vpc-appliance.yml

AWSTemplateFormatVersion: 2010-09-09
Description: >
  VPC with private subnet service access for the AWS Panorama Appliance.
  This template is part of the AWS Panorama guide repository at
  https://github.com/awsdocs/aws-panorama-developer-guide
Resources:
  vpc:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 172.31.0.0/16
      EnableDnsHostnames: true
      EnableDnsSupport: true
      Tags:
        - Key: Name
          Value: !Ref AWS::StackName
  privateSubnetA:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref vpc
      AvailabilityZone:
        Fn::Select:
         - 0
         - Fn::GetAZs: ""
      CidrBlock: 172.31.3.0/24
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub  ${AWS::StackName}-subnet-a
  privateSubnetB:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref vpc
      AvailabilityZone:
        Fn::Select:
         - 1
         - Fn::GetAZs: ""
      CidrBlock: 172.31.2.0/24
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub  ${AWS::StackName}-subnet-b
  privateRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref vpc
  privateSubnetARouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref privateSubnetA
      RouteTableId: !Ref privateRouteTable
  privateSubnetBRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref privateSubnetB
      RouteTableId: !Ref privateRouteTable
  logsEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      ServiceName: !Sub com.amazonaws.${AWS::Region}.logs
      VpcId: !Ref vpc
      VpcEndpointType: Interface
      SecurityGroupIds:
      - !GetAtt vpc.DefaultSecurityGroup
      PrivateDnsEnabled: true
      SubnetIds:
      - !Ref privateSubnetA
      - !Ref privateSubnetB
      PolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal: "*"
          Action:
            - "logs:*"
          Resource:
            - "*"
  monitoringEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      ServiceName: !Sub com.amazonaws.${AWS::Region}.monitoring
      VpcId: !Ref vpc
      VpcEndpointType: Interface
      SecurityGroupIds:
      - !GetAtt vpc.DefaultSecurityGroup
      PrivateDnsEnabled: true
      SubnetIds:
      - !Ref privateSubnetA
      - !Ref privateSubnetB
      PolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal: "*"
          Action:
            - "monitoring:*"
          Resource:
            - "*"
  s3Endpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      ServiceName: !Sub com.amazonaws.${AWS::Region}.s3
      VpcId: !Ref vpc
      VpcEndpointType: Interface
      SecurityGroupIds:
      - !GetAtt vpc.DefaultSecurityGroup
      PrivateDnsEnabled: false
      SubnetIds:
      - !Ref privateSubnetA
      - !Ref privateSubnetB
      PolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal: "*"
          Action:
            - "s3:*"
          Resource:
            - "*"
  s3HostedZone:
    Type: AWS::Route53::HostedZone
    Properties:
      Name: !Sub s3.${AWS::Region}.amazonaws.com
      VPCs: 
        - VPCId: !Ref vpc
          VPCRegion: !Ref AWS::Region
  s3Records:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneId: !Ref s3HostedZone
      Name: !Sub "*.s3.${AWS::Region}.amazonaws.com"
      Type: CNAME
      TTL: 600
      # first DNS entry, split on :, second value of e.g. ["Z1HUB23UULQXV:vpce-01abc23456de78f9g-12abccd3.ec2.us-east-1.vpce.amazonaws.com", "Z...
