vpc-production.template

AWSTemplateFormatVersion: 2010-09-09
Description: 'Provides networking configuration for a standard, public facing application, separates private-public subnets and enforces traffic with NACL rules (qs-1nb14cqcl)'
Metadata:
    AWS::CloudFormation::Interface:
        ParameterGroups:
          - Label:
                default: Region Config
            Parameters:
              - pRegionAZ1Name
              - pRegionAZ2Name
          - Label:
                default: Production VPC Config
            Parameters:
              - pBastionSSHCIDR
              - pProductionVPCName
              - pProductionCIDR
              - pDMZSubnetACIDR
              - pDMZSubnetBCIDR
              - pAppPrivateSubnetACIDR
              - pAppPrivateSubnetBCIDR
              - pDBPrivateSubnetACIDR
              - pDBPrivateSubnetBCIDR
              - pEC2KeyPair
              - pVPCTenancy
          - Label:
                default: AWS Quick Start Configuration
            Parameters:
              - QuickStartS3URL
              - QSS3BucketName
              - QSS3KeyPrefix
        ParameterLabels:
            pProductionVPCName:
                default: Name of Production VPC
            pProductionCIDR:
                default: Production VPC CIDR block
            pDMZSubnetACIDR:
                default: CIDR block of DMZ A subnet (internet facing)
            pDMZSubnetBCIDR:
                default: CIDR block of DMZ B subnet (internet facing)
            pAppPrivateSubnetACIDR:
                default: CIDR block of Application B subnet (private)
            pAppPrivateSubnetBCIDR:
                default: CIDR block of Application A subnet (private)
            pDBPrivateSubnetACIDR:
                default: CIDR block of Database A subnet (private)
            pDBPrivateSubnetBCIDR:
                default: CIDR block of Database B subnet (private)
            pEC2KeyPair:
                default: Name of existing SSH Key for NAT Instance
            pVPCTenancy:
                default: Instance tenancy
            QuickStartS3URL:
                default: Quick Start URL
            QSS3BucketName:
                default: Quick Start S3 Bucket Name
            QSS3KeyPrefix:
                default: Quick Start S3 Key Prefix
    Stack:
        Value: 2
    VersionDate:
        Value: 20160510
    Identifier:
        Value: template-vpc-production
    Input:
        Description: CIDR blocks, VPC names, KeyName, EC2 instance size
    Output:
        Description: Outputs ID of all deployed resources
Conditions:
    cNeedNatInstance: !Equals [ false, !Ref pSupportsNatGateway ]
    cSupportsNatGateway: !Equals [ true, !Ref pSupportsNatGateway ]
    cEnableFlowLogs: !Not [ !Equals [ !Ref pFlowLogGroup, '' ] ]
Parameters:
    pBastionSSHCIDR:
        Description: CIDR block to allow access to bastion SSH
        Type: String
        Default: 0.0.0.0/0
    pRegionAZ1Name:
        Description: Availability Zone 1 Name in Region
        Type: AWS::EC2::AvailabilityZone::Name
    pRegionAZ2Name:
        Description: Availability Zone 2 Name in Region
        Type: AWS::EC2::AvailabilityZone::Name
    pProductionVPCName:
        Description: Production VPC Name
        Type: String
        Default: CommandCentral-Production
    pProductionCIDR:
        Description: CIDR block for Production VPC
        Type: String
        Default: 10.100.0.0/16
    pManagementCIDR:
        Description: CIDR of Management VPC
        Type: String
    pDMZSubnetACIDR:
        Description: CIDR block for DMZ AZ-1b subnet
        Type: String
        Default: 10.100.10.0/24
    pDMZSubnetBCIDR:
        Description: CIDR block for DMZ AZ-1b subnet
        Type: String
        Default: 10.100.20.0/24
    pAppPrivateSubnetACIDR:
        Description: CIDR block for Application AZ-1a subnet
        Type: String
        Default: 10.100.96.0/21
    pAppPrivateSubnetBCIDR:
        Description: CIDR block for Application AZ-1b subnet
        Type: String
        Default: 10.100.119.0/21
    pDBPrivateSubnetACIDR:
        Description: CIDR block for Private AZ-1a subnet
        Type: String
        Default: 10.100.194.0/21
    pDBPrivateSubnetBCIDR:
        Description: CIDR block for Private AZ-1b subnet
        Type: String
        Default: 10.100.212.0/21
    pEC2KeyPair:
        Description: Name of existing EC2 key pair for production hosts
        Type: String
        Default: ''
    pVPCTenancy:
        Description: Instance tenancy behavior for this VPC
        Type: String
        Default: default
        AllowedValues:
          - default
          - dedicated
    pEnvironment:
        Description: Environment (development, test, or production)
        Type: String
        Default: development
    pSupportsNatGateway:
        Description: Specifies whether this region supports NAT Gateway (this value is determined by the main stack if it is invoked from there)
        Type: String
        Default: true
    pNatAmi:
        Description: AMI to use for the NAT intstance if the region does not support NAT Gateway (this value is determined by the main stack if it is invoked from there)
        Type: String
        Default: ''
    pNatInstanceType:
        Description: Instance type to use for the NAT intstance if the region does not support NAT Gateway (this value is determined by the main stack if it is invoked from there)
        Type: String
        Default: ''
    pFlowLogGroup:
          Description: Log Group for capturing VPC Flow Logs
          Type: String
          Default: ''
    QuickStartS3URL:
        Description: Quick Start S3 URL prefix.
