DRVault-Single-Deployment.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: This template handles the deployment of CyberArk DR Vault to an existing network infrastructure
Resources:
  LogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      RetentionInDays: 30
    UpdateReplacePolicy: Retain
    DeletionPolicy: Retain
  CfnInitLogStream:
    Type: AWS::Logs::LogStream
    Properties:
      LogGroupName: !Sub '${LogGroup}'
      LogStreamName: 'VaultDRMachine/CfnInitLog'
    UpdateReplacePolicy: Retain
    DeletionPolicy: Retain
  VaultInitLogStream:
    Type: AWS::Logs::LogStream
    Properties:
      LogGroupName: !Sub '${LogGroup}'
      LogStreamName: 'VaultDRMachine/VaultInitLog'
    UpdateReplacePolicy: Retain
    DeletionPolicy: Retain
  VaultPostInstallLogStream:
    Type: AWS::Logs::LogStream
    Properties:
      LogGroupName: !Sub '${LogGroup}'
      LogStreamName: 'VaultDRMachine/VaultPostInstallLog'
    UpdateReplacePolicy: Retain
    DeletionPolicy: Retain
  VaultAmi:
    Type: Custom::FindAMI
    Properties:
      ServiceToken: !GetAtt GetLatestAMILambda.Arn
      Version: "13.2"
      Component: "Vault"
      OS: !Ref WinVersion
      OwnerAccountId: !Ref CyberarkAccountId
    DependsOn:
      - LambdaDeployRole
    Condition: CustomImageEmpty
  StoreDRPassword:
    Type: AWS::CloudFormation::CustomResource
    Properties:
      ServiceToken: !GetAtt 'StorePasswordLambda.Arn'
      Password: !Ref 'VaultDRPassword'
    DependsOn:
      - LambdaDeployRole
  StoreSecret:
    Type: AWS::CloudFormation::CustomResource
    Properties:
      ServiceToken: !GetAtt 'StorePasswordLambda.Arn'
      Password: !Ref 'Secret'
    DependsOn:
      - LambdaDeployRole
  CleanDRPassword:
    Type: AWS::CloudFormation::CustomResource
    Version: '1.0'
    Properties:
      ServiceToken: !GetAtt 'DeletePasswordLambda.Arn'
      key: !GetAtt 'StoreDRPassword.SsmId'
    DependsOn:
      - LambdaDeployRole
      - VaultDRMachine
  CleanSecret:
    Type: AWS::CloudFormation::CustomResource
    Version: '1.0'
    Properties:
      ServiceToken: !GetAtt 'DeletePasswordLambda.Arn'
      key: !GetAtt 'StoreSecret.SsmId'
    DependsOn:
      - LambdaDeployRole
      - VaultDRMachine
  RemovePermissionVault:
    Type: AWS::CloudFormation::CustomResource
    Version: '1.0'
    Properties:
      ServiceToken: !GetAtt 'RemovePermissionLambda.Arn'
      vault_role_name: !Ref 'VaultInstancesRole'
      lambda_role_name: !Ref 'LambdaRemovePermissionsRole'
      instance: !Ref 'VaultDRMachine'
      region: !Ref 'AWS::Region'
  VaultBootstrapIAMPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: VaultBootstrapIAMPolicy
      PolicyDocument:
        Statement:
          - Effect: Allow
            Action:
              - iam:GetRole
              - iam:DeleteRolePolicy
              - iam:PutRolePolicy
            Resource:
              - !GetAtt VaultInstancesRole.Arn
              - !GetAtt LambdaRemovePermissionsRole.Arn
      Roles:
        - !Ref 'LambdaRemovePermissionsRole'
  LambdaDeployRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: CloudWatch
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:DescribeLogGroups
                  - logs:DescribeLogStreams
                  - logs:PutLogEvents
                Resource:
                  - '*'
        - PolicyName: SSM
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - ssm:PutParameter
                  - ssm:DeleteParameter
                Resource:
                  - !Sub 'arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/*'
        - PolicyName: DescribeImages
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action: 'ec2:DescribeImages'
                Resource: "*"
  LambdaRemovePermissionsRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: CloudWatch
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:DescribeLogGroups
                  - logs:DescribeLogStreams
                  - logs:PutLogEvents
                Resource:
                  - '*'
        - PolicyName: KMSPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - kms:DescribeKey
                Resource:
                  - '*'
  VaultInstancesRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: VaultLogPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:DescribeLogGroups
                  - logs:DescribeLogStreams
                Resource:
                  - !Sub 'arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:${LogGroup}'
              - Effect: Allow
                Action:
                  - logs:PutLogEvents
                Resource:
                  - !Sub 'arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:${LogGroup}:log-stream:${CfnInitLogStream}'
                  - !Sub 'arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:${LogGroup}:log-stream:${VaultInitLogStream}'
                  - !Sub 'arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:${LogGroup}:log-stream:${VaultPostInstallLogStream}'
        - PolicyName: VaultSSMPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - ssm:GetParameters
                Resource:
                  - !Sub 'arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${StoreDRPassword.SsmId}'
                  - !Sub 'arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${StoreSecret.SsmId}'
        - PolicyName: VaultInstancesKMSPolicy
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - kms:CreateKey
                  - kms:GenerateRandom
                  - kms:TagResource
                  - kms:Encrypt
                  - kms:Decrypt
                  - kms:EnableKeyRotation
                  - kms:UpdateKeyDescription
                  - kms:CreateAlias
                Resource: '*'
    DeletionPolicy: Retain
  VaultInstancesProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - !Ref 'VaultInstancesRole'
    DeletionPolicy: Retain
  StorePasswordLambda:
    Type: AWS::Lambda::Function
    Properties:
      Description: Saves given password to parameter store as SecureString
      Code:
        ZipFile: |-
          import uuid
          import boto3
          import cfnresponse


