al2-mutable-private.yaml

---
# Copyright 2018 widdix GmbH
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
AWSTemplateFormatVersion: '2010-09-09'
Description: 'EC2: Amazon Linux 2 (mutable, private), a cloudonaut.io template'
Metadata:
  'AWS::CloudFormation::Interface':
    ParameterGroups:
    - Label:
        default: 'Parent Stacks'
      Parameters:
      - ParentVPCStack
      - ParentSSHBastionStack
      - ParentAlertStack
      - ParentKmsKeyStack
      - ParentZoneStack
      - ParentClientStack1
      - ParentClientStack2
      - ParentClientStack3
    - Label:
        default: 'Network Parameters'
      Parameters:
      - SubnetName
      - SubDomainNameWithDot
      - IngressTcpPort1
      - IngressTcpParentClientStack1
      - IngressTcpPort2
      - IngressTcpParentClientStack2
      - IngressTcpPort3
      - IngressTcpParentClientStack3
    - Label:
        default: 'Permission Parameters'
      Parameters:
      - KeyName
      - IAMUserSSHAccess
      - ManagedPolicyArns
      - PermissionsBoundary
    - Label:
        default: 'EC2 Parameters'
      Parameters:
      - Name
      - AmazonLinux2Version
      - RestoreImageId
      - InstanceType
      - UserData
      - RootVolumeSize
    - Label:
        default: 'Operational Parameters'
      Parameters:
      - LogsRetentionInDays
      - MaintenanceWindowSchedule
      - MaintenanceWindowScheduleTimezone
      - BackupRetentionPeriod
      - BackupScheduleExpression
Parameters:
  ParentVPCStack:
    Description: 'Stack name of parent VPC stack based on vpc/vpc-*azs.yaml template.'
    Type: String
  ParentSSHBastionStack:
    Description: 'Optional but recommended stack name of parent SSH bastion host/instance stack based on vpc/vpc-*-bastion.yaml template.'
    Type: String
    Default: ''
  ParentAlertStack:
    Description: 'Optional but recommended stack name of parent alert stack based on operations/alert.yaml template.'
    Type: String
    Default: ''
  ParentKmsKeyStack:
    Description: 'Optional stack name of parent KMS key stack based on security/kms-key.yaml template.'
    Type: String
    Default: ''
  ParentZoneStack:
    Description: 'Optional stack name of parent zone stack based on vpc/zone-*.yaml template.'
    Type: String
    Default: ''
  ParentClientStack1:
    Description: 'Optional stack name of parent Client Security Group stack based on state/client-sg.yaml template to allow network access from the EC2 instance to whatever uses the client security group.'
    Type: String
    Default: ''
  ParentClientStack2:
    Description: 'Optional stack name of parent Client Security Group stack based on state/client-sg.yaml template to allow network access from the EC2 instance to whatever uses the client security group.'
    Type: String
    Default: ''
  ParentClientStack3:
    Description: 'Optional stack name of parent Client Security Group stack based on state/client-sg.yaml template to allow network access from the EC2 instance to whatever uses the client security group.'
    Type: String
    Default: ''
  KeyName:
    Description: 'Optional key pair of the ec2-user to establish a SSH connection to the EC2 instance.'
    Type: String
    Default: ''
  IAMUserSSHAccess:
    Description: 'Synchronize public keys of IAM users to enable personalized SSH access (Doc: https://cloudonaut.io/manage-aws-ec2-ssh-access-with-iam/).'
    Type: String
    Default: false
    AllowedValues:
    - true
    - false
  InstanceType:
    Description: 'The instance type for the EC2 instance.'
    Type: String
    Default: 't3.nano'
  Name:
    Description: 'The name for the EC2 instance.'
    Type: String
    Default: 'test'
  SubnetName:
    Description: 'Subnet name of parent VPC stack based on vpc/vpc-*azs.yaml template.'
    Type: String
    Default: SubnetAPrivate
    AllowedValues:
    - SubnetAPrivate
    - SubnetBPrivate
    - SubnetCPrivate
    - SubnetDPrivate
  LogsRetentionInDays:
    Description: 'Specifies the number of days you want to retain log events.'
    Type: Number
    Default: 14
    AllowedValues: [1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 3653]
  SubDomainNameWithDot:
    Description: 'Name that is used to create the DNS entry with trailing dot, e.g. §{SubDomainNameWithDot}§{HostedZoneName}. Leave blank for naked (or apex and bare) domain. Requires ParentZoneStack parameter!'
    Type: String
    Default: ''
  UserData:
    Description: 'Optional Bash script executed on first instance launch.'
    Type: String
    Default: ''
  IngressTcpPort1:
    Description: 'Optional port allowing ingress TCP traffic.'
    Type: String
    Default: ''
  IngressTcpParentClientStack1:
    Description: 'Optional stack name of parent Client Security Group stack based on state/client-sg.yaml that is required to access IngressTcpPort1 (if you leave this blank, IngressTcpPort1 is open to the world 0.0.0.0/0).'
    Type: String
    Default: ''
  IngressTcpPort2:
    Description: 'Optional port allowing ingress TCP traffic.'
    Type: String
    Default: ''
  IngressTcpParentClientStack2:
    Description: 'Optional stack name of parent Client Security Group stack based on state/client-sg.yaml that is required to access IngressTcpPort2 (if you leave this blank, IngressTcpPort2 is open to the world 0.0.0.0/0).'
    Type: String
    Default: ''
  IngressTcpPort3:
    Description: 'Optional port allowing ingress TCP traffic.'
    Type: String
    Default: ''
  IngressTcpParentClientStack3:
    Description: 'Optional stack name of parent Client Security Group stack based on state/client-sg.yaml that is required to access IngressTcpPort3 (if you leave this blank, IngressTcpPort3 is open to the world 0.0.0.0/0).'
    Type: String
    Default: ''
  ManagedPolicyArns:
    Description: 'Optional comma-delimited list of IAM managed policy ARNs to attach to the instance''s IAM role.'
    Type: String
    Default: ''
  PermissionsBoundary:
    Description: 'Optional ARN for a policy that will be used as the permission boundary for all roles created by this template.'
    Type: String
    Default: ''
  RootVolumeSize:
    Description: 'The root volume size, in Gibibytes (GiB) (if RestoreImageId is set, value must be >= snapshot of AMI).'
    Type: Number
    Default: 8
    ConstraintDescription: 'Must be in the range [8-1024]'
    MinValue: 8
    MaxValue: 1024
  MaintenanceWindowSchedule:
    Description: 'SSM cron expressions to trigger the maintenace window for patch installation (leave empty to disable).'
    Type: String
    Default: 'cron(0 5 ? * SUN *)'
  MaintenanceWindowScheduleTimezone:
    Description: 'Timezone for maintenance window schedule (in IANA format).'
    Type: String
    Default: UTC
  BackupRetentionPeriod:
    Description: 'The number of days to keep backups of the EC2 instance (set to 0 to disable).'
    Type: Number
    MinValue: 0
    MaxValue: 35
    Default: 30
  BackupScheduleExpression:
    Description: 'A CRON expression specifying when AWS Backup initiates a backup job.'
    Type: String
    Default: 'cron(0 4 ? * * *)'
  RestoreImageId:
    Description: 'Restore from existing Amazon Machine Image (AMI).'
    Type: String
    Default: ''
  AmazonLinux2Version:
    Description: 'Version of Amazon Linux 2 to boot from the first time (ignored if RestoreImageId is set; select the latest version for new stacks; OS updates are enabled to patch the system).'
