samples-windows-server.yml

AWSTemplateFormatVersion: '2010-09-09'

Description: Windows Server Joined to Active Directory (AD) Domain

Metadata:
  cfn-lint:
    config:
      ignore_checks:
      - W2509
  AWS::CloudFormation::Interface:
    ParameterGroups:
    - Label:
        default: System Classification
      Parameters:
      - pOrg
      - pSystem
      - pApp
    - Label:
        default: System Environment
      Parameters:
      - pEnvPurpose
    - Label:
        default: Windows Server Instance
      Parameters:
      - pAmiId
      - pInstanceType
      - pKeyPair
      - pDomainJoined
    - Label:
        default: Network
      Parameters:
      - pVpcId
      - pSubnetId
      - pPublicIpAddress
      - pIngressCidr
      - pIngressPrefixListId
    - Label:
        default: Active Directory Settings for Domain Joined Instances
      Parameters:
      - pActiveDirectoryId
      - pActiveDirectoryDomainName
      - pActiveDirectoryIpAddress1
      - pActiveDirectoryIpAddress2

    ParameterLabels:
      pEnvPurpose:
        default: Environment Purpose
      pOrg:
        default: Organization Identifier
      pSystem:
        default: System Identifier
      pApp:
        default: Application Identifier
      pAmiId:
        default: EC2 AMI ID
      pInstanceType:
        default: EC2 Instance Type
      pKeyPair:
        default: EC2 Key Pair
      pDomainJoined:
        default: Domain Joined (true | false)
      pVpcId:
        default: VPC ID
      pSubnetId:
        default: Subnet ID
      pPublicIpAddress:
        default: Public IP Address (true | false)
      pIngressCidr:
        default: Allowed Ingress CIDR IP Range (optional)
      pIngressPrefixListId:
        default: Allowed Prefix List ID (optional)
      pActiveDirectoryId:
        default: AWS Managed Active Directory Identifier
      pActiveDirectoryDomainName:
        default: Active Directory Domain Name
      pActiveDirectoryIpAddress1:
        default: Active Directory Domain Controller 1 IP Address
      pActiveDirectoryIpAddress2:
        default: Active Directory Domain Controller 2 IP Address

Parameters:
  pOrg:
    Type: String
    Description: Used to qualify resource names
    Default: example

  pSystem:
    Type: String
    Description: Used to qualify resource names
    Default: samples

  pApp:
    Type: String
    Description: Used to qualify resource names
    Default: windows-server

  pEnvPurpose:
    Type: String
    Description: Used to qualify resource names. 10 characters max.
    AllowedPattern: '^[a-zA-Z0-9-_]{1,10}$'

  pKeyPair:
    Type: String
    Description: EC2 Key Pair

  pDomainJoined:
    Description: Domain Joined (true | false)
    Type: String
    Default: false
    AllowedValues: [true, false] 

  pVpcId:
    Description: ID of existing VPC
    Type: AWS::EC2::VPC::Id

  pSubnetId:
    Description: ID for subnet in which server is to be deployed
    Type: AWS::EC2::Subnet::Id

  pPublicIpAddress:
    Description: Enable public IP address (true | false)
    Type: String
    Default: false
    AllowedValues: [true, false]
 
  pIngressCidr:
    Description: IP address range that can be used to access the Windows server
    Type: String
    Default: ''

  pIngressPrefixListId:
    Description: ID of the prefix list representing the service that can be used to access the server
    Type: String
    Default: ''

  pAmiId:
    Type: 'AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>'
    Default: '/aws/service/ami-windows-latest/Windows_Server-2019-English-Full-Base'

  pInstanceType:
    Description: Windows Server EC2 instance type
    Type: String
    Default: t3a.micro
    AllowedValues:
      - t3a.micro
      - t3a.small
      - t3a.medium
    ConstraintDescription: must be a valid EC2 instance type.