          def lambda_handler(event, context):
              ssmClient = boto3.client('ssm')
              physicalResourceId = str(uuid.uuid4())
              if 'PhysicalResourceId' in event:
                  physicalResourceId = event['PhysicalResourceId']
              if 'Password' not in event['ResourceProperties'] or not event['ResourceProperties']['Password']:
                  print ('The property Password must not be empty')
                  return cfnresponse.send(event, context, cfnresponse.FAILED, {}, physicalResourceId)
              try:
                  if event['RequestType'] == 'Delete':
                      ssmClient.delete_parameter(Name=physicalResourceId)
                      print ('Password successfully deleted. Id='+physicalResourceId)
                      return cfnresponse.send(event, context, cfnresponse.SUCCESS, {}, physicalResourceId)
                  if event['RequestType'] == 'Create':
                      ssmClient.put_parameter(Name=physicalResourceId, Value=event['ResourceProperties']['Password'], Type='SecureString')
                      print ('The store parameter has been created. Id='+physicalResourceId)
                      response = {'SsmId': physicalResourceId}
                      return cfnresponse.send(event, context, cfnresponse.SUCCESS, response, physicalResourceId)
              except ssmClient.exceptions.ParameterNotFound:
                  print ('Item already removed')
                  return cfnresponse.send(event, context, cfnresponse.SUCCESS, {}, physicalResourceId)
              except Exception as E:
                  print (E)
                  return cfnresponse.send(event, context, cfnresponse.FAILED, {}, physicalResourceId)


