bind53.cfn

{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Description": "Serve Route 53 hosted zones over BIND",

    "Metadata": {
        "LastUpdated": "2016-05-25"
    },

    "Mappings": {
        "AmazonLinux": {
            "ap-northeast-1":   { "HVM64": "ami-29160d47" },
            "ap-northeast-2":   { "HVM64": "ami-cf32faa1" },
            "ap-southeast-1":   { "HVM64": "ami-1ddc0b7e" },
            "ap-southeast-2":   { "HVM64": "ami-0c95b86f" },
            "eu-central-1":     { "HVM64": "ami-d3c022bc" },
            "eu-west-1":        { "HVM64": "ami-b0ac25c3" },
            "sa-east-1":        { "HVM64": "ami-fb890097" },
            "us-east-1":        { "HVM64": "ami-f5f41398" },
            "us-gov-west-1":    { "HVM64": "ami-e3ad1282" },
            "us-west-1":        { "HVM64": "ami-6e84fa0e" },
            "us-west-2":        { "HVM64": "ami-d0f506b0" }
        }
    },

    "Parameters": {
        "KeyName": {
            "Type": "AWS::EC2::KeyPair::KeyName",
            "Description": "EC2 keypair used to log into the instance for maintenance.",
            "MinLength": "1"
        },

        "HostedZoneIds": {
            "Type": "List<AWS::Route53::HostedZone::Id>",
            "Description": "The hosted zones to read from Route 53."
        },

        "SubnetIds": {
            "Type": "List<AWS::EC2::Subnet::Id>",
            "Description": "The subnets the instance may launch in."
        },

        "SecurityGroupIds": {
            "Type": "List<AWS::EC2::SecurityGroup::Id>",
            "Description": "The security groups to attach to the instance."
        },

        "InstanceType": {
            "Type": "String",
            "Default": "t2.nano",
            "Description": "The instance type to use.",
            "AllowedValues": [
                "c3.large", "c3.xlarge", "c3.2xlarge", "c3.4xlarge", "c3.8xlarge",
                "c4.large", "c4.xlarge", "c4.2xlarge", "c4.4xlarge", "c4.8xlarge",
                "cc2.8xlarge",
                "cr1.8xlarge",
                "d2.xlarge", "d2.2xlarge", "d2.4xlarge", "d2.8xlarge",
                "g2.2xlarge", "g2.8xlarge",
                "i2.xlarge", "i2.2xlarge", "i2.4xlarge", "i2.8xlarge",
                "m3.medium", "m3.large", "m3.xlarge", "m3.2xlarge",
                "m4.large", "m4.xlarge", "m4.2xlarge", "m4.4xlarge", "m4.10xlarge",
                "r3.large", "r3.xlarge", "r3.2xlarge", "r3.4xlarge", "r3.8xlarge",
                "t2.nano", "t2.micro", "t2.small", "t2.medium", "t2.large"
            ]
        }
    },

    "Resources": {
        "IamRole": {
            "Type": "AWS::IAM::Role",
            "Properties": {
                "AssumeRolePolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Principal": { "Service": [ "ec2.amazonaws.com" ] },
                            "Action": [ "sts:AssumeRole" ]
                        }
                    ]
                },
                "Policies": [{
                    "PolicyName": "Bind53",
                    "PolicyDocument": {
                        "Version": "2012-10-17",
                        "Statement": [
                            {
                                "Sid": "Route53Actions",
                                "Effect": "Allow",
                                "Action": [ "route53:GetHostedZone", "route53:ListResourceRecordSets" ],
                                "Resource": "*"
                            },
                            {
                                "Sid": "EIPActions",
                                "Effect": "Allow",
                                "Action": [ "ec2:AssociateAddress" ],
                                "Resource": "*"
                            }
                        ]
                    }
                }]
            }
        },

        "IamProfile": {
            "Type": "AWS::IAM::InstanceProfile",
            "Properties": {
                "Path": "/",
                "Roles": [ {"Ref":"IamRole"} ]
            }
        },