  pPermissionsBoundaryArn:
    Description: IAM Permissions Boundary ARN (optional)
    Type: String
    Default: ''

  pActiveDirectoryId:
    Type: String
    Description: AWS managed Active Directory identifier. Eg. d-12345679a
  
  pActiveDirectoryDomainName:
    Type: String
    Description: Active Directory Domain Name
  
  pActiveDirectoryIpAddress1:
    Type: String
    Description: Active Directory Domain Controller 1 IP Address
  
  pActiveDirectoryIpAddress2:
    Type: String
    Description: Active Directory Domain Controller 2 IP Address

Rules:
  SubnetInVPC:
    Assertions:
      - Assert:
          'Fn::EachMemberIn':
            - 'Fn::ValueOfAll':
                - 'AWS::EC2::Subnet::Id'
                - VpcId
            - 'Fn::RefAll': 'AWS::EC2::VPC::Id'
        AssertDescription: Subnet must in the VPC

Conditions:
  cUseKeyPair: !Not [!Equals [ !Ref 'pKeyPair', '' ] ]
  cNoKeyPair: !Equals [ !Ref 'pKeyPair', '' ]
  cUsePermissionsBoundary: !Not [!Equals [ !Ref 'pPermissionsBoundaryArn', '' ] ]
  cDomainJoined: !Equals [ !Ref 'pDomainJoined', true ]
  cIngressUseCidr: !Not [!Equals [ !Ref 'pIngressCidr', '' ] ]
  cIngressUsePrefixListId: !Not [!Equals [ !Ref 'pIngressPrefixListId', '' ] ]

Resources:
  rInstanceSecurityGroupRdp:
    Type: AWS::EC2::SecurityGroup
    Condition: cUseKeyPair
    Properties:
      GroupName: !Sub '${pSystem}-${pApp}-ec2-${pEnvPurpose}'
      VpcId: !Ref pVpcId
      GroupDescription: Allow access via HTTP
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 3389
          ToPort: 3389
          CidrIp: !If [ cIngressUseCidr, !Ref pIngressCidr, !Ref 'AWS::NoValue' ]
          SourcePrefixListId: !If [ cIngressUsePrefixListId, !Ref pIngressPrefixListId, !Ref 'AWS::NoValue' ]

  rInstanceSecurityGroupEmpty:
    Type: AWS::EC2::SecurityGroup
    Condition: cNoKeyPair
    Properties:
      GroupName: !Sub '${pSystem}-${pApp}-ec2-${pEnvPurpose}'
      VpcId: !Ref pVpcId
      GroupDescription: Empty security group

  rSsmDocument:
    Type: AWS::SSM::Document
    Condition: cDomainJoined
    Properties:
      Tags:
        - Key: Name
          Value: !Sub '${pSystem}-${pApp}-${pEnvPurpose}'
      Content:
        schemaVersion: '1.2'
        description: Join instances to an AWS Directory Service domain.
        parameters:
          directoryId:
            type: String
            description: (Required) The ID of the AWS Directory Service directory.
          directoryName:
            type: String
            description: >-
              (Required) The name of the directory; for example,
              test.example.com
          dnsIpAddresses:
            type: StringList
            default: []
            description: >-
              (Optional) The IP addresses of the DNS servers in the directory.
              Required when DHCP is not configured. Learn more at
              http://docs.aws.amazon.com/directoryservice/latest/simple-ad/join_get_dns_addresses.html
            allowedPattern: >-
              ((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)
        runtimeConfig:
          'aws:domainJoin':
            properties:
              directoryId: '{{ directoryId }}'
              directoryName: '{{ directoryName }}'
              dnsIpAddresses: '{{ dnsIpAddresses }}'

  rSsmAssociation:
    Type: AWS::SSM::Association
    Condition: cDomainJoined
    Properties:
      AssociationName: !Sub '${pSystem}-${pApp}-${pEnvPurpose}'
      Name: !Ref rSsmDocument
      Parameters:
        directoryId: 
        - !Ref pActiveDirectoryId
        directoryName:
        - !Ref pActiveDirectoryDomainName
        dnsIpAddresses:
        - !Ref pActiveDirectoryIpAddress1
        - !Ref pActiveDirectoryIpAddress2
      Targets:
      - Key: 'tag:Name'
        Values:
          - !Sub '${pSystem}-${pApp}-${pEnvPurpose}'

