cfn-01-basis.yml

Description: |
  This template enables you to create the following resources.
  
  - A VPC.
  - Subnets classified 4 types such as "Front", "Service", "Datastore" and "Bastion. The former 3 subnet types are spread across 3 AZs.
  - A Route table as for a Public Subnet.
  - An Internet Gateway attached the Route table above.
  - Subnets with A NAT Gateway and corresponding route tables are optionally provided. If you set the parameter "EnableNatGw" true, subnets called "PrivateSubnet*" and its accompanying resources will be created.
  
# ------------------------------------------------------------
# Parameters/Mappings/Conditions section
# ------------------------------------------------------------
Parameters:
  EnvName:
    Description: Please select the environment you want to create. Besides, its name will be prefixed to all resources' name.
    Type: String
    AllowedValues:
      - dev1
      - dev2
      - prd
  AppServiceName:
    Description: Please enter the service name will be provided to the customer.
    Type: String
    Default: YourApp

  RevisionNumber:
    Description: The revision number of this template consists of 3 parts.
    Type: String
    Default: 0.5.0

  EnableNatGw:
    Description: This parameter defines whether to create Private Subnets with a NAT Gateway.
    Type: String
    Default: false
    AllowedValues:
      - true
      - false

  IpAddressAllowedSsh:
    Description: Global IP address of yours to maintain this system with connecting by ssh.
    Type: String
    AllowedPattern:
      '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$'

Mappings:
  Vpc:
    dev1:
      VpcCIDR: 172.16.0.0/19
      FrontSubnet1CIDR:     172.16.0.0/23
      FrontSubnet2CIDR:     172.16.2.0/23
      FrontSubnet3CIDR:     172.16.4.0/23
      ServiceSubnet1CIDR:   172.16.8.0/23
      ServiceSubnet2CIDR:   172.16.10.0/23
      ServiceSubnet3CIDR:   172.16.12.0/23
      PrivateSubnet1CIDR:   172.16.16.0/23
      PrivateSubnet2CIDR:   172.16.18.0/23
      PrivateSubnet3CIDR:   172.16.20.0/23
      DatastoreSubnet1CIDR: 172.16.24.0/24
      DatastoreSubnet2CIDR: 172.16.25.0/24
      DatastoreSubnet3CIDR: 172.16.26.0/24
      BastionSubnet1CIDR:   172.16.31.192/26
    dev2:
      VpcCIDR: 172.16.32.0/19
      FrontSubnet1CIDR:     172.16.32.0/23
      FrontSubnet2CIDR:     172.16.34.0/23
      FrontSubnet3CIDR:     172.16.36.0/23
      ServiceSubnet1CIDR:   172.16.40.0/23
      ServiceSubnet2CIDR:   172.16.42.0/23
      ServiceSubnet3CIDR:   172.16.44.0/23
      PrivateSubnet1CIDR:   172.16.48.0/23
      PrivateSubnet2CIDR:   172.16.50.0/23
      PrivateSubnet3CIDR:   172.16.52.0/23
      DatastoreSubnet1CIDR: 172.16.56.0/24
      DatastoreSubnet2CIDR: 172.16.57.0/24
      DatastoreSubnet3CIDR: 172.16.58.0/24
      BastionSubnet1CIDR:   172.16.63.192/26

Conditions:
  enableNatGw: !Equals [ !Ref EnableNatGw, "true" ]

# ------------------------------------------------------------
# Resources section
# ------------------------------------------------------------
Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !FindInMap [Vpc, !Ref EnvName, VpcCIDR]
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: !Sub ${EnvName}-${AppServiceName}
        - Key: Env
          Value: !Ref EnvName
        - Key: AppService
          Value: !Ref AppServiceName

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: !Sub ${EnvName}-${AppServiceName}
        - Key: Env
          Value: !Ref EnvName
        - Key: AppServiceName
          Value: !Ref AppServiceName

  InternetGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref VPC


  # ----------------------------------------
  # NAT Gateway
  # ----------------------------------------
  NatGateway1EIP:
    Type: AWS::EC2::EIP
    Condition: enableNatGw
    Properties:
      Domain: vpc

