vpc-nat-instance.yaml

---
AWSTemplateFormatVersion: '2010-09-09'
Description: 'VPC: highly available NAT instance for private subnets, a cloudonaut.io template'
Metadata:
  'AWS::CloudFormation::Interface':
    ParameterGroups:
    - Label:
        default: 'Parent Stacks'
      Parameters:
      - ParentVPCStack
      - ParentSSHBastionStack
      - ParentAlertStack
    - Label:
        default: 'EC2 Parameters'
      Parameters:
      - NATInstanceType
      - KeyName
      - IAMUserSSHAccess
      - LogsRetentionInDays
      - NewRelicLicenseKey
Parameters:
  ParentVPCStack:
    Description: 'Stack name of parent VPC stack based on vpc/vpc-*azs.yaml template.'
    Type: String
  ParentSSHBastionStack:
    Description: 'Optional but recommended stack name of parent SSH bastion host/instance stack based on vpc/vpc-ssh-bastion.yaml template.'
    Type: String
    Default: ''
  ParentAlertStack:
    Description: 'Optional but recommended stack name of parent alert stack based on operations/alert.yaml template.'
    Type: String
    Default: ''
  KeyName:
    Description: 'Optional key pair of the ec2-user to establish a SSH connection to the NAT instance.'
    Type: String
    Default: ''
  IAMUserSSHAccess:
    Description: 'Synchronize public keys of IAM users to enable personalized SSH access (Doc: https://cloudonaut.io/manage-aws-ec2-ssh-access-with-iam/).'
    Type: String
    Default: false
    AllowedValues:
    - true
    - false
  NATInstanceType:
    Description: 'Instance type of the NAT instance. Keep in mind that different instances come with different network capabilities.'
    Type: String
    Default: 't2.nano'
  LogsRetentionInDays:
    Description: 'Specifies the number of days you want to retain log events.'
    Type: Number
    Default: 14
    AllowedValues: [1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 3653]
  NewRelicLicenseKey:
    Description: 'Optional New Relic License Key will install the New Relic Servers for Linux agent.'
    Type: String
    Default: ''
    NoEcho: true
Mappings:
  RegionMap:
    'ap-south-1':
      NATAMI: 'ami-85c1b2ea'
    'eu-west-2':
      NATAMI: 'ami-17c4d073'
    'eu-west-1':
      NATAMI: 'ami-5bc6c23d'
    'ap-northeast-2':
      NATAMI: 'ami-2e15c740'
    'ap-northeast-1':
      NATAMI: 'ami-6c3c130b'
    'sa-east-1':
      NATAMI: 'ami-93ccaeff'
    'ca-central-1':
      NATAMI: 'ami-c8db67ac'
    'ap-southeast-1':
      NATAMI: 'ami-ae5ce5cd'
    'ap-southeast-2':
      NATAMI: 'ami-242f2647'
    'eu-central-1':
      NATAMI: 'ami-0469bb6b'
    'us-east-1':
      NATAMI: 'ami-258e1f33'
    'us-east-2':
      NATAMI: 'ami-6793b702'
    'us-west-1':
      NATAMI: 'ami-eeba9f8e'
    'us-west-2':
      NATAMI: 'ami-8437a5e4'
Conditions:
  HasKeyName: !Not [!Equals [!Ref KeyName, '']]
  HasIAMUserSSHAccess: !Equals [!Ref IAMUserSSHAccess, 'true']
  HasSSHBastionSecurityGroup: !Not [!Equals [!Ref ParentSSHBastionStack, '']]
  HasNotSSHBastionSecurityGroup: !Equals [!Ref ParentSSHBastionStack, '']
  HasNewRelic: !Not [!Equals [!Ref NewRelicLicenseKey, '']]
  HasAlertTopic: !Not [!Equals [!Ref ParentAlertStack, '']]
Resources:
  EIP:
    Type: 'AWS::EC2::EIP'
    Properties:
      Domain: vpc
  Logs:
    Type: 'AWS::Logs::LogGroup'
    Properties:
      RetentionInDays: !Ref LogsRetentionInDays
  NATSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: !Sub
      - 'NAT instance 10.${ClassB}.0.0/16'
      - ClassB:
          'Fn::ImportValue': !Sub '${ParentVPCStack}-ClassB'
      SecurityGroupEgress:
      - IpProtocol: udp
        FromPort: 123
        ToPort: 123
        CidrIp: '0.0.0.0/0'
      - IpProtocol: tcp
        FromPort: 80
        ToPort: 80
        CidrIp: '0.0.0.0/0'
      - IpProtocol: tcp
        FromPort: 443
        ToPort: 443
        CidrIp: '0.0.0.0/0'
      SecurityGroupIngress:
      - IpProtocol: udp
        FromPort: 123
        ToPort: 123
        CidrIp: !Sub
        - '10.${ClassB}.0.0/16'
        - ClassB:
            'Fn::ImportValue': !Sub '${ParentVPCStack}-ClassB'
      - IpProtocol: tcp
        FromPort: 80
        ToPort: 80
        CidrIp: !Sub
        - '10.${ClassB}.0.0/16'
