notejam.cf.template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: Deploy Notejam + Django + Multi-AZ
Metadata:
  LICENSE: Apache License Version 2.0
  AWS::CloudFormation::Interface:
    ParameterGroups:
    - Label:
        default: Network Configuration
      Parameters:
      - AvailabilityZones
      - VPCCIDR
      - PrivateSubnet1CIDR
      - PrivateSubnet2CIDR
      - PublicSubnet1CIDR
      - PublicSubnet2CIDR
      - RemoteAccessCIDR
      - AccessCIDR
    - Label:
        default: Amazon EC2 Configuration
      Parameters:
      - KeyPairName
      - BastionAMIOS
      - BastionInstanceType
      - WebServerInstanceType
      - WebServerMinSize
      - WebServerMaxSize
      - WebServerDesiredCapacity
    - Label:
        default: Amazon RDS (Aurora/MySQL) Configuration
      Parameters:
      - DBEngineType
      - DBInstanceClass
      - DBName
      - DBMultiAZ
      - DBMasterUsername
      - DBMasterUserPassword
      - DBAutoMinorVersionUpgrade
      - DBBackupRetentionPeriod
    - Label:
        default: AWS Quick Start Configuration
      Parameters:
      - QSS3BucketName
      - QSS3BucketRegion
      - QSS3KeyPrefix
    ParameterLabels:
      AccessCIDR:
        default: Permitted IP range
      AvailabilityZones:
        default: Availability Zones
      BastionAMIOS:
        default: Bastion AMI OS
      BastionInstanceType:
        default: Bastion instance type
      DBAutoMinorVersionUpgrade:
        default: Automatic upgrade to new Amazon Aurora/MySQL minor versions
      DBBackupRetentionPeriod:
        default: DB backup retention period
      DBEngineType:
        default: DB engine
      DBInstanceClass:
        default: Amazon Aurora/MySQL DB instance type
      DBMasterUserPassword:
        default: DB master password
      DBMasterUsername:
        default: DB master user name
      DBMultiAZ:
        default: Enable Multi-AZ deployment for DB instance
      DBName:
        default: DB name
      KeyPairName:
        default: Key pair name
      PrivateSubnet1CIDR:
        default: Private subnet 1 CIDR
      PrivateSubnet2CIDR:
        default: Private subnet 2 CIDR
      PublicSubnet1CIDR:
        default: Public subnet 1 CIDR
      PublicSubnet2CIDR:
        default: Public subnet 2 CIDR
      QSS3BucketName:
        default: AWS Quick Start S3 bucket name
      QSS3BucketRegion:
        default: Quick Start S3 bucket region
      QSS3KeyPrefix:
        default: AWS Quick Start S3 key prefix
      RemoteAccessCIDR:
        default: Allowed bastion external access CIDR
      VPCCIDR:
        default: VPC CIDR
      WebServerDesiredCapacity:
        default: Desired number of web server instances
      WebServerInstanceType:
        default: Web server cluster node instance type
      WebServerMaxSize:
        default: Maximum number of web server instances
      WebServerMinSize:
        default: Minimum number of web server instances
Parameters:
  AccessCIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
    ConstraintDescription: Must be a valid IP range in x.x.x.x/x notation
    Description: 'The CIDR IP range that is permitted to access Notejam instances.
      Note: a value of 0.0.0.0/0 will allow access from ANY ip address'
    Type: String
  AvailabilityZones:
    Description: 'List of Availability Zones to use for the subnets in the VPC. Note:
      The logical order is preserved (2 AZs are used for this deployment)'
    Type: List<AWS::EC2::AvailabilityZone::Name>
  BastionAMIOS:
    AllowedValues:
      - Amazon-Linux2-HVM
      - Amazon-Linux-HVM
      - CentOS-7-HVM
      - Ubuntu-Server-18.04-LTS-HVM
      - Ubuntu-Server-16.04-LTS-HVM
      - SUSE-SLES-15-HVM
    Default: Amazon-Linux2-HVM
    Description: The Linux distribution for the AMI to be used for the bastion instances
    Type: String
  BastionInstanceType:
    AllowedValues:
      - t2.nano
      - t2.micro
      - t2.small
      - t2.medium
      - t2.large
      - t3.micro
      - t3.small
      - t3.medium
      - t3.large
      - t3.xlarge
      - t3.2xlarge
      - m3.large
      - m3.xlarge
      - m3.2xlarge
      - m4.large
      - m4.xlarge
      - m4.2xlarge
      - m4.4xlarge
    Default: t2.micro
    Description: Amazon EC2 instance type for the bastion instances
    Type: String
  DBAutoMinorVersionUpgrade:
    AllowedValues:
    - 'true'
    - 'false'
    Default: 'true'
    Description: Select true/false to setup Auto Minor Version upgrade
    Type: String
  DBBackupRetentionPeriod:
    Default: '7'
    Description: The number of days for which automatic DB snapshots are retained.
