cloudformation.yml

AWSTemplateFormatVersion: 2010-09-09
Description: >

  This template creates a play and learn sandbox environment with the following
  resources:

  - A tiered VPC with public and private subnets. - AN EKS cluster deployed
  across two Availability Zones in a
    Serverless deployment model via AWS Fargate.
  - A pair of NAT gateways (one in each zone) to handle outbound traffic. - A
  RDS PostgreSQL data backend. - An Elastic Container Registry.
Parameters:
  EnvironmentName:
    Description: >-
      An environment name that will be prefixed to resource names.  Use lower
      cased alphabet characters only such as letters with no numbers, special
      characters.
    Type: String
    Default: sandboxenv
  MasterdbUsername:
    Description: The master RDS postgres db username
    Type: String
    Default: senv_eks_rds_pstgsql_uname
  MasterdbUserPassword:
    Description: The master RDS postgres db password
    Type: String
    Default: senv_eks_rds_pstgsql_pword
  VpcCIDR:
    Description: Please enter the IP range (CIDR notation) for this VPC
    Type: String
    AllowedPattern: '((\d{1,3})\.){3}\d{1,3}/\d{1,2}'
    Default: 10.192.0.0/16
  PublicSubnet1CIDR:
    Description: >-
      Please enter the IP range (CIDR notation) for the public subnet in the
      first Availability Zone
    Type: String
    AllowedPattern: '((\d{1,3})\.){3}\d{1,3}/\d{1,2}'
    Default: 10.192.10.0/24
  PublicSubnet2CIDR:
    Description: >-
      Please enter the IP range (CIDR notation) for the public subnet in the
      second Availability Zone
    Type: String
    AllowedPattern: '((\d{1,3})\.){3}\d{1,3}/\d{1,2}'
    Default: 10.192.11.0/24
  PrivateSubnet1CIDR:
    Description: >-
      Please enter the IP range (CIDR notation) for the private subnet in the
      first Availability Zone
    Type: String
    AllowedPattern: '((\d{1,3})\.){3}\d{1,3}/\d{1,2}'
    Default: 10.192.20.0/24
  PrivateSubnet2CIDR:
    Description: >-
      Please enter the IP range (CIDR notation) for the private subnet in the
      second Availability Zone
    Type: String
    AllowedPattern: '((\d{1,3})\.){3}\d{1,3}/\d{1,2}'
    Default: 10.192.21.0/24
  PrivateSubnet3CIDR:
    Description: >-
      Please enter the IP range (CIDR notation) for the private subnet in the
      second Availability Zone
    Type: String
    AllowedPattern: '((\d{1,3})\.){3}\d{1,3}/\d{1,2}'
    Default: 10.192.22.0/24
  PrivateSubnet4CIDR:
    Description: >-
      Please enter the IP range (CIDR notation) for the private subnet in the
      second Availability Zone
    Type: String
    AllowedPattern: '((\d{1,3})\.){3}\d{1,3}/\d{1,2}'
    Default: 10.192.23.0/24
  InstanceType:
    Type: String
    Default: db.t3.micro
    AllowedValues:
      - db.t3.micro
      - db.t2.micro
      - db.m1.small
Resources:
  VPC:
    Type: 'AWS::EC2::VPC'
    Properties:
      CidrBlock: !Ref VpcCIDR
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: !Ref EnvironmentName
  InternetGateway:
    Type: 'AWS::EC2::InternetGateway'
    Properties:
      Tags:
        - Key: Name
          Value: !Ref EnvironmentName
  InternetGatewayAttachment:
    Type: 'AWS::EC2::VPCGatewayAttachment'
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref VPC
  PublicSubnet1:
    Type: 'AWS::EC2::Subnet'
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select 
        - 0
        - !GetAZs ''
      CidrBlock: !Ref PublicSubnet1CIDR
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub '${EnvironmentName} Public Subnet (AZ1)'
  PublicSubnet2:
    Type: 'AWS::EC2::Subnet'
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select 
        - 1
        - !GetAZs ''
      CidrBlock: !Ref PublicSubnet2CIDR
