genericbastion_nested.json

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Creates a Bastion host in a Public Subnet",
  "Parameters": {
    "BastionS3BucketName": {
      "Description": "The name of the existing S3 bucket where you stored the Bastion host files",
      "Type": "String",
      "Default": "eyamrog-toolbox",
      "AllowedPattern": "[-.a-z0-9]*",
      "ConstraintDescription": "Bucket names can contain lowercase letters, numbers, hyphens and periods (.)"
    },
    "BastionInstanceType": {
      "Description": "Bastion host EC2 instance type",
      "Type": "String",
      "Default": "t2.micro",
      "AllowedValues": [
        "t2.nano",
        "t2.micro",
        "t2.small",
        "t2.medium",
        "t2.large",
        "t2.xlarge",
        "t2.2xlarge",
        "m3.medium",
        "m3.large",
        "m3.xlarge",
        "m3.2xlarge",
        "m4.large",
        "m4.xlarge",
        "m4.2xlarge",
        "m4.4xlarge",
        "m4.10xlarge",
        "m4.16xlarge",
        "c3.large",
        "c3.xlarge",
        "c3.2xlarge",
        "c3.4xlarge",
        "c3.8xlarge",
        "c4.large",
        "c4.xlarge",
        "c4.2xlarge",
        "c4.4xlarge",
        "c4.8xlarge",
        "c5.large",
        "c5.xlarge",
        "c5.2xlarge",
        "c5.4xlarge",
        "c5.9xlarge",
        "c5.18xlarge",
        "r3.large",
        "r3.xlarge",
        "r3.2xlarge",
        "r3.4xlarge",
        "r3.8xlarge",
        "r4.large",
        "r4.xlarge",
        "r4.2xlarge",
        "r4.4xlarge",
        "r4.8xlarge",
        "r4.16xlarge",
        "x1.16xlarge",
        "x1.32xlarge",
        "x1e.32xlarge",
        "d2.xlarge",
        "d2.2xlarge",
        "d2.4xlarge",
        "d2.8xlarge",
        "i2.xlarge",
        "i2.2xlarge",
        "i2.4xlarge",
        "i2.8xlarge",
        "i3.large",
        "i3.xlarge",
        "i3.2xlarge",
        "i3.4xlarge",
        "i3.8xlarge",
        "i3.16xlarge",
        "f1.2xlarge",
        "f1.16xlarge",
        "g2.2xlarge",
        "g2.8xlarge",
        "g3.4xlarge",
        "g3.8xlarge",
        "g3.16xlarge",
        "p2.xlarge",
        "p2.8xlarge",
        "p2.16xlarge",
        "p3.2xlarge",
        "p3.8xlarge",
        "p3.16xlarge"
      ],
      "ConstraintDescription": "Must be a valid EC2 instance type."
    },
    "BastionKeyName": {
      "Description": "Name of an existing EC2 KeyPair to enable SSH access to the Bastion instance",
      "Type": "AWS::EC2::KeyPair::KeyName",
      "ConstraintDescription": "Must be the name of an existing EC2 KeyPair."
    },
    "BastionSSHLocation": {
      "Description": "The IP address range that can be used to SSH to the Bastion host",
      "Type": "String",
      "MinLength": "9",
      "MaxLength": "18",
      "Default": "0.0.0.0/0",
      "AllowedPattern": "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})",
      "ConstraintDescription": "Must be a valid IP CIDR range of the form x.x.x.x/x."
