Merge pull request #5 from SanketD92/fix-version-template-update

fix: package version and template update

Author: manikandan-thangavelu-rl

RStudio/cfn-templates/ec2-rlstudio.yaml

@@ -5,63 +5,87 @@ Metadata:
   PartnerName: Relevance Lab
   PartnerURL: https://relevancelab.com
   KnowMore: https://github.com/RLOpenCatalyst/Service_Workbench_Templates/tree/main/RStudio
-  
+
 Parameters:
   Namespace:
     Type: String
     Description: An environment name that will be prefixed to resource names
-
+  SolutionNamespace:
+    Type: String
+    Description: The namespace value provided when onboarding the Member account
   AmiId:
     Type: String
     Description: Amazon Machine Image for the EC2 instance
-
+  IsAppStreamEnabled:
+    Type: String
+    AllowedValues: [true, false]
+    Description: Is AppStream enabled for this workspace
   InstanceType:
     Type: String
     Description: EC2 instance type to launch
-
   KeyName:
     Type: String
     Description: Keypair name for SSH access
-
   AccessFromCIDRBlock:
     Type: String
     Description: The CIDR used to access the ec2 instances.
     Default: 0.0.0.0/0
-
   S3Mounts:
     Type: String
     Description: A JSON array of objects with name, bucket, and prefix properties used to mount data
-
   IamPolicyDocument:
     Type: String
     Description: The IAM policy to be associated with the launched workstation
-
   VPC:
     Description: The VPC in which the EC2 instance will reside
     Type: AWS::EC2::VPC::Id
-
-  Subnet1:
+  Subnet:
     Description: The VPC subnet in which the EC2 instance will reside
     Type: AWS::EC2::Subnet::Id
-
   EnvironmentInstanceFiles:
     Type: String
     Description: >-
       An S3 URI (starting with "s3://") that specifies the location of files to be copied to
       the environment instance, including any bootstrap scripts
-
   EncryptionKeyArn:
     Type: String
     Description: The ARN of the KMS encryption Key used to encrypt data in the instance
-
   ACMSSLCertARN:
     Type: String
     Description: The ARN of the AWS Certificate Manager SSL Certificate to associate with the Load Balancer
+  EgressStoreIamPolicyDocument:
+    Type: String
+    Description: The IAM policy for launched workstation to access egress store
 
 Conditions:
   IamPolicyEmpty: !Equals [!Ref IamPolicyDocument, "{}"]
+  EgressStoreIamPolicyEmpty: !Equals [!Ref EgressStoreIamPolicyDocument, "{}"]
+  AppStreamEnabled: !Equals [!Ref IsAppStreamEnabled, "true"]
+  AppStreamDisabled: !Equals [!Ref IsAppStreamEnabled, "false"]
 
 Resources:
+  InstanceRolePermissionBoundary:
+    Type: AWS::IAM::ManagedPolicy
+    Properties:
+      Description: Permission boundary for EC2 instance role
+      ManagedPolicyName:
+        !Join ["-", [Ref: Namespace, "ec2-rstudio-permission-boundary"]]
+      PolicyDocument:
+        Version: "2012-10-17"
+        Statement:
+          - Effect: Allow
+            Action:
+              - "s3:*"
+              - "ssm:*"
+            Resource: "*"
+          - Effect: Allow
+            Action:
+              - "kms:*"
+            Resource: "*"
+          - Effect: Allow
+            Action:
+              - "sts:AssumeRole"
+            Resource: "arn:aws:iam::*:role/swb-*"
   IAMRole:
     Type: "AWS::IAM::Role"
     Properties:
@@ -83,6 +107,11 @@ Resources:
           - !Ref "AWS::NoValue"
           - PolicyName: !Join ["-", [Ref: Namespace, "s3-studydata-policy"]]
             PolicyDocument: !Ref IamPolicyDocument
+        - !If
+          - EgressStoreIamPolicyEmpty
+          - !Ref "AWS::NoValue"
+          - PolicyName: !Join ["-", [Ref: Namespace, "s3-egressstore-policy"]]
+            PolicyDocument: !Ref EgressStoreIamPolicyDocument
         - PolicyName:
             !Join ["-", [Ref: Namespace, "s3-bootstrap-script-policy"]]
           PolicyDocument:
@@ -124,6 +153,7 @@ Resources:
                   - "ssm:GetParameter"
                   - "ssm:PutParameter"
                 Resource: !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/*"
+      PermissionsBoundary: !Ref InstanceRolePermissionBoundary
 
