template.yml

Resources:

  VPC:
     Type: AWS::EC2::VPC
     Properties:
      CidrBlock: 10.0.0.0/16

  Subnet:
    DependsOn: VPC
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.0.0/24

  User:
    Type: AWS::IAM::User
    Properties:
      Path: "/"
      Policies:
        - PolicyName: root
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action: "*"
                Resource: "*"
  Keys:
    Type: AWS::IAM::AccessKey
    Properties:
      UserName: !Ref User

  DirtyInstance:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: t2.micro
      ImageId: ami-22ce4934
      Tags:
        - Key: Name
          Value: Dirty Instance
        - Key: DirtyInstance
          Value: yup

  CustodianInstance:
    Type: AWS::EC2::Instance
    DependsOn:
      - User
      - Keys
      - Subnet
      - SecurityGroup
      - DirtyInstance
    Metadata:
      AWS::CloudFormation::Init:
        config:
          files:
            /root/custodian.yml:
              mode: "000644"
              owner: "root"
              group: "root"
              content: !Sub |
                ---
                policies:
                  - name: keep-instance-policy
                    resource: ec2
                    filters:
                      - "tag:DirtyInstance": present
                    actions:
                      - terminate
            /root/.aws/credentials:
              mode: "000644"
              owner: "root"
              group: "root"
              content: !Sub |
                [default]
                aws_access_key_id=${Keys}
                aws_secret_access_key=${Keys.SecretAccessKey}
            /root/.aws/config:
              mode: "000644"
              owner: "root"
              group: "root"
              content: !Sub |
                [default]
                region=us-east-1
          commands:
            1-virtualenv:
              command: "virtualenv custodian"
              cwd: "~"
            2-source:
              command: "source custodian/bin/activate && pip install c7n && custodian run --output-dir=. /root/custodian.yml"
              cwd: "~"
    Properties:
      SubnetId: !Ref Subnet
      InstanceType: t2.micro
      ImageId: ami-22ce4934
      Tags:
        - Key: Name
          Value: Custodian Instance
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash -v
          yum update -y aws-cfn-bootstrap
          /opt/aws/bin/cfn-init -s ${AWS::StackId} -r CustodianInstance --region ${AWS::Region}