|
| 1 | +AWSTemplateFormatVersion: '2010-09-09' |
| 2 | +Description: VPC with public and private subnets (1 AZs) & NAT |
| 3 | +# Use three subnets |
| 4 | +Mappings: |
| 5 | + Networking: |
| 6 | + VPC: |
| 7 | + CIDR: 10.0.0.0/16 |
| 8 | + PublicSubnet: |
| 9 | + CIDR: 10.0.1.0/24 |
| 10 | + PrivateSubnet: |
| 11 | + CIDR: 10.0.2.0/24 |
| 12 | +Resources: |
| 13 | + # Create a VPC |
| 14 | + VPC: |
| 15 | + Type: AWS::EC2::VPC |
| 16 | + Properties: |
| 17 | + EnableDnsSupport: 'true' |
| 18 | + EnableDnsHostnames: 'true' |
| 19 | + CidrBlock: !FindInMap |
| 20 | + - Networking |
| 21 | + - VPC |
| 22 | + - CIDR |
| 23 | + Tags: |
| 24 | + - Key: Name |
| 25 | + Value: HPC VPC |
| 26 | + # Create an IGW and add it to the VPC |
| 27 | + InternetGateway: |
| 28 | + Type: AWS::EC2::InternetGateway |
| 29 | + GatewayToInternet: |
| 30 | + Type: AWS::EC2::VPCGatewayAttachment |
| 31 | + Properties: |
| 32 | + VpcId: !Ref VPC |
| 33 | + InternetGatewayId: !Ref InternetGateway |
| 34 | + # Create a NAT GW then add it to the public subnet |
| 35 | + NATGateway: |
| 36 | + DependsOn: GatewayToInternet |
| 37 | + Type: AWS::EC2::NatGateway |
| 38 | + Properties: |
| 39 | + AllocationId: !GetAtt ElasticIP.AllocationId |
| 40 | + SubnetId: !Ref PublicSubnet |
| 41 | + ElasticIP: |
| 42 | + Type: AWS::EC2::EIP |
| 43 | + Properties: |
| 44 | + Domain: vpc |
| 45 | + # Create and set the route table |
| 46 | + PublicRouteTable: |
| 47 | + Type: AWS::EC2::RouteTable |
| 48 | + Properties: |
| 49 | + VpcId: !Ref VPC |
| 50 | + PublicRoute: |
| 51 | + Type: AWS::EC2::Route |
| 52 | + Properties: |
| 53 | + RouteTableId: !Ref PublicRouteTable |
| 54 | + DestinationCidrBlock: '0.0.0.0/0' |
| 55 | + GatewayId: !Ref InternetGateway |
| 56 | + # Build the subnet and associate the route table with it |
| 57 | + PublicSubnet: |
| 58 | + Type: AWS::EC2::Subnet |
| 59 | + Properties: |
| 60 | + VpcId: !Ref VPC |
| 61 | + MapPublicIpOnLaunch: true |
| 62 | + CidrBlock: !FindInMap |
| 63 | + - Networking |
| 64 | + - PublicSubnet |
| 65 | + - CIDR |
| 66 | + AvailabilityZone: !Select |
| 67 | + - '0' |
| 68 | + - !GetAZs |
| 69 | + Ref: AWS::Region |
| 70 | + Tags: |
| 71 | + - Key: Name |
| 72 | + Value: 'HPC Public Subnet' |
| 73 | + # Then create and associate the route table to the public subnet |
| 74 | + PublicSubnetRouteTableAssociation: |
| 75 | + Type: AWS::EC2::SubnetRouteTableAssociation |
| 76 | + Properties: |
| 77 | + SubnetId: !Ref PublicSubnet |
| 78 | + RouteTableId: !Ref PublicRouteTable |
| 79 | + # Create the 3 private subnets |
| 80 | + PrivateSubnet: |
| 81 | + Type: AWS::EC2::Subnet |
| 82 | + Properties: |
| 83 | + VpcId: !Ref VPC |
| 84 | + CidrBlock: !FindInMap |
| 85 | + - Networking |
| 86 | + - PrivateSubnet |
| 87 | + - CIDR |
| 88 | + AvailabilityZone: !Select |
| 89 | + - '0' |
| 90 | + - !GetAZs |
| 91 | + Ref: AWS::Region |
| 92 | + Tags: |
| 93 | + - Key: Name |
| 94 | + Value: 'HPC Private Subnet' |
| 95 | + # Then the route tab and associate it to the three subnets |
| 96 | + PrivateRouteTable: |
| 97 | + Type: AWS::EC2::RouteTable |
| 98 | + Properties: |
| 99 | + VpcId: !Ref VPC |
| 100 | + PrivateRouteToInternet: |
| 101 | + Type: AWS::EC2::Route |
| 102 | + Properties: |
| 103 | + RouteTableId: !Ref PrivateRouteTable |
| 104 | + DestinationCidrBlock: '0.0.0.0/0' |
| 105 | + NatGatewayId: !Ref NATGateway |
| 106 | + PrivateSubnetRouteTableAssociation: |
| 107 | + Type: AWS::EC2::SubnetRouteTableAssociation |
| 108 | + Properties: |
| 109 | + SubnetId: !Ref PrivateSubnet |
| 110 | + RouteTableId: !Ref PrivateRouteTable |
| 111 | + # And create the Cloud9 Instance |
| 112 | + C9IDE: |
| 113 | + Type: AWS::Cloud9::EnvironmentEC2 |
| 114 | + Properties: |
| 115 | + Name: |
| 116 | + Fn::Join: |
