project-env-3az-vpc.template

{
  "AWSTemplateFormatVersion": "2010-09-09",

  "Description": "Creation of network structure based on 3 availability zones for a new project environment",

  "Parameters" : {
    "ProjectName" : {
      "Type" : "String",
      "Description" : "Project Name. E.g. Destapp"
    },
    "Environment" : {
      "Type" : "String",
      "Description" : "Project Environment"
    },
    "ProjectId" : {
      "Type" : "Number",
      "Description" : "Project Identifier, i.e., the second number of VPC CIDR block"
    },
    "SubnetsZone1" : {
      "Type" : "AWS::EC2::AvailabilityZone::Name",
      "Description" : "Zone 1 for Multi-AZ Subnets"
    },
    "SubnetsZone2" : {
      "Type" : "AWS::EC2::AvailabilityZone::Name",
      "Description" : "Zone 2 for Multi-AZ Subnets"
    },
    "SubnetsZone3" : {
      "Type" : "AWS::EC2::AvailabilityZone::Name",
      "Description" : "Zone 3 for Multi-AZ Subnets"
    }
  },

  "Conditions" : {
    "LiveEnvironment" : {
      "Fn::Or" : [
        { "Fn::Equals" : [ { "Ref" : "Environment" }, "Live" ] },
        { "Fn::Equals" : [ { "Ref" : "Environment" }, "EB" ] }
      ]
    }
  },

  "Mappings" : {
    "ZoneId" : {
      "us-east-1a" : { "Number" : "1", "Letter" : "A" },
      "us-east-1b" : { "Number" : "2", "Letter" : "B" },
      "us-east-1c" : { "Number" : "3", "Letter" : "C" },
      "us-east-1d" : { "Number" : "4", "Letter" : "D" },
      "us-east-1e" : { "Number" : "5", "Letter" : "E" },

      "us-west-1a" : { "Number" : "1", "Letter" : "A" },
      "us-west-1b" : { "Number" : "2", "Letter" : "B" },
      "us-west-1c" : { "Number" : "3", "Letter" : "C" },

      "us-west-2a" : { "Number" : "1", "Letter" : "A" },
      "us-west-2b" : { "Number" : "2", "Letter" : "B" },
      "us-west-2c" : { "Number" : "3", "Letter" : "C" },

      "eu-west-1a" : { "Number" : "1", "Letter" : "A" },
      "eu-west-1b" : { "Number" : "2", "Letter" : "B" },
      "eu-west-1c" : { "Number" : "3", "Letter" : "C" },

      "eu-central-1a" : { "Number" : "1", "Letter" : "A" },
      "eu-central-1b" : { "Number" : "2", "Letter" : "B" },
      "eu-central-1c" : { "Number" : "3", "Letter" : "C" },

      "sa-east-1a" : { "Number" : "1", "Letter" : "A" },
      "sa-east-1b" : { "Number" : "2", "Letter" : "B" },
      "sa-east-1c" : { "Number" : "3", "Letter" : "C" }
    }
  },