      Runtime: python3.7
      Handler: index.lambda_handler
      Timeout: 60
      Role: !GetAtt 'LambdaDeployRole.Arn'
  DeletePasswordLambda:
    Type: AWS::Lambda::Function
    Properties:
      Description: Delete password from parameter store
      Code:
        ZipFile: |-
          import uuid
          import boto3
          import cfnresponse


          def lambda_handler(event, context):
              ssmClient = boto3.client('ssm')
              physicalResourceId = str(uuid.uuid4())
              if 'PhysicalResourceId' in event:
                  physicalResourceId = event['PhysicalResourceId']
              try:
                  if event['RequestType'] == 'Create':
                      ssmClient.delete_parameter(Name=event['ResourceProperties']['key'])
                      print ('Password succesfully deleted. Id='+event['ResourceProperties']['key'])
                      return cfnresponse.send(event, context, cfnresponse.SUCCESS, {}, physicalResourceId)
                  if event['RequestType'] == 'Delete':
                      return cfnresponse.send(event, context, cfnresponse.SUCCESS, {}, physicalResourceId)
              except ssmClient.exceptions.ParameterNotFound:
                  print ('Item already removed')
                  return cfnresponse.send(event, context, cfnresponse.SUCCESS, {}, physicalResourceId)
              except Exception as E:
                  print (E)
                  return cfnresponse.send(event, context, cfnresponse.FAILED, {}, physicalResourceId)

      Runtime: python3.7
      Handler: index.lambda_handler
      Timeout: 60
      Role: !GetAtt 'LambdaDeployRole.Arn'
  RemovePermissionLambda:
    Type: AWS::Lambda::Function
    Properties:
      Description: Change Policies of VaultInstancesRole IAM Role
      Code:
        ZipFile: |-
          import json
          import boto3
          import uuid
          import cfnresponse

          def lambda_handler(event, context):
            physicalResourceId = str(uuid.uuid4())
            if 'PhysicalResourceId' in event:
              physicalResourceId = event['PhysicalResourceId']
            if event['RequestType'] == 'Create':
              try:
                print("Creating AWS CloudFormation")
                print("Start RemovePermissionLambda execution")
                client = boto3.client('iam')

                # Get vault role info
                vault_role = client.get_role(RoleName=event['ResourceProperties']['vault_role_name'])['Role']
                print("Retrieve IAM Role ID: {0}".format(vault_role["RoleId"]))

                # Delete old Policies
                list = [event['ResourceProperties']['vault_role_name'],event['ResourceProperties']['lambda_role_name']]
                inline_policies = ["VaultInstancesKMSPolicy","VaultSSMPolicy","VaultFilesBucketAccess","KMSPolicy", "VaultBootstrapIAMPolicy"]
                print("Trying to delete inline policies from {0} IAM Role".format(vault_role["RoleId"]))
                for role in list:
                  print("Delete policies in {0} IAM Role".format(role))
                  for inline_policy in inline_policies:
                    try:
                      delete = client.delete_role_policy(RoleName=role, PolicyName=inline_policy)
                      print("Delete policy: {0}".format(inline_policy))
                    except:
                      print("Didn\'t find policy: {0}".format(inline_policy))
                print("Finish to delete inline policies from {0} IAM Role".format(vault_role["RoleId"]))

                # Get KMS ID
                kms = boto3.client('kms', region_name=event['ResourceProperties']['region'])
                kms_arn = kms.describe_key(KeyId="alias/vault/{0}".format(event['ResourceProperties']['instance']))['KeyMetadata']['Arn']
                print("Retrieve KMS ARN: {0}".format(kms_arn))

                # Create inline policy
                kms_policy =  {
                  "Statement": [
                    {
                      "Action": [
                        "kms:Encrypt",
                        "kms:Decrypt"
                        ],
                        "Resource": kms_arn,
                        "Effect": "Allow"
                    }
                  ]
                }

                response = client.put_role_policy(RoleName=vault_role['RoleName'], PolicyName="VaultInstancesKMSPolicy", PolicyDocument=json.dumps(kms_policy))
                print("Add inline policy VaultInstancesKMSRestrictedPolicy to {0} IAM Role".format(vault_role["RoleId"]))