  rWindowsServer:
    Type: AWS::EC2::Instance
    Properties:
      IamInstanceProfile: !Ref rInstanceProfile
      KeyName: !If [ cUseKeyPair, !Ref pKeyPair, !Ref 'AWS::NoValue' ]
      ImageId: !Ref pAmiId
      InstanceType: !Ref pInstanceType
      NetworkInterfaces:
        - DeleteOnTermination: true
          Description: !Sub '${pSystem}-${pApp}-${pEnvPurpose}'
          DeviceIndex: '0'
          SubnetId: !Ref pSubnetId
          GroupSet:
            - !If [ cUseKeyPair, !Ref rInstanceSecurityGroupRdp, !Ref 'AWS::NoValue' ]
            - !If [ cNoKeyPair,  !Ref rInstanceSecurityGroupEmpty, !Ref 'AWS::NoValue' ]
          AssociatePublicIpAddress: !Ref pPublicIpAddress 
      UserData:
        Fn::Base64: !Sub |
          <script>
          mkdir C:\Downloads\Amazon\AmazonCloudWatchAgent
          powershell -Command "(New-Object Net.WebClient).DownloadFile('https://s3.amazonaws.com/amazoncloudwatch-agent/windows/amd64/latest/amazon-cloudwatch-agent.msi','C:\Downloads\Amazon\AmazonCloudWatchAgent\amazon-cloudwatch-agent.msi')"
          C:\Downloads\Amazon\AmazonCloudWatchAgent\amazon-cloudwatch-agent.msi
          cfn-init.exe --verbose --stack ${AWS::StackName} --resource rWindowsServer --configsets default --region ${AWS::Region}
          cfn-signal.exe -e %errorlevel% --stack ${AWS::StackId} --resource rWindowsServer --region ${AWS::Region}
          </script>
      Tags:
        - Key: Name
          Value: !Sub '${pSystem}-${pApp}-${pEnvPurpose}'
    CreationPolicy:
      ResourceSignal:
        Count: 1
        Timeout: "PT15M"
    Metadata:
      AWS::CloudFormation::Init:
        configSets:
          default:
            - 00-setup-cfn-hup
            - 01-cfn-hup-service
            - 02-config-cloudwatch-agent
            - 03-restart-cloudwatch-agent
          update:
            - 02-config-cloudwatch-agent
            - 03-restart-cloudwatch-agent
        00-setup-cfn-hup:
          files:
             "c:\\cfn\\cfn-hup.conf":
               content: !Sub |
                 [main]
                 stack=${AWS::StackId}
                 region=${AWS::Region}
                 interval=1
             "c:\\cfn\\hooks.d\\amazon-cloudwatch-agent-auto-reloader.conf":
               content: !Sub |
                 [cfn-auto-reloader-hook]
                 triggers=post.update
                 path=Resources.EC2Instance.Metadata.AWS::CloudFormation::Init.02-config-cloudwatch-agent
                 action=cfn-init.exe -v --stack ${AWS::StackId} --resource EC2Instance --region ${AWS::Region} --configsets update
        01-cfn-hup-service:
          services:
            windows:
              cfn-hup:
                enabled: 'true'
                ensureRunning: 'true'
                files:
                  - "c:\\cfn\\cfn-hup.conf"
                  - "c:\\cfn\\hooks.d\\cfn-auto-reloader.conf"
        02-config-cloudwatch-agent:
          files:
            "C:\\ProgramData\\Amazon\\AmazonCloudWatchAgent\\amazon-cloudwatch-agent.json":
              content: !Sub |
                {
                  "metrics": {
                    "namespace": "${pSystem}-${pApp}-${pEnvPurpose}",
                    "metrics_collected": {
                      "statsd": {},
                      "Processor": {
                        "measurement": [
                          {"name": "% Idle Time", "rename": "CPU_IDLE", "unit": "Percent"},
                          "% Interrupt Time",
                          "% User Time",
                          "% Processor Time"
                        ],
                        "resources": [
                          "*"
                        ]
                      },
                      "LogicalDisk": {
                        "measurement": [
                          {"name": "% Idle Time", "unit": "Percent"},
                          {"name": "% Disk Read Time", "rename": "DISK_READ"},
                          "% Disk Write Time"
                        ],
                        "resources": [
                          "*"
                        ]
                      },
                      "Memory": {
                        "metrics_collection_interval": 5,
                        "measurement": [
                          "Available Bytes",
                          "Cache Faults/sec",
                          "Page Faults/sec",
                          "Pages/sec"
                        ]
                      },
