example.yml

---
# Copyright 2018 widdix GmbH
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
AWSTemplateFormatVersion: '2010-09-09'
Description: 'cfn-modules: ASG singleton SSM example'
Resources:
  Alerting:
    Type: 'AWS::CloudFormation::Stack'
    Properties:
      Parameters:
        Email: 'email@domain.com' # replace with your email address to receive alerts
        # HttpsEndpoint: 'https://api.marbot.io/v1/endpoint/xyz' # or uncommnet and receive alerts in Slack or Microsoft Teams using marbot.io
      TemplateURL: './node_modules/@cfn-modules/alerting/module.yml'
  Vpc:
    Type: 'AWS::CloudFormation::Stack'
    Properties:
      Parameters:
        AlertingModule: !GetAtt 'Alerting.Outputs.StackName'
        S3Endpoint: 'false' # speed up the example
        DynamoDBEndpoint: 'false' # speed up the example
        FlowLog: 'false' # speed up the example
        NatGateways: 'false' # speed up the example
      TemplateURL: './node_modules/@cfn-modules/vpc/module.yml'
  AsgPolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Properties:
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Action:
          - 'ssm:ListInstanceAssociations' # State Manager by https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-messageAPIs.html
          - 'ssm:GetDeployablePatchSnapshotForInstance' # Patch Manager by trial and error
          Resource: '*'
        - Effect: Allow # Patch Manager by trial and error
          Action: 'ssm:PutInventory'
          Resource: '*'
        - Effect: Allow # Patch Manager by https://docs.aws.amazon.com/systems-manager/latest/userguide/ssm-agent-minimum-s3-permissions.html
          Action: 's3:GetObject'
          Resource:
          - !Sub 'arn:aws:s3:::aws-ssm-${AWS::Region}/*'
          - !Sub 'arn:aws:s3:::amazon-ssm-${AWS::Region}/*'
          - !Sub 'arn:aws:s3:::amazon-ssm-packages-${AWS::Region}/*'
          - !Sub 'arn:aws:s3:::${AWS::Region}-birdwatcher-prod/*'
          - !Sub 'arn:aws:s3:::patch-baseline-snapshot-${AWS::Region}/*'
        - Effect: Allow # AWS-GatherSoftwareInventory
          Action: 'ssm:GetDocument'
          Resource: !Sub 'arn:${AWS::Partition}:ssm:${AWS::Region}::document/AWS-GatherSoftwareInventory'
        - Effect: Allow # AWS-GatherSoftwareInventory
          Action: 'ssm:UpdateInstanceAssociationStatus'
          Resource: '*'
  AsgSingleton:
    Type: 'AWS::CloudFormation::Stack'
    Properties:
      Parameters:
        VpcModule: !GetAtt 'Vpc.Outputs.StackName'
        AlertingModule: !GetAtt 'Alerting.Outputs.StackName'
        AmazonLinux2Version: '2.0.20181114'
        ManagedPolicyArns: !Ref AsgPolicy
      TemplateURL: './node_modules/@cfn-modules/asg-singleton-amazon-linux2/module.yml'
  AssociationGatherSoftwareInventory:
    Type: 'AWS::SSM::Association'
    Properties:
      Name: 'AWS-GatherSoftwareInventory'
      ScheduleExpression: 'rate(1 hour)'
      Targets:
      - Key: 'tag:aws:autoscaling:groupName'
        Values: [!GetAtt 'AsgSingleton.Outputs.Name']
  AssociationRunPatchBaselineScan:
    Type: 'AWS::SSM::Association'
    Properties:
      Name: 'AWS-RunPatchBaseline'
      Parameters:
        Operation: [Scan]
      ScheduleExpression: 'rate(1 hour)'
      Targets:
      - Key: 'tag:aws:autoscaling:groupName'
        Values: [!GetAtt 'AsgSingleton.Outputs.Name']
  AssociationRunPatchBaselineInstall:
    Type: 'AWS::SSM::Association'
    Properties:
      Name: 'AWS-RunPatchBaseline'
      Parameters:
        Operation: [Install]
      ScheduleExpression: 'rate(1 hour)'
      Targets:
      - Key: 'tag:aws:autoscaling:groupName'
        Values: [!GetAtt 'AsgSingleton.Outputs.Name']