        Default: https://s3.amazonaws.com
        Type: String
    QSS3BucketName:
        AllowedPattern: ^[0-9a-zA-Z]+([0-9a-zA-Z\-\.]*[0-9a-zA-Z])*$
        ConstraintDescription: Quick Start bucket name can include numbers, lowercase
            letters, uppercase letters, periods (.), and hyphens (-). It cannot start or end with a hyphen
            (-).
        Default: quickstart-reference
        Description: S3 bucket name for the Quick Start assets. Quick Start bucket name
            can include numbers, lowercase letters, uppercase letters, periods (.), and hyphens (-).
            It cannot start or end with a hyphen (-).
        Type: String
    QSS3KeyPrefix:
        AllowedPattern: ^[0-9a-zA-Z-]+(/[0-9a-zA-Z-]+)*$
        ConstraintDescription: Quick Start key prefix can include numbers, lowercase letters,
            uppercase letters, hyphens (-), and forward slash (/). It cannot start or end
            with forward slash (/) because they are automatically appended.
        Default: quickstart-enterprise-accelerator-nist
        Description: S3 key prefix for the Quick Start assets. Quick Start key prefix
            can include numbers, lowercase letters, uppercase letters, hyphens (-), and
            forward slash (/). It cannot start or end with forward slash (/) because they
            are automatically appended.
        Type: String
Resources:
    rVPCProduction:
        Type: AWS::EC2::VPC
        Properties:
            CidrBlock: !Ref pProductionCIDR
            InstanceTenancy: !Ref pVPCTenancy
            EnableDnsSupport: true
            EnableDnsHostnames: true
            Tags:
              - Key: Name
                Value: !Ref pProductionVPCName
              - Key: Environment
                Value: !Ref pEnvironment
    rSecurityGroupVpcNat:
        Type: AWS::EC2::SecurityGroup
        Properties:
            GroupDescription: Allow NAT from production
            VpcId: !Ref rVPCProduction
            SecurityGroupIngress:
              - IpProtocol: tcp
                FromPort: 80
                ToPort: 80
                CidrIp: !Ref pProductionCIDR
              - IpProtocol: tcp
                FromPort: 443
                ToPort: 443
                CidrIp: !Ref pProductionCIDR
            Tags:
              - Key: Name
                Value: sg-web-access-ports-from-production
              - Key: Environment
                Value: !Ref pEnvironment
    rSecurityGroupMgmtBastion:
        Type: AWS::EC2::SecurityGroup
        Properties:
            GroupDescription: Allow Bastion from Management Network
            VpcId: !Ref rVPCProduction
            SecurityGroupIngress:
              - IpProtocol: tcp
                FromPort: 22
                ToPort: 22
                CidrIp: !Ref pBastionSSHCIDR
            Tags:
              - Key: Name
                Value: sg-ssh-access-from-management-vpc
              - Key: Environment
                Value: !Ref pEnvironment
    rSecurityGroupSSHFromProd:
        Type: AWS::EC2::SecurityGroup
        Properties:
            GroupDescription: Enable SSH access via port 22
            VpcId: !Ref rVPCProduction
            SecurityGroupIngress:
              - IpProtocol: tcp
                FromPort: 22
                ToPort: 22
                CidrIp: !Ref pProductionCIDR
            Tags:
              - Key: Name
                Value: sg-enable-ssh-access
              - Key: Environment
                Value: !Ref pEnvironment
    rDMZSubnetA:
        Type: AWS::EC2::Subnet
        Properties:
            CidrBlock: !Ref pDMZSubnetACIDR
