fullVPCstackWithEC2andS3.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: >
       This template deploys a basic VPC/Network with public and private subnets. 
Resources:
#VPC, Internet Gateway and attachment for both.
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.10.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
      - Key: Name
        Value:  !Join ['', [!Ref "AWS::StackName", "-VPC" ]]
  InternetGateway:
    Type: AWS::EC2::InternetGateway
    DependsOn: VPC
  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway
  SubnetPub:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.10.20.0/24
      #You can hardcode this value or make a random selection listing AZ's and choosing one in that list    
      AvailabilityZone: !Select [ 1, !GetAZs ]
      Tags:
      - Key: Name
        Value: !Sub ${AWS::StackName}-Public-B
  PrivateSubnetA:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.10.50.0/24
      AvailabilityZone: !Select [ 1, !GetAZs ]
      Tags:
      - Key: Name
        Value: !Sub ${AWS::StackName}-Private-A
  # A security group for our NAT.  Ingress from the VPC IPs only.  Egress is TCP & UDP only:
  NATSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    DependsOn: AttachGateway
    Properties:
      GroupName: !Sub NATSecurityGroup-${AWS::StackName}
      GroupDescription: Enable internal access to the NAT device
      VpcId: !Ref VPC
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: "22"
        ToPort: "22"
        CidrIp: !GetAtt VPC.CidrBlock
      SecurityGroupEgress:
      - IpProtocol: tcp
        FromPort: "0"
        ToPort: "65535"
        CidrIp: 0.0.0.0/0
      - IpProtocol: udp
        FromPort: "0"
        ToPort: "65535"
        CidrIp: 0.0.0.0/0
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
      - Key: Name
        Value: Public
  PublicRoute1:   # Public route table has direct routing to IGW:
    Type: AWS::EC2::Route
    DependsOn: AttachGateway
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway
  # A NAT Instance will be used if the user selected Private subnets and EC2-based NAT.
  NATInstance:
    Type: AWS::EC2::Instance
    DependsOn: PublicRoute1                           # Must have route to IGW established.
    Properties:
      KeyName: "edrans"
      ImageId: ami-05220ffa0e7fce3d1
      InstanceType: t2.micro                          # Any instance type is fine
      NetworkInterfaces:
      - DeviceIndex: "0"
        SubnetId: !Ref SubnetPub                  # Any public subnet is fine
        AssociatePublicIpAddress: true                # We will need a public IP address
        GroupSet: [!Ref NATSecurityGroup]             # Plug in the security group
      SourceDestCheck: false  # NATs don't work if EC2 matches source with destinations.
      Tags:
      - Key: Name
        Value: !Sub "NAT-${AWS::StackName}"
      UserData:      #  This code is NAT code.  Last line signals completion:
        Fn::Base64: !Sub |
          #!/bin/bash
          yum -y update
          yum install -y aws-cfn-bootstrap
          echo 1 > /proc/sys/net/ipv4/ip_forward
          echo 0 > /proc/sys/net/ipv4/conf/eth0/send_redirects
          /sbin/iptables -t nat -A POSTROUTING -o eth0 -s 0.0.0.0/0 -j MASQUERADE
          /sbin/iptables-save > /etc/sysconfig/iptables
          mkdir -p /etc/sysctl.d/
          cat << NatConfFileMarker > /etc/sysctl.d/nat.conf
          net.ipv4.ip_forward = 1
          net.ipv4.conf.eth0.send_redirects = 0
          NatConfFileMarker
          /opt/aws/bin/cfn-signal -e 0 --resource NATInstance --stack ${AWS::StackName} --region ${AWS::Region}
  PrivateRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
      - Key: Name
        Value: Private
  PrivateRoute1:            # Private route table can access web via NAT (created below)
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      # Route traffic through the NAT Instance:
      InstanceId: !Ref NATInstance
      #  MyEC2Instance:
      #Type: 'AWS::EC2::Instance'
      #Properties:
      #InstanceType: 't2.micro'
      #AvailabilityZone: 'us-east-2b'
      #ImageId: ami-0ebbf2179e615c338
      #SubnetId: !Ref PrivateSubnetA
      #SecurityGroupIds: 
      #  - !Ref NATSecurityGroup
  MyS3Bucket:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: "https://cf-templates-12g7l9xo2avw3-us-east-2.s3.us-east-2.amazonaws.com/monex4S3.yaml"
  NestedEC2:
    Type: AWS::CloudFormation::Stack
    Properties:
    TemplateURL: "https://cf-templates-12g7l9xo2avw3-us-east-2.s3.us-east-2.amazonaws.com/monex4-parameters.yaml" 
      Parameters:
        InstanceType: t2.micro
        KeyName: "edrans"
        AvailabilityZone: !Select [ 1, !GetAZs ]
        ImageId: ami-0ebbf2179e615c338
        IamInstanceProfile: "s3access-profile"
Outputs:
  NATSecurityGroup:
    Description: Security Group for reuse in other stacks
    Value: !Ref NATSecurityGroup
    Export:
      Name: !Sub "${AWS::StackName}-SecurityGroup"
  SubnetPub:
    Description: Security Group for reuse in other stacks
    Value: !Ref SubnetPub
    Export:
      Name: !Sub "${AWS::StackName}-Public"
  PrivateSubnetA:
    Description: Security Group for reuse in other stacks
    Value: !Ref PrivateSubnetA
    Export:
      Name: !Sub "${AWS::StackName}-Private"