CF-A1-cmu.yml

AWSTemplateFormatVersion: 2010-09-09

Parameters:

  #ssh to the EC2 instance
  SSHLocation:
    Description: The IP address range that can be used to SSH to the EC2 instances
    Type: String
    MinLength: '9'
    MaxLength: '18'
    Default: 0.0.0.0/0
    AllowedPattern: '(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})'
    ConstraintDescription: Must be a valid IP CIDR range of the form x.x.x.x/x
  # Database credentials
  DBUsername:
    Description: Username for database access
    Type: String
    MinLength: '1'
    MaxLength: '16'
    AllowedPattern: '[a-zA-Z][a-zA-Z0-9]*'
    ConstraintDescription: Must begin with a letter and contain only alphanumeric characters.
  DBPassword:
    NoEcho: 'true'
    Description: Password for database access
    Type: String
    MinLength: '8'
    MaxLength: '41'
    AllowedPattern: '[a-zA-Z0-9]*'
  #launch template data
  LatestAmiId:
    Description: Region specific image from the Parameter Store
    Type: 'AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>'
    Default: '/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2'
  InstanceType:
    Description: Amazon EC2 instance type for the instances
    Type: String
    AllowedValues:
      - t3.micro
      - t3.small
      - t3.medium
    Default: t3.micro

Resources:

  # VPC
  # It's a virtual private network where within you launch resources you'll manage.
  # There are 1+ subnets defined in a VPC. Each subnet is a range of IP addresses and is limited to a single AZ.
  VpcBookstore:
    Type: 'AWS::EC2::VPC'
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsSupport: 'true'
      EnableDnsHostnames: 'true'

  # Public subnets for EC2 instances
  # Each subnet is in a different availability zone (AZ)
  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: "us-east-1a"
      MapPublicIpOnLaunch: true
      VpcId: !Ref VpcBookstore
      CidrBlock: 10.0.0.0/24
      Tags:
        - Key: Name
          Value: PublicSubnet1

  PublicSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: "us-east-1b"
      MapPublicIpOnLaunch: true
      VpcId: !Ref VpcBookstore
      CidrBlock: 10.0.20.0/24
      Tags:
        - Key: Name
          Value: PublicSubnet2

  # Internet gateway
  # It enables the communication between the VPC and the public Internet. It provides routing and NAT services.
  InternetGateway:
    Type: "AWS::EC2::InternetGateway"
    DependsOn: VpcBookstore
  VPCGatewayAttachment:
    Type: "AWS::EC2::VPCGatewayAttachment"
    Properties:
      VpcId: !Ref VpcBookstore
      InternetGatewayId: !Ref "InternetGateway"

  # Route tables
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VpcBookstore
      Tags:
        - Key: Name
          Value: Public
  # The public route table routes directly to the Internet Gateway
  PublicRoute1: 
    Type: AWS::EC2::Route
    DependsOn: VPCGatewayAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  # Route table associated with subnets. Attaches the public subnets to the public route table.
  PublicSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet1
      RouteTableId: !Ref PublicRouteTable
  PublicSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet2
      RouteTableId: !Ref PublicRouteTable

  # EC2 Security Group
  # A security group defines what inbound and outbound traffic is allowed. 
  # Allowed traffic is specified in terms of protocols, ports and IP ranges.
  EC2SecurityGroup:
    DependsOn: VpcBookstore
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupName: EC2SecurityGroup
      GroupDescription: Security group for EC2 instances allowing http and ssh
      VpcId: !Ref VpcBookstore
      SecurityGroupEgress:
        - Description: Allow all outbound traffic
          IpProtocol: "-1"  # ALL
          CidrIp: 0.0.0.0/0
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          SourceSecurityGroupId:
            Fn::GetAtt:
              - ALBSecurityGroup
              - GroupId
        - IpProtocol: tcp  # ssh configured to your IP
          FromPort: 22
          ToPort: 22
          CidrIp: !Ref SSHLocation

  # EC2 Instances
  # An EC2 instance launched in a VPC has a private IPv4 address and may have a public IP address (Elastic IP).
  # Upon initialization the EC2 instance installs and runs docker. On your own template, you may add the 
  # instructions to pull and run your service docker images. 
  EC2BookstoreA:
    Type: 'AWS::EC2::Instance'
    Properties:
      ImageId: ami-0d5eff06f840b45e9
      InstanceType: t2.micro
      KeyName: vockey
      UserData:
        Fn::Base64:
          !Sub |
          #!/bin/bash
          sudo yum update -y
          sudo amazon-linux-extras install docker
          sudo service docker start
          sudo usermod -a -G docker ec2-user
          sudo chkconfig docker on
      SubnetId: !Ref PublicSubnet1
      SecurityGroupIds:
        - !Ref EC2SecurityGroup
      Tags:
        - Key: Name
          Value: EC2BookstoreA
  ElasticIPA:
    Type: AWS::EC2::EIP
    Properties:
      InstanceId: !Ref EC2BookstoreA

