aws-cf-vpc-amazon-linux-2.yaml

---
AWSTemplateFormatVersion: '2010-09-09'

Description: Create the VPC framework for the Amazon Linux environment.

# Create the following:
#
# - A VPC (VpcName)
# - A subnet (Subnet01)
# - An EC2 intstance running the Amazon Linux 2 operating system (LinuxInstance01)
# - A security group for the EC2 instance (SecurityGroup01)
# - An Internet gateway
# - A route table (RouteTable01) with a default route pointing to the Internet gateway
#
# An AWS Lambda function is used to look up the AMI.

Parameters:
  NamePrefix:
    Type: String
    Default: prefix
    MinLength: 2
    MaxLength: 15
    AllowedPattern: "[a-zA-Z][a-zA-Z0-9]*"
    Description: Enter a prefix for resource names generated by this template (2-15 characters).

  AZName:
    Type: AWS::EC2::AvailabilityZone::Name
    Description: Subnet availability zone

  HostKeyPairName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: EC2 keypair for host

  HostInstanceType:
    Type: String
    Default: t2.micro
    AllowedValues:
    - t2.micro
    - t2.small
    - t2.medium
    Description: Instance type for host. Enter t2.micro (default), t2.small, or t2.medium.

  NotifyEmail:
    Description: Email address to notify for various events
    Type: String
    Default: user@example.com
    MinLength: 2
    MaxLength: 50

Resources:
  VpcName:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.200.0.0/16
      EnableDnsSupport: 'true'
      EnableDnsHostnames: 'true'
      Tags:
      - Key: Name
        Value: !Join [ '', [ Ref: NamePrefix, '-vpc' ]]

  Subnet01:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Ref AZName
      CidrBlock: 10.200.11.0/24
      MapPublicIpOnLaunch: 'true'
      Tags:
      - Key: Name
        Value: !Join [ '', [ Ref: NamePrefix, '-sn01' ]]
      VpcId: !Ref VpcName

  VpcIgw:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
      - Key: Name
        Value: !Join [ '', [ Ref: NamePrefix, '-igw' ]]

  VpcIgwAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref VpcIgw
      VpcId: !Ref VpcName

  RouteTable01:
    Type: AWS::EC2::RouteTable
    DependsOn: VpcIgwAttachment
    Properties:
      VpcId: !Ref VpcName
      Tags:
      - Key: Name
        Value: !Join [ '', [ Ref: NamePrefix, '-rtb01' ]]

  DefaultRoute:
    Type: AWS::EC2::Route
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref VpcIgw
      RouteTableId: !Ref RouteTable01

  Subnet01Rtb01:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref RouteTable01
      SubnetId: !Ref Subnet01

  SecurityGroup01:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Enable SSH access via port 22
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: '22'
        ToPort: '22'
        CidrIp: 0.0.0.0/0
      Tags:
      - Key: Name
        Value: !Join [ '', [ Ref: NamePrefix, '-sg01' ]]
      VpcId: !Ref VpcName

  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: "/"
      Policies:
      - PolicyName: root
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            Resource: arn:aws:logs:*:*:*
          - Effect: Allow
            Action:
            - ec2:DescribeImages
            Resource: "*"

# AMIInfoFunction - Look up an AMI based on a NameFilter
#
# This AWS Lambda function is used to look up an Amazon EC2 AMI based
# on a name filter. An example of a name filter would be:
#
# amzn2-ami-hvm\*ebs
#
# After looking up the names of all images that satify the filter,
# they are sorted in reverse by date/time stamp and the first AMI
# ID (which corresponds to the newest AMI) is returned.
#
# Using a Lambda function makes it possible to look up the AMI
# dynamically.  THe alternative would be to create a static map.

  AMIInfoFunction:
    Type: AWS::Lambda::Function
    Properties: 
      Description: "Look up an AMI based on a filter"
      Handler: index.handler
      MemorySize: 128
      Role: !GetAtt LambdaExecutionRole.Arn
      Runtime: "python3.6"
      Timeout: 30
      Tags: 
      - Key: Name
        Value: !Join [ '', [ Ref: NamePrefix, '-lambda' ]]
      Code:
        ZipFile: |
          import json
          import boto3
          import cfnresponse
          def handler(event, context):
            if event['RequestType'] == 'Delete':
              responseData = {}      
              cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData)
              return
            
            ec2=boto3.client('ec2')
            imageDescriptions=ec2.describe_images(
              Owners=['amazon'],
              Filters=[
                {'Name': 'name', 'Values': [event['ResourceProperties']['NameFilter']]}
              ],
            )
            
            if len(imageDescriptions) == 0:
              responseData = {}
              cfnresponse.send(event, context, cfnresponse.FAILED)
            else:
              amiNames = sorted(imageDescriptions['Images'],
                key=lambda x: x['CreationDate'],
                reverse=True)
              responseData = {}
              responseData['Id'] = amiNames[0]['ImageId']
              cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData)

            return

# AMIInfo - The AWS Lambda-backed resource for looking up an Amazon EC2 AMI
#
# Parameters
#
# ServiceToken - a pointer to the AWS Lambda function
# NameFilter - the name filter to pass to the describe_images API

  AMIInfo:
    Type: Custom::AMIInfo
    Properties:
      ServiceToken: !GetAtt AMIInfoFunction.Arn
      NameFilter: 'amzn2-ami-hvm*gp2'

  LinuxInstance01:
    Type: AWS::EC2::Instance
    DependsOn: VpcIgwAttachment

    CreationPolicy:
      ResourceSignal:
        Timeout: PT15M

    Properties:
      AvailabilityZone: !Ref AZName
      ImageId: !GetAtt AMIInfo.Id
      InstanceInitiatedShutdownBehavior: stop
      InstanceType: !Ref HostInstanceType
      KeyName: !Ref HostKeyPairName
      Monitoring: 'true'
      NetworkInterfaces:
      - AssociatePublicIpAddress: 'true'
        DeviceIndex: '0'
        GroupSet:
        - !Ref SecurityGroup01
        SubnetId: !Ref Subnet01
      Tags:
      - Key: Name
        Value: !Join [ '', [ Ref: NamePrefix, '-host' ]]
      Tenancy: default
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash -xe
          yum -y update
          /opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource LinuxInstance01 --region ${AWS::Region}

Outputs:
  VpcId:
    Description: Vpc Id
    Value: !Ref VpcName

  LinuxInstance01Id:
    Description: LinuxInstance01 Instance Id
    Value: !Ref LinuxInstance01

  LinuxInstance01IP:
    Description: LinuxInstance01 IP Address
    Value: !GetAtt LinuxInstance01.PublicIp