  "Resources": {
    "EnvVPC": {
      "Type": "AWS::EC2::VPC",
      "Properties": {
        "CidrBlock": { "Fn::Join" : [ ".", [ "10", { "Ref" : "ProjectId" }, "0.0/16" ] ] },
        "InstanceTenancy": "default",
        "EnableDnsSupport": "true",
        "EnableDnsHostnames": "true",
        "Tags": [
          {
            "Key": "Name",
            "Value": { "Fn::Join" : [ " - ", [ { "Ref" : "ProjectName" }, { "Ref" : "Environment" } ] ] }
          }
        ]
      }
    },
    "Web1Subnet": {
      "Type": "AWS::EC2::Subnet",
      "Properties": {
        "CidrBlock": {
          "Fn::Join" : [ ".", [ "10", { "Ref" : "ProjectId" }, {
            "Fn::Join" : [ "", [ { "Fn::If": [ "LiveEnvironment", "1", "2" ] }, "1", {
              "Fn::FindInMap" : [ "ZoneId", { "Ref" : "SubnetsZone1" }, "Number" ]
            } ] ]
          }, "0/24" ] ]
        },
        "AvailabilityZone": { "Ref" : "SubnetsZone1" },
        "VpcId": { "Ref": "EnvVPC" },
        "Tags": [
          {
            "Key": "Name",
            "Value": {
              "Fn::Join" : [ " - ", [ { "Ref" : "ProjectName" }, { "Ref" : "Environment" }, "Web", {
                "Fn::Join" : [ " ", [ {
                  "Fn::FindInMap" : [ "ZoneId", { "Ref" : "SubnetsZone1" }, "Letter" ]
                }, "Zone" ] ]
              } ] ]
            }
          }
        ]
      }
    },
    "Web2Subnet": {
      "Type": "AWS::EC2::Subnet",
      "Properties": {
        "CidrBlock": {
          "Fn::Join" : [ ".", [ "10", { "Ref" : "ProjectId" }, {
            "Fn::Join" : [ "", [ { "Fn::If": [ "LiveEnvironment", "1", "2" ] }, "1", {
              "Fn::FindInMap" : [ "ZoneId", { "Ref" : "SubnetsZone2" }, "Number" ]
            } ] ]
          }, "0/24" ] ]
        },
        "AvailabilityZone": { "Ref" : "SubnetsZone2" },
        "VpcId": { "Ref": "EnvVPC" },
        "Tags": [
          {
            "Key": "Name",
            "Value": {
              "Fn::Join" : [ " - ", [ { "Ref" : "ProjectName" }, { "Ref" : "Environment" }, "Web", {
                "Fn::Join" : [ " ", [ {
                  "Fn::FindInMap" : [ "ZoneId", { "Ref" : "SubnetsZone2" }, "Letter" ]
                }, "Zone" ] ]
              } ] ]
            }
          }
        ]
      }
    },
    "Web3Subnet": {
      "Type": "AWS::EC2::Subnet",
      "Properties": {
        "CidrBlock": {
          "Fn::Join" : [ ".", [ "10", { "Ref" : "ProjectId" }, {
            "Fn::Join" : [ "", [ { "Fn::If": [ "LiveEnvironment", "1", "2" ] }, "1", {
              "Fn::FindInMap" : [ "ZoneId", { "Ref" : "SubnetsZone3" }, "Number" ]
            } ] ]
          }, "0/24" ] ]
        },
        "AvailabilityZone": { "Ref" : "SubnetsZone3" },
        "VpcId": { "Ref": "EnvVPC" },
        "Tags": [
          {
            "Key": "Name",
            "Value": {
              "Fn::Join" : [ " - ", [ { "Ref" : "ProjectName" }, { "Ref" : "Environment" }, "Web", {
                "Fn::Join" : [ " ", [ {
                  "Fn::FindInMap" : [ "ZoneId", { "Ref" : "SubnetsZone3" }, "Letter" ]
                }, "Zone" ] ]
              } ] ]
            }
          }
        ]
      }
    },
    "Database1Subnet": {
      "Type": "AWS::EC2::Subnet",
      "Properties": {
        "CidrBlock": {
          "Fn::Join" : [ ".", [ "10", { "Ref" : "ProjectId" }, {
            "Fn::Join" : [ "", [ { "Fn::If": [ "LiveEnvironment", "1", "2" ] }, "2", {
              "Fn::FindInMap" : [ "ZoneId", { "Ref" : "SubnetsZone1" }, "Number" ]
            } ] ]
          }, "0/24" ] ]
        },