            AvailabilityZone: !Ref pRegionAZ1Name
            VpcId: !Ref rVPCProduction
            Tags:
              - Key: Name
                Value: Production DMZ Subnet A
              - Key: Environment
                Value: !Ref pEnvironment
    rDMZSubnetB:
        Type: AWS::EC2::Subnet
        Properties:
            CidrBlock: !Ref pDMZSubnetBCIDR
            AvailabilityZone: !Ref pRegionAZ2Name
            VpcId: !Ref rVPCProduction
            Tags:
              - Key: Name
                Value: Production DMZ Subnet B
              - Key: Environment
                Value: !Ref pEnvironment
    rAppPrivateSubnetA:
        Type: AWS::EC2::Subnet
        Properties:
            CidrBlock: !Ref pAppPrivateSubnetACIDR
            AvailabilityZone: !Ref pRegionAZ1Name
            VpcId: !Ref rVPCProduction
            Tags:
              - Key: Name
                Value: Production App Subnet A
              - Key: Environment
                Value: !Ref pEnvironment
    rAppPrivateSubnetB:
        Type: AWS::EC2::Subnet
        Properties:
            CidrBlock: !Ref pAppPrivateSubnetBCIDR
            AvailabilityZone: !Ref pRegionAZ2Name
            VpcId: !Ref rVPCProduction
            Tags:
              - Key: Name
                Value: Production App Subnet B
              - Key: Environment
                Value: !Ref pEnvironment
    rDBPrivateSubnetA:
        Type: AWS::EC2::Subnet
        Properties:
            CidrBlock: !Ref pDBPrivateSubnetACIDR
            AvailabilityZone: !Ref pRegionAZ1Name
            VpcId: !Ref rVPCProduction
            Tags:
              - Key: Name
                Value: Production DB Subnet A
              - Key: Environment
                Value: !Ref pEnvironment
    rDBPrivateSubnetB:
        Type: AWS::EC2::Subnet
        Properties:
            CidrBlock: !Ref pDBPrivateSubnetBCIDR
            AvailabilityZone: !Ref pRegionAZ2Name
            VpcId: !Ref rVPCProduction
            Tags:
              - Key: Name
                Value: Production DB Subnet B
              - Key: Environment
                Value: !Ref pEnvironment
    rIGWProd:
        Type: AWS::EC2::InternetGateway
        Properties:
            Tags:
              - Key: Name
                Value: igw-production
              - Key: Environment
                Value: !Ref pEnvironment
    rNACLPublic:
        Type: AWS::EC2::NetworkAcl
        Properties:
            VpcId: !Ref rVPCProduction
    rNACLPrivate:
        Type: AWS::EC2::NetworkAcl
        Properties:
            VpcId: !Ref rVPCProduction
    rRouteTableMain:
        Type: AWS::EC2::RouteTable
        Properties:
            VpcId: !Ref rVPCProduction
            Tags:
              - Key: Name
                Value: Production DMZ Route
    rEIPProdNatA:
        Type: AWS::EC2::EIP
        Properties:
            Domain: vpc
    rNATGatewaySubnetA:
        Type: AWS::EC2::NatGateway
        DependsOn: rIGWProd
        Condition: cSupportsNatGateway
        Properties:
            AllocationId: !GetAtt rEIPProdNatA.AllocationId
            SubnetId: !Ref rDMZSubnetA
    rEIPProdNatB:
        Type: AWS::EC2::EIP
        Properties:
            Domain: vpc
    rNATGatewaySubnetB:
        Type: AWS::EC2::NatGateway
        DependsOn: rIGWProd
        Condition: cSupportsNatGateway
        Properties:
            AllocationId: !GetAtt rEIPProdNatB.AllocationId
            SubnetId: !Ref rDMZSubnetB
    rNatInstanceTemplate:
        Type: AWS::CloudFormation::Stack
        Condition: cNeedNatInstance
        Properties:
            TemplateURL: !Sub ${QuickStartS3URL}/${QSS3BucketName}/${QSS3KeyPrefix}/nat-instance.template
