module.yml

---
# Copyright 2018 widdix GmbH
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
AWSTemplateFormatVersion: '2010-09-09'
Description: 'cfn-modules: SSH bastion'
# cfn-modules:implements(Bastion)
# TODO could be based on module asg-singleton-amazon-linux2
Parameters:
  VpcModule:
    Description: 'Stack name of vpc module.'
    Type: String
  AlertingModule:
    Description: 'Optional but recommended stack name of alerting module.'
    Type: String
    Default: ''
  HostedZoneModule:
    Description: 'Optional but recommended stack name of module implementing HostedZone.'
    Type: String
    Default: ''
  KeyName:
    Description: 'Optional key name of the Linux user ec2-user to establish a SSH connection to the EC2 instance.'
    Type: String
    Default: ''
  IAMUserSSHAccess:
    Description: 'Synchronize public keys of IAM users to enable personalized SSH access (https://github.com/widdix/aws-ec2-ssh)?'
    Type: String
    Default: false
    AllowedValues: [true, false]
  InstanceType:
    Description: 'The instance type for the EC2 instance.'
    Type: String
    Default: 't2.nano'
  LogGroupRetentionInDays:
    Description: 'Specifies the number of days you want to retain log events.'
    Type: Number
    Default: 14
    AllowedValues: [1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 3653]
  SubDomainNameWithDot:
    Description: 'Name that is used to create the DNS entry with trailing dot, e.g. &sect;{SubDomainNameWithDot}&sect;{HostedZoneName}. Leave blank for naked (or apex and bare) domain. Requires HostedZoneModule parameter!'
    Type: String
    Default: 'ssh.'
Mappings:
  RegionMap:
    'af-south-1':
      ImageId: 'ami-012cfe9645defcccc'
    'eu-north-1':
      ImageId: 'ami-04059857e65e8706a'
    'ap-south-1':
      ImageId: 'ami-0a1ef5c78c35eb30f'
    'eu-west-3':
      ImageId: 'ami-084901c131bb81554'
    'eu-west-2':
      ImageId: 'ami-0526a2ea416570f68'
    'eu-south-1':
      ImageId: 'ami-0d3f5ecf106cf35b8'
    'eu-west-1':
      ImageId: 'ami-06965d227fdac9555'
    'ap-northeast-3':
      ImageId: 'ami-02cf1b9547200c090'
    'ap-northeast-2':
      ImageId: 'ami-041b2fbe37cff5e6e'
    'me-south-1':
      ImageId: 'ami-03b2cbcd2af6e9cb5'
    'ap-northeast-1':
      ImageId: 'ami-08c8679dc2213bf15'
    'sa-east-1':
      ImageId: 'ami-0d8878c559055f7e5'
    'ca-central-1':
      ImageId: 'ami-0cbf426e8553ea475'
    'ap-east-1':
      ImageId: 'ami-0687f185bf824c057'
    'ap-southeast-1':
      ImageId: 'ami-0cee4365258700120'
    'ap-southeast-2':
      ImageId: 'ami-03793e0cc77ae1dca'
    'eu-central-1':
      ImageId: 'ami-067bf87afbb871599'
    'us-east-1':
      ImageId: 'ami-0984a48dcb8fa390a'
    'us-east-2':
      ImageId: 'ami-05abc59cb5c333f95'
    'us-west-1':
      ImageId: 'ami-00a6eb705abfa5235'
    'us-west-2':
      ImageId: 'ami-074d18b2165005fd6'
Conditions:
  HasAlertingModule: !Not [!Equals [!Ref AlertingModule, '']]
  HasHostedZoneModule: !Not [!Equals [!Ref HostedZoneModule, '']]
  HasKeyName: !Not [!Equals [!Ref KeyName, '']]
  HasIAMUserSSHAccess: !Equals [!Ref IAMUserSSHAccess, 'true']
Resources:
  RecordSet:
    Condition: HasHostedZoneModule
    Type: 'AWS::Route53::RecordSet'
    Properties:
      HostedZoneId:
        'Fn::ImportValue': !Sub '${HostedZoneModule}-Id'
      Name: !Sub
      - '${SubDomainNameWithDot}${HostedZoneName}'
      - SubDomainNameWithDot: !Ref SubDomainNameWithDot
        HostedZoneName:
          'Fn::ImportValue': !Sub '${HostedZoneModule}-Name'
      ResourceRecords:
      - !Ref ElasticIP
      TTL: 60
      Type: A
  ElasticIP:
    Type: 'AWS::EC2::EIP'
    Properties:
      Domain: vpc
  LogGroup:
    Type: 'AWS::Logs::LogGroup'
    Properties:
      RetentionInDays: !Ref LogGroupRetentionInDays
  SecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: !Ref 'AWS::StackName'
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 22
        ToPort: 22
        CidrIp: '0.0.0.0/0'
      VpcId:
        'Fn::ImportValue': !Sub '${VpcModule}-Id'
  InstanceProfile:
    Type: 'AWS::IAM::InstanceProfile'
    Properties:
      Roles:
      - !Ref Role
  Role:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: 'ec2.amazonaws.com'
          Action: 'sts:AssumeRole'
      Policies:
      - PolicyName: ec2