  EC2BookstoreB:
    Type: 'AWS::EC2::Instance'
    Properties:
      ImageId: ami-0d5eff06f840b45e9
      InstanceType: t2.micro
      KeyName: vockey
      UserData:
        Fn::Base64:
          !Sub |
          #!/bin/bash
          sudo yum update -y
          sudo amazon-linux-extras install docker
          sudo service docker start
          sudo usermod -a -G docker ec2-user
          sudo chkconfig docker on
      SubnetId: !Ref PublicSubnet2
      SecurityGroupIds:
        - !Ref EC2SecurityGroup
      Tags:
        - Key: Name
          Value: EC2BookstoreB
  ElasticIPB:
    Type: AWS::EC2::EIP
    Properties:
      InstanceId: !Ref EC2BookstoreB

  # Application Load Balancer (ALB)
  # It's a layer 7 (application layer) load balancer. Ideal for HTTP/HTTPS traffic and microservices architectures.

  # ALB Security Group
  ALBSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: ALBSecurityGroup
      GroupDescription: ALB Security Group allowing 80 from anywhere
      VpcId: !Ref VpcBookstore
      SecurityGroupEgress:
        - Description: Allow all outbound traffic
          IpProtocol: "-1"
          CidrIp: 0.0.0.0/0
      SecurityGroupIngress:
        - IpProtocol: tcp   # HTTP open to world
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp   # HTTPS open to world
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0

  # The ALB itself for Internet facing traffic
  MyALB:
    DependsOn: VPCGatewayAttachment
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Name: MyALB
      Scheme: internet-facing
      Type: application
      Subnets:
        - !Ref PublicSubnet1
        - !Ref PublicSubnet2
      SecurityGroups:
        - !Ref ALBSecurityGroup

  # ALB listener
  # Defines the protocol/port combination that the ALB listens on for incoming requests.
  # It checks for connection requests from clients using the configured protocol and port.
  # Based on the rules you define, it forwards requests to one or more target groups.
  # Each ALB requires at least one listener to accept traffic.
  HTTPListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: !Ref MyALB
      Port: 80
      Protocol: HTTP
      DefaultActions:
        - Order: 1
          TargetGroupArn: !Ref EC2TargetGroup
          Type: forward

  # ALB target group
  # Is used to route requests to one or more registered targets (in this case EC2 instances).
  # It acts as a logical grouping of targets. The ALB continually monitors the health of registered targets.
  # Requests are routed to healthy targets within the target group.
  EC2TargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckProtocol: HTTP
      HealthCheckPath: "/status"
      HealthCheckIntervalSeconds: 30
      HealthCheckTimeoutSeconds: 15
      HealthyThresholdCount: 5
      Matcher:
        HttpCode: '200'
      Name: EC2TargetGroup
      Port: 80
      Protocol: HTTP
      TargetGroupAttributes:
        - Key: deregistration_delay.timeout_seconds
          Value: '30'
      Targets:
        - Id: !Ref EC2BookstoreA
          Port: 80
        - Id: !Ref EC2BookstoreB
          Port: 80
      UnhealthyThresholdCount: 3
      VpcId: !Ref VpcBookstore

  #################################
  # This CF template defines above 2 EC2 instances in two AZs with an ALB. Such setup provides HIGH AVAILABILITY as
  # traffic can be directed to a single instance in case there's a problem with the other instance or AZ.
  # However, this setup does NOT provide HIGH SCALABILITY. The scalable alternative would be to define an
  # Auto Scaling Group (ASG). ASGs dynamically adjust the number of instances based on demand. If traffic increases,
  # it launches more instances; if demand decreases, it terminates instances.
  # ASGs require a launch template (or launch configuration), which describes the configuration for the EC2 instances.
  # The snippet below defines a LaunchTemplate and an ASG. However, the ASG is not a target of the ALB, so it's not
  # used. The ASG has minSize 0 so it won't launch any EC2 instances when the CF stack is created.
  #
  # If you have time, feel free to alter your CF template to use the ASG instead of the two EC2 instances. YOu'll
  # have to add the ASG as a target of the ALB.

