rubrik_cloudout_consolidation.template

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Complete the AWS configuration process required for the Rubrik CloudOut with consolidation. CloudOut uses an S3 bucket for archiving to Amazon. When consolidation for Amazon S3 is enabled, the snapshot consolidation runs in the AWS cloud using the cloud compute resources.",
  "Metadata": {
    "AWS::CloudFormation::Interface": {
      "ParameterGroups": [
        {
          "Label": { "default": "Storage Configuration" },
          "Parameters": ["CreateNewS3Bucket", "S3BucketName"]
        },
        {
          "Label": { "default": "Network Configuration" },
          "Parameters": ["VPC",
            "Subnet",
            "RubrikClusterCIDR",
            "SecurityGroupName",
            "SecurityGroupDescription",
            "SecurityGroupRoleDescription"
          ]
        },
        {
          "Label": { "default": "IAM Users and Roles" },
          "Parameters": ["CreateNewUser",
            "IAMUserName"
          ]
        },
        {
          "Label": { "default": "KMS" },
          "Parameters": [ "UseKMS" ]
        }
      ]
    }
  },

  "Parameters": {
    "CreateNewS3Bucket": {
      "Description": "Create a new S3 Bucket to use as a Rubrik archival location.",
      "Type": "String",
      "Default": "no",
      "AllowedValues": ["yes", "no"],
      "ConstraintDescription": "Choose 'yes' to create a new S3 Bucket or 'no' to use an existing bucket."
    },

    "S3BucketName": {
      "Description": "The name of the S3 Bucket to be used as a Rubrik archival location.",
      "Type": "String",
      "AllowedPattern": "^[a-z][a-z0-9_-]*[a-z0-9]${3,63}",
      "ConstraintDescription": "Bucket name must be lowercase, contain only letters and numbers, not begin or end with special characters, and be 3-63 characters long"
    },

    "VPC": {
      "Description": "Select the VPC for the archival location.",
      "Type": "AWS::EC2::VPC::Id"
    },

    "Subnet": {
      "Description": "Select the Subnet for the archival location.",
      "Type": "AWS::EC2::Subnet::Id"
    },

    "RubrikClusterCIDR": {
      "Type": "String",
      "Default": "10.79.0.0/24",
      "Description": "The CIDR block for your Rubrik Cluster that will use CloudOut and Archival Consolidation.",
      "AllowedPattern": "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})",
      "ConstraintDescription": "Enter a valid IP CIDR range in the form x.x.x.x/x."
    },

    "CreateNewUser": {
      "Description": "Create a new IAM user specific to Rubrik",
      "Type": "String",
      "Default": "yes",
      "AllowedValues": ["yes", "no"],
      "ConstraintDescription": "Choose 'yes' to create a new IAM User specific to Rubrik or 'no' to use an existing IAM User."
    },

    "IAMUserName": {
      "Description": "The name of the IAM User to assign the new CloudOut specific policies to.",
      "Type": "String",
      "Default": "rubrik"
    },

    "UseKMS": {
      "Description": "Create a new KMS key for encryption.",
      "Type": "String",
      "Default": "yes",
      "AllowedValues": ["yes", "no"],
      "ConstraintDescription": "Choose 'yes' to create a new KMS Key for encryption"
    },

    "SecurityGroupName": {
      "Description": "The name of the Security Group specific to Rubrik CloudOut consolidation.",
      "Type": "String",
      "Default": "rubrik-cloudout-consolidation"
    },

    "SecurityGroupDescription": {
      "Description": "The description of the Security Group configured to allow the ports required for Rubrik CloudOut consolidation.",
      "Type": "String",
      "Default": "Security group used for Rubrik CloudOut consolidation."
    },

    "SecurityGroupRoleDescription": {
      "Description": "The description of the Security Group Ingress Role specific to Rubrik CloudOut consolidation.",
      "Type": "String",
      "Default": "Ports required for Rubrik CloudOut consolidation."
    }
  },