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action: 'ec2:AssociateAddress'
            Resource: '*'
      - PolicyName: logs
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - 'logs:CreateLogGroup'
            - 'logs:CreateLogStream'
            - 'logs:PutLogEvents'
            - 'logs:DescribeLogStreams'
            Resource: !GetAtt 'LogGroup.Arn'
  PolicySshAccess:
    Type: 'AWS::IAM::Policy'
    Condition: HasIAMUserSSHAccess
    Properties:
      Roles:
      - !Ref Role
      PolicyName: 'ssh-access'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Action:
          - 'iam:ListUsers'
          - 'iam:GetGroup'
          Resource: '*'
        - Effect: Allow
          Action:
          - 'iam:ListSSHPublicKeys'
          - 'iam:GetSSHPublicKey'
          Resource: !Sub 'arn:${AWS::Partition}:iam::${AWS::AccountId}:user/*'
        - Effect: Allow
          Action: 'ec2:DescribeTags'
          Resource: '*'
  LaunchConfiguration:
    Type: 'AWS::AutoScaling::LaunchConfiguration'
    Metadata:
      'AWS::CloudFormation::Init':
        configSets:
          default: !If [HasIAMUserSSHAccess, [awslogs, ssh-access, config], [awslogs, config]]
        awslogs:
          packages:
            yum:
              awslogs: []
          files:
            '/etc/awslogs/awscli.conf':
              content: !Sub |
                [default]
                region = ${AWS::Region}
                [plugins]
                cwlogs = cwlogs
              mode: '000644'
              owner: root
              group: root
            '/etc/awslogs/awslogs.conf':
              content: !Sub |
                [general]
                state_file = /var/lib/awslogs/agent-state
                [/var/log/messages]
                datetime_format = %b %d %H:%M:%S
                file = /var/log/messages
                log_stream_name = {instance_id}/var/log/messages
                log_group_name = ${LogGroup}
                [/var/log/secure]
                datetime_format = %b %d %H:%M:%S
                file = /var/log/secure
                log_stream_name = {instance_id}/var/log/secure
                log_group_name = ${LogGroup}
                [/var/log/cron]
                datetime_format = %b %d %H:%M:%S
                file = /var/log/cron
                log_stream_name = {instance_id}/var/log/cron
                log_group_name = ${LogGroup}
                [/var/log/cloud-init.log]
                datetime_format = %b %d %H:%M:%S
                file = /var/log/cloud-init.log
                log_stream_name = {instance_id}/var/log/cloud-init.log
                log_group_name = ${LogGroup}
                [/var/log/cfn-init.log]
                datetime_format = %Y-%m-%d %H:%M:%S
                file = /var/log/cfn-init.log
                log_stream_name = {instance_id}/var/log/cfn-init.log
                log_group_name = ${LogGroup}
                [/var/log/cfn-hup.log]
                datetime_format = %Y-%m-%d %H:%M:%S
                file = /var/log/cfn-hup.log
                log_stream_name = {instance_id}/var/log/cfn-hup.log
                log_group_name = ${LogGroup}
                [/var/log/cfn-init-cmd.log]
                datetime_format = %Y-%m-%d %H:%M:%S
                file = /var/log/cfn-init-cmd.log
                log_stream_name = {instance_id}/var/log/cfn-init-cmd.log
                log_group_name = ${LogGroup}
                [/var/log/cloud-init-output.log]
                file = /var/log/cloud-init-output.log
                log_stream_name = {instance_id}/var/log/cloud-init-output.log
                log_group_name = ${LogGroup}
                [/var/log/dmesg]
                file = /var/log/dmesg
                log_stream_name = {instance_id}/var/log/dmesg
                log_group_name = ${LogGroup}
              mode: '000644'
              owner: root
              group: root
          services:
            sysvinit:
              awslogs:
                enabled: true
                ensureRunning: true
                packages:
                  yum:
                  - awslogs
                files:
                - '/etc/awslogs/awslogs.conf'
                - '/etc/awslogs/awscli.conf'
        ssh-access:
          packages:
            rpm:
              aws-ec2-ssh: 'https://s3-eu-west-1.amazonaws.com/widdix-aws-ec2-ssh-releases-eu-west-1/aws-ec2-ssh-1.9.2-1.el7.centos.noarch.rpm'
