aws-refarch-wordpress-03-bastion.yaml

---
AWSTemplateFormatVersion: 2010-09-09

Description: Reference Architecture to host WordPress on AWS - Creates bastion (desired:0; min:0; max:1) Auto Scaling group

Metadata:

  Authors:
    Description: Darryl Osborne (darrylo@amazon.com)
  License:
    Description: 'Copyright 2018 Amazon.com, Inc. and its affiliates. All Rights Reserved.
      Licensed under the Amazon Software License (the "License"). You may not use this file
      except in compliance with the License. A copy of the License is located at
      http://aws.amazon.com/asl/
      or in the "license" file accompanying this file. This file is distributed on an "AS IS"
      BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
      License for the specific language governing permissions and limitations under the License.'

  AWS::CloudFormation::Interface:
    ParameterGroups:
    - Label:
        default: AWS Parameters
      Parameters:
        - EC2KeyName
        - BastionInstanceType
        - BastionSecurityGroup
        - NumberOfSubnets
        - Subnet
    ParameterLabels:
      BastionSecurityGroup:
        default: Bastion Security Group
      BastionInstanceType:
        default: Instance Type
      EC2KeyName:
        default: Existing Key Pair
      NumberOfSubnets:
        default: Number of subnets
      Subnet:
        default: Subnets

Parameters:

  BastionSecurityGroup:
    Description: Select the bastion security group.
    Type: AWS::EC2::SecurityGroup::Id
  BastionInstanceType:
    AllowedValues:
    - t3.nano 
    - t3.micro 
    - t3.small 
    - t3.medium 
    - t3.large 
    - t3.xlarge 
    - t3.2xlarge 
    - m3.medium 
    - m3.large 
    - m3.xlarge 
    - m3.2xlarge 
    - m4.large 
    - m4.xlarge 
    - m4.2xlarge 
    - m4.4xlarge 
    - m4.10xlarge 
    - m4.16xlarge 
    - m5.large 
    - m5.xlarge 
    - m5.2xlarge 
    - m5.4xlarge 
    - m5.12xlarge 
    - m5.24xlarge 
    - c3.large 
    - c3.xlarge 
    - c3.2xlarge 
    - c3.4xlarge 
    - c3.8xlarge 
    - c4.large 
    - c4.xlarge 
    - c4.2xlarge 
    - c4.4xlarge 
    - c4.8xlarge 
    - c5.large 
    - c5.xlarge 
    - c5.2xlarge 
    - c5.4xlarge 
    - c5.9xlarge 
    - c5.18xlarge
    - r3.large 
    - r3.xlarge 
    - r3.2xlarge 
    - r3.4xlarge 
    - r3.8xlarge 
    - r4.large 
    - r4.xlarge 
    - r4.2xlarge 
    - r4.4xlarge 
    - r4.8xlarge 
    - r4.16xlarge 
    - x1.16xlarge 
    - x1.32xlarge 
    - x1e.xlarge 
    - x1e.2xlarge 
    - x1e.4xlarge 
    - x1e.8xlarge 
    - x1e.16xlarge 
    - x1e.32xlarge
    - d2.xlarge 
    - d2.2xlarge 
    - d2.4xlarge 
    - d2.8xlarge 
    - h1.2xlarge 
    - h1.4xlarge 
    - h1.8xlarge 
    - h1.16xlarge 
    - i2.xlarge 
    - i2.2xlarge 
    - i2.4xlarge 
    - i2.8xlarge 
    - i3.large 
    - i3.xlarge 
    - i3.2xlarge 
    - i3.4xlarge 
    - i3.8xlarge 
    - i3.16xlarge
    - f1.2xlarge 
    - f1.16xlarge 
    - g2.2xlarge 
    - g2.8xlarge 
    - g3.4xlarge 
    - g3.8xlarge 
    - g3.16xlarge 
    - p2.xlarge 
    - p2.8xlarge 
    - p2.16xlarge 
    - p3.2xlarge 
    - p3.8xlarge 
    - p3.16xlarge
    ConstraintDescription: Must be a valid Amazon EC2 instance type.
    Default: t3.nano
    Description: Bastion EC2 instance type.
    Type: String
  EC2KeyName:
    Description: Name of an EC2 KeyPair. Your bastion instances will launch with this KeyPair.
    Type: AWS::EC2::KeyPair::KeyName
  NumberOfSubnets:
    AllowedValues:
    - 2
    - 3
    - 4
    - 5
    - 6
    Default: 3
    Description: Number of subnets. This must match your selections in the list of subnets below.
    Type: String 
  Subnet:
    Description: Select existing subnets. The number selected must match the number of subnets above. Subnets selected must be in separate AZs.
    Type: List<AWS::EC2::Subnet::Id>

Conditions:

  NumberOfSubnets1:
      !Equals [ 1, !Ref NumberOfSubnets ]
  NumberOfSubnets2:
      !Equals [ 2, !Ref NumberOfSubnets ]
  NumberOfSubnets3:
      !Equals [ 3, !Ref NumberOfSubnets ]
  NumberOfSubnets4:
      !Equals [ 4, !Ref NumberOfSubnets ]
  NumberOfSubnets5:
      !Equals [ 5, !Ref NumberOfSubnets ]
  NumberOfSubnets6:
      !Equals [ 6, !Ref NumberOfSubnets ]
  Subnet0: !Or
    - !Condition NumberOfSubnets1
    - !Condition NumberOfSubnets2
    - !Condition NumberOfSubnets3
    - !Condition NumberOfSubnets4
    - !Condition NumberOfSubnets5
    - !Condition NumberOfSubnets6
  Subnet1: !Or
    - !Condition NumberOfSubnets2
    - !Condition NumberOfSubnets3
    - !Condition NumberOfSubnets4
    - !Condition NumberOfSubnets5
    - !Condition NumberOfSubnets6
  Subnet2: !Or
    - !Condition NumberOfSubnets3
    - !Condition NumberOfSubnets4
    - !Condition NumberOfSubnets5
    - !Condition NumberOfSubnets6
  Subnet3: !Or
    - !Condition NumberOfSubnets4
    - !Condition NumberOfSubnets5
    - !Condition NumberOfSubnets6
  Subnet4: !Or
    - !Condition NumberOfSubnets5
    - !Condition NumberOfSubnets6
  Subnet5: !Condition NumberOfSubnets6

Mappings:

  RegionMap:
    ap-northeast-1:
      AMI: ami-da9e2cbc
    ap-northeast-2:
      AMI: ami-1196317f
    ap-south-1:
      AMI: ami-d5c18eba
    ap-southeast-1:
      AMI: ami-c63d6aa5
    ap-southeast-2:
      AMI: ami-ff4ea59d
    ca-central-1:
      AMI: ami-d29e25b6
    eu-central-1:
      AMI: ami-bf2ba8d0
    eu-west-1:
      AMI: ami-1a962263
    eu-west-2:
      AMI: ami-e7d6c983
    sa-east-1:
      AMI: ami-286f2a44
    us-east-1:
      AMI: ami-55ef662f
    us-east-2:
      AMI: ami-15e9c770
    us-west-1:
      AMI: ami-a51f27c5
    us-west-2:
      AMI: ami-bf4193c7

Resources:

  BastionAutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      Cooldown: 60
      HealthCheckGracePeriod: 120
      HealthCheckType: EC2
      LaunchConfigurationName: !Ref BastionLaunchConfiguration
      MaxSize: 1
      MinSize: 0
      Tags:
        - Key: Name
          Value: !Join [ '', [ 'Bastion / ', !Ref 'AWS::StackName' ] ]
          PropagateAtLaunch: true
      VPCZoneIdentifier:
        !If
          [ NumberOfSubnets1,
          [ !Select [ 0, !Ref Subnet ] ],
          !If
            [ NumberOfSubnets2,
            [ !Select [ 0, !Ref Subnet ], !Select [ 1, !Ref Subnet ] ],
            !If
              [ NumberOfSubnets3,
              [ !Select [ 0, !Ref Subnet ], !Select [ 1, !Ref Subnet ], !Select [ 2, !Ref Subnet ] ],
              !If
                [ NumberOfSubnets4,
                [ !Select [ 0, !Ref Subnet ], !Select [ 1, !Ref Subnet ], !Select [ 2, !Ref Subnet ], !Select [ 3, !Ref Subnet ] ],
                !If
                  [ NumberOfSubnets5,
                  [ !Select [ 0, !Ref Subnet ], !Select [ 1, !Ref Subnet ], !Select [ 2, !Ref Subnet ], !Select [ 3, !Ref Subnet ], !Select [ 4, !Ref Subnet ] ],
                  [ !Select [ 0, !Ref Subnet ], !Select [ 1, !Ref Subnet ], !Select [ 2, !Ref Subnet ], !Select [ 3, !Ref Subnet ], !Select [ 4, !Ref Subnet ], !Select [ 5, !Ref Subnet ] ]
                  ]
                ]
              ]
            ]
          ]
  BastionLaunchConfiguration:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      IamInstanceProfile: !Ref BastionInstanceProfile
      ImageId: !FindInMap [ RegionMap, !Ref 'AWS::Region', AMI ]
      InstanceMonitoring: true
      InstanceType: !Ref BastionInstanceType
      KeyName: !Ref EC2KeyName
      SecurityGroups:
        - !Ref BastionSecurityGroup
  BastionInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: '/'
      Roles:
      - !Ref BastionInstanceRole
  BastionInstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - ec2.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: '/'
      Policies:
      - PolicyName: logs
        PolicyDocument:
          Version: 2012-10-17
          Statement:
          - Effect: Allow
            Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            - logs:DescribeLogStreams
            Resource:
            - arn:aws:logs:*:*:*