  NatGateway1:
    Type: AWS::EC2::NatGateway
    Condition: enableNatGw
    DependsOn: InternetGatewayAttachment
    Properties:
      AllocationId: !GetAtt NatGateway1EIP.AllocationId
      SubnetId: !Ref FrontSubnet1
      Tags:
        - Key: Name
          Value: !Sub ${EnvName}-NatGateway1
        - Key: Env
          Value: !Ref EnvName
        - Key: AppService
          Value: !Ref AppServiceName

  # ----------------------------------------
  # Subnets
  # ----------------------------------------
  FrontSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 0, !GetAZs '' ]
      CidrBlock: !FindInMap [Vpc, !Ref EnvName, FrontSubnet1CIDR]
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub ${EnvName}-Front(AZ1)
        - Key: Env
          Value: !Ref EnvName
        - Key: AppService
          Value: !Ref AppServiceName

  FrontSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 1, !GetAZs '' ]
      CidrBlock: !FindInMap [Vpc, !Ref EnvName, FrontSubnet2CIDR]
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub ${EnvName}-Front(AZ2)
        - Key: Env
          Value: !Ref EnvName
        - Key: AppService
          Value: !Ref AppServiceName

  FrontSubnet3:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 2, !GetAZs '' ]
      CidrBlock: !FindInMap [Vpc, !Ref EnvName, FrontSubnet3CIDR]
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub ${EnvName}-Front(AZ3)
        - Key: Env
          Value: !Ref EnvName
        - Key: AppService
          Value: !Ref AppServiceName

  ServiceSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 0, !GetAZs '' ]
      CidrBlock: !FindInMap [Vpc, !Ref EnvName, ServiceSubnet1CIDR]
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub ${EnvName}-Service(AZ1)
        - Key: Env
          Value: !Ref EnvName
        - Key: AppService
          Value: !Ref AppServiceName

  ServiceSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 1, !GetAZs '' ]
      CidrBlock: !FindInMap [Vpc, !Ref EnvName, ServiceSubnet2CIDR]
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub ${EnvName}-Service(AZ2)
        - Key: Env
          Value: !Ref EnvName
        - Key: AppService
          Value: !Ref AppServiceName

  ServiceSubnet3:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 2, !GetAZs '' ]
      CidrBlock: !FindInMap [Vpc, !Ref EnvName, ServiceSubnet3CIDR]
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub ${EnvName}-Service(AZ3)
        - Key: Env
          Value: !Ref EnvName
        - Key: AppService
          Value: !Ref AppServiceName

  PrivateSubnet1:
    Type: AWS::EC2::Subnet
    Condition: enableNatGw
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 0, !GetAZs '' ]
      CidrBlock: !FindInMap [Vpc, !Ref EnvName, PrivateSubnet1CIDR]
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub ${EnvName}-Private(AZ1)
        - Key: Env
          Value: !Ref EnvName
        - Key: AppService
          Value: !Ref AppServiceName

  PrivateSubnet2:
    Type: AWS::EC2::Subnet
    Condition: enableNatGw
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 1, !GetAZs '' ]
      CidrBlock: !FindInMap [Vpc, !Ref EnvName, PrivateSubnet2CIDR]
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub ${EnvName}-Private(AZ2)
        - Key: Env
          Value: !Ref EnvName
        - Key: AppService
          Value: !Ref AppServiceName

  PrivateSubnet3:
    Type: AWS::EC2::Subnet
    Condition: enableNatGw
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 2, !GetAZs '' ]
      CidrBlock: !FindInMap [Vpc, !Ref EnvName, PrivateSubnet3CIDR]
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub ${EnvName}-Private(AZ3)
        - Key: Env
          Value: !Ref EnvName
        - Key: AppService
          Value: !Ref AppServiceName

  DatastoreSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 0, !GetAZs '' ]
      CidrBlock: !FindInMap [Vpc, !Ref EnvName, DatastoreSubnet1CIDR]
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub ${EnvName}-Datastore(AZ1)
        - Key: Env
          Value: !Ref EnvName
        - Key: AppService
          Value: !Ref AppServiceName

  DatastoreSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 1, !GetAZs '' ]
      CidrBlock: !FindInMap [Vpc, !Ref EnvName, DatastoreSubnet2CIDR]
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub ${EnvName}-Datastore(AZ2)
        - Key: Env
          Value: !Ref EnvName
        - Key: AppService
          Value: !Ref AppServiceName