  "Mappings": {},

  "Conditions": {
    "CreateBucket": { "Fn::Equals": [{ "Ref": "CreateNewS3Bucket" }, "yes"] },
    "CreateIAMuser": { "Fn::Equals": [{ "Ref": "CreateNewUser" }, "yes"] },
    "DontCreateIAMuser": { "Fn::Equals": [{ "Ref": "CreateNewUser" }, "no"] },
    "CreateKMS": { "Fn::Equals": [{ "Ref": "UseKMS" }, "yes"] }
  },

  "Resources": {
    "CreateS3Bucket": {
      "Type": "AWS::S3::Bucket",
      "Condition": "CreateBucket",
      "DeletionPolicy": "Retain",
      "Properties": {
        "AccessControl": "Private",
        "BucketName": { "Ref": "S3BucketName" }
      }
    },

    "CreateSecurityGroup": {
      "Type": "AWS::EC2::SecurityGroup",
      "DeletionPolicy": "Retain",
      "Properties": {
        "GroupName": { "Ref": "SecurityGroupName" },
        "GroupDescription": { "Ref": "SecurityGroupDescription" },
        "SecurityGroupEgress": [],
        "SecurityGroupIngress": [
          {
            "IpProtocol": "tcp",
            "FromPort": "2002",
            "ToPort": "2002",
            "CidrIp": { "Ref": "RubrikClusterCIDR" },
            "Description": { "Ref": "SecurityGroupRoleDescription" }
          },
          {
            "IpProtocol": "tcp",
            "FromPort": "8077",
            "ToPort": "8077",
            "CidrIp": { "Ref": "RubrikClusterCIDR" },
            "Description": { "Ref": "SecurityGroupRoleDescription" }
          }
        ],
        "VpcId": { "Ref": "VPC" }
      }
    },
    
    "UpdateSecurityGroupForConverter": {
      "Type": "AWS::EC2::SecurityGroupIngress",
      "DeletionPolicy": "Retain",
      "Properties": {
        "GroupId": { "Fn::GetAtt": ["CreateSecurityGroup", "GroupId"] },
        "Description": { "Ref": "SecurityGroupRoleDescription" },
        "IpProtocol": "tcp",
        "FromPort": "7785",
        "ToPort": "7785",
        "SourceSecurityGroupId": {
          "Fn::GetAtt": ["CreateSecurityGroup", "GroupId"]
        }
      }
    },

    "CreateNewIAMUser": {
      "Type": "AWS::IAM::User",
      "Condition": "CreateIAMuser",
      "DeletionPolicy": "Retain",
      "Properties": {
        "UserName": { "Ref": "IAMUserName" }
      }
    },

    "IAMUserAccessKeys": {
      "Type": "AWS::IAM::AccessKey",
      "Condition": "CreateIAMuser",
      "DeletionPolicy": "Retain",
      "DependsOn": "CreateNewIAMUser",
      "Properties": {
        "UserName": { "Ref": "IAMUserName" }
      }
    },

    "CreateCloudOutPolicyForNewUser": {
      "Type": "AWS::IAM::Policy",
      "DependsOn": "CreateNewIAMUser",
      "Condition": "CreateIAMuser",
      "DeletionPolicy": "Retain",
      "Properties": {
        "PolicyName": "Rubrik-CloudOut",
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Sid": "RubrikCloudOutGlobal",
              "Effect": "Allow",
              "Action": ["s3:ListAllMyBuckets"],
              "Resource": "*"
            },
            {
              "Sid": "RubrikCloudOutRestricted",
              "Effect": "Allow",
              "Action": [
                "s3:AbortMultipartUpload",
                "s3:CreateBucket",
                "s3:DeleteObject",
                "s3:DeleteBucket",
                "s3:GetBucketLocation",
                "s3:GetBucketAcl",
                "s3:ListBucket",
                "s3:ListMultipartUploadParts",
                "s3:PutObject",
                "s3:RestoreObject",
                "s3:GetObject"
              ],
              "Resource": [
                {
                  "Fn::Join": ["", ["arn:aws:s3:::", { "Ref": "S3BucketName" }]]
                },
                {
                  "Fn::Join": [
                    "",
                    ["arn:aws:s3:::", { "Ref": "S3BucketName" }, "/*"]
                  ]
                }
              ]
            }
          ]
        },
        "Users": [{ "Ref": "IAMUserName" }]
      }
    },
    
