fsxn_demo_environment_initial.yaml

---
AWSTemplateFormatVersion: 2010-09-09

Description: Creates the Amazon FSx for NetApp ONTAP test environment.

Metadata:
  Authors:
    Description: Shengyu Fang　(shengyu.fang@netapp.com)
  Reference 1:
    Description:
      - https://github.com/aws-samples/amazon-fsx-workshop/blob/master/netapp-ontap/templates/fsx-ontap-od-workshop.yaml#L257
      - by Shrinath Kurdekar (kurdekar@amazon.com)
  Reference 2:
    Description:
      - https://www.youtube.com/watch?v=a_EqgdKfa2M
      - by Nick Howell (nick.howell@netapp.com)
  Reference 3:
    Description:
      - https://awstut.com/en/2021/12/11/accessing-a-windows-instance-via-ssm-session-manager/
      - by awstut
  AWS::CloudFormation::Interface:
    ParameterGroups:
    - Label:
        default: Amazon FSx for NetApp ONTAP Environment
      Parameters:
        - VpcCidr
        - AvailabilityZones
        - DeploymentType
        - InstanceType
        - KeyPair
        - ThroughputCapacity
        - StorageCapacity
        - LatestWindowsAmiId
        - LatestLinuxAmiId
        - EnvironmentPassword
        - EnvironmentType
    ParameterLabels:
      VpcCidr:
        default: VPC CIDR
      AvailabilityZones:
        default: Availability Zones
      DeploymentType:
        default: File System Deployment Type (MULTI_AZ or SINGLE_AZ)
      InstanceType:
        default: Instance Type
      KeyPair:
        default: Key Pair
      ThroughputCapacity:
        default: File System Throughput Capacity
      StorageCapacity:
        default: File System Storage Capacity
      LatestWindowsAmiId:
        default: Latest Windows AMI ID
      LatestLinuxAmiId:
        default: Latest Linux AMI ID
      EnvironmentPassword:
        default: Your Test Environment Unify Password
      EnvironmentType:
        default: Your Test Environment Type

Parameters:
  VpcCidr:
    AllowedValues:
    - 10.0.0.0/16
    - 173.31.0.0/16
    - 192.168.0.0/16
    Default: 10.0.0.0/16
    Description: Select the private IPv4 CIDR for the VPC.
    Type: String
  AvailabilityZones:
    Description: Select two 2 Availability Zones (AZ).
    Type: List<AWS::EC2::AvailabilityZone::Name>
  DeploymentType:
    AllowedValues:
    - SINGLE_AZ_1
    - MULTI_AZ_1
    Default: SINGLE_AZ_1
    Type: String
  InstanceType:
    Description: Select the instance type.
    AllowedValues:
    - t2.micro
    - m5.large
    - c5n.xlarge
    - c5n.2xlarge
    - c5n.9xlarge
    - c5n.18xlarge
    - r5n.8xlarge
    - r5n.16xlarge
    - r5n.24xlarge
    Default: t2.micro
    Type: String
  KeyPair:
    Type: AWS::EC2::KeyPair::KeyName
    ConstraintDescription: Must specify your key pair
  ThroughputCapacity:
    Description: Select Storage Throughput from 128, 256, 512, 1024, and 2048 MB/s.
    AllowedValues:
    - 128
    - 256
    - 512
    - 1024
    - 2048
    Default: 128
    Type: Number
  StorageCapacity:
    Description: Specify a Storage Capacity between 1024 to 196608.
    Default: 1024
    Type: Number
  LatestWindowsAmiId:
    Type: 'AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>'
    Default: '/aws/service/ami-windows-latest/Windows_Server-2022-English-Full-Base'
  LatestLinuxAmiId:
    Type: 'AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>'
    Default: '/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2'
  EnvironmentPassword:
    NoEcho: true
    Description: The password for your FSx for NetApp ONTAP and MS Directory Admin.Must contain at least 8 characters in the allowed pattern ("^[^\u0000\u0085\u2028\u2029\r\n]{8,50}$").
    Type: String
    MinLength: 8
    AllowedPattern: ^[^\u0000\u0085\u2028\u2029\r\n]{8,50}$
    ConstraintDescription: Your environment password must contain at least 8 characters in the allowed pattern ("^[^\u0000\u0085\u2028\u2029\r\n]{8,50}$").
  EnvironmentType:
    Description: Is Microsoft AD required in your environment
    AllowedValues:
    - "Create an AD for me"
    - "I don't need an AD"
    Type: String
    ConstraintDescription: Must specify the AD resources

Conditions:
  CreateADResources: !Equals
    - !Ref EnvironmentType
    - "Create an AD for me"
  IsSingleAZ: !Equals
    - !Ref DeploymentType
    - "SINGLE_AZ_1"
  IsMultiAZ: !Equals
    - !Ref DeploymentType
    - "MULTI_AZ_1"