        "AvailabilityZone": { "Ref" : "SubnetsZone1" },
        "VpcId": { "Ref": "EnvVPC" },
        "Tags": [
          {
            "Key": "Name",
            "Value": {
              "Fn::Join" : [ " - ", [ { "Ref" : "ProjectName" }, { "Ref" : "Environment" }, "Database", {
                "Fn::Join" : [ " ", [ {
                  "Fn::FindInMap" : [ "ZoneId", { "Ref" : "SubnetsZone1" }, "Letter" ]
                }, "Zone" ] ]
              } ] ]
            }
          }
        ]
      }
    },
    "Database2Subnet": {
      "Type": "AWS::EC2::Subnet",
      "Properties": {
        "CidrBlock": {
          "Fn::Join" : [ ".", [ "10", { "Ref" : "ProjectId" }, {
            "Fn::Join" : [ "", [ { "Fn::If": [ "LiveEnvironment", "1", "2" ] }, "2", {
              "Fn::FindInMap" : [ "ZoneId", { "Ref" : "SubnetsZone2" }, "Number" ]
            } ] ]
          }, "0/24" ] ]
        },
        "AvailabilityZone": { "Ref" : "SubnetsZone2" },
        "VpcId": { "Ref": "EnvVPC" },
        "Tags": [
          {
            "Key": "Name",
            "Value": {
              "Fn::Join" : [ " - ", [ { "Ref" : "ProjectName" }, { "Ref" : "Environment" }, "Database", {
                "Fn::Join" : [ " ", [ {
                  "Fn::FindInMap" : [ "ZoneId", { "Ref" : "SubnetsZone2" }, "Letter" ]
                }, "Zone" ] ]
              } ] ]
            }
          }
        ]
      }
    },
    "Database3Subnet": {
      "Type": "AWS::EC2::Subnet",
      "Properties": {
        "CidrBlock": {
          "Fn::Join" : [ ".", [ "10", { "Ref" : "ProjectId" }, {
            "Fn::Join" : [ "", [ { "Fn::If": [ "LiveEnvironment", "1", "2" ] }, "2", {
              "Fn::FindInMap" : [ "ZoneId", { "Ref" : "SubnetsZone3" }, "Number" ]
            } ] ]
          }, "0/24" ] ]
        },
        "AvailabilityZone": { "Ref" : "SubnetsZone3" },
        "VpcId": { "Ref": "EnvVPC" },
        "Tags": [
          {
            "Key": "Name",
            "Value": {
              "Fn::Join" : [ " - ", [ { "Ref" : "ProjectName" }, { "Ref" : "Environment" }, "Database", {
                "Fn::Join" : [ " ", [ {
                  "Fn::FindInMap" : [ "ZoneId", { "Ref" : "SubnetsZone3" }, "Letter" ]
                }, "Zone" ] ]
              } ] ]
            }
          }
        ]
      }
    },
    "DBSubnetGroup": {
      "Type": "AWS::RDS::DBSubnetGroup",
      "Properties": {
        "DBSubnetGroupDescription": { "Fn::Join" : [ " ", [ { "Ref" : "ProjectName" }, { "Ref" : "Environment" }, "DB Subnet Group" ] ] },
        "SubnetIds": [
          { "Ref": "Database1Subnet" },
          { "Ref": "Database2Subnet" },
          { "Ref": "Database3Subnet" }
        ]
      }
    },
    "Cache1Subnet": {
      "Type": "AWS::EC2::Subnet",
      "Properties": {
        "CidrBlock": {
          "Fn::Join" : [ ".", [ "10", { "Ref" : "ProjectId" }, {
            "Fn::Join" : [ "", [ { "Fn::If": [ "LiveEnvironment", "1", "2" ] }, "3", {
              "Fn::FindInMap" : [ "ZoneId", { "Ref" : "SubnetsZone1" }, "Number" ]
            } ] ]
          }, "0/24" ] ]
        },
        "AvailabilityZone": { "Ref" : "SubnetsZone1" },
        "VpcId": { "Ref": "EnvVPC" },
        "Tags": [
          {
            "Key": "Name",
            "Value": {
              "Fn::Join" : [ " - ", [ { "Ref" : "ProjectName" }, { "Ref" : "Environment" }, "Cache", {
                "Fn::Join" : [ " ", [ {
                  "Fn::FindInMap" : [ "ZoneId", { "Ref" : "SubnetsZone1" }, "Letter" ]
                }, "Zone" ] ]
              } ] ]
            }