    "CreateCloudOutConsolidationPolicyForNewUser": {
      "Type": "AWS::IAM::Policy",
      "DependsOn": "CreateNewIAMUser",
      "Condition": "CreateIAMuser",
      "DeletionPolicy": "Retain",
      "Properties": {
        "PolicyName": "Rubrik-CloudOut-Consolidation",
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Sid": "RubrikCloudOutConsolidationV1",
              "Effect": "Allow",
              "Action": [
                "ec2:AttachVolume",
                "ec2:CreateKeyPair",
                "ec2:CreateTags",
                "ec2:CreateVolume",
                "ec2:DeleteSnapshot",
                "ec2:DeleteTags",
                "ec2:DeleteVolume",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeImages",
                "ec2:DescribeInstanceAttribute",
                "ec2:DescribeInstanceStatus",
                "ec2:DescribeInstances",
                "ec2:DescribeKeyPairs",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSubnets",
                "ec2:DescribeTags",
                "ec2:DescribeVolumes",
                "ec2:DescribeVpcs",
                "ec2:ModifyInstanceAttribute",
                "ec2:RunInstances",
                "ec2:StartInstances",
                "ec2:StopInstances",
                "ec2:TerminateInstances",
                "kms:Decrypt",
                "kms:DescribeKey",
                "kms:Encrypt",
                "kms:GenerateDataKey",
                "kms:GenerateDataKeyWithoutPlaintext",
                "s3:CreateBucket",
                "s3:ListAllMyBuckets"
              ],
              "Resource": "*"
            }
          ]
        },
        "Users": [{ "Ref": "IAMUserName" }]
      }
    },
    
    "CreateCloudOutPolicyForExistingUser": {
      "Type": "AWS::IAM::Policy",
      "Condition": "DontCreateIAMuser",
      "DeletionPolicy": "Retain",
      "Properties": {
        "PolicyName": "RubrikCloudOut",
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Sid": "RubrikCloudOutGlobal",
              "Effect": "Allow",
              "Action": ["s3:ListAllMyBuckets"],
              "Resource": "*"
            },
            {
              "Sid": "RubrikCloudOutRestricted",
              "Effect": "Allow",
              "Action": [
                "s3:AbortMultipartUpload",
                "s3:CreateBucket",
                "s3:DeleteObject",
                "s3:DeleteBucket",
                "s3:GetBucketLocation",
                "s3:GetBucketAcl",
                "s3:ListBucket",
                "s3:ListMultipartUploadParts",
                "s3:PutObject",
                "s3:RestoreObject",
                "s3:GetObject"
              ],
              "Resource": [
                {
                  "Fn::Join": ["", ["arn:aws:s3:::", { "Ref": "S3BucketName" }]]
                },
                {
                  "Fn::Join": [
                    "",
                    ["arn:aws:s3:::", { "Ref": "S3BucketName" }, "/*"]
                  ]
                }
              ]
            }
          ]
        },
        "Users": [{ "Ref": "IAMUserName" }]
      }
    },
    
    "CreateCloudOutConsolidationPolicyForExistingUser": {
      "Type": "AWS::IAM::Policy",
      "Condition": "DontCreateIAMuser",
      "DeletionPolicy": "Retain",
      "Properties": {
        "PolicyName": "Rubrik-CloudOut-Consolidation",
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Sid": "RubrikCloudOutConsolidationV1",
              "Effect": "Allow",
              "Action": [
                "ec2:AttachVolume",
                "ec2:CreateKeyPair",
                "ec2:CreateTags",
                "ec2:CreateVolume",
                "ec2:DeleteSnapshot",
                "ec2:DeleteTags",
                "ec2:DeleteVolume",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeImages",
                "ec2:DescribeInstanceAttribute",
                "ec2:DescribeInstanceStatus",
                "ec2:DescribeInstances",
                "ec2:DescribeKeyPairs",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSubnets",
                "ec2:DescribeTags",
                "ec2:DescribeVolumes",
                "ec2:DescribeVpcs",
                "ec2:ModifyInstanceAttribute",
                "ec2:RunInstances",
                "ec2:StartInstances",
                "ec2:StopInstances",
                "ec2:TerminateInstances",
                "kms:Decrypt",
                "kms:DescribeKey",
                "kms:Encrypt",
                "kms:GenerateDataKey",
                "kms:GenerateDataKeyWithoutPlaintext",
                "s3:CreateBucket",
                "s3:ListAllMyBuckets"
              ],
              "Resource": "*"
            }
          ]
        },
        "Users": [{ "Ref": "IAMUserName" }]
      }
    },
    
