question1-bastion-less-ssm.yaml

Parameters:
  EnvironmentName:
    Description: This is dynamically prefixed to organize all resources and artifacts meaningfully
    Type: String

  VpcCIDR:
    Description: IP range for VPC in CIDR notation
    Type: String
    Default: 10.192.0.0/16

  PublicSubnet1CIDR:
    Description: IP range for public subnet
    Type: String
    Default: 10.192.10.0/24

  PrivateSubnet1CIDR:
    Description: IP range for private subnet
    Type: String
    Default: 10.192.20.0/24



Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCIDR
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: !Ref EnvironmentName

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: !Ref EnvironmentName

  InternetGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref VPC

  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 0, !GetAZs '' ]
      CidrBlock: !Ref PublicSubnet1CIDR
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName} Public Subnet (AZ1)

  PrivateSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 0, !GetAZs  '' ]
      CidrBlock: !Ref PrivateSubnet1CIDR
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName} Private Subnet (AZ1)

  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName} Public Routes

  DefaultPublicRoute:
    Type: AWS::EC2::Route
    DependsOn: InternetGatewayAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  PublicSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref PublicSubnet1

  PrivateRouteTable1:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName} Private Routes (AZ1)

  PrivateSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateRouteTable1
      SubnetId: !Ref PrivateSubnet1

  EC2AssumeRoleGeneral:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub 'ec2_general-${AWS::Region}'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: 
                - 'ec2.amazonaws.com'
            Action:
              - 'sts:AssumeRole'
      Path: '/'
      ManagedPolicyArns: 
        - arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM

  EC2InstanceProfileGeneral:
    Type: 'AWS::IAM::InstanceProfile'
    Properties:
      InstanceProfileName: !Sub 'ec2_general-${AWS::Region}'
      Path: '/'
      Roles:
        - !Ref EC2AssumeRoleGeneral

  EC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: ami-0ac43988dfd31ab9a
      InstanceType: t3.small
      # Enable termination protection
      DisableApiTermination: true
      BlockDeviceMappings:
        - DeviceName: /dev/sda1
          Ebs: 
            VolumeSize: 8
            VolumeType: gp2

      KeyName: test
      SubnetId: !Ref PrivateSubnet1
      IamInstanceProfile: ec2_general-eu-west-1

      Tags:
      - Key: Name
        Value: TestServer