        - ClassB:
            'Fn::ImportValue': !Sub '${ParentVPCStack}-ClassB'
      - IpProtocol: tcp
        FromPort: 443
        ToPort: 443
        CidrIp: !Sub
        - '10.${ClassB}.0.0/16'
        - ClassB:
            'Fn::ImportValue': !Sub '${ParentVPCStack}-ClassB'
      VpcId:
        'Fn::ImportValue': !Sub '${ParentVPCStack}-VPC'
  NATSecurityGroupInSSHBastion:
    Type: 'AWS::EC2::SecurityGroupIngress'
    Condition: HasSSHBastionSecurityGroup
    Properties:
      GroupId: !Ref NATSecurityGroup
      IpProtocol: tcp
      FromPort: 22
      ToPort: 22
      SourceSecurityGroupId:
        'Fn::ImportValue': !Sub '${ParentSSHBastionStack}-SecurityGroup'
  NATSecurityGroupInSSHWorld:
    Type: 'AWS::EC2::SecurityGroupIngress'
    Condition: HasNotSSHBastionSecurityGroup
    Properties:
      GroupId: !Ref NATSecurityGroup
      IpProtocol: tcp
      FromPort: 22
      ToPort: 22
      CidrIp: '0.0.0.0/0'
  NATInstanceProfile:
    Type: 'AWS::IAM::InstanceProfile'
    Properties:
      Path: '/'
      Roles:
      - !Ref NATIAMRole
  NATIAMRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - 'ec2.amazonaws.com'
          Action:
          - 'sts:AssumeRole'
      Path: '/'
      Policies:
      - PolicyName: ec2
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Sid: Stmt1425023276000
            Effect: Allow
            Action:
            - 'ec2:AssociateAddress'
            - 'ec2:ModifyInstanceAttribute'
            - 'ec2:CreateRoute'
            - 'ec2:ReplaceRoute'
            Resource:
            - '*'
      - PolicyName: logs
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - 'logs:CreateLogGroup'
            - 'logs:CreateLogStream'
            - 'logs:PutLogEvents'
            - 'logs:DescribeLogStreams'
            Resource:
            - 'arn:aws:logs:*:*:*'
  NATIAMPolicySSHAccess:
    Type: 'AWS::IAM::Policy'
    Condition: HasIAMUserSSHAccess
    Properties:
      Roles:
      - !Ref NATIAMRole
      PolicyName: iam
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Action:
          - 'iam:ListUsers'
          Resource:
          - '*'
        - Effect: Allow
          Action:
          - 'iam:ListSSHPublicKeys'
          - 'iam:GetSSHPublicKey'
          Resource:
          - !Sub 'arn:aws:iam::${AWS::AccountId}:user/*'
  NATLaunchConfiguration:
    Type: 'AWS::AutoScaling::LaunchConfiguration'
    Metadata:
      'AWS::CloudFormation::Init':
        configSets:
          default:
            !If
            - HasNewRelic
            - !If [HasIAMUserSSHAccess, [ssh-access, newrelic, config], [newrelic, config]]
            - !If [HasIAMUserSSHAccess, [ssh-access, config], [config]]
        newrelic:
          packages:
            rpm:
              newrelic-sysmond: 'https://download.newrelic.com/pub/newrelic/el5/x86_64/newrelic-sysmond-2.3.0.132-1.x86_64.rpm'
          files:
            '/etc/newrelic/nrsysmond.cfg':
              content: !Sub |
                license_key=${NewRelicLicenseKey}
                loglevel=info
                logfile=/var/log/newrelic/nrsysmond.log
                labels=StackName:${AWS::StackName};AccountId:${AWS::AccountId};Region:${AWS::Region}
              mode: '000640'
              owner: root
              group: newrelic
          services:
            sysvinit:
              newrelic-sysmond:
                enabled: true
                ensureRunning: true
                files:
                - '/etc/newrelic/nrsysmond.cfg'
        ssh-access:
          files:
            '/opt/authorized_keys_command.sh':
              content: |
                #!/bin/bash -e
                if [ -z "$1" ]; then
                  exit 1
                fi
                SaveUserName="$1"
                SaveUserName=${SaveUserName//"+"/".plus."}
                SaveUserName=${SaveUserName//"="/".equal."}
                SaveUserName=${SaveUserName//","/".comma."}
                SaveUserName=${SaveUserName//"@"/".at."}
                aws iam list-ssh-public-keys --user-name "$SaveUserName" --query "SSHPublicKeys[?Status == 'Active'].[SSHPublicKeyId]" --output text | while read KeyId; do