| 117 | + - '' |
| 118 | + - - 'HPC-Cloud9-IDE-' |
| 119 | + - !Select |
| 120 | + - 0 |
| 121 | + - !Split |
| 122 | + - "-" |
| 123 | + - !Select |
| 124 | + - 2 |
| 125 | + - !Split |
| 126 | + - '/' |
| 127 | + - !Ref AWS::StackId |
| 128 | + Description: !Sub 'Your Cloud9 IDE' |
| 129 | + AutomaticStopTimeMinutes: 600 |
| 130 | + SubnetId: !Ref 'PublicSubnet' |
| 131 | + InstanceType: t2.micro |
| 132 | + |
| 133 | + # Create a bucket and build a role to read and write to this bucket |
| 134 | + S3EncryptionKey: |
| 135 | + Type: AWS::KMS::Key |
| 136 | + Properties: |
| 137 | + KeyPolicy: |
| 138 | + Version: '2012-10-17' |
| 139 | + Statement: |
| 140 | + - Sid: Enable IAM User Permissions |
| 141 | + Effect: Allow |
| 142 | + Principal: |
| 143 | + AWS: !Sub 'arn:aws:iam::${AWS::AccountId}:root' |
| 144 | + Action: 'kms:*' |
| 145 | + Resource: '*' |
| 146 | + |
| 147 | + WorkshopS3Bucket: |
| 148 | + Type: AWS::S3::Bucket |
| 149 | + Properties: |
| 150 | + BucketEncryption: |
| 151 | + ServerSideEncryptionConfiguration: |
| 152 | + - ServerSideEncryptionByDefault: |
| 153 | + SSEAlgorithm: 'aws:kms' |
| 154 | + KMSMasterKeyID: !GetAtt S3EncryptionKey.Arn |
| 155 | + DeletionPolicy: Delete |
| 156 | + BucketName: |
| 157 | + Fn::Join: |
| 158 | + - '' |
| 159 | + - - 'workshop-bucket-' |
| 160 | + - !Select |
| 161 | + - 0 |
| 162 | + - !Split |
| 163 | + - "-" |
| 164 | + - !Select |
| 165 | + - 2 |
| 166 | + - !Split |
| 167 | + - '/' |
| 168 | + - !Ref AWS::StackId |
| 169 | + WorkshopS3BucketRole: |
| 170 | + Type: AWS::IAM::Role |
| 171 | + Properties: |
| 172 | + AssumeRolePolicyDocument: |
| 173 | + Version: '2012-10-17' |
| 174 | + Statement: |
| 175 | + - Effect: Allow |
| 176 | + Principal: |
| 177 | + Service: |
| 178 | + - ec2.amazonaws.com |
| 179 | + Action: |
| 180 | + - sts:AssumeRole |
| 181 | + WorkshopS3BucketPolicy: |
| 182 | + Type: AWS::IAM::Policy |
| 183 | + Properties: |
| 184 | + PolicyName: WorkshopS3BucketPolicy |
| 185 | + PolicyDocument: |
| 186 | + Statement: |
| 187 | + - Effect: Allow |
| 188 | + Action: |
| 189 | + - s3:* |
| 190 | + Resource: |
| 191 | + - !Join [ "", [ "arn:aws:s3:::", !Ref 'WorkshopS3Bucket' , "/*" ] ] |
| 192 | + Roles: |
| 193 | + - !Ref WorkshopS3BucketRole |
| 194 | + |
| 195 | +# Print the outputs |
| 196 | +Outputs: |
| 197 | + VPC: |
| 198 | + Value: !Ref VPC |
| 199 | + Description: ID of the VPC |
| 200 | + Export: |
| 201 | + Name: !Sub ${AWS::StackName}-VPC |
| 202 | + PublicSubnet: |
| 203 | + Value: !Ref PublicSubnet |
| 204 | + Description: ID of the public subnet |
| 205 | + Export: |
| 206 | + Name: !Sub ${AWS::StackName}-PublicSubnet |
| 207 | + PrivateSubnet: |
| 208 | + Value: !Ref PrivateSubnet |
| 209 | + Description: ID of the PrivateSubnet |
| 210 | + Export: |
| 211 | + Name: !Sub ${AWS::StackName}-PrivateSubnet |
| 212 | + Cloud9URL: |
| 213 | + Description: Cloud9 Environment |
| 214 | + Value: |
| 215 | + Fn::Join: |
| 216 | + - '' |
| 217 | + - - !Sub https://${AWS::Region}.console.aws.amazon.com/cloud9/ide/ |
| 218 | + - !Ref C9IDE |
| 219 | + Export: |
| 220 | + Name: !Sub ${AWS::StackName}-Cloud-9IDE |
| 221 | + WorkshopS3Bucket: |
| 222 | + Description: S3 Bucket used for the workshop |
| 223 | + Value: !Ref WorkshopS3Bucket |
| 224 | + WorkshopS3BucketRole: |
| 225 | + Description: EC2 Role to Read and Write to the Bucket |
| 226 | + Value: !Ref WorkshopS3BucketRole |
| 227 | + WorkshopName: |
| 228 | + Description: Workshop Name |
| 229 | + Value: |
| 230 | + Fn::Join: |
| 231 | + - '' |
| 232 | + - - 'ComputeWorkshop-' |
| 233 | + - !Select |
| 234 | + - 0 |
| 235 | + - !Split |
| 236 | + - "-" |
| 237 | + - !Select |
| 238 | + - 2 |
| 239 | + - !Split |
| 240 | + - '/' |
| 241 | + - !Ref AWS::StackId |
0 commit comments