lab.yml

AWSTemplateFormatVersion: '2010-09-09'
Description: CloudWatch hands-on lab environment template

Resources:
# Network Configuration
  # VPC
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.1.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
      InstanceTenancy: default
      Tags:
        -
          Key: Name
          Value: cw-vpc

  # Public Subnets
  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: 10.1.0.0/24
      AvailabilityZone: ap-northeast-2a
      MapPublicIpOnLaunch: true
      VpcId: !Ref VPC
      Tags:
        -
          Key: Name
          Value: cw-public-subnet-az1
    DependsOn: VPC

  PublicSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: 10.1.1.0/24
      AvailabilityZone: ap-northeast-2b
      MapPublicIpOnLaunch: true
      VpcId: !Ref VPC
      Tags:
        -
          Key: Name
          Value: cw-public-subnet-az2
    DependsOn: VPC

  PublicSubnet3:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: 10.1.2.0/24
      AvailabilityZone: ap-northeast-2c
      MapPublicIpOnLaunch: true
      VpcId: !Ref VPC
      Tags:
        -
          Key: Name
          Value: cw-public-subnet-az3
    DependsOn: VPC

  # Custom Gateways
  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        -
          Key: Name
          Value: cw-igw

  VPCGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway
    DependsOn: [VPC, InternetGateway]

  # Route Tables
  RouteTablePublic:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        -
          Key: Name
          Value: cw-public-rt
    DependsOn: VPC

  # Routes
  RouteIGW:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref RouteTablePublic
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway
    DependsOn: [RouteTablePublic, InternetGateway, VPCGatewayAttachment]

  # Route Table Assocations
  PublicSubnet1RTA:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref RouteTablePublic
      SubnetId: !Ref PublicSubnet1
    DependsOn: [RouteTablePublic, PublicSubnet1]

  PublicSubnet2RTA:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref RouteTablePublic
      SubnetId: !Ref PublicSubnet2
    DependsOn: [RouteTablePublic, PublicSubnet2]

  PublicSubnet3RTA:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref RouteTablePublic
      SubnetId: !Ref PublicSubnet3
    DependsOn: [RouteTablePublic, PublicSubnet3]

  # RDS (PostgreSQL)
  RDSSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: rds-sg
      GroupDescription: rds-sg
      VpcId: !Ref VPC
      SecurityGroupIngress:
        -
          IpProtocol: TCP
          FromPort: 5432
          ToPort: 5432
          SourceSecurityGroupId: !GetAtt InstanceSecurityGroup.GroupId
          Description: Web Server

      Tags:
        -
          Key: Name
          Value: cw-postgres

    DependsOn:
      - InstanceSecurityGroup

  RDSSubnetGroup:
    Type: "AWS::RDS::DBSubnetGroup"
    Properties:
      DBSubnetGroupDescription: cw-rds-subnet-group
      SubnetIds:
        - !Ref PublicSubnet1
        - !Ref PublicSubnet2
        - !Ref PublicSubnet3
      Tags:
        -
          Key: Name
          Value: cw-rds-subnet-group
    DependsOn:
      - PublicSubnet1
      - PublicSubnet2
      - PublicSubnet3

  RDS:
    Type: "AWS::RDS::DBInstance"
    Properties:
      AllowMajorVersionUpgrade: false
      AutoMinorVersionUpgrade: true
      CopyTagsToSnapshot: true
      DBInstanceClass: db.t2.micro
      AllocatedStorage: 20
      StorageType: gp2
      Engine: postgres
      EngineVersion: 11.5
      MasterUsername: master
      MasterUserPassword: asdf1234
      DBInstanceIdentifier: cw-postgres
      VPCSecurityGroups:
        - !GetAtt RDSSecurityGroup.GroupId
      DBSubnetGroupName: !Ref RDSSubnetGroup
      PubliclyAccessible: true

      Tags:
        -
          Key: Name
          Value: cw-postgres
    DeletionPolicy: Delete
    DependsOn:
      - RDSSecurityGroup
      - RDSSubnetGroup

  # IAM roles assigned to EC2 instnaces
  IAMRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          -
            Effect: Allow
            Action:
              - sts:AssumeRole
            Principal:
              Service:
                - ec2.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM
        - arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess
        - arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess

  # IAM Instance profile assigned to EC2 instnaces
  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - !Ref IAMRole
    DependsOn: IAMRole

  # Security Group assigned to EC2 instnaces
  InstanceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: ec2-sg
      GroupDescription: InstanceSecurityGroup
      VpcId: !Ref VPC
      SecurityGroupIngress:
        -
          IpProtocol: tcp
          CidrIp: 220.70.6.93/32
          FromPort: 22
          ToPort : 22
          Description: Saltware
        -
          IpProtocol: tcp
          CidrIp: 0.0.0.0/0
          FromPort: 80
          ToPort : 80
          Description: public-web

      Tags:
        -
          Key: Name
          Value: InstanceSecurityGroup

  Instance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: ami-05185e41c15c8b566
      InstanceType: t2.small
      SubnetId: !Ref PublicSubnet1
      IamInstanceProfile: !Ref InstanceProfile
      DisableApiTermination: false
      InstanceInitiatedShutdownBehavior: stop
      Monitoring: false
      SecurityGroupIds:
        - !Ref InstanceSecurityGroup
      Tags:
        -
          Key: Name
          Value: cw-app

    DependsOn:
      - InstanceSecurityGroup
      - RDS