    "CreateKMSKey": {
      "Type": "AWS::KMS::Key",
      "Condition": "CreateKMS",
      "Properties": {
        "Description": "Rubrik archive location encryption",
        "KeyPolicy": {
          "Version": "2012-10-17",
          "Id": {
            "Fn::Join": ["", ["rubrik-encryption-", { "Ref": "S3BucketName" }]]
          },
          "Statement": [
            {
              "Sid": "Enable IAM User Permissions",
              "Effect": "Allow",
              "Principal": {
                "AWS": {
                  "Fn::Join": [
                    "",
                    ["arn:aws:iam::", { "Ref": "AWS::AccountId" }, ":root"]
                  ]
                }
              },
              "Action": "kms:*",
              "Resource": "*"
            },
            {
              "Sid": "Allow use of the key",
              "Effect": "Allow",
              "Principal": {
                "AWS": {
                  "Fn::If": [
                    "CreateIAMuser",
                    {
                      "Fn::GetAtt": ["CreateNewIAMUser", "Arn"]
                    },
                    {
                      "Fn::Join": [
                        "",
                        [
                          "arn:aws:iam::",
                          { "Ref": "AWS::AccountId" },
                          ":user/",
                          { "Ref": "IAMUserName" }
                        ]
                      ]
                    }
                  ]
                }
              },
              "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:DescribeKey"
              ],
              "Resource": "*"
            }
          ]
        }
      }
    },

    "KMSKeyAlias": {
      "Type": "AWS::KMS::Alias",
      "DependsOn": "CreateKMSKey",
      "Condition": "CreateKMS",
      "Properties": {
        "AliasName": {
          "Fn::Join": [
            "",
            ["alias/rubrik-encryption-", { "Ref": "S3BucketName" }]
          ]
        },
        "TargetKeyId": { "Ref": "CreateKMSKey" }
      }
    }
  },

  "Outputs": {
    "AWSBucketName": {
      "Description": "The S3 Bucket name.",
      "Value": { "Ref": "S3BucketName" }
    },
    "IAMUserAccessKey": {
      "Condition": "CreateIAMuser",
      "Description": "Access Key for the new IAM User.",
      "Value": { "Ref": "IAMUserAccessKeys" }
    },
    "IAMUserSecretKey": {
      "Condition": "CreateIAMuser",
      "Description": "Secret Key for the new IAM user.",
      "Value": { "Fn::GetAtt": ["IAMUserAccessKeys", "SecretAccessKey"] }
    },
    "KMSKeyId": {
      "Condition": "CreateKMS",
      "Description": "The KMS Key ID used for encryption.",
      "Value": { "Ref": "CreateKMSKey" }
    },
    "Region": {
      "Description": "The AWS Region that the resources were created in.",
      "Value": { "Ref": "AWS::Region" }
    },
    "SecurityGroupId": {
      "Description": "ID for the newly created Security Group",
      "Value": { "Fn::GetAtt": ["CreateSecurityGroup", "GroupId"] }
    },
    "SubnetId": {
      "Description": "Subnet ID where the Rubrik Bolt Instance will run.",
      "Value": { "Ref": "Subnet" }
    },
    "VPCId": {
      "Description": "VPC ID where the Rubrik Bolt Instance is created.",
      "Value": { "Ref": "VPC" }
    }
  }
}