            TimeoutInMinutes: 20
            Parameters:
                pDMZSubnetA: !Ref rDMZSubnetA
                pSecurityGroupSSHFromVpc: !Ref rSecurityGroupSSHFromProd
                pSecurityGroupVpcNat: !Ref rSecurityGroupVpcNat
                pNatAmi: !Ref pNatAmi
                pNatInstanceType: !Ref pNatInstanceType
                pEC2KeyPair: !Ref pEC2KeyPair
                pVpcId: !Ref rVPCProduction
                pVpcName: !Ref pProductionVPCName
                pRouteTablePrivateA: !Ref rRouteTableProdPrivateA
                pRouteTablePrivateB: !Ref rRouteTableProdPrivateB
                pEipNatAllocationId: !GetAtt rEIPProdNatA.AllocationId
    rRouteProdIGW:
        Type: AWS::EC2::Route
        DependsOn: rGWAttachmentProdIGW
        Properties:
            RouteTableId: !Ref rRouteTableMain
            GatewayId: !Ref rIGWProd
            DestinationCidrBlock: 0.0.0.0/0
    rRouteProdPrivateNatGatewayA:
        Type: AWS::EC2::Route
        Condition: cSupportsNatGateway
        Properties:
            DestinationCidrBlock: 0.0.0.0/0
            RouteTableId: !Ref rRouteTableProdPrivateA
            NatGatewayId: !Ref rNATGatewaySubnetA
    rRouteProdPrivateNatGatewayB:
        Type: AWS::EC2::Route
        Condition: cSupportsNatGateway
        Properties:
            DestinationCidrBlock: 0.0.0.0/0
            RouteTableId: !Ref rRouteTableProdPrivateB
            NatGatewayId: !Ref rNATGatewaySubnetB
    rRouteAssocProdDMZA:
        Type: AWS::EC2::SubnetRouteTableAssociation
        Properties:
            RouteTableId: !Ref rRouteTableMain
            SubnetId: !Ref rDMZSubnetA
    rRouteAssocProdDMZB:
        Type: AWS::EC2::SubnetRouteTableAssociation
        Properties:
            RouteTableId: !Ref rRouteTableMain
            SubnetId: !Ref rDMZSubnetB
    rAppPrivateSubnetAssociationA:
        Type: AWS::EC2::SubnetRouteTableAssociation
        Properties:
            RouteTableId: !Ref rRouteTableProdPrivateA
            SubnetId: !Ref rAppPrivateSubnetA
    rAppPrivateSubnetAssociationB:
        Type: AWS::EC2::SubnetRouteTableAssociation
        Properties:
            RouteTableId: !Ref rRouteTableProdPrivateB
            SubnetId: !Ref rAppPrivateSubnetB
    rRouteAssocDBPrivateA:
        Type: AWS::EC2::SubnetRouteTableAssociation
        Properties:
            RouteTableId: !Ref rRouteTableProdPrivateA
            SubnetId: !Ref rDBPrivateSubnetA
    rRouteAssocDBPrivateB:
        Type: AWS::EC2::SubnetRouteTableAssociation
        Properties:
            RouteTableId: !Ref rRouteTableProdPrivateB
            SubnetId: !Ref rDBPrivateSubnetB
    rRouteTableProdPrivateA:
        Type: AWS::EC2::RouteTable
        Properties:
            VpcId: !Ref rVPCProduction
            Tags:
              - Key: Name
                Value: Production Private Route A
    rRouteTableProdPrivateB:
        Type: AWS::EC2::RouteTable
        Properties:
            VpcId: !Ref rVPCProduction
            Tags:
              - Key: Name
                Value: Production Private Route B
    rNACLRuleAllowAllTCPInternal:
        Type: AWS::EC2::NetworkAclEntry
        Properties:
            CidrBlock: !Ref pProductionCIDR
            Protocol: 6
            PortRange:
                From: 1
                To: 65535
            RuleAction: allow
            RuleNumber: 120
            NetworkAclId: !Ref rNACLPrivate
    rNACLRuleAllowBastionSSHAccessPrivate:
        Type: AWS::EC2::NetworkAclEntry
        Properties:
            CidrBlock: 0.0.0.0/0
            Protocol: 6