Resources:
  # Network Environment
  AttachInternetGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref Vpc

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: !Join [ '', [ 'VPC IGW | ', !Ref 'AWS::StackName' ] ]

  PublicRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      Tags:
        - Key: Name
          Value: !Join [ '', [ 'Public Route Table | ', !Ref 'AWS::StackName' ] ]
        - Key: Network
          Value: Public
      VpcId: !Ref Vpc

  PublicRouteTableAssociation0:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet0
      RouteTableId: !Ref PublicRouteTable

  PublicRouteTableAssociation1:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet1
      RouteTableId: !Ref PublicRouteTable

  PublicSubnet0:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Select [ 0, !Ref AvailabilityZones ]
      CidrBlock: !Select [ 0, !Cidr [ !GetAtt Vpc.CidrBlock, 2, 8 ] ]
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Join [ '', [ 'Public Subnet 0 | ', !Ref 'AWS::StackName' ] ]
        - Key: SubnetType
          Value: Public
      VpcId: !Ref Vpc

  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Select [ 1, !Ref AvailabilityZones ]
      CidrBlock: !Select [ 1, !Cidr [ !GetAtt Vpc.CidrBlock, 2, 8 ] ]
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Join [ '', [ 'Public Subnet 1 | ', !Ref 'AWS::StackName' ] ]
        - Key: SubnetType
          Value: Public
      VpcId: !Ref Vpc

  Vpc:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCidr
      EnableDnsHostnames: true
      EnableDnsSupport: true
      Tags:
        - Key: Name
          Value: !Join [ '', [ 'VPC | ', !Ref 'AWS::StackName' ] ]

  #Security Group
  SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for Amazon FSx for NetApp ONTAP Workshop Environment
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 3389
          ToPort: 3389
          CidrIp: 0.0.0.0/0
      Tags:
        - Key: Name
          Value: "Amazon FSx for  NetApp ONTAP Test Environment security group"
      VpcId:
        !Ref Vpc

  SecurityGroupIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref SecurityGroup
      IpProtocol: -1
      SourceSecurityGroupId: !Ref SecurityGroup

  #AWS Managed Microsoft AD
  MSDirectory:
    Type: AWS::DirectoryService::MicrosoftAD
    Condition: CreateADResources
    Properties:
      Edition: Standard
      Name: fsxontap.com
      Password: !Ref EnvironmentPassword
      VpcSettings:
        SubnetIds:
          - !Ref PublicSubnet0
          - !Ref PublicSubnet1
        VpcId:
          !Ref Vpc

  #DHCP Setting
  DhcpOptions:
    Type: AWS::EC2::DHCPOptions
    Condition: CreateADResources
    Properties:
      DomainName: fsxontap.com
      DomainNameServers: !GetAtt MSDirectory.DnsIpAddresses
  DhcpOptionsAssociation:
    Type: AWS::EC2::VPCDHCPOptionsAssociation
    Condition: CreateADResources
    Properties:
      DhcpOptionsId: !Ref DhcpOptions
      VpcId: !Ref Vpc

  #The Windows OS Instance
  WindowsInstance:
    Type: AWS::EC2::Instance
    Condition: CreateADResources
    Properties:
      IamInstanceProfile: !Ref InstanceProfile
      ImageId: !Ref LatestWindowsAmiId
      InstanceType: !Ref InstanceType
      KeyName: !Ref KeyPair
      Monitoring: true
      SecurityGroupIds:
        - !Ref SecurityGroup
      SubnetId: !Ref PublicSubnet0
      Tags:
        - Key: Name
          Value: FSx for ONTAP Windows Instance

  #The Linux OS Instance
  LinuxInstance:
    Type: AWS::EC2::Instance
    Properties:
      IamInstanceProfile: !Ref InstanceProfile
      ImageId: !Ref LatestLinuxAmiId
      InstanceType: !Ref InstanceType
      KeyName: !Ref KeyPair
      Monitoring: true
      SecurityGroupIds:
        - !Ref SecurityGroup
      SubnetId: !Ref PublicSubnet0
      Tags:
        - Key: Name
          Value: FSx for ONTAP Linux Instance

  # Instance Role Setting
  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: '/'
      Roles:
      - !Ref InstanceRole

  InstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - ec2.amazonaws.com
          Action:
          - sts:AssumeRole
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM
      - arn:aws:iam::aws:policy/AmazonFSxFullAccess
      - arn:aws:iam::aws:policy/AmazonEC2FullAccess
      - arn:aws:iam::aws:policy/IAMFullAccess
      - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
      - arn:aws:iam::aws:policy/AmazonSSMDirectoryServiceAccess
      Path: "/"