  DatastoreSubnet3:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 2, !GetAZs '' ]
      CidrBlock: !FindInMap [Vpc, !Ref EnvName, DatastoreSubnet3CIDR]
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub ${EnvName}-Datastore(AZ3)
        - Key: Env
          Value: !Ref EnvName
        - Key: AppService
          Value: !Ref AppServiceName

  BastionSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 0, !GetAZs '' ]
      CidrBlock: !FindInMap [Vpc, !Ref EnvName, BastionSubnet1CIDR]
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub ${EnvName}-Bastion(AZ1)
        - Key: Env
          Value: !Ref EnvName
        - Key: AppService
          Value: !Ref AppServiceName


  # ----------------------------------------
  # RouteTables
  # ----------------------------------------
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub ${EnvName}-Public-Routes
        - Key: Env
          Value: !Ref EnvName
        - Key: AppService
          Value: !Ref AppServiceName

  DefaultPublicRoute:
    Type: AWS::EC2::Route
    DependsOn: InternetGatewayAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  PrivateRouteTable:
    Type: AWS::EC2::RouteTable
    Condition: enableNatGw
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub ${EnvName} Private Routes
        - Key: Env
          Value: !Ref EnvName
        - Key: AppService
          Value: !Ref AppServiceName

  DefaultPrivateRoute:
    Type: AWS::EC2::Route
    Condition: enableNatGw
    Properties:
      RouteTableId: !Ref PrivateRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway1

  # ----------------------------------------
  # RouteTable Associations
  # ----------------------------------------
  FrontSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref FrontSubnet1

  FrontSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref FrontSubnet2

  FrontSubnet3RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref FrontSubnet3

  ServiceSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref ServiceSubnet1

  ServiceSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref ServiceSubnet2

  ServiceSubnet3RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref ServiceSubnet3

  PrivateSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Condition: enableNatGw
    Properties:
      RouteTableId: !Ref PrivateRouteTable
      SubnetId: !Ref PrivateSubnet1

  PrivateSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Condition: enableNatGw
    Properties:
      RouteTableId: !Ref PrivateRouteTable
      SubnetId: !Ref PrivateSubnet2

  PrivateSubnet3RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Condition: enableNatGw
    Properties:
      RouteTableId: !Ref PrivateRouteTable
      SubnetId: !Ref PrivateSubnet3

  BastionSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref BastionSubnet1

  # ----------------------------------------
  # Security Groups
  # ----------------------------------------
  SecurityGroupInternal:
    Type: AWS::EC2::SecurityGroup
    Properties:
      VpcId: !Ref VPC
      GroupName: !Sub ${EnvName}-Internal
      GroupDescription: "Allow all traffic from and to each other within the VPC."
      SecurityGroupIngress:
        - CidrIp: !FindInMap [Vpc, !Ref EnvName, VpcCIDR]
          IpProtocol: "-1"
          FromPort: -1
          ToPort: -1

  SecurityGroupPublicWeb:
    Type: AWS::EC2::SecurityGroup
    Properties:
      VpcId: !Ref VPC
      GroupName: !Sub ${EnvName}-PublicWeb
      GroupDescription: "Allow HTTP/HTTPS traffic from the Internet to the Web servers."
      SecurityGroupIngress:
        - CidrIp: "0.0.0.0/0"
          IpProtocol: "tcp"
          FromPort: 80
          ToPort: 80
        - CidrIp: "0.0.0.0/0"
          IpProtocol: "tcp"
          FromPort: 443
          ToPort: 443

  SecurityGroupPublicApi:
    Type: AWS::EC2::SecurityGroup
    Properties:
      VpcId: !Ref VPC
      GroupName: !Sub ${EnvName}-PublicApi
      GroupDescription: "Allow only HTTPS traffic from the Internet to the API servers."
      SecurityGroupIngress:
        # - CidrIp: "0.0.0.0/0"
        #   IpProtocol: "tcp"
        #   FromPort: "80"
        #   ToPort: "80"
        - CidrIp: "0.0.0.0/0"
          IpProtocol: "tcp"
          FromPort: 443
          ToPort: 443