                return cfnresponse.send(event, context, cfnresponse.SUCCESS, None, {}, physicalResourceId)
              except Exception as E:
                print("Error in Lambda execution: {0}".format(E))
                return cfnresponse.send(event, context, cfnresponse.FAILED,E,{}, physicalResourceId)
            elif event['RequestType'] == 'Delete':
              print("Deleting AWS CloudFormation")
              return cfnresponse.send(event, context, cfnresponse.SUCCESS, {}, physicalResourceId)
      Runtime: python3.7
      Handler: index.lambda_handler
      Timeout: 60
      Role: !GetAtt 'LambdaRemovePermissionsRole.Arn'
  GetLatestAMILambda:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        ZipFile: |
          import boto3
          import cfnresponse
          import json
          import traceback


          def handler(event, context):
            try:
              component = event['ResourceProperties']['Component']
              pas_ver= event['ResourceProperties']['Version']
              pas_ver_major= int(pas_ver.split(".")[0])
              pas_ver_minor= int(pas_ver.split(".")[1])
              response = {
                  "Images": []
              }

              pas_ver_without_os_filter = ['11.5','11.6','11.7','12.0','12.1','12.2']
              os_filter = '' if pas_ver in pas_ver_without_os_filter else \
              event['ResourceProperties']['OS']
              