  #Join Windows Instance to AD
  AWSJoinDirectoryServiceDomainAssociation:
    Type: AWS::SSM::Association
    Condition: CreateADResources
    DependsOn:
          - WindowsInstance
          - MSDirectory
    Properties:
      AssociationName: "fsxontap-aws-join-directory-service-domain-association"
      Name: AWS-JoinDirectoryServiceDomain
      Parameters:
        directoryId:
          - !Ref MSDirectory
        directoryName:
          - fsxontap.com
        directoryOU:
          - OU=Computers,OU=fsxontap,DC=fsxontap,DC=com
        dnsIpAddresses:
          - !Select [0, !GetAtt MSDirectory.DnsIpAddresses]
          - !Select [1, !GetAtt MSDirectory.DnsIpAddresses]
      Targets:
        - Key: InstanceIds
          Values:
            - !Ref WindowsInstance
      WaitForSuccessTimeoutSeconds: 3000

  #FSx for NetApp ONTAP Setting
  FileSystem:
    Type: "AWS::FSx::FileSystem"
    Properties:
      FileSystemType: "ONTAP"
      StorageCapacity: !Ref StorageCapacity
      SubnetIds: !If
        - IsSingleAZ
        - - !Ref PublicSubnet0
        - - !Ref PublicSubnet0
          - !Ref PublicSubnet1
      SecurityGroupIds:
        - !Ref SecurityGroup
      OntapConfiguration:
        FsxAdminPassword: !Ref EnvironmentPassword
        DeploymentType: !Ref DeploymentType
        ThroughputCapacity: !Ref ThroughputCapacity
        PreferredSubnetId: !If
          - IsMultiAZ
          - !Ref PublicSubnet0
          - !Ref AWS::NoValue

  #FSx for NetApp ONTAP SVM (No AD)
  SVM0:
    DependsOn: FileSystem
    Type: "AWS::FSx::StorageVirtualMachine"
    Properties:
      FileSystemId: !Ref FileSystem
      Name: SVM0

  #The Volume Under FSx for NetApp ONTAP SVM (No AD)
  Volume1:
    DependsOn: SVM0
    Type: "AWS::FSx::Volume"
    Properties:
      Name: vol1
      VolumeType: "ONTAP"
      OntapConfiguration:
        JunctionPath: /vol1
        SizeInMegabytes: 10240
        StorageEfficiencyEnabled: true
        StorageVirtualMachineId: !Ref SVM0

  #FSx for NetApp ONTAP SVM (Join AD)
  SVMAD:
    DependsOn:
      - FileSystem
      - MSDirectory
    Type: "AWS::FSx::StorageVirtualMachine"
    Condition: CreateADResources
    Properties:
      FileSystemId: !Ref FileSystem
      Name: SVMAD
      ActiveDirectoryConfiguration:
        NetBiosName: "SVMAD"
        SelfManagedActiveDirectoryConfiguration:
          DnsIps:
            - !Select [0, !GetAtt MSDirectory.DnsIpAddresses]
            - !Select [1, !GetAtt MSDirectory.DnsIpAddresses]
          DomainName: "fsxontap.com"
          FileSystemAdministratorsGroup: "Domain Admins"
          OrganizationalUnitDistinguishedName: "OU=Computers,OU=fsxontap,DC=fsxontap,DC=com"
          Password: !Ref EnvironmentPassword
          UserName: "Admin"

  #The Volume Under FSx for NetApp ONTAP SVM (Join AD)
  VolumeAD:
    DependsOn: SVMAD
    Type: "AWS::FSx::Volume"
    Condition: CreateADResources
    Properties:
      Name: volad
      VolumeType: "ONTAP"
      OntapConfiguration:
        JunctionPath: /volad
        SizeInMegabytes: 10240
        StorageEfficiencyEnabled: true
        StorageVirtualMachineId: !Ref SVMAD

Outputs:
  DirectoryID:
    Description: ID of the Microsoft Active Directory
    Value: !Ref MSDirectory
    Condition: CreateADResources
  DirectoryAdminAccount:
    Description: Admin account of the Microsoft Active Directory
    Value: admin@fsxontap.com
    Condition: CreateADResources
  DirectoryAdminPassword:
    Description: Admin password of the Microsoft Active Directory
    Value: Your Test Environment Unify Password
    Condition: CreateADResources
  DomainName:
    Description: DomainName of the Microsoft Active Directory
    Value: fsxontap.com
    Condition: CreateADResources
  FileSystemID:
    Description: ID of the FSx for NetApp ONTAP
    Value: !Ref FileSystem
  FileSystemUser:
    Description: Admin account of the FSx for NetApp ONTAP
    Value: fsxadmin
  FileSystemPassword:
    Description: Admin password of the FSx for NetApp ONTAP
    Value: Your Test Environment Unify Password
  WindowsInstancePublicIp:
    Description: Windows Server Public IP
    Value: !GetAtt WindowsInstance.PublicIp
    Condition: CreateADResources
  LinuxInstancePublicIp:
    Description: Linux Server Public IP
    Value: !GetAtt LinuxInstance.PublicIp