                  aws iam get-ssh-public-key --user-name "$SaveUserName" --ssh-public-key-id "$KeyId" --encoding SSH --query "SSHPublicKey.SSHPublicKeyBody" --output text
                done
              mode: '000755'
              owner: root
              group: root
            '/opt/import_users.sh':
              content: |
                #!/bin/bash -e
                aws iam list-users --query "Users[].[UserName]" --output text | while read User; do
                  SaveUserName="$User"
                  SaveUserName=${SaveUserName//"+"/".plus."}
                  SaveUserName=${SaveUserName//"="/".equal."}
                  SaveUserName=${SaveUserName//","/".comma."}
                  SaveUserName=${SaveUserName//"@"/".at."}
                  if ! id -u "$SaveUserName" >/dev/null 2>&1; then
                    #sudo will read each file in /etc/sudoers.d, skipping file names that end in ‘~’ or contain a ‘.’ character to avoid causing problems with package manager or editor temporary/backup files.
                    SaveUserFileName=$(echo "$SaveUserName" | tr "." " ")
                    /usr/sbin/useradd "$SaveUserName"
                    echo "$SaveUserName ALL=(ALL) NOPASSWD:ALL" > "/etc/sudoers.d/$SaveUserFileName"
                  fi
                done
              mode: '000755'
              owner: root
              group: root
            '/etc/cron.d/import_users':
              content: |
                */10 * * * * root /opt/import_users.sh
              mode: '000644'
              owner: root
              group: root
          commands:
            'a_configure_sshd_command':
              command: 'sed -i "s:#AuthorizedKeysCommand none:AuthorizedKeysCommand /opt/authorized_keys_command.sh:g" /etc/ssh/sshd_config'
            'b_configure_sshd_commanduser':
              command: 'sed -i "s:#AuthorizedKeysCommandUser nobody:AuthorizedKeysCommandUser nobody:g" /etc/ssh/sshd_config'
            'c_import_users':
              command: './import_users.sh'
              cwd: '/opt'
          services:
            sysvinit:
              sshd:
                enabled: true
                ensureRunning: true
                commands:
                - 'a_configure_sshd_command'
                - 'b_configure_sshd_commanduser'
        config:
          packages:
            yum:
              awslogs: []
          files:
            '/etc/awslogs/awscli.conf':
              content: !Sub |
                [default]
                region = ${AWS::Region}
                [plugins]
                cwlogs = cwlogs
              mode: '000644'
              owner: root
              group: root
            '/etc/awslogs/awslogs.conf':
              content: !Sub |
                [general]
                state_file = /var/lib/awslogs/agent-state
                [/var/log/messages]
                datetime_format = %b %d %H:%M:%S
                file = /var/log/messages
                log_stream_name = {instance_id}/var/log/messages
                log_group_name = ${Logs}
                [/var/log/secure]
                datetime_format = %b %d %H:%M:%S
                file = /var/log/secure
                log_stream_name = {instance_id}/var/log/secure
                log_group_name = ${Logs}
                [/var/log/cron]
                datetime_format = %b %d %H:%M:%S
                file = /var/log/cron
                log_stream_name = {instance_id}/var/log/cron
                log_group_name = ${Logs}
                [/var/log/cloud-init.log]
                datetime_format = %b %d %H:%M:%S
                file = /var/log/cloud-init.log
                log_stream_name = {instance_id}/var/log/cloud-init.log
                log_group_name = ${Logs}
                [/var/log/cfn-init.log]
                datetime_format = %Y-%m-%d %H:%M:%S
                file = /var/log/cfn-init.log
                log_stream_name = {instance_id}/var/log/cfn-init.log
                log_group_name = ${Logs}
                [/var/log/cfn-hup.log]
                datetime_format = %Y-%m-%d %H:%M:%S
                file = /var/log/cfn-hup.log
