resources.yml

Parameters:

  EnvironmentName: 
    Description: Name for the Environment 
    Type: String

  InstanceAMI: 
    Description: id of AMI image used by the webservers 
    Type: String
    Default: ami-08fdec01f5df9998f

  GroupMinSize:
    Description: Min size of the autoScaling Group 
    Type: String
    Default: '4'

  GroupMaxSize:
    Description: Max size of the autoScaling Group 
    Type: String
    Default: '4'


Resources:

#### SECURITY GROUPS
  LbSecGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow http to client host
      VpcId: 
        Fn::ImportValue:
          !Sub ${EnvironmentName}-VPCID
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0

  WebAppSecGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow http to client host
      VpcId: 
        Fn::ImportValue:
          !Sub ${EnvironmentName}-VPCID
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0

  JumpBoxSecGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow ssh only to my personal ip address
      VpcId: 
        Fn::ImportValue:
          !Sub ${EnvironmentName}-VPCID
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 41.83.53.130/32

#### LAUNCH CONFIGURATION WITH ACCESS S3 PROFILE
  WebAppLaunchConfiguration:
    Type: AWS::AutoScaling::LaunchConfiguration
    DependsOn: S3Bucket
    Properties: 
      LaunchConfigurationName: WebAppLaunchConfiguration
      IamInstanceProfile: !Ref AccessS3RoleInstanceProfile
      ImageId: !Ref InstanceAMI
      SecurityGroups: 
        - !Ref WebAppSecGroup
      InstanceType: t2.medium
      BlockDeviceMappings: 
        - DeviceName: /dev/sda1
          Ebs: 
            VolumeSize: 10
            VolumeType: gp3
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash
          sudo apt-get update
          sudo apt-get install apache2 -y
          sudo systemctl start apache2
          sudo systemctl enable apache2
          aws s3 cp s3://${S3Bucket}/index.html /var/www/html/index.html
          systemctl restart apache2

#### AUTOSCALING GROUP      
  WebAppAutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    DependsOn: WebAppLaunchConfiguration
    Properties:
      LaunchConfigurationName: WebAppLaunchConfiguration
      MaxSize: !Ref GroupMaxSize
      MinSize: !Ref GroupMinSize
      VPCZoneIdentifier:
        - Fn::ImportValue:
           !Sub ${EnvironmentName}-PRIV-SN1
        - Fn::ImportValue:
           !Sub ${EnvironmentName}-PRIV-SN2
      TargetGroupARNs:
      - !Ref WebAppTargetGroup
      Tags:
          - Key: Name
            PropagateAtLaunch: true
            Value: !Sub '${EnvironmentName}-AUTS-GRP'

#### TARGET GROUP
  WebAppTargetGroup: 
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties: 
      HealthCheckEnabled: true
      HealthCheckIntervalSeconds: 30
      HealthCheckPath: "/"
      HealthCheckProtocol: HTTP
      HealthCheckTimeoutSeconds: 5
      HealthyThresholdCount: 5
      Name: WebAppTargetGroup
      Port: 80
      Protocol: HTTP
      TargetType: instance
      UnhealthyThresholdCount: 2
      VpcId:
        Fn::ImportValue:
              !Sub ${EnvironmentName}-VPCID
      Tags:
          - Key: Name
            Value: !Sub '${EnvironmentName}-TGT-GRP'

#### LOAD BALANCER
  WebAppLoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties: 
      Name: WebAppLoadBalancer
      SecurityGroups: 
        - !Ref LbSecGroup
      Subnets: 
        - Fn::ImportValue:
           !Sub ${EnvironmentName}-PUB-SN1
        - Fn::ImportValue:
           !Sub ${EnvironmentName}-PUB-SN2
      Tags:
          - Key: Name
            Value: !Sub '${EnvironmentName}-LB'

#### LISTENER FOR THE LOADBALANCER
  Listener:
    Type: 'AWS::ElasticLoadBalancingV2::Listener'
    Properties:
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref WebAppTargetGroup
      LoadBalancerArn: !Ref WebAppLoadBalancer
      Port: 80
      Protocol: HTTP

#### LISTENER RULE
  ListenerRule:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties: 
      Actions: 
        - Type: "forward"
          TargetGroupArn: !Ref WebAppTargetGroup
      Conditions: 
        - Field: path-pattern
          Values: 
            - /*
      ListenerArn: !Ref Listener
      Priority: 1

#### IAM ROLE THAT PROVIDE ACCESS TO S3 BUCKET
  AccessS3Role:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /
      Policies:
        - PolicyName: AccessS3
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                - s3:Get*
                - s3:List*
                - s3:AbortMultipartUpload
                Resource: !Join 
                  - ''
                  - - 'arn:aws:s3:::'
                    - !Ref S3Bucket
                    - /*

#### ACCESS S3 PROFILE TO INSTANCES ASSOCIATED WITH LAUNCH CONFIGURATION
  AccessS3RoleInstanceProfile:
    Type: 'AWS::IAM::InstanceProfile'
    Properties:
      Path: /
      Roles:
        - !Ref AccessS3Role

#### S3 BUCKET 
  S3Bucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      AccessControl: PublicRead
      WebsiteConfiguration:
        IndexDocument: index.html
        ErrorDocument: error.html
    DeletionPolicy: Retain

#### CREATE A S3 OBJECT TO STORE OUR INDEX.HTML FILE 
  S3BucketObject:
    Type: AWS::S3::Object
    Properties:
      Bucket: !Ref S3Bucket
      Key: index.html
      Content: |
        <h1>it works! Udagram, Udacity</h1>
          

#### S3 BUCKET POLICY
  BucketPolicy:
    Type: 'AWS::S3::BucketPolicy'
    Properties:
      PolicyDocument:
        Id: MyPolicy
        Version: 2012-10-17
        Statement:
          - Sid: PublicReadForGetBucketObjects
            Effect: Allow
            Principal: '*'
            Action: 's3:GetObject'
            Resource: !Join 
              - ''
              - - 'arn:aws:s3:::'
                - !Ref S3Bucket
                - /*
      Bucket: !Ref S3Bucket

#### JUMPBOX 
  JumpBoxInstance: 
    Type: AWS::EC2::Instance
    Properties: 
      ImageId: ami-08fdec01f5df9998f
      InstanceType: t2.micro
      NetworkInterfaces: 
        - AssociatePublicIpAddress: true
          DeviceIndex: "0"
          GroupSet: 
            - !Ref "JumpBoxSecGroup"
          SubnetId: 
            Fn::ImportValue:
              !Sub ${EnvironmentName}-PUB-SN1

  

Outputs:
  URL:
    Value: !Join ['', [ 'http://', !GetAtt WebAppLoadBalancer.DNSName]]