dstack-examples/custom-domain/dstack-ingress/CLOUDFORMATION_EXAMPLE.yaml at main · wwwehr/dstack-examples · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
AWSTemplateFormatVersion: '2010-09-09'

Parameters:
  HostedZoneId:
    Type: String
    Default:
    Description: Route53 Hosted Zone ID
  UserName:
    Type: String
    Description: IAM user that can only assume the Route53 role

Resources:
  User:
    Type: AWS::IAM::User
    Properties:
      UserName: !Ref UserName

  AccessKey:
    Type: AWS::IAM::AccessKey
    Properties:
      UserName: !Ref User
      Status: Active

  Route53Role:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub '${UserName}-route53-role'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            # The *account root* as trusted principal.
            # This avoids invalid-principal errors while remaining safe,
            # because the USER policy enforces the actual restriction.
            Principal:
              AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
            Action: sts:AssumeRole
      Policies:
        - PolicyName: Route53DnsChallenges
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: AllowDnsChallengeChanges
                Effect: Allow
                Action:
                  - route53:ChangeResourceRecordSets
                Resource: !Sub arn:aws:route53:::hostedzone/${HostedZoneId}
              - Sid: AllowListingForDnsChallenge
                Effect: Allow
                Action:
                  - route53:ListHostedZonesByName
                  - route53:ListHostedZones
                  - route53:GetChange
                  - route53:ListResourceRecordSets
                Resource: "*"

  UserAssumeRolePolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub '${UserName}-assume-route53-role'
      Users:
        - !Ref User
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - sts:AssumeRole
            Resource: !Sub arn:aws:iam::${AWS::AccountId}:role/${UserName}-route53-role

Outputs:
  AWSAccessKeyId:
    Description: Access key ID for the IAM user
    Value: !Ref AccessKey

  AWSSecretAccessKey:
    Description: Secret access key for the IAM user
    Value: !GetAtt AccessKey.SecretAccessKey

  AWSUserArn:
    Description: IAM User ARN
    Value: !Sub arn:aws:iam::${AWS::AccountId}:user/${UserName}

  Route53RoleArn:
    Description: ARN of the Route53 role used by Certbot
    Value: !Sub arn:aws:iam::${AWS::AccountId}:role/${UserName}-route53-role