          }
        ]
      }
    },
    "Cache2Subnet": {
      "Type": "AWS::EC2::Subnet",
      "Properties": {
        "CidrBlock": {
          "Fn::Join" : [ ".", [ "10", { "Ref" : "ProjectId" }, {
            "Fn::Join" : [ "", [ { "Fn::If": [ "LiveEnvironment", "1", "2" ] }, "3", {
              "Fn::FindInMap" : [ "ZoneId", { "Ref" : "SubnetsZone2" }, "Number" ]
            } ] ]
          }, "0/24" ] ]
        },
        "AvailabilityZone": { "Ref" : "SubnetsZone2" },
        "VpcId": { "Ref": "EnvVPC" },
        "Tags": [
          {
            "Key": "Name",
            "Value": {
              "Fn::Join" : [ " - ", [ { "Ref" : "ProjectName" }, { "Ref" : "Environment" }, "Cache", {
                "Fn::Join" : [ " ", [ {
                  "Fn::FindInMap" : [ "ZoneId", { "Ref" : "SubnetsZone2" }, "Letter" ]
                }, "Zone" ] ]
              } ] ]
            }
          }
        ]
      }
    },
    "Cache3Subnet": {
      "Type": "AWS::EC2::Subnet",
      "Properties": {
        "CidrBlock": {
          "Fn::Join" : [ ".", [ "10", { "Ref" : "ProjectId" }, {
            "Fn::Join" : [ "", [ { "Fn::If": [ "LiveEnvironment", "1", "2" ] }, "3", {
              "Fn::FindInMap" : [ "ZoneId", { "Ref" : "SubnetsZone3" }, "Number" ]
            } ] ]
          }, "0/24" ] ]
        },
        "AvailabilityZone": { "Ref" : "SubnetsZone3" },
        "VpcId": { "Ref": "EnvVPC" },
        "Tags": [
          {
            "Key": "Name",
            "Value": {
              "Fn::Join" : [ " - ", [ { "Ref" : "ProjectName" }, { "Ref" : "Environment" }, "Cache", {
                "Fn::Join" : [ " ", [ {
                  "Fn::FindInMap" : [ "ZoneId", { "Ref" : "SubnetsZone3" }, "Letter" ]
                }, "Zone" ] ]
              } ] ]
            }
          }
        ]
      }
    },
    "CacheSubnetGroup" : {
      "Type" : "AWS::ElastiCache::SubnetGroup",
      "Properties" : {
        "Description" : { "Fn::Join" : [ " ", [ { "Ref" : "ProjectName" }, { "Ref" : "Environment" }, "Cache Subnet Group" ] ] },
        "SubnetIds" : [
          { "Ref" : "Cache1Subnet" },
          { "Ref" : "Cache2Subnet" },
          { "Ref" : "Cache3Subnet" }
        ]
      }
    },
    "EnvInternetGateway": {
      "Type": "AWS::EC2::InternetGateway",
      "Properties": {
        "Tags": [
          {
            "Key": "Name",
            "Value": { "Fn::Join" : [ " - ", [ { "Ref" : "ProjectName" }, { "Ref" : "Environment" } ] ] }
          }
        ]
      }
    },
    "EnvVPCGatewayAttachment": {
      "Type": "AWS::EC2::VPCGatewayAttachment",
      "Properties": {
        "VpcId": { "Ref": "EnvVPC" },
        "InternetGatewayId": { "Ref": "EnvInternetGateway" }
      }
    },
    "PublicRouteTable": {
      "Type": "AWS::EC2::RouteTable",
      "Properties": {
        "VpcId": { "Ref": "EnvVPC" },
        "Tags": [
          {
            "Key": "Name",
            "Value": { "Fn::Join" : [ " - ", [ { "Ref" : "ProjectName" }, { "Ref" : "Environment" }, "Public" ] ] }
          }
        ]
      }
    },
    "PublicRoute": {
      "Type": "AWS::EC2::Route",
      "Properties": {
        "DestinationCidrBlock": "0.0.0.0/0",
        "RouteTableId": { "Ref": "PublicRouteTable" },
        "GatewayId": { "Ref": "EnvInternetGateway" }
      },
      "DependsOn": "EnvInternetGateway"
    },
    "Web1SubnetRTPublicAssociation": {
      "Type": "AWS::EC2::SubnetRouteTableAssociation",
      "Properties": {
        "RouteTableId": { "Ref": "PublicRouteTable" },
        "SubnetId": { "Ref": "Web1Subnet" }
