template.yml

---
AWSTemplateFormatVersion: "2010-09-09"

Description: Creates a VPC with 1 public subnet allowing ssh

Mappings:
  SubnetConfig:
    VPC:
      CIDR: 10.0.0.0/16
    Public:
      CIDR: 10.0.0.0/24

Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      EnableDnsSupport: "true"
      EnableDnsHostnames: "true"
      CidrBlock:
        Fn::FindInMap:
          - SubnetConfig
          - VPC
          - CIDR

  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId:
        Ref: VPC
      AvailabilityZone:
        Fn::Select:
          - "0"
          - Fn::GetAZs: us-east-1
      MapPublicIpOnLaunch: "true"
      CidrBlock:
        Fn::FindInMap:
          - SubnetConfig
          - Public
          - CIDR

  InternetGateway:
    Type: AWS::EC2::InternetGateway

  GatewayToInternet:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId:
        Ref: VPC
      InternetGatewayId:
        Ref: InternetGateway

  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId:
        Ref: VPC

  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: GatewayToInternet
    Properties:
      RouteTableId:
        Ref: PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId:
        Ref: InternetGateway

  PublicSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId:
        Ref: PublicSubnet
      RouteTableId:
        Ref: PublicRouteTable

  PublicNetworkAcl:
    Type: AWS::EC2::NetworkAcl
    Properties:
      VpcId:
        Ref: VPC

  InboundHTTPPublicNetworkAclEntry:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId:
        Ref: PublicNetworkAcl
      RuleNumber: "100"
      Protocol: "6"
      RuleAction: allow
      Egress: "false"
      CidrBlock: 0.0.0.0/0
      PortRange:
        From: "80"
        To: "80"

  InboundHTTPSPublicNetworkAclEntry:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId:
        Ref: PublicNetworkAcl
      RuleNumber: "101"
      Protocol: "6"
      RuleAction: allow
      Egress: "false"
      CidrBlock: 0.0.0.0/0
      PortRange:
        From: "443"
        To: "443"

  InboundSSHPublicNetworkAclEntry:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId:
        Ref: PublicNetworkAcl
      RuleNumber: "102"
      Protocol: "6"
      RuleAction: allow
      Egress: "false"
      CidrBlock: 0.0.0.0/0
      PortRange:
        From: "22"
        To: "22"

  InboundEmphemeralPublicNetworkAclEntry:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId:
        Ref: PublicNetworkAcl
      RuleNumber: "103"
      Protocol: "6"
      RuleAction: allow
      Egress: "false"
      CidrBlock: 0.0.0.0/0
      PortRange:
        From: "1024"
        To: "65535"

  OutboundPublicNetworkAclEntry:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId:
        Ref: PublicNetworkAcl
      RuleNumber: "100"
      Protocol: "6"
      RuleAction: allow
      Egress: "true"
      CidrBlock: 0.0.0.0/0
      PortRange:
        From: "0"
        To: "65535"

  PublicSubnetNetworkAclAssociation:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    Properties:
      SubnetId:
        Ref: PublicSubnet
      NetworkAclId:
        Ref: PublicNetworkAcl

  InstanceRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - "sts:AssumeRole"
      Path: /
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: ["*"]
                Resource: "*"

  InstanceProfile:
    Type: "AWS::IAM::InstanceProfile"
    Properties:
      Path: /
      Roles:
        - !Ref InstanceRole

  EC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: t3.micro
      ImageId: "ami-0b0dcb5067f052a63"
      IamInstanceProfile: !Ref InstanceProfile
      UserData:
        Fn::Base64:
          Fn::Join:
            - "\n"
            - - "#!/bin/bash"
              - sudo yum update -y
              - sudo yum install -y git-core zlib zlib-devel gcc-c++ patch readline readline-devel libyaml-devel libffi-devel openssl-devel make bzip2 autoconf automake libtool bison curl sqlite-devel
              - git clone https://github.com/rbenv/rbenv.git /.rbenv
              - export PATH="/.rbenv/bin:$PATH"
              - git clone https://github.com/rbenv/ruby-build.git /.rbenv/plugins/ruby-build
              - export PATH="/.rbenv/plugins/ruby-build/bin:$PATH"
              - echo 'eval "$(rbenv init -)"' >> /.rbenvinit
              - source /.rbenvinit
              - rbenv install 2.7.0
              - rbenv global 2.7.0
              - sudo curl --silent --location https://rpm.nodesource.com/setup_16.x | sudo bash -
              - sudo yum -y install nodejs
              - sudo npm i -g yarn
              - git clone https://github.com/ACloudGuru/ccs-ruby-lambda-event.git
              - cd ccs-ruby-lambda-event
              - yarn install
              - APP_ENV=dev yarn cdk bootstrap
              - APP_ENV=dev yarn cdk deploy --require-approval=never
              - gem install bundler:2.3.12
              - yarn sls deploy -s dev
              - echo 'setup done.' > ~/status
      NetworkInterfaces:
        - GroupSet:
            - Ref: EC2SecurityGroup
          AssociatePublicIpAddress: true
          DeviceIndex: "0"
          DeleteOnTermination: "true"
          SubnetId: !Ref PublicSubnet
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            VolumeType: gp2
            VolumeSize: "30"
            DeleteOnTermination: "true"
            Encrypted: "true"

  EC2SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: EC2SecurityGroupPublic
      VpcId:
        Ref: VPC
      SecurityGroupIngress:
        - CidrIp: 0.0.0.0/0
          FromPort: 22
          IpProtocol: tcp
          ToPort: 22