base-vpc-example-improved.template.yml

AWSTemplateFormatVersion: 2010-09-09

# This CloudFormation template deploys a basic VPC / Network.  Specifically:
# It deploys a VPC with 1 to 6 subnets 3 Availability Zones depending on parameter selection.
# User has the choice of public subnets or private + public subnets in each AZ.
# When private subnets are created, NATing is provided by either an EC2 instance or NAT Gateway based on user selection.
# The VPC and subnets are exported for use by other stacks.

Metadata: 
  # Control the UI display when running this template from the AWS Management Console:
  AWS::CloudFormation::Interface: 
    ParameterGroups: 
      - Label: 
          default: "Network Configuration"
        Parameters: 
          - NumberOfAZs
          - PrivateSubnets
          - NATType

Parameters:
  PrivateSubnets:
    Type: String
    AllowedValues: 
    - True
    - False
    Default: True
    Description: Do you want to create private subnets in addition to public subnets?

  NumberOfAZs:
    Type: Number
    AllowedValues: 
    - 1
    - 2
    - 3
    Default: 2
    Description:  How many Availability Zones do you wish to utilize?

  NATType:
    Type: String
    AllowedValues:
    - "EC2 NAT Instance"
    - "NAT Gateway"
    Default:  "NAT Gateway"
    Description:  What type of NAT to use for private instances to communicate with the internet.  A single EC2 instance can be used as a NAT, or you can use the AWS NAT Gateway (managed, scalable, more expensive).  This setting will be IGNORED if you do not build private subnets.

Conditions:
  BuildPublicB:         !Not [ !Equals [ !Ref NumberOfAZs, 1 ]]  
  BuildPublicC:         !Equals [ !Ref NumberOfAZs, 3 ]  
  BuildPrivateSubnets:  !Equals [ !Ref PrivateSubnets, True ] 
  BuildPrivateA:        !Equals [ !Ref PrivateSubnets, True ]       # Can't determine how to build a condition from a separate single condition
  BuildPrivateB:        !And [ Condition: BuildPrivateSubnets, Condition: BuildPublicB ]
  BuildPrivateC:        !And [ Condition: BuildPrivateSubnets, Condition: BuildPublicC ]
  BuildNATGateway:      !And [ Condition: BuildPrivateSubnets, !Equals [ !Ref NATType, "NAT Gateway" ] ]
  BuildNATInstance:     !And [ Condition: BuildPrivateSubnets, !Equals [ !Ref NATType, "EC2 NAT Instance" ] ]


Mappings:
  #  This is the Amazon Linux 2 AMI.  Adjust these values as needed, they can change a few times per year:
  AmazonLinuxAMI:
    us-east-1:
      AMI: ami-04681a1dbd79675a5    # N Virginia
    us-east-2:
      AMI: ami-0cf31d971a3ca20d6    # Ohio      
    us-west-1:
      AMI: ami-0782017a917e973e7    # N California
    us-west-2:
      AMI: ami-6cd6f714             # Oregon
    eu-west-1:
      AMI: ami-0bdb1d6c15a40392c    # Ireland
    eu-central-1:
      AMI: ami-0f5dbc86dd9cbf7a8    # Frankfurt
    sa-east-1:
      AMI: ami-0ad7b0031d41ed4b9    # Sao Paulo
    ap-southeast-1:
      AMI: ami-01da99628f381e50a    # Singaport
    ap-southeast-2:
      AMI: ami-00e17d1165b9dd3ec    # Sydney
    ap-northeast-1:
      AMI: ami-08847abae18baa040    # Tokyo


Resources:

  # First, a VPC:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.1.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
      - Key: Name
        Value: !Sub ${AWS::StackName}-VPC
        