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub '${EnvironmentName} Public Subnet (AZ2)'
  PrivateSubnet1:
    Type: 'AWS::EC2::Subnet'
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select 
        - 0
        - !GetAZs ''
      CidrBlock: !Ref PrivateSubnet1CIDR
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub '${EnvironmentName} Private Subnet (AZ1)'
  PrivateSubnet2:
    Type: 'AWS::EC2::Subnet'
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select 
        - 1
        - !GetAZs ''
      CidrBlock: !Ref PrivateSubnet2CIDR
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub '${EnvironmentName} Private Subnet (AZ2)'
  PrivateSubnet3:
    Type: 'AWS::EC2::Subnet'
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select 
        - 0
        - !GetAZs ''
      CidrBlock: !Ref PrivateSubnet3CIDR
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub '${EnvironmentName} Private Subnet (AZ1)'
  PrivateSubnet4:
    Type: 'AWS::EC2::Subnet'
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select 
        - 1
        - !GetAZs ''
      CidrBlock: !Ref PrivateSubnet4CIDR
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub '${EnvironmentName} Private Subnet (AZ2)'
  RDSDBSubnetGroup:
    Type: 'AWS::RDS::DBSubnetGroup'
    Properties:
      DBSubnetGroupDescription: Subnet Group for RDS PostgreSQL
      DBSubnetGroupName: !Ref EnvironmentName
      SubnetIds:
        - !Ref PrivateSubnet3
        - !Ref PrivateSubnet4
  NatGateway1EIP:
    Type: 'AWS::EC2::EIP'
    DependsOn: InternetGatewayAttachment
    Properties:
      Domain: vpc
  NatGateway2EIP:
    Type: 'AWS::EC2::EIP'
    DependsOn: InternetGatewayAttachment
    Properties:
      Domain: vpc
  NatGateway1:
    Type: 'AWS::EC2::NatGateway'
    Properties:
      AllocationId: !GetAtt 
        - NatGateway1EIP
        - AllocationId
      SubnetId: !Ref PublicSubnet1
  NatGateway2:
    Type: 'AWS::EC2::NatGateway'
    Properties:
      AllocationId: !GetAtt 
        - NatGateway2EIP
        - AllocationId
      SubnetId: !Ref PublicSubnet2
  PublicRouteTable:
    Type: 'AWS::EC2::RouteTable'
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub '${EnvironmentName} Public Routes'
  DefaultPublicRoute:
    Type: 'AWS::EC2::Route'
    DependsOn: InternetGatewayAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway
  PublicSubnet1RouteTableAssociation:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref PublicSubnet1
  PublicSubnet2RouteTableAssociation:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref PublicSubnet2
  PrivateRouteTable1:
    Type: 'AWS::EC2::RouteTable'
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub '${EnvironmentName} Private Routes (AZ1)'
  RDSPrivate1Route1:
    Type: 'AWS::EC2::Route'
    Properties:
      RouteTableId: !Ref PrivateRouteTable1
      DestinationCidrBlock: !Ref PrivateSubnet3CIDR
      NatGatewayId: !Ref NatGateway1
  RDSPrivate1Route2:
    Type: 'AWS::EC2::Route'
    Properties:
      RouteTableId: !Ref PrivateRouteTable1
      DestinationCidrBlock: !Ref PrivateSubnet4CIDR
      NatGatewayId: !Ref NatGateway1
  DefaultPrivateRoute1:
    Type: 'AWS::EC2::Route'
    Properties:
      RouteTableId: !Ref PrivateRouteTable1
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway1
  PrivateSubnet1RouteTableAssociation:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      RouteTableId: !Ref PrivateRouteTable1
      SubnetId: !Ref PrivateSubnet1
  PrivateRouteTable2:
    Type: 'AWS::EC2::RouteTable'
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub '${EnvironmentName} Private Routes (AZ2)'
  RDSPrivate2Route1:
    Type: 'AWS::EC2::Route'
    Properties:
      RouteTableId: !Ref PrivateRouteTable2
      DestinationCidrBlock: !Ref PrivateSubnet3CIDR