                      "Network Interface": {
                        "metrics_collection_interval": 5,
                        "measurement": [
                          "Bytes Received/sec",
                          "Bytes Sent/sec",
                          "Packets Received/sec",
                          "Packets Sent/sec"
                        ],
                        "resources": [
                          "*"
                        ]
                      },
                      "System": {
                        "measurement": [
                          "Context Switches/sec",
                          "System Calls/sec",
                          "Processor Queue Length"
                        ]
                      }
                    },
                    "append_dimensions": {
                      "ImageId": "${!aws:ImageId}",
                      "InstanceId": "${!aws:InstanceId}",
                      "InstanceType": "${!aws:InstanceType}"
                    },
                    "aggregation_dimensions" : [["ImageId"], ["InstanceId", "InstanceType"],[]]
                  },
                  "logs": {
                    "logs_collected": {
                      "files": {
                        "collect_list": [
                          {
                            "file_path": "c:\\ProgramData\\Amazon\\AmazonCloudWatchAgent\\Logs\\amazon-cloudwatch-agent.log",
                            "log_group_name": "${rCloudWatchLogsAgentGroup}",
                            "log_stream_name": "{instance_id}/cloudwatch-agent.log",
                            "timezone": "UTC"
                          },
                          {
                            "file_path": "c:\\cfn\\log\\cfn-init.log",
                            "log_group_name": "${rCloudWatchLogsAgentGroup}",
                            "log_stream_name": "{instance_id}/cfn-init.log",
                            "timezone": "UTC"
                          },
                          {
                            "file_path": "c:\\cfn\\log\\cfn-wire.log",
                            "log_group_name": "${rCloudWatchLogsAgentGroup}",
                            "log_stream_name": "{instance_id}/cfn-wire.log",
                            "timezone": "UTC"
                          }
                        ]
                      },
                      "windows_events": {
                        "collect_list": [
                          {
                            "event_name": "System",
                            "event_levels": [
                              "INFORMATION",
                              "ERROR"
                            ],
                            "log_group_name": "${rCloudWatchLogsAgentGroup}",
                            "log_stream_name": "{instance_id}/System",
                            "event_format": "xml"
                          }
                        ]
                      }
                    },
                    "log_stream_name": "${rCloudWatchLogsAgentGroup}",
                    "force_flush_interval" : 15
                  }
                }
        03-restart-cloudwatch-agent:
          commands:
            01_stop_service:
              command: powershell -Command "C:\\'Program Files'\\Amazon\\AmazonCloudWatchAgent\\amazon-cloudwatch-agent-ctl.ps1 -a stop"
            02_start_service:
              command: powershell -Command "C:\\'Program Files'\\Amazon\\AmazonCloudWatchAgent\\amazon-cloudwatch-agent-ctl.ps1 -a fetch-config -m ec2 -c file:C:\\ProgramData\\Amazon\\AmazonCloudWatchAgent\\amazon-cloudwatch-agent.json -s"

  rRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub '${pOrg}-${pSystem}-${pApp}-${pEnvPurpose}-svc-cloud-watch-ssm'
      Path: !Sub '/${pOrg}/${pSystem}/${pApp}/'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
        - arn:aws:iam::aws:policy/AmazonSSMDirectoryServiceAccess
        - arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy
      PermissionsBoundary: !If [ cUsePermissionsBoundary, !Ref pPermissionsBoundaryArn, !Ref 'AWS::NoValue' ]

  rCloudWatchLogsAgentGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub '/${pSystem}/${pApp}/ec2/${pEnvPurpose}'
      RetentionInDays: 30

  rInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      InstanceProfileName: !Sub '${pSystem}-${pApp}-${pEnvPurpose}'
      Path: !Sub '/${pOrg}/${pSystem}/${pApp}/'
      Roles:
        - !Ref rRole