        "EIP": {
            "Type": "AWS::EC2::EIP",
            "Properties": { "Domain": "vpc" }
        },

        "LaunchConfig2": {
            "Type": "AWS::AutoScaling::LaunchConfiguration",
            "DependsOn": [ "EIP" ],
            "Properties": {
                "AssociatePublicIpAddress": "true",
                "BlockDeviceMappings": [
                    {
                        "DeviceName": "/dev/xvda",
                        "Ebs": {
                            "DeleteOnTermination": "true",
                            "VolumeSize": "20",
                            "VolumeType": "gp2"
                        }
                    }
                ],
                "IamInstanceProfile": {"Ref":"IamProfile"},
                "ImageId": { "Fn::FindInMap": ["AmazonLinux", {"Ref":"AWS::Region"}, "HVM64"] },
                "InstanceMonitoring": "true",
                "InstanceType": {"Ref":"InstanceType"},
                "KeyName": {"Ref":"KeyName"},
                "SecurityGroups": {"Ref":"SecurityGroupIds"},
                "UserData": {"Fn::Base64": {"Fn::Join": ["", [
                    "#!/bin/bash\n",
                    "md='http://169.254.169.254/latest/meta-data'\n",
                    "mkdir -p /root/.aws\n",
                    "cat > /root/.aws/config <<.EOF\n",
                    "[default]\n",
                    "region = ", {"Ref":"AWS::Region"}, "\n",
                    ".EOF\n",
                    "yum -y update\n",
                    "yum -y install bind git\n",
                    "sed -e 's/listen-on .*/listen-on port 53 { any; };/' -e 's/listen-on-v6.*/listen-on-v6 port 53 { any; };/' -e 's/allow-query .*/allow-query { any; };/' /etc/named.conf > /etc/named.conf.new\n",
                    "echo 'include \"/etc/bind53.conf\";' >> /etc/named.conf.new\n",
                    "mv /etc/named.conf /etc/named.conf.orig\n",
                    "mv /etc/named.conf.new /etc/named.conf\n",
                    "cd /tmp\n",
                    "git clone 'https://github.com/dacut/bind53.git'\n",
                    "cd bind53\n",
                    "./setup.py install\n",
                    "cd /\n",
                    "rm -r /tmp/bind53\n",
                    "/usr/local/bin/bind53 --output '/var/named/%(zone_name)szone' --kick ", {"Fn::Join": [" ", {"Ref":"HostedZoneIds"}]}, " >> /var/log/bind53.log 2>&1\n",
                    "crontab - <<.EOF\n",
                    "*/5 * * * * /usr/local/bin/bind53 --output '/var/named/\\%(zone_name)szone' --kick ", {"Fn::Join": [" ", {"Ref":"HostedZoneIds"}]}, " >> /var/log/bind53.log 2>&1\n",
                    ".EOF\n",
                    "iid=`curl -s $md/instance-id`\n",
                    "aws ec2 associate-address --instance-id $iid --allocation-id ", {"Fn::GetAtt": ["EIP", "AllocationId"]}, " --allow-reassociation\n",
                    "service named start\n",
                    ""
                    ]]}}
            }
        },

        "AutoScalingGroup": {
            "Type": "AWS::AutoScaling::AutoScalingGroup",
            "DependsOn": [ "LaunchConfig2" ],
            "Properties": {
                "DesiredCapacity": "1",
                "LaunchConfigurationName": {"Ref":"LaunchConfig2"},
                "MaxSize": "1",
                "MinSize": "1",
                "Tags": [ {"Key": "Name", "Value": "Bind53", "PropagateAtLaunch": "true" }],
                "VPCZoneIdentifier": {"Ref":"SubnetIds"}
            },
            "UpdatePolicy": {
                "AutoScalingRollingUpdate": {
                    "MaxBatchSize": "10",
                    "MinInstancesInService": "0"
                }
            }
        }
    },

    "Outputs": {
        "PublicIP": {
            "Description": "Elasitc IP allocation for the BIND server",
            "Value": {"Ref":"EIP"}
        }
    }
}