    Type: String
  DBEngineType:
    AllowedValues:
    - Amazon Aurora
    - MySQL
    Default: Amazon Aurora
    Description: Database engine to use for Notejam database
    Type: String
  DBInstanceClass:
    AllowedValues:
    - db.m1.large
    - db.m1.medium
    - db.m1.small
    - db.m1.xlarge
    - db.m2.2xlarge
    - db.m2.4xlarge
    - db.m2.xlarge
    - db.m3.2xlarge
    - db.m3.large
    - db.m3.medium
    - db.m3.xlarge
    - db.m4.10xlarge
    - db.m4.2xlarge
    - db.m4.4xlarge
    - db.m4.large
    - db.m4.xlarge
    - db.r3.2xlarge
    - db.r3.4xlarge
    - db.r3.8xlarge
    - db.r3.large
    - db.r3.xlarge
    - db.r4.16xlarge
    - db.r4.2xlarge
    - db.r4.4xlarge
    - db.r4.8xlarge
    - db.r4.large
    - db.r4.xlarge
    - db.r5.12xlarge
    - db.r5.2xlarge
    - db.r5.4xlarge
    - db.r5.large
    - db.r5.xlarge
    - db.t1.micro
    - db.t2.large
    - db.t2.medium
    - db.t2.micro
    - db.t2.small
    ConstraintDescription: Must select a valid database instance type.
    Default: db.r4.large
    Description: The name of the compute and memory capacity class of the Amazon RDS
      (Aurora/MySQL) DB instance.
    Type: String
  DBMasterUserPassword:
    AllowedPattern: (?=^.{6,255}$)((?=.*\d)(?=.*[A-Z])(?=.*[a-z])|(?=.*\d)(?=.*[^A-Za-z0-9])(?=.*[a-z])|(?=.*[^A-Za-z0-9])(?=.*[A-Z])(?=.*[a-z])|(?=.*\d)(?=.*[A-Z])(?=.*[^A-Za-z0-9]))^.*
    ConstraintDescription: Must be at least 8 characters containing letters, numbers
      and symbols. It can be any printable ASCII character except /, double quotes, or @.
    Description: The database admin account password. Must be at least 8 characters containing letters, numbers and symbols. It can be any printable ASCII character except /, double quotes, or @.
    MaxLength: '32'
    MinLength: '8'
    NoEcho: 'True'
    Type: String
  DBMasterUsername:
    AllowedPattern: '[a-zA-Z][a-zA-Z0-9]*'
    ConstraintDescription: Must begin with a letter and contain only alphanumeric
      characters.
    Default: admin
    Description: The database admin account username
    MaxLength: '16'
    MinLength: '1'
    Type: String
  DBMultiAZ:
    AllowedValues:
    - 'true'
    - 'false'
    Default: 'true'
    Description: Specifies if the database instance is a multiple Availability Zone
      deployment.
    Type: String
  DBName:
    AllowedPattern: '[a-zA-Z][a-zA-Z0-9]*'
    ConstraintDescription: Must begin with a letter and contain only alphanumeric
      characters.
    Default: NotejamQuickstartDB
    Description: Name of Notejam Quick Start database.
    MaxLength: '64'
    MinLength: '5'
    Type: String
  DNSName:
    Default: ''
    Description: (Optional) DNS Name for the Notejam site, you should create an alias
      for the ELB after the stack creation
    Type: String
  KeyPairName:
    Description: Public/private key pairs allow you to securely connect to your instance
      after it launches
    Type: AWS::EC2::KeyPair::KeyName
  PrivateSubnet1CIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
    ConstraintDescription: Must be a valid IP range in x.x.x.x/x notation
    Default: 10.0.0.0/19
    Description: CIDR block for private subnet 1 located in Availability Zone 1
    Type: String
  PrivateSubnet2CIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
    ConstraintDescription: Must be a valid IP range in x.x.x.x/x notation
    Default: 10.0.32.0/19
    Description: CIDR block for private subnet 2 located in Availability Zone 2
    Type: String
  PublicSubnet1CIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
    ConstraintDescription: Must be a valid IP range in x.x.x.x/x notation
    Default: 10.0.128.0/20
    Description: CIDR Block for the public DMZ subnet 1 located in Availability Zone
      1
    Type: String
  PublicSubnet2CIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
    ConstraintDescription: Must be a valid IP range in x.x.x.x/x notation
    Default: 10.0.144.0/20
    Description: CIDR Block for the public DMZ subnet 2 located in Availability Zone
      2
    Type: String
  QSS3BucketName:
    AllowedPattern: ^[0-9a-zA-Z]+([0-9a-zA-Z-]*[0-9a-zA-Z])*$
    ConstraintDescription: Quick Start bucket name can include numbers, lowercase
      letters, uppercase letters, and hyphens (-). It cannot start or end with a hyphen
      (-).