    Type: String
    AllowedValues: ['20220316.0', '20220218.3', '20220218.1', '20220207.1', '20211223.0', '20211005.0', '20210721.2', '20210617.0', '20210126.0', '20200917.0', '20200722.0', '20200520.1', '20200406.0', '20200304.0', '20200207.1', '20191217.0']
Mappings:
  VersionMap:
    '20220316.0':
      Map: RegionMap202203160
    '20220218.3':
      Map: RegionMap202202183
    '20220218.1':
      Map: RegionMap202202181
    '20220207.1':
      Map: RegionMap202202071
    '20211223.0':
      Map: RegionMap202112230
    '20211005.0':
      Map: RegionMap202110050
    '20210721.2':
      Map: RegionMap202107212
    '20210617.0':
      Map: RegionMap202106170
    '20210126.0':
      Map: RegionMap202101260
    '20200917.0':
      Map: RegionMap20200917
    '20200722.0':
      Map: RegionMap202007220
    '20200520.1':
      Map: RegionMap202005201
    '20200406.0':
      Map: RegionMap202004060
    '20200304.0':
      Map: RegionMap202003040
    '20200207.1':
      Map: RegionMap202002071
    '20191217.0':
      Map: RegionMap201912170
  RegionMap202203160:
    'af-south-1':
      AMI: 'ami-01dacfb543597986e'
    'eu-north-1':
      AMI: 'ami-0dbef1af74414d054'
    'ap-south-1':
      AMI: 'ami-04a223c5825a793bc'
    'eu-west-3':
      AMI: 'ami-01df7c80e2aa60122'
    'eu-west-2':
      AMI: 'ami-0a4b5c4a6ada12bb0'
    'eu-south-1':
      AMI: 'ami-05bbd3b1a777dd4f6'
    'eu-west-1':
      AMI: 'ami-010c802cb2f348b54'
    'ap-northeast-3':
      AMI: 'ami-012b0e028ee9bb335'
    'ap-northeast-2':
      AMI: 'ami-09fee16f759d3c3a2'
    'me-south-1':
      AMI: 'ami-0f6426915cd915575'
    'ap-northeast-1':
      AMI: 'ami-0521a4a0a1329ff86'
    'sa-east-1':
      AMI: 'ami-0df679e2b2ce72667'
    'ca-central-1':
      AMI: 'ami-0cfc8f6b6d827ff08'
    'ap-east-1':
      AMI: 'ami-0d3881e59d6e28931'
    'ap-southeast-1':
      AMI: 'ami-02c62c1cc162ef9a1'
    'ap-southeast-2':
      AMI: 'ami-0916f5ee07e7b15d6'
    'eu-central-1':
      AMI: 'ami-056343e91872518f7'
    'ap-southeast-3':
      AMI: 'ami-06d59519532343357'
    'us-east-1':
      AMI: 'ami-03e0b06f01d45a4eb'
    'us-east-2':
      AMI: 'ami-09662e4f2b2fb67f9'
    'us-west-1':
      AMI: 'ami-052f64d0cd359fe1f'
    'us-west-2':
      AMI: 'ami-0eb324d928acca58a'
  RegionMap202202183:
    'af-south-1':
      AMI: 'ami-08d292fff05be4fd7'
    'eu-north-1':
      AMI: 'ami-0cc56fdf12f1adbf6'
    'ap-south-1':
      AMI: 'ami-058927a80413afd9e'
    'eu-west-3':
      AMI: 'ami-000fb470705e9b427'
    'eu-west-2':
      AMI: 'ami-0127d411688545f05'
    'eu-south-1':
      AMI: 'ami-09bb171d034878fa6'
    'eu-west-1':
      AMI: 'ami-01ddabedd99da311e'
    'ap-northeast-3':
      AMI: 'ami-01b2cb75ad60685ea'
    'ap-northeast-2':
      AMI: 'ami-036f006e994752282'
    'me-south-1':
      AMI: 'ami-0c622a92dda7b6ea0'
    'ap-northeast-1':
      AMI: 'ami-0726c1c7e01759156'
    'sa-east-1':
      AMI: 'ami-01f19ebd61bd11278'
    'ca-central-1':
      AMI: 'ami-08b873ca28bee919b'
    'ap-east-1':
      AMI: 'ami-0dc0e75ebff016b38'
    'ap-southeast-1':
      AMI: 'ami-0b65860b1b39327d1'
    'ap-southeast-2':
      AMI: 'ami-00b8a691539cc0039'
    'eu-central-1':
      AMI: 'ami-0b67cc43bc64a6060'
    'ap-southeast-3':
      AMI: 'ami-07d9d45b01cb0b44e'
    'us-east-1':
      AMI: 'ami-01b20f5ea962e3fe7'
    'us-east-2':
      AMI: 'ami-07e19c485c7cf2266'
    'us-west-1':
      AMI: 'ami-0577aef94c154720e'
    'us-west-2':
      AMI: 'ami-07c73ee7f59efbb9a'
  RegionMap202202181:
    'af-south-1':
      AMI: 'ami-0d7fe0087700f21a2'
    'eu-north-1':
      AMI: 'ami-0ba3efa3b01966bcb'
    'ap-south-1':
      AMI: 'ami-041aae81ed72817fd'
    'eu-west-3':
      AMI: 'ami-0299a65418e560db7'
    'eu-west-2':
      AMI: 'ami-0804a2711fa3726f3'
    'eu-south-1':
      AMI: 'ami-0420a01403c9572b9'
    'eu-west-1':
      AMI: 'ami-08754599965c30981'
    'ap-northeast-3':
      AMI: 'ami-038c5e963b706eb42'
    'ap-northeast-2':
      AMI: 'ami-0829f99d6eebc491a'
    'me-south-1':
      AMI: 'ami-0bff2679df4b5325d'
    'ap-northeast-1':
      AMI: 'ami-0a35e0f30c477c4ed'
    'sa-east-1':
      AMI: 'ami-0e75da331852510a4'
    'ca-central-1':
      AMI: 'ami-0e299df0d6042ab19'
    'ap-east-1':
      AMI: 'ami-0a9e4ecfcdcdf2ffe'
    'ap-southeast-1':
      AMI: 'ami-04b112e8ba800ec78'
    'ap-southeast-2':
      AMI: 'ami-08d76d04928793577'
    'eu-central-1':
      AMI: 'ami-0e06412e7a2ab14a2'
    'ap-southeast-3':
      AMI: 'ami-09beff734503fcd96'
    'us-east-1':
      AMI: 'ami-0e322da50e0e90e21'
    'us-east-2':
      AMI: 'ami-059e474a5b37e133b'
    'us-west-1':
      AMI: 'ami-07747ec74364622ce'
    'us-west-2':
      AMI: 'ami-00656d51d312f0dee'
  RegionMap202202071:
    'af-south-1':
      AMI: 'ami-0e896f1f6fc1e3480'
    'eu-north-1':
      AMI: 'ami-0e3f1570eb0a9bc7f'
    'ap-south-1':
      AMI: 'ami-0dafa01c8100180f8'
    'eu-west-3':
      AMI: 'ami-05cb6b584fc3c8ac8'
    'eu-west-2':
      AMI: 'ami-098a393b6fa6e700b'
    'eu-south-1':
      AMI: 'ami-0f8415bea5b1e5fd1'
    'eu-west-1':
      AMI: 'ami-09d5dd12541e69077'
    'ap-northeast-3':
      AMI: 'ami-032e497ef5ca5794c'
    'ap-northeast-2':
      AMI: 'ami-0eb7a369386789460'
    'me-south-1':
      AMI: 'ami-05c00047b0c3b6ed1'
    'ap-northeast-1':
      AMI: 'ami-08d56ac42e2d4a08b'
    'sa-east-1':
      AMI: 'ami-088911543b10876a4'
    'ca-central-1':
      AMI: 'ami-040d8c460f4fc4a9f'
    'ap-east-1':
      AMI: 'ami-02333d201cff78886'
    'ap-southeast-1':
      AMI: 'ami-04fc979a55e14b094'
    'ap-southeast-2':
      AMI: 'ami-042c4533fa25c105a'
    'eu-central-1':
      AMI: 'ami-00e232b942edaf8f9'
    'ap-southeast-3':
      AMI: 'ami-00ec7b5e8882f3a58'
    'us-east-1':
      AMI: 'ami-038b3df3312ddf25d'
    'us-east-2':
      AMI: 'ami-07b1d7739c91ed3fc'
    'us-west-1':
      AMI: 'ami-0729cd65c1a99b0c9'
    'us-west-2':
      AMI: 'ami-090bc08d7ae1f3881'
  RegionMap202112230:
    'af-south-1':
      AMI: 'ami-00ea1180c33766be8'
    'eu-north-1':
      AMI: 'ami-0a654623d21580ce0'
    'ap-south-1':
      AMI: 'ami-08181691f669ef7d2'
    'eu-west-3':
      AMI: 'ami-0984c6fda63734a94'
    'eu-west-2':
      AMI: 'ami-0cf5e24570c2b477b'
    'eu-south-1':
      AMI: 'ami-0b5b1b31fe90e8e71'
    'eu-west-1':
      AMI: 'ami-096f7a9ab885b50f4'
    'ap-northeast-3':
      AMI: 'ami-085322a66ec7b6645'
    'ap-northeast-2':
      AMI: 'ami-0781ede7661c6cd6e'
    'me-south-1':
      AMI: 'ami-00374a4f064f79cae'
    'ap-northeast-1':
      AMI: 'ami-0923d9a4d39b22a91'
    'sa-east-1':
      AMI: 'ami-050f2383ae3cd4bc2'
    'ca-central-1':
      AMI: 'ami-094d8d12ac8f29dc4'
    'ap-east-1':
      AMI: 'ami-003dcc837470176f6'
    'ap-southeast-1':
      AMI: 'ami-0a7587d725542cb4d'
    'ap-southeast-2':
      AMI: 'ami-0c1d83d75982f9cc0'
    'eu-central-1':
      AMI: 'ami-095e0f8062e0e8216'