      NatGatewayId: !Ref NatGateway2
  RDSPrivate2Route2:
    Type: 'AWS::EC2::Route'
    Properties:
      RouteTableId: !Ref PrivateRouteTable2
      DestinationCidrBlock: !Ref PrivateSubnet4CIDR
      NatGatewayId: !Ref NatGateway2
  DefaultPrivateRoute2:
    Type: 'AWS::EC2::Route'
    Properties:
      RouteTableId: !Ref PrivateRouteTable2
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway2
  PrivateSubnet2RouteTableAssociation:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      RouteTableId: !Ref PrivateRouteTable2
      SubnetId: !Ref PrivateSubnet2
  PrivateRouteTable3:
    Type: 'AWS::EC2::RouteTable'
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub '${EnvironmentName} Private Routes (AZ1)'
  DefaultPrivateRoute3:
    Type: 'AWS::EC2::Route'
    Properties:
      RouteTableId: !Ref PrivateRouteTable3
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway1
  PrivateSubnet3RouteTableAssociation:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      RouteTableId: !Ref PrivateRouteTable3
      SubnetId: !Ref PrivateSubnet3
  PrivateRouteTable4:
    Type: 'AWS::EC2::RouteTable'
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub '${EnvironmentName} Private Routes (AZ2)'
  DefaultPrivateRoute4:
    Type: 'AWS::EC2::Route'
    Properties:
      RouteTableId: !Ref PrivateRouteTable4
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway2
  PrivateSubnet4RouteTableAssociation:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      RouteTableId: !Ref PrivateRouteTable4
      SubnetId: !Ref PrivateSubnet4
  EKSHostSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      VpcId: !Ref VPC
      GroupDescription: Access to the EKS hosts and the tasks/containers that run on them
      SecurityGroupIngress:
        - SourceSecurityGroupId: !Ref LoadBalancerSecurityGroup
          IpProtocol: '-1'
      Tags:
        - Key: Name
          Value: !Sub '${EnvironmentName}-EKS-Hosts'
  LoadBalancerSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      VpcId: !Ref VPC
      GroupDescription: Access to the load balancer that sits in front of EKS
      SecurityGroupIngress:
        - CidrIp: 0.0.0.0/0
          IpProtocol: '-1'
      Tags:
        - Key: Name
          Value: !Sub '${EnvironmentName}-LoadBalancers'
  RDSSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      VpcId: !Ref VPC
      GroupDescription: Access to the RDS Instance from EKS
      SecurityGroupIngress:
        - CidrIp: !Ref VpcCIDR
          IpProtocol: '-1'
      Tags:
        - Key: Name
          Value: !Sub '${EnvironmentName}-RDS-Hosts'
  IAMRole:
    Type: 'AWS::IAM::Role'
    Properties:
      Path: /
      RoleName: !Sub '${EnvironmentName}-AmazonEKSFargatePodExecutionRole'
      AssumeRolePolicyDocument: >-
        {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"eks-fargate-pods.amazonaws.com"},"Action":"sts:AssumeRole"}]}
      MaxSessionDuration: 3600
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy'
      Description: >-
        Allows access to other AWS service resources that are required to run
        Amazon EKS pods on AWS Fargate.
      Tags:
        - Key: sandbox
          Value: eks-postgres
  IAMRole2:
    Type: 'AWS::IAM::Role'
    Properties:
      Path: /
      RoleName: !Sub '${EnvironmentName}-AmazonEKSClusterRole'
      AssumeRolePolicyDocument: >-
        {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"eks.amazonaws.com"},"Action":"sts:AssumeRole"}]}
      MaxSessionDuration: 3600
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/AmazonEKSClusterPolicy'
      Description: >-
        Allows access to other AWS service resources that are required to
        operate clusters managed by EKS.