            PortRange:
                From: 22
                To: 22
            RuleAction: allow
            RuleNumber: 130
            NetworkAclId: !Ref rNACLPrivate
    rNACLRuleAllowMgmtAccessSSHtoPrivate:
        Type: AWS::EC2::NetworkAclEntry
        Properties:
            CidrBlock: !Ref pManagementCIDR
            Protocol: 6
            PortRange:
                From: 22
                To: 22
            RuleAction: allow
            RuleNumber: 125
            NetworkAclId: !Ref rNACLPrivate
    rNACLRuleAllowReturnTCPPriv:
        Type: AWS::EC2::NetworkAclEntry
        Properties:
            CidrBlock: 0.0.0.0/0
            Protocol: 6
            PortRange:
                From: 1024
                To: 65535
            RuleAction: allow
            RuleNumber: 140
            NetworkAclId: !Ref rNACLPrivate
    rNACLRuleAllowALLfromPrivEgress:
        Type: AWS::EC2::NetworkAclEntry
        Properties:
            CidrBlock: 0.0.0.0/0
            Egress: true
            Protocol: 6
            PortRange:
                From: 1
                To: 65535
            RuleAction: allow
            RuleNumber: 120
            NetworkAclId: !Ref rNACLPrivate
    rNACLRuleAllowAllTCPInternalEgress:
        Type: AWS::EC2::NetworkAclEntry
        Properties:
            CidrBlock: 0.0.0.0/0
            Egress: true
            Protocol: 6
            PortRange:
                From: 1
                To: 65535
            RuleAction: allow
            RuleNumber: 100
            NetworkAclId: !Ref rNACLPrivate
    rNACLRuleAllowALLEgressPublic:
        Type: AWS::EC2::NetworkAclEntry
        Properties:
            CidrBlock: 0.0.0.0/0
            Egress: true
            Protocol: 6
            PortRange:
                From: 1
                To: 65535
            RuleAction: allow
            RuleNumber: 100
            NetworkAclId: !Ref rNACLPublic
    rNACLRuleAllowAllReturnTCP:
        Type: AWS::EC2::NetworkAclEntry
        Properties:
            CidrBlock: 0.0.0.0/0
            Protocol: 6
            PortRange:
                From: 1024
                To: 65535
            RuleAction: allow
            RuleNumber: 140
            NetworkAclId: !Ref rNACLPublic
    rNACLRuleAllowHTTPfromProd:
        Type: AWS::EC2::NetworkAclEntry
        Properties:
            CidrBlock: !Ref pProductionCIDR
            Protocol: 6
            PortRange:
                From: 80
                To: 80
            RuleAction: allow
            RuleNumber: 200
            NetworkAclId: !Ref rNACLPublic
    rNACLRuleAllowBastionSSHAccessPublic:
        Type: AWS::EC2::NetworkAclEntry
        Properties:
            CidrBlock: 0.0.0.0/0
            Protocol: 6
            PortRange:
                From: 22
                To: 22
            RuleAction: allow
            RuleNumber: 210
            NetworkAclId: !Ref rNACLPublic
    rNACLRuleAllowEgressReturnTCP:
        Type: AWS::EC2::NetworkAclEntry
        Properties:
            CidrBlock: 0.0.0.0/0
            Egress: true
            Protocol: 6
            PortRange:
                From: 1024
                To: 65535
            RuleAction: allow
            RuleNumber: 140
            NetworkAclId: !Ref rNACLPublic
    rNACLRuleAllowHTTPSPublic:
        Type: AWS::EC2::NetworkAclEntry
        Properties:
            CidrBlock: 0.0.0.0/0
            Protocol: 6
            PortRange:
                From: 443
                To: 443
            RuleAction: allow
            RuleNumber: 100
            NetworkAclId: !Ref rNACLPublic
    rNACLAssocAppPrivSubnetB:
        Type: AWS::EC2::SubnetNetworkAclAssociation