    'us-east-1':
      AMI: 'ami-083602cee93914c0c'
    'us-east-2':
      AMI: 'ami-066157edddaec5e49'
    'us-west-1':
      AMI: 'ami-08629b3250aa07841'
    'us-west-2':
      AMI: 'ami-0ecf760d3d7e1fefa'
  RegionMap202110050:
    'af-south-1':
      AMI: 'ami-070fc0373e6c22c97'
    'eu-north-1':
      AMI: 'ami-001c5f3c0a8b3f245'
    'ap-south-1':
      AMI: 'ami-041db4a969fe3eb68'
    'eu-west-3':
      AMI: 'ami-0da7ba92c3c072475'
    'eu-west-2':
      AMI: 'ami-074771aa49ab046e7'
    'eu-south-1':
      AMI: 'ami-07f0f6adab1daa189'
    'eu-west-1':
      AMI: 'ami-0ed961fa828560210'
    'ap-northeast-3':
      AMI: 'ami-026107638e7d599b1'
    'ap-northeast-2':
      AMI: 'ami-04e8dfc09b22389ad'
    'me-south-1':
      AMI: 'ami-0980753c2dfad9136'
    'ap-northeast-1':
      AMI: 'ami-02d36247c5bc58c23'
    'sa-east-1':
      AMI: 'ami-07983613af1a3ef44'
    'ca-central-1':
      AMI: 'ami-0d8ad3ab25e7abc51'
    'ap-east-1':
      AMI: 'ami-0d41b14f11c68e677'
    'ap-southeast-1':
      AMI: 'ami-07191cf2912e097a6'
    'ap-southeast-2':
      AMI: 'ami-04a81599b183d7908'
    'eu-central-1':
      AMI: 'ami-047e03b8591f2d48a'
    'us-east-1':
      AMI: 'ami-01cc34ab2709337aa'
    'us-east-2':
      AMI: 'ami-0f19d220602031aed'
    'us-west-1':
      AMI: 'ami-0e0bf4b3a0c0e0adc'
    'us-west-2':
      AMI: 'ami-0e5b6b6a9f3db6db8'
  RegionMap202107212:
    'af-south-1':
      AMI: 'ami-0edec67949fd25461'
    'eu-north-1':
      AMI: 'ami-0d441f5643da997cb'
    'ap-south-1':
      AMI: 'ami-04db49c0fb2215364'
    'eu-west-3':
      AMI: 'ami-0d49cec198762b78c'
    'eu-west-2':
      AMI: 'ami-0d26eb3972b7f8c96'
    'eu-south-1':
      AMI: 'ami-0fce326033a239d55'
    'eu-west-1':
      AMI: 'ami-02b4e72b17337d6c1'
    'ap-northeast-3':
      AMI: 'ami-0e787554e61105680'
    'ap-northeast-2':
      AMI: 'ami-0a0de518b1fc4524c'
    'me-south-1':
      AMI: 'ami-004b77593bd476317'
    'ap-northeast-1':
      AMI: 'ami-09ebacdc178ae23b7'
    'sa-east-1':
      AMI: 'ami-0f8243a5175208e08'
    'ca-central-1':
      AMI: 'ami-02f84cf47c23f1769'
    'ap-east-1':
      AMI: 'ami-0a2115f8cc0a3956b'
    'ap-southeast-1':
      AMI: 'ami-0f511ead81ccde020'
    'ap-southeast-2':
      AMI: 'ami-0aab712d6363da7f9'
    'eu-central-1':
      AMI: 'ami-0453cb7b5f2b7fca2'
    'us-east-1':
      AMI: 'ami-0c2b8ca1dad447f8a'
    'us-east-2':
      AMI: 'ami-0443305dabd4be2bc'
    'us-west-1':
      AMI: 'ami-04b6c97b14c54de18'
    'us-west-2':
      AMI: 'ami-083ac7c7ecf9bb9b0'
  RegionMap202106170:
    'af-south-1':
      AMI: 'ami-0a797f6e4448b3b6f'
    'eu-north-1':
      AMI: 'ami-0865a7423ddc6317c'
    'ap-south-1':
      AMI: 'ami-011c99152163a87ae'
    'eu-west-3':
      AMI: 'ami-0b2f05cf909299b7c'
    'eu-west-2':
      AMI: 'ami-033af134328c47f48'
    'eu-south-1':
      AMI: 'ami-0512b7a96307ce5c4'
    'eu-west-1':
      AMI: 'ami-0f89681a05a3a9de7'
    'ap-northeast-3':
      AMI: 'ami-09965f96c50f5a3d4'
    'ap-northeast-2':
      AMI: 'ami-086a3601cd7a83590'
    'me-south-1':
      AMI: 'ami-0a0ee2492a9f81d76'
    'ap-northeast-1':
      AMI: 'ami-06631ebafb3ae5d34'
    'sa-east-1':
      AMI: 'ami-0113db2202e3b45a5'
    'ca-central-1':
      AMI: 'ami-07d95746fec4b20a3'
    'ap-east-1':
      AMI: 'ami-036fe7ba35d60224e'
    'ap-southeast-1':
      AMI: 'ami-018c1c51c7a13e363'
    'ap-southeast-2':
      AMI: 'ami-05064bb33b40c33a2'
    'eu-central-1':
      AMI: 'ami-089b5384aac360007'
    'us-east-1':
      AMI: 'ami-0ab4d1e9cf9a1215a'
    'us-east-2':
      AMI: 'ami-0277b52859bac6f4b'
    'us-west-1':
      AMI: 'ami-02f24ad9a1d24a799'
    'us-west-2':
      AMI: 'ami-0721c9af7b9b75114'
  RegionMap202101260:
    'af-south-1':
      AMI: 'ami-0438616cef15ba2ca'
    'eu-north-1':
      AMI: 'ami-0eb6f319b31f7092d'
    'ap-south-1':
      AMI: 'ami-08e0ca9924195beba'
    'eu-west-3':
      AMI: 'ami-0ea4a063871686f37'
    'eu-west-2':
      AMI: 'ami-098828924dc89ea4a'
    'eu-south-1':
      AMI: 'ami-0ea288dd7bb5b0251'
    'eu-west-1':
      AMI: 'ami-0fc970315c2d38f01'
    'ap-northeast-2':
      AMI: 'ami-09282971cf2faa4c9'
    'me-south-1':
      AMI: 'ami-0cc4f2b06b56d27e9'
    'ap-northeast-1':
      AMI: 'ami-0992fc94ca0f1415a'
    'sa-east-1':
      AMI: 'ami-089aac6323aa08aee'
    'ca-central-1':
      AMI: 'ami-075cfad2d9805c5f2'
    'ap-east-1':
      AMI: 'ami-040f64b9a031d8eb0'
    'ap-southeast-1':
      AMI: 'ami-0e2e44c03b85f58b3'
    'ap-southeast-2':
      AMI: 'ami-04f77aa5970939148'
    'eu-central-1':
      AMI: 'ami-0a6dc7529cd559185'
    'us-east-1':
      AMI: 'ami-047a51fa27710816e'
    'us-east-2':
      AMI: 'ami-01aab85a5e4a5a0fe'
    'us-west-1':
      AMI: 'ami-005c06c6de69aee84'
    'us-west-2':
      AMI: 'ami-0e999cbd62129e3b1'
  RegionMap20200917:
    'af-south-1':
      AMI: 'ami-0cec12e29ebe3f0d5'
    'eu-north-1':
      AMI: 'ami-0653812935d0743fe'
    'ap-south-1':
      AMI: 'ami-0e306788ff2473ccb'
    'eu-west-3':
      AMI: 'ami-0de12f76efe134f2f'
    'eu-west-2':
      AMI: 'ami-0a669382ea0feb73a'
    'eu-south-1':
      AMI: 'ami-0759301b88845d121'
    'eu-west-1':
      AMI: 'ami-0bb3fad3c0286ebd5'
    'ap-northeast-2':
      AMI: 'ami-03b42693dc6a7dc35'
    'me-south-1':
      AMI: 'ami-08155c9ee8b845e35'
    'ap-northeast-1':
      AMI: 'ami-0ce107ae7af2e92b5'
    'sa-east-1':
      AMI: 'ami-02898a1921d38a50b'
    'ca-central-1':
      AMI: 'ami-0c2f25c1f66a1ff4d'
    'ap-east-1':
      AMI: 'ami-814d0ff0'
    'ap-southeast-1':
      AMI: 'ami-015a6758451df3cb9'
    'ap-southeast-2':
      AMI: 'ami-0f96495a064477ffb'
    'eu-central-1':
      AMI: 'ami-00a205cb8e06c3c4e'
    'us-east-1':
      AMI: 'ami-0947d2ba12ee1ff75'
    'us-east-2':
      AMI: 'ami-03657b56516ab7912'
    'us-west-1':
      AMI: 'ami-0e4035ae3f70c400f'
    'us-west-2':
      AMI: 'ami-0528a5175983e7f28'
  RegionMap202007220:
    'af-south-1':
      AMI: 'ami-08c9d9528020000ac'
    'eu-north-1':
      AMI: 'ami-039609244d2810a6b'
    'ap-south-1':
      AMI: 'ami-0ebc1ac48dfd14136'
    'eu-west-3':
      AMI: 'ami-093fa4c538885becf'
    'eu-west-2':
      AMI: 'ami-0a13d44dccf1f5cf6'
    'eu-south-1':
      AMI: 'ami-0533a9871112d2d51'
    'eu-west-1':
      AMI: 'ami-07d9160fa81ccffb5'
    'ap-northeast-2':
      AMI: 'ami-0bd7691bf6470fe9c'
    'me-south-1':
      AMI: 'ami-01f41d49c363da2ad'
    'ap-northeast-1':
      AMI: 'ami-0cc75a8978fbbc969'
    'sa-east-1':
      AMI: 'ami-018ccfb6b4745882a'
    'ca-central-1':
      AMI: 'ami-013d1df4bcea6ba95'
    'ap-east-1':
      AMI: 'ami-47317236'
    'ap-southeast-1':
      AMI: 'ami-0cd31be676780afa7'
    'ap-southeast-2':
      AMI: 'ami-0ded330691a314693'
    'eu-central-1':
      AMI: 'ami-0c115dbd34c69a004'
    'us-east-1':
      AMI: 'ami-02354e95b39ca8dec'
    'us-east-2':