    Default: aws-quickstart
    Description: S3 bucket name for the Quick Start assets. Quick Start bucket name
      can include numbers, lowercase letters, uppercase letters, and hyphens (-).
      It cannot start or end with a hyphen (-).
    Type: String
  QSS3BucketRegion:
    Default: 'us-east-1'
    Description: 'The AWS Region where the Quick Start S3 bucket (QSS3BucketName) is hosted. When using your own bucket, you must specify this value.'
    Type: String
  QSS3KeyPrefix:
    AllowedPattern: ^[0-9a-zA-Z-/]*$
    ConstraintDescription: Quick Start key prefix can include numbers, lowercase letters,
      uppercase letters, hyphens (-), and forward slash (/).
    Default: quickstart-Notejam/
    Description: S3 key prefix for the Quick Start assets. Quick Start key prefix
      can include numbers, lowercase letters, uppercase letters, hyphens (-), and
      forward slash (/).
    Type: String
  RemoteAccessCIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/x
    Description: Allowed CIDR block for external SSH access to the bastions
    Type: String
  SSLCertificateId:
    Default: ''
    Description: (Optional) The ARN of the SSL certificate to use for the webserver.
      [optional]
    Type: String
  VPCCIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
    ConstraintDescription: Must be a valid IP range in x.x.x.x/x notation
    Default: 10.0.0.0/16
    Description: CIDR Block for the VPC
    Type: String
  WebServerDesiredCapacity:
    Default: '1'
    Description: Desired No of web server instances
    Type: Number
  WebServerInstanceType:
    AllowedValues:
    - t2.micro
    - t2.small
    - t2.medium
    - t2.large
    - m4.large
    - m4.xlarge
    - m4.2xlarge
    - m4.4xlarge
    - m4.10xlarge
    - m5.large
    - m5.xlarge
    - m5.2xlarge
    - m5.4xlarge
    - c4.large
    - c4.xlarge
    - c4.2xlarge
    - c4.4xlarge
    - c4.8xlarge
    - c3.large
    - c3.xlarge
    - c3.2xlarge
    - c3.4xlarge
    - c3.8xlarge
    - r5.large
    - r5.xlarge
    - r5.2xlarge
    - r5.4xlarge
    - r5.8xlarge
    - i3.large
    - i3.xlarge
    - i3.2xlarge
    - i3.4xlarge
    - i3.8xlarge
    ConstraintDescription: Choose an instance type. m3.medium or larger recommended.
    Default: m4.large
    Description: Web server instance type
    Type: String
  WebServerMaxSize:
    Default: '10'
    Description: Maximum No of web server instances
    Type: Number
  WebServerMinSize:
    Default: '1'
    Description: Minimum No of web server instances
    Type: Number
Conditions:
  UsingDefaultBucket: !Equals [!Ref QSS3BucketName, 'aws-quickstart']
Rules:
  AuroraDBInstanceTypeRule:
    RuleCondition:
      !Equals
      - !Ref DBEngineType
      - Amazon Aurora
    Assertions:
    - Assert:
        !Contains
        - - db.r5.12xlarge
          - db.r5.4xlarge
          - db.r5.2xlarge
          - db.r5.xlarge
          - db.r5.large
          - db.r4.16xlarge
          - db.r4.8xlarge
          - db.r4.4xlarge
          - db.r4.2xlarge
          - db.r4.xlarge
          - db.r4.large
        - !Ref DBInstanceClass
      AssertDescription: Amazon Aurora does not currently support this DB instance
        class.
