium
          BlockDeviceMappings:
          - DeviceName: "/dev/sdk"
            Ebs:
              VolumeSize: '10'

    WebAppGroup:
        Type: AWS::AutoScaling::AutoScalingGroup
        Properties:
          VPCZoneIdentifier:
          - Ref: "PrivateSubnet1"
          - Ref: "PrivateSubnet2"
          LaunchConfigurationName:
            Ref: WebAppLaunchConfig
          MaxSize: '5'
          MinSize: '3'
          TargetGroupARNs:
          - Ref: WebAppTargetGroup

    WebAppLB:
        Type: AWS::ElasticLoadBalancingV2::LoadBalancer
        Properties:
          Subnets:
          - Ref: "PublicSubnet1"
          - Ref: "PublicSubnet2"
          SecurityGroups:
          - Ref: LBSecGroup

    Listener:
        Type: AWS::ElasticLoadBalancingV2::Listener
        Properties:
          LoadBalancerArn: !Ref WebAppLB
          Port: '80'
          Protocol: HTTP
          DefaultActions:
          - Type: forward
            TargetGroupArn: !Ref 'WebAppTargetGroup'
          
    ALBListenerRule:
        Type: AWS::ElasticLoadBalancingV2::ListenerRule
        Properties: 
          Actions:
           - Type: forward
             TargetGroupArn: !Ref 'WebAppTargetGroup'
          Conditions:
            - Field: path-pattern
              Values: [/]
          ListenerArn: !Ref 'Listener'
          Priority: 1

Outputs:

    VPC: 
        Description: A reference to the created VPC
        Value: !Ref VPC
        Export:
          Name: !Sub ${EnvironmentName}-VPCID

    VPCPublicRouteTable:
        Description: Public Routing
        Value: !Ref PublicRouteTable
        Export:
          Name: !Sub ${EnvironmentName}-PUB-RT

    VPCPrivateRouteTable1:
        Description: Private Routing AZ1
        Value: !Ref PrivateRouteTable1
        Export:
          Name: !Sub ${EnvironmentName}-PRT1-RT
    
    VPCPrivateRouteTable2:
        Description: Private Routing AZ2
        Value: !Ref PrivateRouteTable2
        Export:
          Name: !Sub ${EnvironmentName}-PRT2-RT

    PublicSubnets:
        Description: A list of the public subnets
        Value: !Join [",", [!Ref PublicSubnet1, !Ref PublicSubnet2]]
        Export:
          Name: !Sub ${EnvironmentName}-PUB-NETS

    PrivateSubnets:
        Description: A list of the private subnets
        Value: !Join [",", [!Ref PrivateSubnet1, !Ref PrivateSubnet2]]
        Export:
          Name: !Sub ${EnvironmentName}-PRV-NETS

    PublicSubnet1:
        Description: A reference to the public subnet in the 1st AvailabilityZone
        Value: !Ref PublicSubnet1
        Export:
          Name: !Sub ${EnvironmentName}-PUB1-SN

    PublicSubnet2:
        Description: A reference to the public subnet in the 2nd AvailabilityZone
        Value: !Ref PublicSubnet2
        Export:
          Name: !Sub ${EnvironmentName}-PUB2-SN

    PrivateSubnet1:
        Description: A reference to the private subnet in the 1st AvailabilityZone
        Value: !Ref PrivateSubnet1
        Export:
          Name: !Sub ${EnvironmentName}-PRI1-SN

    PrivateSubnet2:
        Description: A reference to the private subnet in the 2nd AvailabilityZone
        Value: !Ref PrivateSubnet2
        Export:
          Name: !Sub ${EnvironmentName}-PRI2-SN

    LoadBalancerDNS:
        Description: A reference to the LoadBalancer DNS
        Value: !Join [ "", [ "http://", !GetAtt WebAppLB.DNSName ] ]
        Export:
          Name: !Sub "${EnvironmentName}-LB-DNS"