      AMI: 'ami-07c8bc5c1ce9598c3'
    'us-west-1':
      AMI: 'ami-05655c267c89566dd'
    'us-west-2':
      AMI: 'ami-0873b46c45c11058d'
  RegionMap202005201:
    'af-south-1':
      AMI: 'ami-0ec47ddb564d75b64'
    'eu-north-1':
      AMI: 'ami-04697c9bb5d6135a2'
    'ap-south-1':
      AMI: 'ami-0447a12f28fddb066'
    'eu-west-3':
      AMI: 'ami-01c72e187b357583b'
    'eu-west-2':
      AMI: 'ami-032598fcc7e9d1c7a'
    'eu-south-1':
      AMI: 'ami-0f9b9a8cf93d838d0'
    'eu-west-1':
      AMI: 'ami-0ea3405d2d2522162'
    'ap-northeast-2':
      AMI: 'ami-01af223aa7f274198'
    'me-south-1':
      AMI: 'ami-01b31491b74045c0c'
    'ap-northeast-1':
      AMI: 'ami-0a1c2ec61571737db'
    'sa-east-1':
      AMI: 'ami-0477a95397a9154b3'
    'ca-central-1':
      AMI: 'ami-0f75c2980c6a5851d'
    'ap-east-1':
      AMI: 'ami-49bbfa38'
    'ap-southeast-1':
      AMI: 'ami-0615132a0f36d24f4'
    'ap-southeast-2':
      AMI: 'ami-088ff0e3bde7b3fdf'
    'eu-central-1':
      AMI: 'ami-0a02ee601d742e89f'
    'us-east-1':
      AMI: 'ami-09d95fab7fff3776c'
    'us-east-2':
      AMI: 'ami-026dea5602e368e96'
    'us-west-1':
      AMI: 'ami-04e59c05167ea7bd5'
    'us-west-2':
      AMI: 'ami-0e34e7b9ca0ace12d'
  RegionMap202004060:
    'af-south-1':
      AMI: 'ami-0b4a93eff849f20ca'
    'eu-north-1':
      AMI: 'ami-0b7a46b4bd694e8a6'
    'ap-south-1':
      AMI: 'ami-0470e33cd681b2476'
    'eu-west-3':
      AMI: 'ami-00077e3fed5089981'
    'eu-west-2':
      AMI: 'ami-01a6e31ac994bbc09'
    'eu-south-1':
      AMI: 'ami-06db5ba0a09e927c8'
    'eu-west-1':
      AMI: 'ami-06ce3edf0cff21f07'
    'ap-northeast-2':
      AMI: 'ami-01288945bd24ed49a'
    'me-south-1':
      AMI: 'ami-0fde637e0db57a2ab'
    'ap-northeast-1':
      AMI: 'ami-0f310fced6141e627'
    'sa-east-1':
      AMI: 'ami-003449ffb2605a74c'
    'ca-central-1':
      AMI: 'ami-054362537f5132ce2'
    'ap-east-1':
      AMI: 'ami-dd7731ac'
    'ap-southeast-1':
      AMI: 'ami-0ec225b5e01ccb706'
    'ap-southeast-2':
      AMI: 'ami-0970010f37c4f9c8d'
    'eu-central-1':
      AMI: 'ami-076431be05aaf8080'
    'us-east-1':
      AMI: 'ami-0323c3dd2da7fb37d'
    'us-east-2':
      AMI: 'ami-0f7919c33c90f5b58'
    'us-west-1':
      AMI: 'ami-06fcc1f0bc2c8943f'
    'us-west-2':
      AMI: 'ami-0d6621c01e8c2de2c'
  RegionMap202003040:
    'eu-north-1':
      AMI: 'ami-0f630db6194a81ad0'
    'ap-south-1':
      AMI: 'ami-03b5297d565ef30a6'
    'eu-west-3':
      AMI: 'ami-07eda9385feb1e969'
    'eu-west-2':
      AMI: 'ami-0cb790308f7591fa6'
    'eu-west-1':
      AMI: 'ami-04d5cc9b88f9d1d39'
    'ap-northeast-2':
      AMI: 'ami-0db78afd3d150fc18'
    'me-south-1':
      AMI: 'ami-05613911cb72781b8'
    'ap-northeast-1':
      AMI: 'ami-052652af12b58691f'
    'sa-east-1':
      AMI: 'ami-0b032e878a66c3b68'
    'ca-central-1':
      AMI: 'ami-0bf54ac1b628cf143'
    'ap-east-1':
      AMI: 'ami-33a7e042'
    'ap-southeast-1':
      AMI: 'ami-0cbc6aae997c6538a'
    'ap-southeast-2':
      AMI: 'ami-08fdde86b93accf1c'
    'eu-central-1':
      AMI: 'ami-0ec1ba09723e5bfac'
    'us-east-1':
      AMI: 'ami-0fc61db8544a617ed'
    'us-east-2':
      AMI: 'ami-0e01ce4ee18447327'
    'us-west-1':
      AMI: 'ami-09a7fe78668f1e2c0'
    'us-west-2':
      AMI: 'ami-0ce21b51cb31a48b8'
  RegionMap202002071:
    'eu-north-1':
      AMI: 'ami-074a0e4318181e9d9'
    'ap-south-1':
      AMI: 'ami-0d9462a653c34dab7'
    'eu-west-3':
      AMI: 'ami-0fd9bce3a3384b635'
    'eu-west-2':
      AMI: 'ami-0389b2a3c4948b1a0'
    'eu-west-1':
      AMI: 'ami-099a8245f5daa82bf'
    'ap-northeast-2':
      AMI: 'ami-0a93a08544874b3b7'
    'me-south-1':
      AMI: 'ami-0e0e68bcf15b6f5cd'
    'ap-northeast-1':
      AMI: 'ami-0af1df87db7b650f4'
    'sa-east-1':
      AMI: 'ami-080a223be3de0c3b8'
    'ca-central-1':
      AMI: 'ami-00db12b46ef5ebc36'
    'ap-east-1':
      AMI: 'ami-47e4a036'
    'ap-southeast-1':
      AMI: 'ami-0f02b24005e4aec36'
    'ap-southeast-2':
      AMI: 'ami-0f767afb799f45102'
    'eu-central-1':
      AMI: 'ami-0df0e7600ad0913a9'
    'us-east-1':
      AMI: 'ami-0a887e401f7654935'
    'us-east-2':
      AMI: 'ami-0e38b48473ea57778'
    'us-west-1':
      AMI: 'ami-01c94064639c71719'
    'us-west-2':
      AMI: 'ami-0e8c04af2729ff1bb'
  RegionMap201912170:
    'eu-north-1':
      AMI: 'ami-0662eb9b9b8685935'
    'ap-south-1':
      AMI: 'ami-0217a85e28e625474'
    'eu-west-3':
      AMI: 'ami-007fae589fdf6e955'
    'eu-west-2':
      AMI: 'ami-0089b31e09ac3fffc'
    'eu-west-1':
      AMI: 'ami-0713f98de93617bb4'
    'ap-northeast-2':
      AMI: 'ami-0bea7fd38fabe821a'
    'me-south-1':
      AMI: 'ami-05f93aaf03b9bf20c'
    'ap-northeast-1':
      AMI: 'ami-011facbea5ec0363b'
    'sa-east-1':
      AMI: 'ami-09de7b4017733e2af'
    'ca-central-1':
      AMI: 'ami-0a269ca7cc3e3beff'
    'ap-east-1':
      AMI: 'ami-db3d78aa'
    'ap-southeast-1':
      AMI: 'ami-05c64f7b4062b0a21'
    'ap-southeast-2':
      AMI: 'ami-0b8b10b5bf11f3a22'
    'eu-central-1':
      AMI: 'ami-07cda0db070313c52'
    'us-east-1':
      AMI: 'ami-062f7200baf2fa504'
    'us-east-2':
      AMI: 'ami-02ccb28830b645a41'
    'us-west-1':
      AMI: 'ami-03caa3f860895f82e'
    'us-west-2':
      AMI: 'ami-04590e7389a6e577c'
Conditions:
  HasPermissionsBoundary: !Not [!Equals [!Ref PermissionsBoundary, '']]
  HasKmsKey: !Not [!Equals [!Ref ParentKmsKeyStack, '']]
  HasKeyName: !Not [!Equals [!Ref KeyName, '']]
  HasIAMUserSSHAccess: !Equals [!Ref IAMUserSSHAccess, 'true']
  HasSSHBastionSecurityGroup: !Not [!Equals [!Ref ParentSSHBastionStack, '']]
  HasNotSSHBastionSecurityGroup: !Equals [!Ref ParentSSHBastionStack, '']
  HasAlertTopic: !Not [!Equals [!Ref ParentAlertStack, '']]
  HasZone: !Not [!Equals [!Ref ParentZoneStack, '']]
  HasIngressTcpPort1: !Not [!Equals [!Ref IngressTcpPort1, '']]
  HasIngressTcpParentClientStack1: !Not [!Equals [!Ref IngressTcpParentClientStack1, '']]
  HasIngressTcpPort2: !Not [!Equals [!Ref IngressTcpPort2, '']]
  HasIngressTcpParentClientStack2: !Not [!Equals [!Ref IngressTcpParentClientStack2, '']]
  HasIngressTcpPort3: !Not [!Equals [!Ref IngressTcpPort3, '']]
  HasIngressTcpParentClientStack3: !Not [!Equals [!Ref IngressTcpParentClientStack3, '']]
  HasClientSecurityGroup1: !Not [!Equals [!Ref ParentClientStack1, '']]
  HasClientSecurityGroup2: !Not [!Equals [!Ref ParentClientStack2, '']]
  HasClientSecurityGroup3: !Not [!Equals [!Ref ParentClientStack3, '']]
  HasManagedPolicyArns: !Not [!Equals [!Ref ManagedPolicyArns, '']]
  HasBackupRetentionPeriod: !Not [!Equals [!Ref BackupRetentionPeriod, 0]]
  HasRestoreImageId: !Not [!Equals [!Ref RestoreImageId, '']]
  HasMaintenanceWindowSchedule: !Not [!Equals [!Ref MaintenanceWindowSchedule, '']]
Resources:
  RecordSet:
    Condition: HasZone
    Type: 'AWS::Route53::RecordSet'
    Properties:
      HostedZoneId: {'Fn::ImportValue': !Sub '${ParentZoneStack}-HostedZoneId'}
      Name: !Sub
      - '${SubDomainNameWithDot}${HostedZoneName}'
      - SubDomainNameWithDot: !Ref SubDomainNameWithDot
        HostedZoneName: {'Fn::ImportValue': !Sub '${ParentZoneStack}-HostedZoneName'}
      ResourceRecords:
      - !GetAtt 'NetworkInterface.PrimaryPrivateIpAddress'
      TTL: 60
      Type: A
  NetworkInterface:
    Type: 'AWS::EC2::NetworkInterface'
    Properties:
      GroupSet:
      - !Ref SecurityGroup
      - !If [HasClientSecurityGroup1, {'Fn::ImportValue': !Sub '${ParentClientStack1}-ClientSecurityGroup'}, !Ref 'AWS::NoValue']
      - !If [HasClientSecurityGroup2, {'Fn::ImportValue': !Sub '${ParentClientStack2}-ClientSecurityGroup'}, !Ref 'AWS::NoValue']
      - !If [HasClientSecurityGroup3, {'Fn::ImportValue': !Sub '${ParentClientStack3}-ClientSecurityGroup'}, !Ref 'AWS::NoValue']
      SubnetId: {'Fn::ImportValue': !Sub '${ParentVPCStack}-${SubnetName}'}
  Logs:
    Type: 'AWS::Logs::LogGroup'
    Properties:
      RetentionInDays: !Ref LogsRetentionInDays
  SecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: !Ref Name
      VpcId: {'Fn::ImportValue': !Sub '${ParentVPCStack}-VPC'}
  SecurityGroupInSSHBastion:
    Type: 'AWS::EC2::SecurityGroupIngress'
    Condition: HasSSHBastionSecurityGroup
    Properties:
      GroupId: !Ref SecurityGroup
      IpProtocol: tcp
      FromPort: 22
      ToPort: 22
      SourceSecurityGroupId: {'Fn::ImportValue': !Sub '${ParentSSHBastionStack}-SecurityGroup'}
  SecurityGroupInSSHWorld:
    Type: 'AWS::EC2::SecurityGroupIngress'
    Condition: HasNotSSHBastionSecurityGroup
    Properties:
      GroupId: !Ref SecurityGroup
      IpProtocol: tcp
      FromPort: 22
      ToPort: 22
      CidrIp: '0.0.0.0/0'
  SecurityGroupIngressTcpPort1:
    Type: 'AWS::EC2::SecurityGroupIngress'
    Condition: HasIngressTcpPort1
    Properties:
      GroupId: !Ref SecurityGroup
      IpProtocol: tcp
      FromPort: !Ref IngressTcpPort1
      ToPort: !Ref IngressTcpPort1
      SourceSecurityGroupId: !If [HasIngressTcpParentClientStack1, {'Fn::ImportValue': !Sub '${IngressTcpParentClientStack1}-ClientSecurityGroup'}, !Ref 'AWS::NoValue']
      CidrIp: !If [HasIngressTcpParentClientStack1, !Ref 'AWS::NoValue', '0.0.0.0/0']
  SecurityGroupIngressTcpPort2:
    Type: 'AWS::EC2::SecurityGroupIngress'
    Condition: HasIngressTcpPort2
    Properties:
      GroupId: !Ref SecurityGroup
      IpProtocol: tcp
      FromPort: !Ref IngressTcpPort2
      ToPort: !Ref IngressTcpPort2
      SourceSecurityGroupId: !If [HasIngressTcpParentClientStack2, {'Fn::ImportValue': !Sub '${IngressTcpParentClientStack2}-ClientSecurityGroup'}, !Ref 'AWS::NoValue']
      CidrIp: !If [HasIngressTcpParentClientStack2, !Ref 'AWS::NoValue', '0.0.0.0/0']
  SecurityGroupIngressTcpPort3:
    Type: 'AWS::EC2::SecurityGroupIngress'
    Condition: HasIngressTcpPort3
    Properties:
      GroupId: !Ref SecurityGroup
      IpProtocol: tcp
      FromPort: !Ref IngressTcpPort3
      ToPort: !Ref IngressTcpPort3
      SourceSecurityGroupId: !If [HasIngressTcpParentClientStack3, {'Fn::ImportValue': !Sub '${IngressTcpParentClientStack3}-ClientSecurityGroup'}, !Ref 'AWS::NoValue']
      CidrIp: !If [HasIngressTcpParentClientStack3, !Ref 'AWS::NoValue', '0.0.0.0/0']
  InstanceProfile:
    Type: 'AWS::IAM::InstanceProfile'
    Properties:
      Roles:
      - !Ref IAMRole
  IAMRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: 'ec2.amazonaws.com'
          Action: 'sts:AssumeRole'
      ManagedPolicyArns: !If [HasManagedPolicyArns, !Split [',', !Ref ManagedPolicyArns], !Ref 'AWS::NoValue']
      PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundary, !Ref 'AWS::NoValue']
      Policies:
      - PolicyName: ssm
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - 'ssmmessages:*' # SSM Agent by https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-messageAPIs.html
            - 'ssm:UpdateInstanceInformation' # SSM agent by https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-messageAPIs.html
            - 'ec2messages:*' # SSM Session Manager by https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-messageAPIs.html
            - 'ssm:GetDeployablePatchSnapshotForInstance'
            - 'ssm:ListAssociations'
            Resource: '*'
          - Effect: Allow
            Action: 's3:GetObject'
            Resource:
            - !Sub 'arn:${AWS::Partition}:s3:::aws-ssm-${AWS::Region}/*'
            - !Sub 'arn:${AWS::Partition}:s3:::patch-baseline-snapshot-${AWS::Region}/*'
      - PolicyName: cloudwatch
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action: 'cloudwatch:PutMetricData'
            Resource: '*'
            Condition:
              StringEquals:
                'cloudwatch:namespace': !Ref 'AWS::StackName'
          - Effect: Allow
            Action:
            - 'logs:CreateLogGroup'
            - 'logs:CreateLogStream'
            - 'logs:PutLogEvents'
            - 'logs:DescribeLogStreams'
            - 'logs:DescribeLogGroups'
            Resource: !GetAtt 'Logs.Arn'
  IAMPolicySSM:
    Type: 'AWS::IAM::Policy'
    Properties:
      Roles:
      - !Ref IAMRole
      PolicyName: ssm2
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Action: 'ssm:ListInstanceAssociations'
          Resource: !Sub 'arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:instance/${VirtualMachine}'
        - Effect: Allow
          Action: 'ssm:PutInventory'
          Resource:
          - !Sub 'arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:instance/${VirtualMachine}'
          - !Sub 'arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:managed-instance-inventory/${VirtualMachine}'
        - Effect: Allow
          Action: 'ssm:UpdateInstanceAssociationStatus'
          Resource:
          - !Sub 'arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:instance/${VirtualMachine}'
          - !Sub 'arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:association/${AssociationRunPatchBaselineScan}'
  IAMPolicySSHAccess:
    Type: 'AWS::IAM::Policy'
    Condition: HasIAMUserSSHAccess
    Properties:
      Roles:
      - !Ref IAMRole
      PolicyName: iam
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Action:
          - 'iam:ListUsers'
          Resource:
          - '*'
        - Effect: Allow
          Action:
          - 'iam:ListSSHPublicKeys'
          - 'iam:GetSSHPublicKey'
          Resource:
          - !Sub 'arn:aws:iam::${AWS::AccountId}:user/*'
  VirtualMachine: # TODO make IMDSv2 required (waits for https://github.com/aws-cloudformation/aws-cloudformation-coverage-roadmap/issues/655)
    Type: 'AWS::EC2::Instance'
    Metadata:
      'AWS::CloudFormation::Init':
        configSets:
          default: [cloudwatch, !If [HasIAMUserSSHAccess, ssh-access, !Ref 'AWS::NoValue'], config]
        cloudwatch:
          packages:
            rpm:
              cloudwatch: 'https://s3.amazonaws.com/amazoncloudwatch-agent/amazon_linux/amd64/latest/amazon-cloudwatch-agent.rpm'
          files:
            '/opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json': # https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Agent-Configuration-File-Details.html
              content: !Sub |
                {
                  "logs": {
                    "logs_collected": {
                      "files": {
                        "collect_list": [{
                           "log_group_name": "${Logs}",
                           "file_path": "/var/log/amazon/amazon-cloudwatch-agent/amazon-cloudwatch-agent.log",
                           "log_stream_name": "{instance_id}/var/log/amazon/amazon-cloudwatch-agent/amazon-cloudwatch-agent.log",
                           "timestamp_format": "%Y-%m-%dT%H:%M:%S"
                        }, {
                           "log_group_name": "${Logs}",
                           "file_path": "/var/log/amazon/amazon-cloudwatch-agent/configuration-validation.log",
                           "log_stream_name": "{instance_id}/var/log/amazon/amazon-cloudwatch-agent/configuration-validation.log",
                           "timestamp_format": "%Y/%m/%d %H:%M:%S"
                        }, {
                          "log_group_name": "${Logs}",
                          "file_path": "/var/log/amazon/ssm/amazon-ssm-agent.log",
                          "log_stream_name": "{instance_id}/var/log/amazon/ssm/amazon-ssm-agent.log",
                          "timestamp_format": "%Y-%m-%d %H:%M:%S"
                        }, {
                           "log_group_name": "${Logs}",
                           "file_path": "/var/log/amazon/ssm/errors.log",
                           "log_stream_name": "{instance_id}/var/log/amazon/ssm/errors.log",
                           "timestamp_format": "%Y-%m-%d %H:%M:%S"
                        }, {
                           "log_group_name": "${Logs}",
                           "file_path": "/var/log/audit/audit.log",
                           "log_stream_name": "{instance_id}/var/log/audit/audit.log"
                        }, {
                           "log_group_name": "${Logs}",
                           "file_path": "/var/log/boot.log",
                           "log_stream_name": "{instance_id}/var/log/boot.log"
                        }, {
                           "log_group_name": "${Logs}",
                           "file_path": "/var/log/cfn-hup.log",
                           "log_stream_name": "{instance_id}/var/log/cfn-hup.log",
                           "timestamp_format": "%Y-%m-%d %H:%M:%S"
                        }, {
                           "log_group_name": "${Logs}",
                           "file_path": "/var/log/cfn-init-cmd.log",
                           "log_stream_name": "{instance_id}/var/log/cfn-init-cmd.log",
                           "timestamp_format": "%Y-%m-%d %H:%M:%S"
                        }, {
                           "log_group_name": "${Logs}",
                           "file_path": "/var/log/cfn-init.log",
                           "log_stream_name": "{instance_id}/var/log/cfn-init.log",
                           "timestamp_format": "%Y-%m-%d %H:%M:%S"
                        }, {
                           "log_group_name": "${Logs}",
                           "file_path": "/var/log/cfn-wire.log",
                           "log_stream_name": "{instance_id}/var/log/cfn-wire.log",
                           "timestamp_format": "%Y-%m-%d %H:%M:%S"
                        }, {
                           "log_group_name": "${Logs}",
                           "file_path": "/var/log/cloud-init-output.log",
                           "log_stream_name": "{instance_id}/var/log/cloud-init-output.log"
                        }, {
                           "log_group_name": "${Logs}",
                           "file_path": "/var/log/cloud-init.log",
                           "log_stream_name": "{instance_id}/var/log/cloud-init.log",
                           "timestamp_format": "%b %d %H:%M:%S"
                        }, {
                           "log_group_name": "${Logs}",
                           "file_path": "/var/log/cron",
                           "log_stream_name": "{instance_id}/var/log/cron",
                           "timestamp_format": "%b %-d %H:%M:%S"
                        }, {
                           "log_group_name": "${Logs}",
                           "file_path": "/var/log/dmesg",
                           "log_stream_name": "{instance_id}/var/log/dmesg"
                        }, {
                           "log_group_name": "${Logs}",
                           "file_path": "/var/log/grubby_prune_debug",
                           "log_stream_name": "{instance_id}/var/log/grubby_prune_debug"
                        }, {
                           "log_group_name": "${Logs}",
                           "file_path": "/var/log/maillog",
                           "log_stream_name": "{instance_id}/var/log/maillog",
                           "timestamp_format": "%b %-d %H:%M:%S"
                        }, {
                           "log_group_name": "${Logs}",
                           "file_path": "/var/log/messages",
                           "log_stream_name": "{instance_id}/var/log/messages",
                           "timestamp_format": "%b %-d %H:%M:%S"
                        }, {
                           "log_group_name": "${Logs}",
                           "file_path": "/var/log/secure",
                           "log_stream_name": "{instance_id}/var/log/secure",
                           "timestamp_format": "%b %-d %H:%M:%S"
                        }, {
                           "log_group_name": "${Logs}",
                           "file_path": "/var/log/yum.log",
                           "log_stream_name": "{instance_id}/var/log/yum.log",
                           "timestamp_format": "%b %d %H:%M:%S"
                        }]
                      }
                    }
                  },
                  "metrics": {
                    "namespace": "${AWS::StackName}",
                    "append_dimensions": {
                      "InstanceId": "${!aws:InstanceId}"
                    },
                    "metrics_collected": {
                      "mem": {
                        "measurement": [
                          "mem_used_percent"
                        ]
                      },
                      "swap": {
                        "measurement": [
                          "swap_used_percent"