              while (response['Images'] == []) and (pas_ver_major >= 0):
                while (response['Images'] == []) and (pas_ver_minor >= 0):
                  ami_name = 'CyberArk PAS ' + component + ' v'+str(pas_ver_major) + '.' + str(pas_ver_minor) +'*'+ os_filter
                  response = boto3.client('ec2').describe_images(
                      Owners= [event['ResourceProperties']['OwnerAccountId']],
                      Filters=[
                        {'Name': 'name', 'Values':  [ami_name]},
                      ],
                  )
                  pas_ver_minor -= 1
                pas_ver_major -= 1
                pas_ver_minor = 9
              amis = sorted(response['Images'],
                            key=lambda x: x['CreationDate'],
                            reverse=True)
              id = amis[0]['ImageId']
              cfnresponse.send(event, context, cfnresponse.SUCCESS, {}, id)
            except IndexError:
              cfnresponse.send(event, context, cfnresponse.FAIL, {}, "Requested AMI not found")
            except:
              traceback.print_last()
              cfnresponse.send(event, context, cfnresponse.FAIL, {}, "An error occured, please refer to the last exception")
      Runtime: python3.7
      Handler: index.handler
      Timeout: 60
      Role: !GetAtt LambdaDeployRole.Arn
  VaultDRMachine:
    Type: AWS::EC2::Instance
    Properties:
      Tags:
        - Key: Name
          Value: !Sub '${VaultInstanceName}'
      SecurityGroupIds: !Ref 'VaultInstanceSecurityGroups'
      BlockDeviceMappings:
        - DeviceName: "/dev/sda1"
          Ebs:
            VolumeSize: 30
            Encrypted: true
        - DeviceName: "/dev/sdb"
          Ebs:
            VolumeSize: 30
            Encrypted: true
      SubnetId: !Ref 'DRInstanceSubnetId'
      ImageId: 
        Fn::If:
          - CustomImageEmpty
          - !Ref VaultAmi
          - !Ref VaultCustomAmi
      InstanceType: !Ref 'VaultInstanceType'
      UserData: !Base64
        Fn::Sub: |-
          <script>
          cfn-init.exe -v -s ${AWS::StackId} -r VaultDRMachine --configsets ascending --region ${AWS::Region}
          </script>
      KeyName: !Ref 'KeyName'
      IamInstanceProfile: !Ref 'VaultInstancesProfile'
    Metadata:
      AWS::CloudFormation::Init:
        configSets:
          ascending:
            - configSSMAndHostnameAndTagKMS
            - configServices
            - configSignal
        configSSMAndHostnameAndTagKMS:
          services:
            windows:
              AmazonSSMAgent:
                enabled: true
                ensureRunning: true
                files:
                  - C:\Program Files\Amazon\SSM\Plugins\awsCloudWatch\AWS.EC2.Windows.CloudWatch.json
          commands:
            1-configCloudWatch:
              command: !Sub >
                powershell.exe -File C:\CyberArk\Deployment\CloudWatch.ps1 -LogGroup ${LogGroup} -CfnInitLogStream ${CfnInitLogStream} -VaultInitLogStream ${VaultInitLogStream} -VaultPostInstallLogStream ${VaultPostInstallLogStream} -Region ${AWS::Region}
              waitAfterCompletion: 10
            2-restartSSM:
              command: powershell.exe -Command "Restart-Service AmazonSSMAgent"
              waitAfterCompletion: 0
            3-addDNSSuffix:
              command: powershell.exe -Command "Set-DnsClientGlobalSetting -SuffixSearchList ((Get-DnsClientGlobalSetting).SuffixSearchList += 'pas.local')"
        configServices:
          commands:
            1-postInstall:
              command: !Sub >
                powershell.exe -File C:\CyberArk\Deployment\VaultPostInstall.ps1 -SSMDRPassParameterID ${StoreDRPassword.SsmId} -IsPrimaryOrDR "DR" -PrimaryVaultIP ${VaultPrivateIP} -LicensePath "C:\CyberArk\Deployment\vaultLicense.xml" -Region ${AWS::Region} -SSMSecretParameterID ${StoreSecret.SsmId}
              waitAfterCompletion: 0
            2-changeKMSTag:
              command: !Sub >
                powershell.exe -File C:\CyberArk\Deployment\VaultTagKMS.ps1 -Role ${VaultInstancesRole} -Region ${AWS::Region}
              waitAfterCompletion: 0
            3-ChangeHostname:
              command: !Sub >
                powershell.exe -Command Rename-Computer -NewName ${VaultHostname} -Force -Restart
              waitAfterCompletion: forever
        configSignal:
          commands:
            0-signalCompletion:
              command: !Sub >
                "C:\Program Files\Amazon\cfn-bootstrap\cfn-signal.exe" -e %ERRORLEVEL% --stack ${AWS::StackId} --resource VaultDRMachine --region ${AWS::Region}
              waitAfterCompletion: 0
    CreationPolicy:
      ResourceSignal:
        Timeout: PT20M
    DeletionPolicy: Retain
Parameters:
  EULA:
    Type: String
    Description: I have read and agree to the Terms and Conditions.