    },
    "VirtualPrivateCloud": {
      "Description": "ID of the Virtual Private Cloud",
      "Type": "AWS::EC2::VPC::Id"
    },
    "BastionSubnet": {
      "Description": "ID of the Public Subnet where you want to create the Bastion host",
      "Type": "AWS::EC2::Subnet::Id"
    }
  },
  "Mappings": {
    "AWSInstanceType2Arch": {
      "t2.nano": {
        "Arch": "HVM64"
      },
      "t2.micro": {
        "Arch": "HVM64"
      },
      "t2.small": {
        "Arch": "HVM64"
      },
      "t2.medium": {
        "Arch": "HVM64"
      },
      "t2.large": {
        "Arch": "HVM64"
      },
      "t2.xlarge": {
        "Arch": "HVM64"
      },
      "t2.2xlarge": {
        "Arch": "HVM64"
      },
      "m3.medium": {
        "Arch": "HVM64"
      },
      "m3.large": {
        "Arch": "HVM64"
      },
      "m3.xlarge": {
        "Arch": "HVM64"
      },
      "m3.2xlarge": {
        "Arch": "HVM64"
      },
      "m4.large": {
        "Arch": "HVM64"
      },
      "m4.xlarge": {
        "Arch": "HVM64"
      },
      "m4.2xlarge": {
        "Arch": "HVM64"
      },
      "m4.4xlarge": {
        "Arch": "HVM64"
      },
      "m4.10xlarge": {
        "Arch": "HVM64"
      },
      "m4.16xlarge": {
        "Arch": "HVM64"
      },
      "c3.large": {
        "Arch": "HVM64"
      },
      "c3.xlarge": {
        "Arch": "HVM64"
      },
      "c3.2xlarge": {
        "Arch": "HVM64"
      },
      "c3.4xlarge": {
        "Arch": "HVM64"
      },
      "c3.8xlarge": {
        "Arch": "HVM64"
      },
      "c4.large": {
        "Arch": "HVM64"
      },
      "c4.xlarge": {
        "Arch": "HVM64"
      },
      "c4.2xlarge": {
        "Arch": "HVM64"
      },
      "c4.4xlarge": {
        "Arch": "HVM64"
      },
      "c4.8xlarge": {
        "Arch": "HVM64"
      },
      "c5.large": {
        "Arch": "HVM64"
      },
      "c5.xlarge": {
        "Arch": "HVM64"
      },
      "c5.2xlarge": {
        "Arch": "HVM64"
      },
      "c5.4xlarge": {
        "Arch": "HVM64"
      },
      "c5.9xlarge": {
        "Arch": "HVM64"
      },
      "c5.18xlarge": {
        "Arch": "HVM64"
      },
      "r3.large": {
        "Arch": "HVM64"
      },
      "r3.xlarge": {
        "Arch": "HVM64"
      },
      "r3.2xlarge": {
        "Arch": "HVM64"
      },
      "r3.4xlarge": {
        "Arch": "HVM64"
      },
      "r3.8xlarge": {
        "Arch": "HVM64"
      },
      "r4.large": {
        "Arch": "HVM64"
      },
      "r4.xlarge": {
        "Arch": "HVM64"
      },
      "r4.2xlarge": {
        "Arch": "HVM64"
      },
      "r4.4xlarge": {
        "Arch": "HVM64"
      },
      "r4.8xlarge": {
        "Arch": "HVM64"
      },
      "r4.16xlarge": {
        "Arch": "HVM64"
      },
      "x1.16xlarge": {
        "Arch": "HVM64"
      },
      "x1.32xlarge": {
        "Arch": "HVM64"
      },
      "x1e.32xlarge": {
        "Arch": "HVM64"
      },
      "d2.xlarge": {
        "Arch": "HVM64"
      },
      "d2.2xlarge": {
        "Arch": "HVM64"
      },
      "d2.4xlarge": {
        "Arch": "HVM64"
      },
      "d2.8xlarge": {
        "Arch": "HVM64"
      },
      "i2.xlarge": {
        "Arch": "HVM64"
      },
      "i2.2xlarge": {
        "Arch": "HVM64"
      },
      "i2.4xlarge": {
        "Arch": "HVM64"
      },
      "i2.8xlarge": {
        "Arch": "HVM64"
      },
      "i3.large": {
        "Arch": "HVM64"
      },
      "i3.xlarge": {
        "Arch": "HVM64"
      },
      "i3.2xlarge": {
        "Arch": "HVM64"
      },
      "i3.4xlarge": {
        "Arch": "HVM64"
      },
      "i3.8xlarge": {
        "Arch": "HVM64"
      },
      "i3.16xlarge": {
        "Arch": "HVM64"
      },
      "f1.2xlarge": {
        "Arch": "HVM64"
      },
      "f1.16xlarge": {
        "Arch": "HVM64"
      },
      "g2.2xlarge": {
        "Arch": "HVM64"
      },
      "g2.8xlarge": {
        "Arch": "HVM64"
      },
      "g3.4xlarge": {
        "Arch": "HVM64"
      },
      "g3.8xlarge": {
        "Arch": "HVM64"
      },
      "g3.16xlarge": {
        "Arch": "HVM64"
      },
      "p2.xlarge": {
        "Arch": "HVM64"
      },
      "p2.8xlarge": {
        "Arch": "HVM64"
      },
      "p2.16xlarge": {
        "Arch": "HVM64"
      },
      "p3.2xlarge": {
        "Arch": "HVM64"
      },
      "p3.8xlarge": {
        "Arch": "HVM64"
      },
      "p3.16xlarge": {
        "Arch": "HVM64"
      }
    }
  },
  "Resources": {
    "BastionSecurityGroup": {
      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "GroupDescription": "Enable SSH access",
        "SecurityGroupIngress": [
          {
            "IpProtocol": "tcp",
            "FromPort": "22",
            "ToPort": "22",
            "CidrIp": {
              "Ref": "BastionSSHLocation"