      }
    },
    "Web2SubnetRTPublicAssociation": {
      "Type": "AWS::EC2::SubnetRouteTableAssociation",
      "Properties": {
        "RouteTableId": { "Ref": "PublicRouteTable" },
        "SubnetId": { "Ref": "Web2Subnet" }
      }
    },
    "Web3SubnetRTPublicAssociation": {
      "Type": "AWS::EC2::SubnetRouteTableAssociation",
      "Properties": {
        "RouteTableId": { "Ref": "PublicRouteTable" },
        "SubnetId": { "Ref": "Web3Subnet" }
      }
    },
    "PrivateRouteTable": {
      "Type": "AWS::EC2::RouteTable",
      "Properties": {
        "VpcId": { "Ref": "EnvVPC" },
        "Tags": [
          {
            "Key": "Name",
            "Value": { "Fn::Join" : [ " - ", [ { "Ref" : "ProjectName" }, { "Ref" : "Environment" }, "Private" ] ] }
          }
        ]
      }
    },
    "Database1SubnetRTPrivateAssociation": {
      "Type": "AWS::EC2::SubnetRouteTableAssociation",
      "Properties": {
        "RouteTableId": { "Ref": "PrivateRouteTable" },
        "SubnetId": { "Ref": "Database1Subnet" }
      }
    },
    "Database2SubnetRTPrivateAssociation": {
      "Type": "AWS::EC2::SubnetRouteTableAssociation",
      "Properties": {
        "RouteTableId": { "Ref": "PrivateRouteTable" },
        "SubnetId": { "Ref": "Database2Subnet" }
      }
    },
    "Database3SubnetRTPrivateAssociation": {
      "Type": "AWS::EC2::SubnetRouteTableAssociation",
      "Properties": {
        "RouteTableId": { "Ref": "PrivateRouteTable" },
        "SubnetId": { "Ref": "Database3Subnet" }
      }
    },
    "Cache1SubnetRTPrivateAssociation": {
      "Type": "AWS::EC2::SubnetRouteTableAssociation",
      "Properties": {
        "RouteTableId": { "Ref": "PrivateRouteTable" },
        "SubnetId": { "Ref": "Cache1Subnet" }
      }
    },
    "Cache2SubnetRTPrivateAssociation": {
      "Type": "AWS::EC2::SubnetRouteTableAssociation",
      "Properties": {
        "RouteTableId": { "Ref": "PrivateRouteTable" },
        "SubnetId": { "Ref": "Cache2Subnet" }
      }
    },
    "Cache3SubnetRTPrivateAssociation": {
      "Type": "AWS::EC2::SubnetRouteTableAssociation",
      "Properties": {
        "RouteTableId": { "Ref": "PrivateRouteTable" },
        "SubnetId": { "Ref": "Cache3Subnet" }
      }
    },
    "LB": {
      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "GroupDescription": { "Fn::Join" : [ " ", [ { "Ref" : "ProjectName" }, { "Ref" : "Environment" }, "Load Balancer VPC SG" ] ] },
        "VpcId": { "Ref": "EnvVPC" }
      }
    },
    "LBFromAllHttpRule": {
      "Type": "AWS::EC2::SecurityGroupIngress",
      "Properties": {
        "GroupId": { "Ref": "LB" },
        "IpProtocol": "tcp",
        "FromPort": "80",
        "ToPort": "80",
        "CidrIp": "0.0.0.0/0"
      }
    },
    "LBFromAllIpv6HttpRule": {
      "Type": "AWS::EC2::SecurityGroupIngress",
      "Properties": {
        "GroupId": { "Ref": "LB" },
        "IpProtocol": "tcp",
        "FromPort": "80",
        "ToPort": "80",
        "CidrIpv6": "::/0"
      }
    },
    "LBFromAllHttpsRule": {
      "Type": "AWS::EC2::SecurityGroupIngress",
      "Properties": {
        "GroupId": { "Ref": "LB" },
        "IpProtocol": "tcp",
        "FromPort": "443",
        "ToPort": "443",
        "CidrIp": "0.0.0.0/0"
      }
    },
    "LBFromAllIpv6HttpsRule": {
      "Type": "AWS::EC2::SecurityGroupIngress",
      "Properties": {
        "GroupId": { "Ref": "LB" },
        "IpProtocol": "tcp",
        "FromPort": "443",
        "ToPort": "443",
        "CidrIpv6": "::/0"
      }
    },
    "Web": {