          commands:
            a_enable:
              command: "sed -i 's/DONOTSYNC=1/DONOTSYNC=0/g' /etc/aws-ec2-ssh.conf && /usr/bin/import_users.sh"
              test: "grep -q 'DONOTSYNC=1' /etc/aws-ec2-ssh.conf"
        config:
          packages:
            yum:
              mysql56: []
          files:
            '/etc/cfn/cfn-hup.conf':
              content: !Sub |
                [main]
                stack=${AWS::StackId}
                region=${AWS::Region}
                interval=1
              mode: '000400'
              owner: root
              group: root
            '/etc/cfn/hooks.d/cfn-auto-reloader.conf':
              content: !Sub |
                [cfn-auto-reloader-hook]
                triggers=post.update
                path=Resources.LaunchConfiguration.Metadata.AWS::CloudFormation::Init
                action=/opt/aws/bin/cfn-init --verbose --stack=${AWS::StackName} --region=${AWS::Region} --resource=LaunchConfiguration
                runas=root
          services:
            sysvinit:
              cfn-hup:
                enabled: true
                ensureRunning: true
                files:
                - '/etc/cfn/cfn-hup.conf'
                - '/etc/cfn/hooks.d/cfn-auto-reloader.conf'
    Properties:
      AssociatePublicIpAddress: true
      EbsOptimized: false
      IamInstanceProfile: !Ref InstanceProfile
      ImageId: !FindInMap [RegionMap, !Ref 'AWS::Region', ImageId]
      InstanceType: !Ref InstanceType
      SecurityGroups:
      - !Ref SecurityGroup
      KeyName: !If [HasKeyName, !Ref KeyName, !Ref 'AWS::NoValue']
      UserData:
        'Fn::Base64': !Sub |
          #!/bin/bash -ex
          trap '/opt/aws/bin/cfn-signal -e 1 --stack ${AWS::StackName} --resource AutoScalingGroup --region ${AWS::Region}' ERR
          INSTANCEID=$(curl -s -m 6 --retry 3 --retry-delay 1 "http://169.254.169.254/latest/meta-data/instance-id")
          aws --region ${AWS::Region} ec2 associate-address --instance-id $INSTANCEID --allocation-id ${ElasticIP.AllocationId}
          /opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource LaunchConfiguration --region ${AWS::Region}
          /opt/aws/bin/cfn-signal -e 0 --stack ${AWS::StackName} --resource AutoScalingGroup --region ${AWS::Region}
  AutoScalingGroup:
    Type: 'AWS::AutoScaling::AutoScalingGroup'
    Properties:
      LaunchConfigurationName: !Ref LaunchConfiguration
      MaxSize: '1'
      MinSize: '1'
      Tags:
      - Key: Name
        Value: !Sub
        - 'SSH bastion ${CidrBlock}'
        - CidrBlock:
            'Fn::ImportValue': !Sub '${VpcModule}-CidrBlock'
        PropagateAtLaunch: true
      NotificationConfigurations: !If
      - HasAlertingModule
      - - NotificationTypes:
          - 'autoscaling:EC2_INSTANCE_LAUNCH_ERROR'
          - 'autoscaling:EC2_INSTANCE_TERMINATE_ERROR'
          TopicARN:
            'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      - []
      VPCZoneIdentifier: !Split
      - ','
      - 'Fn::ImportValue':
          !Sub '${VpcModule}-SubnetIdsPublic'
    CreationPolicy:
      ResourceSignal:
        Count: 1
        Timeout: PT10M
    UpdatePolicy:
      AutoScalingRollingUpdate:
        PauseTime: PT10M
        SuspendProcesses:
        - HealthCheck
        - ReplaceUnhealthy
        - AZRebalance
        - AlarmNotification
        - ScheduledActions
        WaitOnResourceSignals: true
  AlarmCPUTooHigh:
    Condition: HasAlertingModule
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: 'Average CPU utilization over last 10 minutes higher than 80%'
      Namespace: 'AWS/EC2'
      MetricName: CPUUtilization
      Statistic: Average
      Period: 600
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: 80
      AlarmActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      Dimensions:
      - Name: AutoScalingGroupName
        Value: !Ref AutoScalingGroup
Outputs:
  ModuleId:
    Value: 'ssh-bastion'
  ModuleVersion:
    Value: '1.4.4'
  StackName:
    Value: !Ref 'AWS::StackName'
  SecurityGroupId:
    Value: !Ref SecurityGroup
    Export:
      Name: !Sub '${AWS::StackName}-SecurityGroupId'
  PublicIpAddress:
    Value: !Ref ElasticIP
    Export:
      Name: !Sub '${AWS::StackName}-PublicIpAddress'