  SecurityGroupMaintainer:
    Type: AWS::EC2::SecurityGroup
    Properties:
      VpcId: !Ref VPC
      GroupName: !Sub ${EnvName}-Maintainer
      GroupDescription: "Allow SSH/RDP traffic from maintainers."
      SecurityGroupIngress:
        - CidrIp: !Ref IpAddressAllowedSsh
          IpProtocol: "tcp"
          FromPort: 22
          ToPort: 22
        - CidrIp: !Ref IpAddressAllowedSsh
          IpProtocol: "tcp"
          FromPort: 3389
          ToPort: 3389

# ------------------------------------------------------------
# Outputs section
# ------------------------------------------------------------
Outputs:
  VPC:
    Description: A reference to the created VPC
    Value: !Ref VPC
    Export:
      Name: !Sub ${EnvName}-VPC

  FrontSubnets:
    Description: A list of the front subnets
    Value: !Join [ ",", [ !Ref FrontSubnet1, !Ref FrontSubnet2, !Ref FrontSubnet3 ]]
    Export:
      Name: !Sub ${EnvName}-FrontSubnets

  ServiceSubnets:
    Description: A list of the front subnets
    Value: !Join [ ",", [ !Ref ServiceSubnet1, !Ref ServiceSubnet2, !Ref ServiceSubnet3 ]]
    Export:
      Name: !Sub ${EnvName}-ServiceSubnets

  DatastoreSubnets:
    Description: A list of the datastore subnets
    Value: !Join [ ",", [ !Ref DatastoreSubnet1, !Ref DatastoreSubnet2, !Ref DatastoreSubnet2 ]]
    Export:
      Name: !Sub ${EnvName}-DatastoreSubnets

  FrontSubnet1:
    Description: A reference to the public subnet in the 1st Availability Zone
    Value: !Ref FrontSubnet1
    Export:
      Name: !Sub ${EnvName}-FrontSubnet1

  FrontSubnet2:
    Description: A reference to the public subnet in the 2nd Availability Zone
    Value: !Ref FrontSubnet2
    Export:
      Name: !Sub ${EnvName}-FrontSubnet2

  FrontSubnet3:
    Description: A reference to the public subnet in the 3rd Availability Zone
    Value: !Ref FrontSubnet3
    Export:
      Name: !Sub ${EnvName}-FrontSubnet3

  ServiceSubnet1:
    Description: A reference to the public subnet in the 1st Availability Zone
    Value: !Ref ServiceSubnet1
    Export:
      Name: !Sub ${EnvName}-ServiceSubnet1

  ServiceSubnet2:
    Description: A reference to the public subnet in the 2nd Availability Zone
    Value: !Ref ServiceSubnet2
    Export:
      Name: !Sub ${EnvName}-ServiceSubnet2

  ServiceSubnet3:
    Description: A reference to the public subnet in the 3rd Availability Zone
    Value: !Ref ServiceSubnet3
    Export:
      Name: !Sub ${EnvName}-ServiceSubnet3

  DatastoreSubnet1:
    Description: A reference to the datastore subnet in the 1st Availability Zone
    Value: !Ref DatastoreSubnet1
    Export:
      Name: !Sub ${EnvName}-DatastoreSubnet1

  DatastoreSubnet2:
    Description: A reference to the datastore subnet in the 2nd Availability Zone
    Value: !Ref DatastoreSubnet2
    Export:
      Name: !Sub ${EnvName}-DatastoreSubnet2

  DatastoreSubnet3:
    Description: A reference to the datastore subnet in the 3rd Availability Zone
    Value: !Ref DatastoreSubnet3
    Export:
      Name: !Sub ${EnvName}-DatastoreSubnet3

  BastionSubnet1:
    Description: A reference to the bastion subnet in the 1st Availability Zone
    Value: !Ref BastionSubnet1
    Export:
      Name: !Sub ${EnvName}-BastionSubnet1

  SecurityGroupInternal:
    Value: !Ref SecurityGroupInternal
    Export:
      Name: !Sub ${EnvName}-SecurityGroupInternal

  SecurityGroupPublicWeb:
    Value: !Ref SecurityGroupPublicWeb
    Export:
      Name: !Sub ${EnvName}-SecurityGroupPublicWeb

  SecurityGroupPublicApi:
    Value: !Ref SecurityGroupPublicApi
    Export:
      Name: !Sub ${EnvName}-SecurityGroupPublicApi

  SecurityGroupMaintainer:
    Value: !Ref SecurityGroupMaintainer
    Export:
      Name: !Sub ${EnvName}-SecurityGroupMaintainer