      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "GroupDescription": { "Fn::Join" : [ " ", [ { "Ref" : "ProjectName" }, { "Ref" : "Environment" }, "Web VPC SG" ] ] },
        "VpcId": { "Ref": "EnvVPC" }
      }
    },
    "WebFromAllHttpRule": {
      "Type": "AWS::EC2::SecurityGroupIngress",
      "Properties": {
        "GroupId": { "Ref": "Web" },
        "IpProtocol": "tcp",
        "FromPort": "80",
        "ToPort": "80",
        "CidrIp": "0.0.0.0/0"
      }
    },
    "WebFromAllIpv6HttpRule": {
      "Type": "AWS::EC2::SecurityGroupIngress",
      "Properties": {
        "GroupId": { "Ref": "Web" },
        "IpProtocol": "tcp",
        "FromPort": "80",
        "ToPort": "80",
        "CidrIpv6": "::/0"
      }
    },
    "WebFromAllHttpsRule": {
      "Type": "AWS::EC2::SecurityGroupIngress",
      "Properties": {
        "GroupId": { "Ref": "Web" },
        "IpProtocol": "tcp",
        "FromPort": "443",
        "ToPort": "443",
        "CidrIp": "0.0.0.0/0"
      }
    },
    "WebFromAllIpv6HttpsRule": {
      "Type": "AWS::EC2::SecurityGroupIngress",
      "Properties": {
        "GroupId": { "Ref": "Web" },
        "IpProtocol": "tcp",
        "FromPort": "443",
        "ToPort": "443",
        "CidrIpv6": "::/0"
      }
    },
    "DB": {
      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "GroupDescription": { "Fn::Join" : [ " ", [ { "Ref" : "ProjectName" }, { "Ref" : "Environment" }, "Database VPC SG" ] ] },
        "VpcId": { "Ref": "EnvVPC" }
      }
    },
    "DBFromWebPostgresqlRule": {
      "Type": "AWS::EC2::SecurityGroupIngress",
      "Properties": {
        "GroupId": { "Ref": "DB" },
        "IpProtocol": "tcp",
        "FromPort": "5432",
        "ToPort": "5432",
        "SourceSecurityGroupId": { "Ref": "Web" },
        "SourceSecurityGroupOwnerId": { "Ref" : "AWS::AccountId" }
      }
    },
    "DBFromWebMysqlRule": {
      "Type": "AWS::EC2::SecurityGroupIngress",
      "Properties": {
        "GroupId": { "Ref": "DB" },
        "IpProtocol": "tcp",
        "FromPort": "3306",
        "ToPort": "3306",
        "SourceSecurityGroupId": { "Ref": "Web" },
        "SourceSecurityGroupOwnerId": { "Ref" : "AWS::AccountId" }
      }
    },
    "DBFromWebMongodbRule": {
      "Type": "AWS::EC2::SecurityGroupIngress",
      "Properties": {
        "GroupId": { "Ref": "DB" },
        "IpProtocol": "tcp",
        "FromPort": "27017",
        "ToPort": "27017",
        "SourceSecurityGroupId": { "Ref": "Web" },
        "SourceSecurityGroupOwnerId": { "Ref" : "AWS::AccountId" }
      }
    },
    "Cache": {
      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "GroupDescription": { "Fn::Join" : [ " ", [ { "Ref" : "ProjectName" }, { "Ref" : "Environment" }, "Cache VPC SG" ] ] },
        "VpcId": { "Ref": "EnvVPC" }
      }
    },
    "CacheFromWebRedisRule": {
      "Type": "AWS::EC2::SecurityGroupIngress",
      "Properties": {
        "GroupId": { "Ref": "Cache" },
        "IpProtocol": "tcp",
        "FromPort": "6379",
        "ToPort": "6379",
        "SourceSecurityGroupId": { "Ref": "Web" },
        "SourceSecurityGroupOwnerId": { "Ref" : "AWS::AccountId" }
      }
    },
    "CacheFromWebMemcachedRule": {
      "Type": "AWS::EC2::SecurityGroupIngress",
      "Properties": {
        "GroupId": { "Ref": "Cache" },
        "IpProtocol": "tcp",
        "FromPort": "11211",
        "ToPort": "11211",
        "SourceSecurityGroupId": { "Ref": "Web" },
        "SourceSecurityGroupOwnerId": { "Ref" : "AWS::AccountId" }
      }
    }
  }
}