      ResourceRecords:
      - !Select [1, !Split [":", !Select [0, !GetAtt s3Endpoint.DnsEntries ] ] ]
  s3apHostedZone:
    Type: AWS::Route53::HostedZone
    Properties:
      Name: !Sub s3-accesspoint.${AWS::Region}.amazonaws.com
      VPCs: 
        - VPCId: !Ref vpc
          VPCRegion: !Ref AWS::Region
  s3apRecords:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneId: !Ref s3apHostedZone
      Name: !Sub "*.s3-accesspoint.${AWS::Region}.amazonaws.com"
      Type: CNAME
      TTL: 600
      # first DNS entry, split on :, second value
      ResourceRecords: 
      - !Select [1, !Split [":", !Select [0, !GetAtt s3Endpoint.DnsEntries ] ] ]
  iotHostedZone:
    Type: AWS::Route53::HostedZone
    Properties:
      Name: !Sub iot.${AWS::Region}.amazonaws.com
      VPCs:
        - VPCId: !Ref vpc
          VPCRegion: !Ref AWS::Region
  iotDataEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      ServiceName: !Sub com.amazonaws.${AWS::Region}.iot.data
      VpcId: !Ref vpc
      VpcEndpointType: Interface
      SecurityGroupIds:
      - !GetAtt vpc.DefaultSecurityGroup
      PrivateDnsEnabled: false
      SubnetIds:
      - !Ref privateSubnetA
      - !Ref privateSubnetB
  iotDataRecords:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneId: !Ref iotHostedZone
      Name: !Sub "*.iot.${AWS::Region}.amazonaws.com"
      Type: A
      AliasTarget:
        # first DNS entry, split on :, second value
        DNSName: !Select [1, !Split [":", !Select [0, !GetAtt iotDataEndpoint.DnsEntries ] ] ]
        # hosted zone of the endpoint, not in this account
        HostedZoneId: !Select [0, !Split [":", !Select [0, !GetAtt iotDataEndpoint.DnsEntries ] ] ]
        EvaluateTargetHealth: true
  iotCredentialsEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      ServiceName: !Sub com.amazonaws.${AWS::Region}.iot.credentials
      VpcId: !Ref vpc
      VpcEndpointType: Interface
      SecurityGroupIds:
      - !GetAtt vpc.DefaultSecurityGroup
      PrivateDnsEnabled: false
      SubnetIds:
      - !Ref privateSubnetA
      - !Ref privateSubnetB
  iotCredentialsRecords:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneId: !Ref iotHostedZone
      Name: !Sub "*.credentials.iot.${AWS::Region}.amazonaws.com"
      Type: A
      AliasTarget:
        # first DNS entry, split on :, second value
        DNSName: !Select [1, !Split [":", !Select [0, !GetAtt iotCredentialsEndpoint.DnsEntries ] ] ]
        # hosted zone of the endpoint, not in this account
        HostedZoneId: !Select [0, !Split [":", !Select [0, !GetAtt iotCredentialsEndpoint.DnsEntries ] ] ]
        EvaluateTargetHealth: true
  ecrServiceEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      ServiceName: !Sub com.amazonaws.${AWS::Region}.ecr.api
      VpcId: !Ref vpc
      VpcEndpointType: Interface
      SecurityGroupIds:
      - !GetAtt vpc.DefaultSecurityGroup
      PrivateDnsEnabled: true
      SubnetIds:
      - !Ref privateSubnetA
      - !Ref privateSubnetB
  ecrDockerEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      ServiceName: !Sub com.amazonaws.${AWS::Region}.ecr.dkr
      VpcId: !Ref vpc
      VpcEndpointType: Interface
      SecurityGroupIds:
      - !GetAtt vpc.DefaultSecurityGroup
      PrivateDnsEnabled: true
      SubnetIds:
      - !Ref privateSubnetA
      - !Ref privateSubnetB
  publicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref vpc
      AvailabilityZone:
        Fn::Select:
         - 0
         - Fn::GetAZs: ""
      CidrBlock: 172.31.0.0/24
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub  ${AWS::StackName}-public-subnet
  internetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: !Sub  ${AWS::StackName}-gateway
  gatewayToInternet:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref vpc
      InternetGatewayId: !Ref internetGateway
  publicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref vpc
  publicRoute:
    Type: AWS::EC2::Route
    DependsOn: gatewayToInternet
    Properties:
      RouteTableId: !Ref publicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref internetGateway
  publicSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref publicSubnet1
      RouteTableId: !Ref publicRouteTable
Outputs:
  vpcID:
    Description: VPC ID
    Value: !Ref vpc
    Export:
      Name: !Sub  ${AWS::StackName}-vpc
  vpcSecurityGroup:
    Description: Default security group for VPC
    Value: !GetAtt vpc.DefaultSecurityGroup
    Export:
      Name: !Sub  ${AWS::StackName}-vpc-sg
  privateSubnetAID:
    Description: Private Subnet A ID
    Value: !Ref privateSubnetA
    Export:
      Name: !Sub  ${AWS::StackName}-subnet-a
  privateSubnetBID:
    Description: Private Subnet B ID
    Value: !Ref privateSubnetB
    Export:
      Name: !Sub  ${AWS::StackName}-subnet-b
  publicSubnet1ID:
    Description: Public Subnet A ID
    Value: !Ref publicSubnet1
    Export:
      Name: !Sub  ${AWS::StackName}-subnet-public