  # Our VPC will need internet access:      
  InternetGateway:
    Type: AWS::EC2::InternetGateway
    DependsOn: VPC
  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    # Notice how you can't attach an IGW to a VPC unless both are created:
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  # Now some subnets, 2 public and 2 private:
  PublicSubnetA:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.1.10.0/24
      AvailabilityZone: !Select [ 0, !GetAZs ]    # Get the first AZ in the list        
      Tags:
      - Key: Name
        Value: !Sub ${AWS::StackName}-Public-A
  PublicSubnetB:
    Type: AWS::EC2::Subnet
    Condition: BuildPublicB
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.1.20.0/24
      AvailabilityZone: !Select [ 1, !GetAZs ]    # Get the second AZ in the list  
      Tags:
      - Key: Name
        Value: !Sub ${AWS::StackName}-Public-B
  PublicSubnetC:
    Type: AWS::EC2::Subnet
    Condition: BuildPublicC
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.1.30.0/24
      AvailabilityZone: !Select [ 2, !GetAZs ]    # Get the third AZ in the list  
      Tags:
      - Key: Name
        Value: !Sub ${AWS::StackName}-Public-C
  PrivateSubnetA:
    Type: AWS::EC2::Subnet
    Condition: BuildPrivateA
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.1.50.0/24
      AvailabilityZone: !Select [ 0, !GetAZs ]    # Get the first AZ in the list  
      Tags:
      - Key: Name
        Value: !Sub ${AWS::StackName}-Private-A
  PrivateSubnetB:
    Type: AWS::EC2::Subnet
    Condition: BuildPrivateB
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.1.60.0/24
      AvailabilityZone: !Select [ 1, !GetAZs ]    # Get the second AZ in the list  
      Tags:
      - Key: Name
        Value: !Sub ${AWS::StackName}-Private-B
  PrivateSubnetC:
    Type: AWS::EC2::Subnet
    Condition: BuildPrivateC
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.1.70.0/24
      AvailabilityZone: !Select [ 2, !GetAZs ]    # Get the third AZ in the list  
      Tags:
      - Key: Name
        Value: !Sub ${AWS::StackName}-Private-C
        
  # Some route tables for our subnets:        
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
      - Key: Name
        Value: Public
  PublicRoute1:   # Public route table has direct routing to IGW:
    Type: AWS::EC2::Route
    DependsOn: AttachGateway
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway
      
  # Here is a private route table:
  PrivateRouteTable:
    Type: AWS::EC2::RouteTable
    Condition: BuildPrivateSubnets
    Properties:
      VpcId: !Ref VPC
      Tags:
      - Key: Name
        Value: Private
  PrivateRoute1:            # Private route table can access web via NAT (created below)
    Type: AWS::EC2::Route
    Condition: BuildPrivateSubnets
    Properties:
      RouteTableId: !Ref PrivateRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      # If we are using a NAT Instance, route traffic through the NAT Instance:
      InstanceId:   !If [ BuildNATInstance, !Ref NATInstance, !Ref "AWS::NoValue" ]
      # Otherwise if we are using a NAT Gateway, route traffic through the NAT Gateway:
      NatGatewayId: !If [ BuildNATGateway, !Ref NATGateway, !Ref "AWS::NoValue" ]


  # Attach the public subnets to public route tables, 
  # and attach the private subnets to private route tables:    
  PublicSubnetARouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnetA
      RouteTableId: !Ref PublicRouteTable
  PublicSubnetBRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Condition: BuildPublicB
    Properties:
      SubnetId: !Ref PublicSubnetB
      RouteTableId: !Ref PublicRouteTable
  PublicSubnetCRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Condition: BuildPublicC
    Properties:
      SubnetId: !Ref PublicSubnetC
      RouteTableId: !Ref PublicRouteTable
  PrivateSubnetARouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Condition: BuildPrivateA
    Properties:
      SubnetId: !Ref PrivateSubnetA
      RouteTableId: !Ref PrivateRouteTable
  PrivateSubnetBRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Condition: BuildPrivateB
    Properties:
      SubnetId: !Ref PrivateSubnetB
      RouteTableId: !Ref PrivateRouteTable
  PrivateSubnetCRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Condition: BuildPrivateC
    Properties:
      SubnetId: !Ref PrivateSubnetC
      RouteTableId: !Ref PrivateRouteTable
      

  # A security group for our NAT.  Ingress from the VPC IPs only.  Egress is TCP & UDP only:
  NATSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Condition: BuildNATInstance
    DependsOn: AttachGateway
    Properties:
      GroupName: !Sub NATSecurityGroup-${AWS::StackName}
      GroupDescription: Enable internal access to the NAT device
      VpcId: !Ref VPC
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: '0'
        ToPort: '1024'
        CidrIp: !GetAtt VPC.CidrBlock
      SecurityGroupEgress:
      - IpProtocol: tcp
        FromPort: '0'
        ToPort: '65535'
        CidrIp: 0.0.0.0/0
      - IpProtocol: udp
        FromPort: '0'
        ToPort: '65535'
        CidrIp: 0.0.0.0/0