    AllowedValues:
      - Accept
      - Decline
    Default: Decline
  WinVersion:
    Type: String
    Description: Select a Windows Server version for all Windows-based components.
    AllowedValues:
      - Win2016
      - Win2019
    Default: Win2016
  VaultCustomAmi:
    Type: String
    Description: Enter the Vault Image ID, if you wish to use a custom Vault image.
    AllowedPattern: ^ami-[a-f\d]{8}(?:[a-f\d]{9})?$|.{0,0}
    ConstraintDescription: An Amazon EC2 image ID, such as ami-0ff8a91507f77f867
  CyberarkAccountId:
    Type: String
    Description: Enter the CyberArk Account ID (AMI Owner account ID).
    AllowedPattern: ^[\d]{12}$
    ConstraintDescription: Account ID must contain 12 digits
  KeyName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: Select an existing Key Pair from your AWS account.
    ConstraintDescription: Can contain only ASCII characters.
  VaultPrivateIP:
    Type: String
    Description: Enter the Primary Vault Private IP.
  VaultDRPassword:
    Type: String
    Description: Enter a password for the DR Vault user that was set on the Primary Vault.
    NoEcho: true
    MinLength: 8
    AllowedPattern: ^(?=.*[0-9])(?=.*[a-z])(?=.*[A-Z])(?=.*[~!@#$%^&\*\(\)_\-+=:])(?=\S+$).{8,}$
    ConstraintDescription: Vault DR password must contain at least 1 lowercase letter,
      1 uppercase letter, 1 digit and 1 special character
  Secret:
    Type: String
    Description: Enter the secret string for the DR user that was set on the Primary Vault.(Optional).
    NoEcho: true
    AllowedPattern: ^(?=.*[0-9])(?=.*[a-z])(?=.*[A-Z])(?=.*[~!@#$%^&\*\(\)_\-+=:])(?=\S+$).{8,}$|.{0,0}
    ConstraintDescription: if the value isnt empty it must contain at least 1 lowercase letter, 1 uppercase letter, 1 digit and 1 special characters,
      Minimum 10 characters, Allowed A-Z,a-z,0-9,all special characters, Cannot except / \ - ; and controlled characters.
    MinLength: 10
  VaultInstanceName:
    Type: String
    Description: Enter a name for the DR Vault instance.
    Default: CyberArk DR Vault
  VaultHostname:
    Type: String
    Description: Enter the hostname for the DR Vault instance.
    AllowedPattern: ^((?!-)(?=.*[a-zA-Z])[A-Za-z0-9-]{3,15}(?<!-))$
    ConstraintDescription: Parameter must only contain uppercase and lowercase letters (at least one letter), hyphens and numbers. Hostname can't start or end with hyphen.
    MaxLength: 15
    MinLength: 3
    Default: vault-dr
  VaultInstanceType:
    Type: String
    Description: Select the instance type of the DR Vault instance.
    AllowedValues:
      - m5.large
      - m5.xlarge
      - m5.2xlarge
      - m5.4xlarge
      - m5.8xlarge
      - m5.12xlarge
      - m5.16xlarge
      - m5.24xlarge
    Default: m5.large
  VaultInstanceSecurityGroups:
    Type: List<AWS::EC2::SecurityGroup::Id>
    Description: Assign Security Groups to the DR Vault instance.
  DRInstanceSubnetId:
    Type: AWS::EC2::Subnet::Id
    Description: Select the Subnet Id where the DR Vault instance will reside.
Rules:
  EULAAcception:
    Assertions:
      - Assert: !Equals
          - !Ref 'EULA'
          - Accept
        AssertDescription: You must accept EULA to continue.
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: General parameters
        Parameters:
          - EULA
          - WinVersion
          - VaultCustomAmi
          - CyberarkAccountId
          - KeyName
      - Label:
          default: Primary Vault and DR information
        Parameters:
          - VaultPrivateIP
          - VaultDRPassword
          - Secret
      - Label:
          default: DR Vault Machine Information
        Parameters:
          - VaultInstanceName
          - VaultInstanceType
          - VaultHostname
          - VaultInstanceSecurityGroups
          - DRInstanceSubnetId
    ParameterLabels:
      EULA:
        default: License Agreement
      WinVersion:
        defualt: Windows Server Version
      VaultCustomAmi:
        default: Custom Vault Image ID (Optional)
      CyberarkAccountId:
        default: CyberArk Account ID
      KeyName:
        default: Key Pair
      VaultPrivateIP:
        default: Primary Vault Private IP
      VaultDRPassword:
        default: DR User Password
      VaultInstanceName:
        default: DR Vault Instance Name
      VaultHostname:
        default: DR Vault Hostname
      VaultInstanceType:
        default: DR Vault Instance Type
      VaultInstanceSecurityGroups:
        default: DR Vault Instance Security Groups
      DRInstanceSubnetId:
        default: DR Vault Instance Subnet Id
      Secret:
        default: DR User Secret
Conditions:
  CustomImageEmpty: !Equals
    - ''
    - !Ref VaultCustomAmi
Outputs:
  CloudWatchLogGroupName:
    Description: The name of the CloudWatch log group
    Value: !Ref LogGroup