  ECRRepository:
    Type: 'AWS::ECR::Repository'
    Properties:
      RepositoryName: !Ref EnvironmentName
  EKSCluster:
    Type: 'AWS::EKS::Cluster'
    Properties:
      Name: !Ref EnvironmentName
      RoleArn: !GetAtt 
        - IAMRole2
        - Arn
      Version: '1.24'
      ResourcesVpcConfig:
        SecurityGroupIds:
          - !Ref LoadBalancerSecurityGroup
        SubnetIds:
          - !Ref PublicSubnet1
          - !Ref PublicSubnet2
        EndpointPublicAccess: true
        PublicAccessCidrs:
          - 0.0.0.0/0
        EndpointPrivateAccess: true
      KubernetesNetworkConfig:
        ServiceIpv4Cidr: 10.100.0.0/16
  FargateProfile:
    Type: 'AWS::EKS::FargateProfile'
    Properties:
      ClusterName: !Ref EKSCluster
      FargateProfileName: !Ref EnvironmentName
      PodExecutionRoleArn: !GetAtt 
        - IAMRole
        - Arn
      Selectors:
        - Namespace: !Ref EnvironmentName
          Labels:
            - Key: key1
              Value: value1
      Subnets:
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2
  EKSAddon:
    Type: 'AWS::EKS::Addon'
    Properties:
      AddonName: vpc-cni
      AddonVersion: v1.11.4-eksbuild.1
      ClusterName: !Ref EKSCluster
  EKSAddon2:
    Type: 'AWS::EKS::Addon'
    Properties:
      AddonName: kube-proxy
      AddonVersion: v1.24.7-eksbuild.2
      ClusterName: !Ref EKSCluster
  EKSAddon3:
    Type: 'AWS::EKS::Addon'
    Properties:
      AddonName: coredns
      AddonVersion: v1.8.7-eksbuild.3
      ClusterName: !Ref EKSCluster
  RDSDBInstance:
    Type: 'AWS::RDS::DBInstance'
    Properties:
      DBInstanceIdentifier: !Ref EnvironmentName
      AllocatedStorage: 20
      DBInstanceClass: !Ref InstanceType
      Engine: postgres
      MasterUsername: !Ref MasterdbUsername
      MasterUserPassword: !Ref MasterdbUserPassword
      DBName: !Ref EnvironmentName
      PreferredBackupWindow: '10:17-10:47'
      BackupRetentionPeriod: 0
      AvailabilityZone: !GetAtt 
        - PrivateSubnet3
        - AvailabilityZone
      PreferredMaintenanceWindow: 'tue:08:00-tue:08:30'
      MultiAZ: false
      EngineVersion: '14.1'
      AutoMinorVersionUpgrade: true
      LicenseModel: postgresql-license
      PubliclyAccessible: false
      StorageType: gp2
      Port: 5432
      StorageEncrypted: false
      CopyTagsToSnapshot: false
      MonitoringInterval: 0
      EnableIAMDatabaseAuthentication: false
      EnablePerformanceInsights: false
      DeletionProtection: false
      DBSubnetGroupName: !Ref RDSDBSubnetGroup
      VPCSecurityGroups:
        - !Ref RDSSecurityGroup
      OptionGroupName: 'default:postgres-14'
      CACertificateIdentifier: rds-ca-2019
Outputs:
  VPC:
    Description: A reference to the created VPC
    Value: !Ref VPC
  PublicSubnets:
    Description: A list of the public subnets
    Value: !Join 
      - ','
      - - !Ref PublicSubnet1
        - !Ref PublicSubnet2
  PrivateSubnets:
    Description: A list of the private subnets
    Value: !Join 
      - ','
      - - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2
        - !Ref PrivateSubnet3
  PublicSubnet1:
    Description: A reference to the public subnet in the 1st Availability Zone
    Value: !Ref PublicSubnet1
  PublicSubnet2:
    Description: A reference to the public subnet in the 2nd Availability Zone
    Value: !Ref PublicSubnet2
  PrivateSubnet1:
    Description: A reference to the first private subnet in the 1st Availability Zone
    Value: !Ref PrivateSubnet1
  PrivateSubnet2:
    Description: A reference to the second private subnet in the 2nd Availability Zone
    Value: !Ref PrivateSubnet2
  PrivateSubnet3:
    Description: A reference to the third private subnet in the 1st Availability Zone
    Value: !Ref PrivateSubnet3
  PrivateSubnet4:
    Description: A reference to the fourth private subnet in the 2nd Availability Zone
    Value: !Ref PrivateSubnet4
  EKSHostSecurityGroup:
    Description: A reference to the security group for EKS hosts
    Value: !Ref EKSHostSecurityGroup
  RDSSecurityGroup:
    Description: A reference to the security group for RDS Instance
    Value: !Ref RDSSecurityGroup
  LoadBalancerSecurityGroup:
    Description: A reference to the security group for load balancers
    Value: !Ref LoadBalancerSecurityGroup
  Cluster:
    Description: A reference to the EKS cluster
    Value: !Ref EKSCluster
  FargateProfile:
    Description: A reference to the EKS cluster Fargate Profile
    Value: !Ref FargateProfile
  RDSDatabase:
    Description: A reference to the RDS PostgreSQL Database
    Value: !Ref RDSDBInstance