active-directory-managed.yml

AWSTemplateFormatVersion: 2010-09-09
Description: >-
  This template creates a managed Microsoft AD Directory Service within an AWS managed VPC
  along with Elastic Network Interfaces (ENIs) in private subnets within separate 
  Availability Zones (AZs) inside the specified VPC. The default Domain Administrator user is 'admin'.

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Network Configuration
        Parameters:
          - pVpcId
          - pPrivateSubnet1Id
          - pPrivateSubnet2Id
      - Label:
          default: Microsoft Active Directory Configuration
        Parameters:
          - pDomainDnsName
          - pDomainNetBiosName
          - pDomainAdminPasswordSecretName
          - pAdEdition

    ParameterLabels:
      pDomainAdminPasswordSecretName:
        default: Name of secret in AWS Secrets Manager for domain admin password
      pDomainDnsName:
        default: Domain DNS Name
      pDomainNetBiosName:
        default: Domain NetBIOS Name
      pAdEdition:
        default: AWS Microsoft AD edition
      pPrivateSubnet1Id:
        default: Private Subnet 1 ID
      pPrivateSubnet2Id:
        default: Private Subnet 2 ID
      pVpcId:
        default: VPC ID

Parameters:
  pDomainAdminPasswordSecretName:
    Description: Name of secret in AWS Secrets Manager for the domain admin user. The password must be stored in a key named `password`.
    Type: String
    Default: ''

  pDomainDnsName:
    Description: >-
      Fully qualified domain name (FQDN) of the forest root domain e.g.
      example.com
    Type: String
    Default: example.com
    MinLength: '2'
    MaxLength: '255'
    AllowedPattern: '[a-zA-Z0-9\-]+\..+'

  pDomainNetBiosName:
    Description: >-
      NetBIOS name of the domain (upto 15 characters) for users of earlier
      versions of Windows e.g. EXAMPLE
    Type: String
    Default: EXAMPLE
    MinLength: '1'
    MaxLength: '15'
    AllowedPattern: '[a-zA-Z0-9\-]+'

  pAdEdition:
    AllowedValues:
      - Standard
      - Enterprise
    Default: Standard
    Description: >-
      The AWS Microsoft AD edition. Valid values include Standard and
      Enterprise.
    Type: String

  pPrivateSubnet1Id:
    Description: 'ID of the private subnet 1 in Availability Zone 1'
    Type: AWS::EC2::Subnet::Id

  pPrivateSubnet2Id:
    Description: 'ID of the private subnet 2 in Availability Zone 2'
    Type: AWS::EC2::Subnet::Id

  pVpcId:
    Description: 'ID of the VPC'
    Type: AWS::EC2::VPC::Id

  pCreateVpcDhcpOptions:
    Description: Create VPC DHCP Options (true | false)
    Type: String
    Default: false
    AllowedValues: [true, false]

Rules:
  SubnetsInVPC:
    Assertions:
      - Assert:
          'Fn::EachMemberIn':
            - 'Fn::ValueOfAll':
                - 'AWS::EC2::Subnet::Id'
                - VpcId
            - 'Fn::RefAll': 'AWS::EC2::VPC::Id'
        AssertDescription: All subnets must in the VPC

Conditions:
  cCreateVpcDhcpOptions: !Equals [ !Ref 'pCreateVpcDhcpOptions', 'true' ]

Resources:
  rDhcpOptions:
    Type: AWS::EC2::DHCPOptions
    Condition: cCreateVpcDhcpOptions
    Properties:
      DomainName: !Ref pDomainDnsName
      DomainNameServers: !GetAtt rMicrosoftAd.DnsIpAddresses
      Tags:
        - Key: Domain
          Value: !Ref pDomainDnsName

  rVpcDhcpOptionsAssociation:
    Type: AWS::EC2::VPCDHCPOptionsAssociation
    Condition: cCreateVpcDhcpOptions
    Properties:
      VpcId: !Ref pVpcId
      DhcpOptionsId: !Ref rDhcpOptions

  rMicrosoftAd:
    Type: AWS::DirectoryService::MicrosoftAD
    Properties:
      Name: !Ref pDomainDnsName
      Edition: !Ref pAdEdition
      ShortName: !Ref pDomainNetBiosName
      Password: !Sub '{{resolve:secretsmanager:${pDomainAdminPasswordSecretName}:SecretString:password}}'
      VpcSettings:
        SubnetIds:
          - !Ref pPrivateSubnet1Id
          - !Ref pPrivateSubnet2Id
        VpcId: !Ref pVpcId

Outputs:
  oAdServer1PrivateIp:
    Value: !Select 
      - '0'
      - !GetAtt rMicrosoftAd.DnsIpAddresses
    Description: >-
      AD Server 1 Private IP Address (this may vary based on Directory Service
      order of IP addresses)
  
  oAdServer2PrivateIp:
    Value: !Select 
      - '1'
      - !GetAtt rMicrosoftAd.DnsIpAddresses
    Description: >-
      AD Server 2 Private IP Address (this may vary based on Directory Service
      order of IP addresses)
  
  oDirectoryId:
    Value: !Ref rMicrosoftAd
    Description: Directory Services ID
  
  oDomainAdmin:
    Value: !Join 
      - ''
      - - !Ref pDomainNetBiosName
        - \admin
    Description: Domain administrator account