  # Launch template
#  MyLaunchTemplate:
#    Type: 'AWS::EC2::LaunchTemplate'
#    Properties:
#      LaunchTemplateName: !Sub '${AWS::StackName}-launch-template-for-auto-scaling'
#      LaunchTemplateData:
#        UserData:
#          Fn::Base64:
#            !Sub |
#            #!/bin/bash
#            yum update -y
#            yum install -y httpd.x86_64
#            systemctl start httpd.service
#            systemctl enable httpd.service
#            echo ?Hello World from $(hostname -f)? > /var/www/html/index.html
#            sudo yum update -y
#            sudo amazon-linux-extras install docker
#            sudo service docker start
#            sudo usermod -a -G docker ec2-user
#            sudo chkconfig docker on
#        NetworkInterfaces:
#          - DeviceIndex: 0
#            AssociatePublicIpAddress: true
#            Groups:
#              - !Ref EC2SecurityGroup
#            DeleteOnTermination: true
#        Placement:
#          Tenancy: default
#        ImageId: !Ref LatestAmiId
#        InstanceType: !Ref InstanceType
#        KeyName: vockey
#
#  # The ASG itself
#  MyASG:
#    Type: AWS::AutoScaling::AutoScalingGroup
#    Properties:
#      LaunchTemplate:
#        LaunchTemplateId: !Ref MyLaunchTemplate
#        Version: !GetAtt MyLaunchTemplate.LatestVersionNumber
#      MaxSize: '2'
#      MinSize: '0'
#      DesiredCapacity: '0'
#      VPCZoneIdentifier:
#        - !Ref PublicSubnet1
#        - !Ref PublicSubnet2

  # End of ASG definition
  #################################

  #
  # Database configuration
  #
  
  # Private subnets for the RDS database instances
  DBSubnet1:
    Type: 'AWS::EC2::Subnet'
    Properties:
      VpcId:
        Ref: VpcBookstore
      CidrBlock: 10.0.3.0/24
      AvailabilityZone: !Select [ 0, !GetAZs "" ]
      Tags:
        - Key: name
          Value: DBSubnet1
  DBSubnet2:
    Type: 'AWS::EC2::Subnet'
    Properties:
      VpcId:
        Ref: VpcBookstore
      CidrBlock: 10.0.5.0/24
      AvailabilityZone: !Select [ 1, !GetAZs "" ]
      Tags:
        - Key: name
          Value: DBSubnet2

  # DB Subnet group
  # It defines the subnets where RDS DB instances will reside. Each subnet should be in a separate AZ.
  MyDBSubnetGroup:
    Type: "AWS::RDS::DBSubnetGroup"
    Properties:
      DBSubnetGroupDescription: multi-AZ subnet group for RDS instances
      SubnetIds:
        - Ref: DBSubnet1
        - Ref: DBSubnet2

  # DB Security group
  # (The DependsOn property just tells AWS that the EC2SecurityGroup needs to be created before this security group.)
  # Port 3306 is the default TCP port used by MySQL databases.
  DBSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    DependsOn: EC2SecurityGroup
    Properties:
      GroupName: DBSecurityGroup
      GroupDescription: Open database for access
      VpcId: !Ref VpcBookstore
      SecurityGroupEgress:
        - Description: Allow all outbound traffic
          IpProtocol: "-1"
          CidrIp: 0.0.0.0/0
      SecurityGroupIngress:
        - IpProtocol: tcp  # port 3306 open to the EC2 instances.
          FromPort: 3306
          ToPort: 3306
          SourceSecurityGroupId:
            Ref: EC2SecurityGroup

  # RDS Aurora cluster
  # By declaring two DB instances in the cluster, Aurora will make the 1st instance the primary and the second the
  # replica, and will manage the primary/replica roles automatically from then on.
  DBClusterAuroraBookstore:
    Type: AWS::RDS::DBCluster
    Properties:
      Engine: aurora-mysql
      MasterUsername: !Ref DBUsername
      MasterUserPassword: !Ref DBPassword
      BackupRetentionPeriod: '7'
      PreferredBackupWindow: 01:00-02:00
      PreferredMaintenanceWindow: mon:03:00-mon:04:00
      DBSubnetGroupName: !Ref MyDBSubnetGroup
      Port: 3306
      VpcSecurityGroupIds:
        - !Ref DBSecurityGroup
      StorageEncrypted: true

  # The DBInstanceClass should be db.t3.medium. (In 2023 we could use small, but the constraints have changed.)
  DBAuroraA:
    Type: AWS::RDS::DBInstance
    Properties:
      Engine: aurora-mysql
      DBClusterIdentifier: !Ref DBClusterAuroraBookstore
      DBInstanceClass: db.t3.medium
      DBSubnetGroupName: !Ref MyDBSubnetGroup
      PubliclyAccessible: false

  DBAuroraB:
    Type: AWS::RDS::DBInstance
    Properties:
      Engine: aurora-mysql
      DBClusterIdentifier: !Ref DBClusterAuroraBookstore
      DBInstanceClass: db.t3.medium
      DBSubnetGroupName: !Ref MyDBSubnetGroup
      PubliclyAccessible: false