nested.yaml

AWSTemplateFormatVersion: "2010-09-09"

Metadata:
  Author: Dmitriy Kagarlickij

  cfn-lint:
    config:
      ignore_checks:
        - W1020 # Vars could be added to /etc/awslogs/awslogs.conf and/or /etc/cron.d/radiusd-status

Parameters:
  AMI:
    Type: "AWS::EC2::Image::Id"
  InstanceType:
    Type: String
  KeyName:
    Type: "AWS::EC2::KeyPair::KeyName"
  IamInstanceProfile:
    Type: String
  SecurityGroup:
    Type: "AWS::EC2::SecurityGroup::Id"
  AvailabilityZone:
    Type: AWS::EC2::AvailabilityZone::Name
  SubnetId:
    Type: "AWS::EC2::Subnet::Id"
  InstanceName:
    Type: String

Resources:
  ElasticIP:
    Type: "AWS::EC2::EIP"
    Properties:
      Domain: vpc

  NetworkInterface:
    Type: "AWS::EC2::NetworkInterface"
    Properties:
      GroupSet:
        - !Ref SecurityGroup
      SubnetId: !Ref SubnetId
      Tags:
        - Key: Name
          Value: !Join [ "-", [ !Ref InstanceName, "NetworkInterface"] ]

  LaunchTemplate:
    Type: "AWS::EC2::LaunchTemplate"
    Metadata:
      AWS::CloudFormation::Init:
        configSets:
          FreeRADIUS:
          - 00-CloudWatchLogsAgentInstall
          - 01-AssociateEIP
          - 02-InstallFreeRADIUS
          - 03-InstallRadiusCheck
        00-CloudWatchLogsAgentInstall:
          packages:
            yum:
              awslogs: []
          files:
            /etc/awslogs/awslogs.conf:
              mode: "000644"
              owner: "root"
              group: "root"
              content: !Sub |
                [general]
                state_file = /var/lib/awslogs/agent-state
                [/var/log/cfn-init.log]
                datetime_format = %Y-%m-%d %H:%M:%S,%fff
                file = /var/log/cfn-init.log
                buffer_duration = 5000
                log_stream_name = {instance_id}
                initial_position = start_of_file
                log_group_name = /var/log/cfn-init.log
            /etc/awslogs/awscli.conf:
              mode: "000400"
              owner: "root"
              group: "root"
              content: !Sub |
                [plugins]
                cwlogs = cwlogs
                [default]
                region = ${AWS::Region}
          services:
            sysvinit:
              awslogsd:
                enabled: "true"
                ensureRunning: "true"
        01-AssociateEIP:
          commands:
            0-AssociateEIP:
              command:
                !Join
                  - ''
                  - - |
                    - "aws ec2 associate-address"
                    - " --instance-id $(wget -q -O - http://169.254.169.254/latest/meta-data/instance-id)"
                    - " --allocation-id "
                    - !GetAtt "ElasticIP.AllocationId"
                    - " --region "
                    - !Ref "AWS::Region"
                    - |+
        02-InstallFreeRADIUS:
          packages:
            yum:
              freeradius: []
          services:
            sysvinit:
              radiusd:
                enabled: "true"
                ensureRunning: "true"
        03-InstallRadiusCheck:
          files:
            /opt/radiusd-status.sh:
              mode: "000755"
              owner: "root"
              group: "root"
              content: !Sub |
                #!/bin/bash
                if [ $(systemctl show -p ActiveState radiusd | cut -d'=' -f2) == 'active' ]; then {
                    aws cloudwatch put-metric-data --metric-name radiusd-status --namespace radiusd --unit Count --value 1 --dimensions InstanceName=${InstanceName} --region ${AWS::Region}
                } else {
                    aws cloudwatch put-metric-data --metric-name radiusd-status --namespace radiusd --unit Count --value 0 --dimensions InstanceName=${InstanceName} --region ${AWS::Region}
                }
                fi
            /etc/cron.d/radiusd-status:
              mode: "000644"
              owner: "root"
              group: "root"
              content: !Sub |
                * * * * * ec2-user /opt/radiusd-status.sh 2>&1

    Properties:
      LaunchTemplateName: !Join [ "-", [ !Ref InstanceName, "LaunchTemplate"] ]
      LaunchTemplateData:
        TagSpecifications:
          - ResourceType: "instance"
            Tags:
              - Key: Name
                Value: !Ref InstanceName
        KeyName: !Ref KeyName
        ImageId: !Ref AMI
        InstanceType: !Ref InstanceType
        IamInstanceProfile:
          Name: !Ref IamInstanceProfile
        NetworkInterfaces:
          - NetworkInterfaceId: !Ref NetworkInterface
            DeviceIndex: 0
        UserData:
          Fn::Base64:
            !Join
              - ''
              - - |
                  #!/bin/bash
                - |
                - "/opt/aws/bin/cfn-init --verbose"
                - " --stack "
                - !Ref "AWS::StackName"
                - " --resource LaunchTemplate "
                - " --configsets FreeRADIUS"
                - " --region "
                - !Ref "AWS::Region"
                - |+

                - |
                - "/opt/aws/bin/cfn-signal --exit-code $?"
                - " --stack "
                - !Ref "AWS::StackName"
                - " --resource ASG"
                - " --region "
                - !Ref "AWS::Region"
                - |+

  ASG:
    Type: "AWS::AutoScaling::AutoScalingGroup"
    Properties:
      AutoScalingGroupName: !Join [ "-", [ !Ref InstanceName, "ASG"] ]
      DesiredCapacity: "1"
      HealthCheckType: "EC2"
      LaunchTemplate:
        LaunchTemplateId: !Ref LaunchTemplate
        Version: !GetAtt LaunchTemplate.LatestVersionNumber
      MaxSize: "1"
      MinSize: "1"
      AvailabilityZones:
        - !Ref AvailabilityZone
    CreationPolicy:
      ResourceSignal:
        Timeout: PT15M

Outputs:
  ElasticIPAddress:
    Value: !Ref ElasticIP