            }
          }
        ],
        "SecurityGroupEgress": [
          {
            "IpProtocol": "-1",
            "CidrIp": "0.0.0.0/0"
          }
        ],
        "VpcId": {
          "Ref": "VirtualPrivateCloud"
        },
        "Tags": [
          {
            "Key": "Name",
            "Value": "SG-Bastion"
          }
        ]
      }
    },
    "BastionInstanceProfile": {
      "Type": "AWS::IAM::InstanceProfile",
      "Properties": {
        "Path": "/",
        "Roles": [
          {
            "Ref": "BastionInstanceRole"
          }
        ]
      }
    },
    "BastionInstanceRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": [
                  "ec2.amazonaws.com"
                ]
              },
              "Action": [
                "sts:AssumeRole"
              ]
            }
          ]
        },
        "Path": "/",
        "Policies": [
          {
            "PolicyName": "instance-policy",
            "PolicyDocument": {
              "Statement": [
                {
                  "Sid": "AdminPolicy",
                  "Effect": "Allow",
                  "Action": "*",
                  "Resource": "*"
                }
              ]
            }
          }
        ]
      }
    },
    "AMIInfo": {
      "Type": "Custom::AMIInfo",
      "Properties": {
        "ServiceToken": {
          "Fn::GetAtt": [
            "AMIInfoFunction",
            "Arn"
          ]
        },
        "Region": {
          "Ref": "AWS::Region"
        },
        "Architecture": {
          "Fn::FindInMap": [
            "AWSInstanceType2Arch",
            {
              "Ref": "BastionInstanceType"
            },
            "Arch"
          ]
        }
      }
    },
    "AMIInfoFunction": {
      "Type": "AWS::Lambda::Function",
      "Properties": {
        "Code": {
          "S3Bucket": {
            "Ref": "BastionS3BucketName"
          },
          "S3Key": "amilookup.zip"
        },
        "Handler": {
          "Fn::Join": [
            "",
            [
              "amilookup",
              ".handler"
            ]
          ]
        },
        "Role": {
          "Fn::GetAtt":
          [
            "LambdaExecutionRole",
            "Arn"
          ]
        },        
        "Runtime": "nodejs6.10",
        "Timeout": "30"
      }
    },
    "LambdaExecutionRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": [
                  "lambda.amazonaws.com"
                ]
              },
              "Action": [
                "sts:AssumeRole"
              ]
            }
          ]
        },
        "Path": "/",
        "Policies": [
          {
            "PolicyName": "root",
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                "Effect": "Allow",
                "Action": [
                  "logs:CreateLogGroup",
                  "logs:CreateLogStream",
                  "logs:PutLogEvents"
                ],
                "Resource": "arn:aws:logs:*:*:*"
                },
                {
                 "Effect": "Allow",
                 "Action": [
                   "ec2:DescribeImages"
                   ],
                 "Resource": "*"
                }
              ]
            }
          }
        ]
      }
    },
    "BastionHost": {
      "Type": "AWS::EC2::Instance",
      "Properties": {
        "ImageId": {
          "Fn::GetAtt": [
            "AMIInfo",
            "Id"
          ]
        },
        "InstanceType": {
          "Ref": "BastionInstanceType"
        },
        "KeyName": {
          "Ref": "BastionKeyName"
        },
        "IamInstanceProfile": {
          "Ref": "BastionInstanceProfile"
        },
        "SecurityGroupIds": [
          {
            "Ref": "BastionSecurityGroup"
          }
        ],
        "BlockDeviceMappings": [
          {
            "DeviceName": "/dev/xvda",
            "Ebs": {
              "VolumeSize": 8
            }
          }
        ],
        "SubnetId": {
          "Ref": "BastionSubnet"
        },
        "Tags": [
          {
            "Key": "Name",
            "Value": "Bastion host"
          }
        ]
      }
    },
    "BastionIPAddress": {
      "Type": "AWS::EC2::EIP",
      "Properties": {
        "Domain": "vpc",
        "InstanceId": {
          "Ref": "BastionHost"
        }
      }
    }
  },
  "Outputs": {
    "BastionIPAddress": {
      "Description": "IP Address of the Bastion host",
      "Value": {
        "Ref": "BastionIPAddress"
      }
    },
    "AMIID" : {
      "Description": "The latest Amazon EC2 instance AMI ID",
      "Value" : {
        "Fn::GetAtt": [
          "AMIInfo",
          "Id"
        ]
      }
    }
  }
}