                        ]
                      },
                      "disk": {
                        "resources": [
                          "/"
                        ],
                        "measurement": [
                          "used_percent"
                        ],
                        "drop_device": true
                      }
                    }
                  }
                }
              mode: '000644'
              owner: root
              group: root
          services:
            sysvinit:
              'amazon-cloudwatch-agent':
                enabled: true
                ensureRunning: true
                files:
                - '/opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json'
                packages:
                - cloudwatch
        ssh-access:
          files:
            '/opt/authorized_keys_command.sh':
              content: |
                #!/bin/bash -e
                if [ -z "$1" ]; then
                  exit 1
                fi
                UnsaveUserName="$1"
                UnsaveUserName=${UnsaveUserName//".plus."/"+"}
                UnsaveUserName=${UnsaveUserName//".equal."/"="}
                UnsaveUserName=${UnsaveUserName//".comma."/","}
                UnsaveUserName=${UnsaveUserName//".at."/"@"}
                aws iam list-ssh-public-keys --user-name "$UnsaveUserName" --query "SSHPublicKeys[?Status == 'Active'].[SSHPublicKeyId]" --output text | while read -r KeyId; do
                  aws iam get-ssh-public-key --user-name "$UnsaveUserName" --ssh-public-key-id "$KeyId" --encoding SSH --query "SSHPublicKey.SSHPublicKeyBody" --output text
                done
              mode: '000755'
              owner: root
              group: root
            '/opt/import_users.sh':
              content: |
                #!/bin/bash -e
                aws iam list-users --query "Users[].[UserName]" --output text | while read User; do
                  SaveUserName="$User"
                  SaveUserName=${SaveUserName//"+"/".plus."}
                  SaveUserName=${SaveUserName//"="/".equal."}
                  SaveUserName=${SaveUserName//","/".comma."}
                  SaveUserName=${SaveUserName//"@"/".at."}
                  if [ "${#SaveUserName}" -le "32" ]; then
                    if ! id -u "$SaveUserName" >/dev/null 2>&1; then
                      #sudo will read each file in /etc/sudoers.d, skipping file names that end in ‘~’ or contain a ‘.’ character to avoid causing problems with package manager or editor temporary/backup files.
                      SaveUserFileName=$(echo "$SaveUserName" | tr "." " ")
                      /usr/sbin/useradd "$SaveUserName"
                      echo "$SaveUserName ALL=(ALL) NOPASSWD:ALL" > "/etc/sudoers.d/$SaveUserFileName"
                    fi
                  else
                    echo "Can not import IAM user ${SaveUserName}. User name is longer than 32 characters."
                  fi
                done
              mode: '000755'
              owner: root
              group: root
            '/etc/cron.d/import_users':
              content: |
                */10 * * * * root /opt/import_users.sh
              mode: '000644'
              owner: root
              group: root
          commands:
            'a_configure_sshd_command':
              command: 'sed -e ''/AuthorizedKeysCommand / s/^#*/#/'' -i /etc/ssh/sshd_config; echo -e ''\nAuthorizedKeysCommand /opt/authorized_keys_command.sh'' >> /etc/ssh/sshd_config'
              test: '! grep -q ''^AuthorizedKeysCommand /opt/authorized_keys_command.sh'' /etc/ssh/sshd_config'
            'b_configure_sshd_commanduser':
              command: 'sed -e ''/AuthorizedKeysCommandUser / s/^#*/#/'' -i /etc/ssh/sshd_config; echo -e ''\nAuthorizedKeysCommandUser nobody'' >> /etc/ssh/sshd_config'
              test: '! grep -q ''^AuthorizedKeysCommandUser nobody'' /etc/ssh/sshd_config'
            'c_import_users':
              command: './import_users.sh'
              cwd: '/opt'
          services:
            sysvinit:
              sshd:
                enabled: true
                ensureRunning: true
                commands:
                - 'a_configure_sshd_command'
                - 'b_configure_sshd_commanduser'
        config:
          files:
            '/etc/cfn/cfn-hup.conf':
              content: !Sub |
                [main]
                stack=${AWS::StackId}
                region=${AWS::Region}
                interval=1
              mode: '000400'
              owner: root
              group: root
            '/etc/cfn/hooks.d/cfn-auto-reloader.conf':
              content: !Sub |
                [cfn-auto-reloader-hook]
                triggers=post.update
                path=Resources.VirtualMachine.Metadata.AWS::CloudFormation::Init
                action=/opt/aws/bin/cfn-init --verbose --stack=${AWS::StackName} --region=${AWS::Region} --resource=VirtualMachine
                runas=root
          services:
            sysvinit:
              cfn-hup:
                enabled: true
                ensureRunning: true
                files:
                - '/etc/cfn/cfn-hup.conf'
                - '/etc/cfn/hooks.d/cfn-auto-reloader.conf'
              amazon-ssm-agent:
                enabled: true
                ensureRunning: true
    Properties:
      IamInstanceProfile: !Ref InstanceProfile
      ImageId: !If [HasRestoreImageId, !Ref RestoreImageId, !FindInMap [!FindInMap [VersionMap, !Ref AmazonLinux2Version, Map], !Ref 'AWS::Region', AMI]]
      InstanceType: !Ref InstanceType
      KeyName: !If [HasKeyName, !Ref KeyName, !Ref 'AWS::NoValue']
      BlockDeviceMappings:
      - DeviceName: '/dev/xvda'
        Ebs:
          Encrypted: !If [HasKmsKey, true, !Ref 'AWS::NoValue']
          KmsKeyId: !If [HasKmsKey, {'Fn::ImportValue': !Sub '${ParentKmsKeyStack}-KeyArn'}, !Ref 'AWS::NoValue']
          VolumeSize: !Ref RootVolumeSize
          VolumeType: gp2
      NetworkInterfaces:
      - DeviceIndex: '0'
        NetworkInterfaceId: !Ref NetworkInterface
      UserData:
        'Fn::Base64': !Sub |
          #!/bin/bash -ex
          trap '/opt/aws/bin/cfn-signal -e 1 --region ${AWS::Region} --stack ${AWS::StackName} --resource VirtualMachine' ERR
          ${UserData}
          /opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource VirtualMachine --region ${AWS::Region}
          /opt/aws/bin/cfn-signal -e 0 --region ${AWS::Region} --stack ${AWS::StackName} --resource VirtualMachine
      Tags:
      - Key: Name
        Value: !Ref Name
    CreationPolicy:
      ResourceSignal:
        Count: 1
        Timeout: PT10M
  RecoveryAlarm:
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: 'Recovering instance when underlying hardware fails.'