        Properties:
            NetworkAclId: !Ref rNACLPrivate
            SubnetId: !Ref rAppPrivateSubnetB
    rNACLAssocDMZPubSubnetA:
        Type: AWS::EC2::SubnetNetworkAclAssociation
        Properties:
            NetworkAclId: !Ref rNACLPublic
            SubnetId: !Ref rDMZSubnetA
    rNACLAssocDMZPubSubnetB:
        Type: AWS::EC2::SubnetNetworkAclAssociation
        Properties:
            NetworkAclId: !Ref rNACLPublic
            SubnetId: !Ref rDMZSubnetB
    rNACLAssocAppPrivSubnetA:
        Type: AWS::EC2::SubnetNetworkAclAssociation
        Properties:
            NetworkAclId: !Ref rNACLPrivate
            SubnetId: !Ref rAppPrivateSubnetA
    rNACLAssocDBPrivSubnetA:
        Type: AWS::EC2::SubnetNetworkAclAssociation
        Properties:
            NetworkAclId: !Ref rNACLPrivate
            SubnetId: !Ref rDBPrivateSubnetA
    rNACLAssocDBPrivSubnetB:
        Type: AWS::EC2::SubnetNetworkAclAssociation
        Properties:
            NetworkAclId: !Ref rNACLPrivate
            SubnetId: !Ref rDBPrivateSubnetB
    rGWAttachmentProdIGW:
        Type: AWS::EC2::VPCGatewayAttachment
        DependsOn: rIGWProd
        Properties:
            VpcId: !Ref rVPCProduction
            InternetGatewayId: !Ref rIGWProd
    rProductionVpcFlowLogsServiceRole:
        Condition: cEnableFlowLogs
        Type: AWS::IAM::Role
        Properties:
            AssumeRolePolicyDocument:
                Version: 2012-10-17
                Statement:
                  - Sid: AllowFlowLogs
                    Effect: Allow
                    Principal:
                        Service: vpc-flow-logs.amazonaws.com
                    Action: sts:AssumeRole
            Path: /
            Policies:
              - PolicyName: cloudwatchlogsrole
                PolicyDocument:
                    Version: 2012-10-17
                    Statement:
                      - Action:
                          - logs:CreateLogGroup
                          - logs:CreateLogStream
                          - logs:PutLogEvents
                          - logs:DescribeLogGroups
                          - logs:DescribeLogStreams
                        Effect: Allow
                        Resource: '*'
    rProductionVpcFlowLog:
        Condition: cEnableFlowLogs
        Type: AWS::EC2::FlowLog
        Properties:
            DeliverLogsPermissionArn: !GetAtt rProductionVpcFlowLogsServiceRole.Arn
            LogGroupName: !Ref pFlowLogGroup
            ResourceId: !Ref rVPCProduction
            ResourceType: VPC
            TrafficType: ALL
    rProductionVpcFlowLogStream:
        Condition: cEnableFlowLogs
        Type: AWS::Logs::LogStream
        Properties:
            LogGroupName: !Ref pFlowLogGroup
Outputs:
    rVPCProduction:
        Value: !Ref rVPCProduction
    rDMZSubnetA:
        Value: !Ref rDMZSubnetA
    rDMZSubnetB:
        Value: !Ref rDMZSubnetB
    rRouteTableProdPrivate:
        Value: !Ref rRouteTableProdPrivateA
    rRouteTableProdPrivateB:
        Value: !Ref rRouteTableProdPrivateB
    rRouteTableProdPublic:
        Value: !Ref rRouteTableMain
    rAppPrivateSubnetA:
        Value: !Ref rAppPrivateSubnetA
    rAppPrivateSubnetB:
        Value: !Ref rAppPrivateSubnetB
    rDBPrivateSubnetA:
        Value: !Ref rDBPrivateSubnetA
    rDBPrivateSubnetB:
        Value: !Ref rDBPrivateSubnetB
    rNACLPrivate:
        Value: !Ref rNACLPrivate
    rNACLPublic:
        Value: !Ref rNACLPublic
    rSecurityGroupSSHFromProd:
        Value: !Ref rSecurityGroupSSHFromProd
    rSecurityGroupVpcNat:
        Value: !Ref rSecurityGroupVpcNat