   InstanceProfile:
     Type: "AWS::IAM::InstanceProfile"
@@ -137,27 +167,33 @@ Resources:
     Type: "AWS::EC2::SecurityGroup"
     Properties:
       GroupDescription: EC2 workspace security group
-
       SecurityGroupEgress:
         - IpProtocol: tcp
           FromPort: 0
           ToPort: 65535
           CidrIp: 0.0.0.0/0
-        - IpProtocol: icmp
-          FromPort: -1
-          ToPort: -1
-          CidrIp: !Ref AccessFromCIDRBlock
-
+        - !If
+          - AppStreamEnabled
+          - !Ref "AWS::NoValue"
+          - IpProtocol: icmp
+            FromPort: -1
+            ToPort: -1
+            CidrIp: !Ref AccessFromCIDRBlock
       SecurityGroupIngress:
-        - IpProtocol: tcp
-          FromPort: 22
-          ToPort: 22
-          CidrIp: !Ref AccessFromCIDRBlock
-        - IpProtocol: tcp
-          FromPort: 80
-          ToPort: 80
-          CidrIp: !Ref AccessFromCIDRBlock
-
+        - !If
+          - AppStreamEnabled
+          - !Ref "AWS::NoValue"
+          - IpProtocol: tcp
+            FromPort: 22
+            ToPort: 22
+            CidrIp: !Ref AccessFromCIDRBlock
+        - !If
+          - AppStreamEnabled
+          - !Ref "AWS::NoValue"
+          - IpProtocol: tcp
+            FromPort: 80
+            ToPort: 80
+            CidrIp: !Ref AccessFromCIDRBlock
       Tags:
         - Key: Name
           Value: !Join ["-", [Ref: Namespace, "ec2-sg"]]
@@ -181,11 +217,15 @@ Resources:
             KmsKeyId: !Ref EncryptionKeyArn
 
       NetworkInterfaces:
-        - AssociatePublicIpAddress: "true"
+        - AssociatePublicIpAddress: !If [AppStreamEnabled, "false", "true"]
           DeviceIndex: "0"
           GroupSet:
             - !Ref SecurityGroup
-          SubnetId: !Ref Subnet1
+            - !If
+              - AppStreamEnabled
+              - Fn::ImportValue: !Sub "${SolutionNamespace}-WorkspaceSG"
+              - !Ref "AWS::NoValue"
+          SubnetId: !Ref Subnet
 
       Tags:
         - Key: Name
@@ -195,22 +235,14 @@ Resources:
 
       UserData:
         Fn::Base64: !Sub |
-
           #!/usr/bin/env bash
-
           # Download and execute bootstrap script
-
           aws s3 cp "${EnvironmentInstanceFiles}/get_bootstrap.sh" "/tmp"
-
           chmod 500 "/tmp/get_bootstrap.sh"
-
           /tmp/get_bootstrap.sh "${EnvironmentInstanceFiles}" '${S3Mounts}'
 
-
-
           # Signal result to CloudFormation
-
-  #         /opt/aws/bin/cfn-signal -e $? --stack "${AWS::StackName}" --resource "EC2Instance" --region "${AWS::Region}"
+          /opt/aws/bin/cfn-signal -e $? --stack "${AWS::StackName}" --resource "EC2Instance" --region "${AWS::Region}"
 
   EC2TargetGroup:
     Type: AWS::ElasticLoadBalancingV2::TargetGroup
@@ -239,8 +271,13 @@ Outputs:
 
   Ec2WorkspacePublicIp:
     Description: Public IP address of the EC2 workspace instance
+    Condition: AppStreamDisabled
     Value: !GetAtt [EC2Instance, PublicIp]
 
+  Ec2WorkspacePrivateIp:
+    Description: Private IP address of the EC2 workspace instance
+    Value: !GetAtt [EC2Instance, PrivateIp]
+
   Ec2WorkspaceInstanceId:
     Description: Instance Id for the EC2 workspace instance
     Value: !Ref EC2Instance
@@ -321,7 +358,7 @@ Outputs:
   MetaConnection1InstanceId:
     Description: EC2 Linux Instance Id
     Value: !Ref EC2Instance
-  
+
   InstanceSecurityGroupId:
     Description: EC2 Instance Security Group Id
     Value: !Ref SecurityGroup
@@ -332,4 +369,4 @@ Outputs:
 
   MaxCountALBDependentWorkspaces:
     Description: Maximum number of ALB dependent Workspaces
-    Value: 100
+    Value: 100

RStudio/machine-images/config/infra/files/rstudio/nginx.conf

@@ -84,10 +84,6 @@ http {
       proxy_set_body $query_string;
     }
 
-    location /auth-sign-in {
-      return 403;
-    }
-
   }
 
 }

RStudio/machine-images/config/infra/provisioners/provision-rstudio.sh

@@ -4,7 +4,7 @@
 sudo yum install -y gcc-7.3.* gcc-gfortran-7.3.* gcc-c++-7.3.*
 sudo yum install -y java-1.8.0-openjdk-devel-1.8.0.*
 sudo yum install -y readline-devel-6.2 zlib-devel-1.2.* bzip2-devel-1.0.* xz-devel-5.2.* pcre-devel-8.32
-sudo yum install -y libcurl-devel-7.61.* libpng-devel-1.5.* cairo-devel-1.15.* pango-devel-1.42.*
+sudo yum install -y libcurl-devel-7.76.1 libpng-devel-1.5.* cairo-devel-1.15.* pango-devel-1.42.*
 sudo yum install -y xorg-x11-server-devel-1.20.* libX11-devel-1.6.* libXt-devel-1.1.*
 
 # Install R from source (https://docs.rstudio.com/resources/install-r-source/)