      Namespace: 'AWS/EC2'
      MetricName: StatusCheckFailed_System
      Statistic: Minimum
      Period: 60
      EvaluationPeriods: 5
      ComparisonOperator: GreaterThanThreshold
      Threshold: 0
      AlarmActions:
      - !Sub 'arn:aws:automate:${AWS::Region}:ec2:recover'
      Dimensions:
      - Name: InstanceId
        Value: !Ref VirtualMachine
  CPUTooHighAlarm:
    Condition: HasAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: 'Average CPU utilization over last 10 minutes higher than 80%'
      Namespace: 'AWS/EC2'
      MetricName: CPUUtilization
      Statistic: Average
      Period: 600
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: 80
      AlarmActions:
      - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
      Dimensions:
      - Name: InstanceId
        Value: !Ref VirtualMachine
  MemoryTooHighAlarm:
    Condition: HasAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: 'Average memory utilization over last 10 minutes higher than 80%'
      Namespace: !Ref 'AWS::StackName'
      MetricName: mem_used_percent
      Statistic: Average
      Period: 600
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: 80
      AlarmActions:
      - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
      Dimensions:
      - Name: InstanceId
        Value: !Ref VirtualMachine
  DiskTooHighAlarm:
    Condition: HasAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: 'Average disk utilization over last 10 minutes higher than 80%'
      Namespace: !Ref 'AWS::StackName'
      MetricName: disk_used_percent
      Statistic: Average
      Period: 600
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: 80
      AlarmActions:
      - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
      Dimensions:
      - Name: InstanceId
        Value: !Ref VirtualMachine
      - Name: fstype
        Value: xfs
      - Name: path
        Value: '/'
  MaintenanceWindow:
    Condition: HasMaintenanceWindowSchedule
    Type: 'AWS::SSM::MaintenanceWindow'
    Properties:
      AllowUnassociatedTargets: false
      Cutoff: 1
      Duration: 2
      Name: !Ref 'AWS::StackName'
      Schedule: !Ref MaintenanceWindowSchedule
      ScheduleTimezone: !Ref MaintenanceWindowScheduleTimezone
  MaintenanceWindowTarget:
    Condition: HasMaintenanceWindowSchedule
    Type: 'AWS::SSM::MaintenanceWindowTarget'
    Properties:
      ResourceType: INSTANCE
      Targets:
      - Key: InstanceIds
        Values: [!Ref VirtualMachine]
      WindowId: !Ref MaintenanceWindow
  MaintenanceWindowTask:
    Condition: HasMaintenanceWindowSchedule
    Type: 'AWS::SSM::MaintenanceWindowTask'
    Properties:
      MaxConcurrency: '1'
      MaxErrors: '1'
      Priority: 0
      Targets:
      - Key: WindowTargetIds
        Values: [!Ref MaintenanceWindowTarget]
      TaskArn: 'AWS-RunPatchBaseline'
      TaskInvocationParameters:
        MaintenanceWindowRunCommandParameters:
          Parameters:
            Operation: [Install]
      TaskType: 'RUN_COMMAND'
      WindowId: !Ref MaintenanceWindow
  AssociationRunPatchBaselineScan:
    Type: 'AWS::SSM::Association'
    Properties:
      Name: 'AWS-RunPatchBaseline'
      Parameters:
        Operation: [Scan]
      ScheduleExpression: 'rate(1 hour)'
      Targets:
      - Key: InstanceIds
        Values: [!Ref VirtualMachine]
  BackupVault: # cannot be deleted with data
    Condition: HasBackupRetentionPeriod
    Type: 'AWS::Backup::BackupVault'
    Properties:
      BackupVaultName: !Ref 'AWS::StackName'
      Notifications: !If [HasAlertTopic, {BackupVaultEvents: [BACKUP_JOB_STARTED, BACKUP_JOB_COMPLETED, RESTORE_JOB_STARTED, RESTORE_JOB_COMPLETED, RECOVERY_POINT_MODIFIED], SNSTopicArn: {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}}, !Ref 'AWS::NoValue']
  BackupPlan:
    Condition: HasBackupRetentionPeriod
    Type: 'AWS::Backup::BackupPlan'
    Properties:
      BackupPlan:
        BackupPlanName: !Ref 'AWS::StackName'
        BackupPlanRule:
        - CompletionWindowMinutes: 1440
          Lifecycle:
            DeleteAfterDays: !Ref BackupRetentionPeriod
          RuleName: !Ref 'AWS::StackName'
          ScheduleExpression: !Ref BackupScheduleExpression
          StartWindowMinutes: 60
          TargetBackupVault: !Ref BackupVault
  BackupRole:
    Condition: HasBackupRetentionPeriod
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: 'backup.amazonaws.com'
          Action: 'sts:AssumeRole'
      PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundary, !Ref 'AWS::NoValue']
      Policies:
      - PolicyName: backup
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - 'ec2:CreateTags'
            - 'ec2:DeleteSnapshot'
            Resource: !Sub 'arn:${AWS::Partition}:ec2:${AWS::Region}::snapshot/*'
          - Effect: Allow
            Action:
            - 'ec2:CreateImage'
            - 'ec2:DeregisterImage'
            - 'ec2:DescribeSnapshots'
            - 'ec2:DescribeTags'
            - 'ec2:DescribeImages'
            - 'ec2:DescribeInstances'
            - 'ec2:DescribeInstanceAttribute'
            - 'ec2:DescribeInstanceCreditSpecifications'
            - 'ec2:DescribeNetworkInterfaces'
            - 'ec2:DescribeElasticGpus'
            - 'ec2:DescribeSpotInstanceRequests'
            Resource: '*'
          - Effect: Allow
            Action: 'ec2:CreateTags'
            Resource: !Sub 'arn:${AWS::Partition}:ec2:${AWS::Region}::image/*'
          - Effect: Allow
            Action:
            - 'ec2:CreateSnapshot'
            - 'ec2:DeleteSnapshot'
            - 'ec2:DescribeVolumes'
            - 'ec2:DescribeSnapshots'
            Resource:
            - !Sub 'arn:${AWS::Partition}:ec2:${AWS::Region}::snapshot/*'
            - !Sub 'arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:volume/*'
  BackupSelection:
    Condition: HasBackupRetentionPeriod
    Type: 'AWS::Backup::BackupSelection'
    Properties:
      BackupPlanId: !Ref BackupPlan
      BackupSelection:
        IamRoleArn: !GetAtt 'BackupRole.Arn'
        Resources:
        - !Sub 'arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:instance/${VirtualMachine}'
        SelectionName: !Ref 'AWS::StackName'
Outputs:
  TemplateID:
    Description: 'cloudonaut.io template id.'
    Value: 'ec2/al2-mutable-private'
  TemplateVersion:
    Description: 'cloudonaut.io template version.'
    Value: '__VERSION__'
  StackName:
    Description: 'Stack name.'
    Value: !Sub '${AWS::StackName}'
  InstanceId:
    Description: 'The EC2 instance id.'
    Value: !Ref VirtualMachine
    Export:
      Name: !Sub '${AWS::StackName}-InstanceId'
  PrivateIPAddress:
    Description: 'The private IP address of the EC2 instance.'
    Value: !GetAtt 'NetworkInterface.PrimaryPrivateIpAddress'
    Export:
      Name: !Sub '${AWS::StackName}-PrivateIPAddress'