  AuroraSupportedRegionsRule:
    RuleCondition:
      !Equals
      - !Ref DBEngineType
      - Amazon Aurora
    Assertions:
    - Assert:
        !Not
        - !Contains
          - - sa-east-1
          - !Ref AWS::Region
      AssertDescription: Amazon Aurora is not currently supported in this region
  EFSSupportedRegionsRule:
    Assertions:
    - Assert:
        !Not
        - !Contains
          - - sa-east-1
            - us-gov-east-1
            - eu-north-1
            - me-south-1
            - ap-northeast-3
            - ap-east-1
            - cn-north-1
            - cn-northwest-1
          - !Ref AWS::Region
      AssertDescription: Amazon EFS is not currently supported in this region
Resources:
  VPCStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL:
        !Sub
          - 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}submodules/quickstart-aws-vpc/templates/aws-vpc.template'
          - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion]
            S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
      Parameters:
        AvailabilityZones:
          !Join
          - ','
          - !Ref AvailabilityZones
        KeyPairName: !Ref KeyPairName
        NumberOfAZs: '2'
        PrivateSubnet1ACIDR: !Ref PrivateSubnet1CIDR
        PrivateSubnet2ACIDR: !Ref PrivateSubnet2CIDR
        PublicSubnet1CIDR: !Ref PublicSubnet1CIDR
        PublicSubnet2CIDR: !Ref PublicSubnet2CIDR
        VPCCIDR: !Ref VPCCIDR
  BastionStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL:
        !Sub
          - 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}submodules/quickstart-linux-bastion/templates/linux-bastion.template'
          - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion]
            S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
      Parameters:
        BastionAMIOS: !Ref BastionAMIOS
        BastionInstanceType: !Ref BastionInstanceType
        KeyPairName: !Ref KeyPairName
        PublicSubnet1ID: !GetAtt VPCStack.Outputs.PublicSubnet1ID
        PublicSubnet2ID: !GetAtt VPCStack.Outputs.PublicSubnet2ID
        QSS3BucketName: !Ref QSS3BucketName
        QSS3BucketRegion: !Ref QSS3BucketRegion
        QSS3KeyPrefix: !Sub ${QSS3KeyPrefix}submodules/quickstart-linux-bastion/
        RemoteAccessCIDR: !Ref RemoteAccessCIDR
        VPCID: !GetAtt VPCStack.Outputs.VPCID
  NotejamStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL:
        !Sub
          - 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}templates/Notejam.template'
          - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion]
            S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
      Parameters:
        AccessCIDR: !Ref AccessCIDR
        DBEngineType: !Ref DBEngineType
        DBAutoMinorVersionUpgrade: !Ref DBAutoMinorVersionUpgrade
        DBBackupRetentionPeriod: !Ref DBBackupRetentionPeriod
        DBInstanceClass: !Ref DBInstanceClass
        DBMasterUserPassword: !Ref DBMasterUserPassword
        DBMasterUsername: !Ref DBMasterUsername
        DBMultiAZ: !Ref DBMultiAZ
        DBName: !Ref DBName
        DNSName: !Ref DNSName
        KeyPairName: !Ref KeyPairName
        PrivateSubnet1ID: !GetAtt VPCStack.Outputs.PrivateSubnet1AID
        PrivateSubnet2ID: !GetAtt VPCStack.Outputs.PrivateSubnet2AID
        PublicSubnet1ID: !GetAtt VPCStack.Outputs.PublicSubnet1ID
        PublicSubnet2ID: !GetAtt VPCStack.Outputs.PublicSubnet2ID
        QSS3BucketName: !Ref QSS3BucketName
        QSS3BucketRegion: !Ref QSS3BucketRegion
        QSS3KeyPrefix: !Ref QSS3KeyPrefix
        SSLCertificateId: !Ref SSLCertificateId
        VPCCIDR: !GetAtt VPCStack.Outputs.VPCCIDR
        VPCID: !GetAtt VPCStack.Outputs.VPCID
        WebServerDesiredCapacity: !Ref WebServerDesiredCapacity
        WebServerInstanceType: !Ref WebServerInstanceType
        WebServerMaxSize: !Ref WebServerMaxSize
        WebServerMinSize: !Ref WebServerMinSize
Outputs:
  URL:
    Description: The URL of the website
    Value: !GetAtt NotejamStack.Outputs.URL
  AdminURL:
    Description: Admin path
    Value: !GetAtt NotejamStack.Outputs.AdminURL
  ELBURL:
    Description: The URL of the ELB, you should create a CNAME or alias to this name
      if you specified a DNS name
    Value: !GetAtt NotejamStack.Outputs.ELBURL