vpc-fullstack/security-groups-02.yaml at master · faustroxas/vpc-fullstack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
# Security Groups Patterns
# blank state
# bastion, private
# bastion, public, private, database,
# bastion, public, private, database, cache

AWSTemplateFormatVersion: 2010-09-09

Description: Creates Security Groups in the selected AWS VPC.

Metadata:
  Authors:
    Description: Paul Bartocillo (pebartocillo@apper.ph) - Apper Digital Inc.
  License:
    Description:
      "Copyright 2020 Amazon.com, Inc. and its affiliates. All Rights Reserved.
      SPDX-License-Identifier: MIT-0"
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Amazon VPC - Security Groups Parameters
        Parameters:
          - EnvironmentName
          - Vpc
          - SecurityGroupsPatterns
          - SshAccessCidr
    ParameterLabels:
      EnvironmentName:
        default: Environment Name
      Vpc:
        default: AWS Vpc
      SecurityGroupsPatterns:
        default: Security Groups Design Patterns
      SshAccessCidr:
        default: SSH Access CIDR Blocks
Parameters:
  EnvironmentName:
    Description: The name of environment for the current stack (e.g. dev, test, staging, beta, production).
    Type: String
  Vpc:
    Description: Select available AWS VPC network.
    Type: AWS::EC2::VPC::Id
  SecurityGroupsPatterns:
    Description: The design pattern of the current security group architecture. You can select "empty rules" if you want to input inbound rules manually.
    Type: String
    AllowedValues:
      - "empty rules"
      - "bastion | public"
      - "bastion | private"
      - "bastion | public | private | database"
      - "bastion | public | private | database | cache"
    Default: "empty rules"
  SshAccessCidr:
    Description: (Optional) The CIDR IP range that is permitted to SSH to bastion instance. Note - a value of 0.0.0.0/0 will allow access from ANY IP address.
    Type: String

Conditions:
  # parameter conditionals
  EmptySG: !Equals [!Ref SecurityGroupsPatterns, "empty rules"]
  BastionPublicSG: !Equals [!Ref SecurityGroupsPatterns, "bastion | public"]
  BastionPublicPrivateSG: !Equals [!Ref SecurityGroupsPatterns, "bastion | public | private"]
  BastionPublicPrivateDatabaseSG: !Equals [!Ref SecurityGroupsPatterns, "bastion | public | private | database"]
  BastionPublicPrivateDatabaseCacheSG: !Equals [!Ref SecurityGroupsPatterns, "bastion | public | private | database | cache"]
  # template conditionals
  BastionPublicSG: !Or
    - !Condition BastionPublicSG
    - !Condition BastionPublicPrivateSG
    - !Condition BastionPublicPrivateDatabaseSG
    - !Condition BastionPublicPrivateDatabaseCacheSG

Resources:
  EmptySecurityGroup:
    Condition: EmptySG
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Empty security group for manual rules
      VpcId: !Ref Vpc
      GroupName: !Sub "${EnvironmentName}-default-${AWS::StackName}"
      Tags:
        - Key: Name
          Value: !Sub "${EnvironmentName}-default-${AWS::StackName}"
        - Key: Environment
          Value: !Ref EnvironmentName
        - Key: Type
          Value: "Managed by AWS Cloudformation"