  # A NAT Instance will be built and used if the user selected Private subnets and specified an EC2 instance over a managed Gateway.  
  NATInstance:
    Type: AWS::EC2::Instance
    Condition: BuildNATInstance
    DependsOn: PublicRoute1                                           # Must have route to IGW established.
    Properties:
      ImageId: !FindInMap [ AmazonLinuxAMI, !Ref "AWS::Region", AMI]  # We lookup the AMI from the Region Map
      InstanceType: t2.small                                          # Any instance type is fine
      NetworkInterfaces:
      - DeviceIndex: '0'
        SubnetId: !Ref PublicSubnetA                                  # Any public subnet is fine
        AssociatePublicIpAddress: true                                # We will definitely need a public IP address
        GroupSet: [!Ref NATSecurityGroup]                             # Plug in the security group
      SourceDestCheck: false                                          # NATs don't work if EC2 tries the match source addresses with destinations.
      Tags:
      - Key: Name
        Value: !Sub NAT-${AWS::StackName}
      UserData:      #  This code is NAT code.  Look at how the last line signals the wait condition:
        Fn::Base64: !Sub |
          #!/bin/bash
          yum -y update
          yum install -y aws-cfn-bootstrap
          echo 1 > /proc/sys/net/ipv4/ip_forward
          echo 0 > /proc/sys/net/ipv4/conf/eth0/send_redirects
          /sbin/iptables -t nat -A POSTROUTING -o eth0 -s 0.0.0.0/0 -j MASQUERADE
          /sbin/iptables-save > /etc/sysconfig/iptables
          mkdir -p /etc/sysctl.d/
          cat << NatConfFileMarker > /etc/sysctl.d/nat.conf
          net.ipv4.ip_forward = 1
          net.ipv4.conf.eth0.send_redirects = 0
          NatConfFileMarker
          /opt/aws/bin/cfn-signal -e 0 --resource NATInstance --stack ${AWS::StackName} --region ${AWS::Region}
    # This NATInstance is only complete when you get 1 signal back within 5 minutes'.
    CreationPolicy:
      ResourceSignal:
        Count: 1
        Timeout: PT5M

  # A NAT Gateway will be built and used if the user selected Private subnets and a Gateway instead of an EC2 instance.  
  NATGateway:
    Type: AWS::EC2::NatGateway
    Condition: BuildNATGateway
    Properties: 
      AllocationId: !GetAtt ElasticIPAddress.AllocationId
      SubnetId: !Ref PublicSubnetA
      Tags: 
      - Key: Name
        Value: !Sub NAT-${AWS::StackName}
  ElasticIPAddress:
    Type: AWS::EC2::EIP
    Condition: BuildNATGateway
    Properties:
      Domain: VPC


Outputs:
  VPC:
    Description: VPC of the base network
    Value: !Ref VPC
    Export:
      Name: !Sub ${AWS::StackName}-VPC
  PublicSubnetA:
    Description: First Public Subnet
    Value: !Ref PublicSubnetA
    Export:
      Name: !Sub ${AWS::StackName}-PublicSubnetA
  PublicSubnetB:
    Description: Second Public Subnet
    Condition: BuildPublicB
    Value: !Ref PublicSubnetB
    Export:
      Name: !Sub ${AWS::StackName}-PublicSubnetB
  PublicSubnetC:
    Description: Third Public Subnet
    Condition: BuildPublicC
    Value: !Ref PublicSubnetC
    Export:
      Name: !Sub ${AWS::StackName}-PublicSubnetC
  PrivateSubnetA:
    Condition: BuildPrivateSubnets
    Description: First Private Subnet
    Value: !Ref PrivateSubnetA
    Export:
      Name: !Sub ${AWS::StackName}-PrivateSubnetA
  PrivateSubnetB:
    Condition: BuildPrivateB
    Description: Second Private Subnet
    Value: !Ref PrivateSubnetB
    Export:
      Name: !Sub ${AWS::StackName}-PrivateSubnetB
  PrivateSubnetC:
    Condition: BuildPrivateC
    Description: Third Private Subnet
    Value: !Ref PrivateSubnetC
    Export:
      Name: !Sub ${AWS::StackName}-PrivateSubnetC