                log_stream_name = {instance_id}/var/log/cfn-hup.log
                log_group_name = ${Logs}
                [/var/log/cfn-init-cmd.log]
                datetime_format = %Y-%m-%d %H:%M:%S
                file = /var/log/cfn-init-cmd.log
                log_stream_name = {instance_id}/var/log/cfn-init-cmd.log
                log_group_name = ${Logs}
                [/var/log/cloud-init-output.log]
                file = /var/log/cloud-init-output.log
                log_stream_name = {instance_id}/var/log/cloud-init-output.log
                log_group_name = ${Logs}
                [/var/log/dmesg]
                file = /var/log/dmesg
                log_stream_name = {instance_id}/var/log/dmesg
                log_group_name = ${Logs}
              mode: '000644'
              owner: root
              group: root
            '/etc/cfn/cfn-hup.conf':
              content: !Sub |
                [main]
                stack=${AWS::StackId}
                region=${AWS::Region}
                interval=1
              mode: '000400'
              owner: root
              group: root
            '/etc/cfn/hooks.d/cfn-auto-reloader.conf':
              content: !Sub |
                [cfn-auto-reloader-hook]
                triggers=post.update
                path=Resources.NATLaunchConfiguration.Metadata.AWS::CloudFormation::Init
                action=/opt/aws/bin/cfn-init --verbose --stack=${AWS::StackName} --region=${AWS::Region} --resource=NATLaunchConfiguration
                runas=root
          services:
            sysvinit:
              awslogs:
                enabled: true
                ensureRunning: true
                packages:
                  yum:
                  - awslogs
                files:
                - '/etc/awslogs/awslogs.conf'
                - '/etc/awslogs/awscli.conf'
              cfn-hup:
                enabled: true
                ensureRunning: true
                files:
                - '/etc/cfn/cfn-hup.conf'
                - '/etc/cfn/hooks.d/cfn-auto-reloader.conf'
    Properties:
      AssociatePublicIpAddress: true
      EbsOptimized: false
      IamInstanceProfile: !Ref NATInstanceProfile
      ImageId: !FindInMap [RegionMap, !Ref 'AWS::Region', NATAMI]
      InstanceType: !Ref NATInstanceType
      SecurityGroups:
      - !Ref NATSecurityGroup
      KeyName: !If [HasKeyName, !Ref KeyName, !Ref 'AWS::NoValue']
      UserData:
        'Fn::Base64': !Sub
          - |
            #!/bin/bash -x
            INSTANCEID=$(curl -s -m 60 http://169.254.169.254/latest/meta-data/instance-id)
            aws --region ${Region} ec2 associate-address --instance-id $INSTANCEID --allocation-id ${EIPAllocationId} && aws --region ${Region} ec2 modify-instance-attribute --instance-id $INSTANCEID --source-dest-check "{\"Value\": false}" && (aws --region ${Region} ec2 replace-route --route-table-id ${RouteTablePrivate} --destination-cidr-block "0.0.0.0/0" --instance-id $INSTANCEID || aws --region ${Region} ec2 create-route --route-table-id ${RouteTablePrivate} --destination-cidr-block "0.0.0.0/0" --instance-id $INSTANCEID) && /opt/aws/bin/cfn-init -v --stack ${StackName} --resource NATLaunchConfiguration --region ${Region}
            /opt/aws/bin/cfn-signal -e $? --region ${Region} --stack ${StackName} --resource NATAutoScalingGroup
          - RouteTablePrivate:
              'Fn::ImportValue': !Sub '${ParentVPCStack}-RouteTablePrivate'
            Region:
              !Ref 'AWS::Region'
            StackName:
              !Ref 'AWS::StackName'
            EIPAllocationId:
              !Sub '${EIP.AllocationId}'
  NATAutoScalingGroup:
    Type: 'AWS::AutoScaling::AutoScalingGroup'
    Properties:
      DesiredCapacity: 1
      LaunchConfigurationName: !Ref NATLaunchConfiguration
      MaxSize: 1
      MinSize: 1
      Tags:
      - Key: Name
        Value: !Sub
        - 'NAT instance 10.${ClassB}.0.0/16'
        - ClassB:
            'Fn::ImportValue': !Sub '${ParentVPCStack}-ClassB'
        PropagateAtLaunch: true
      VPCZoneIdentifier: !Split
      - ','
      - 'Fn::ImportValue':
          !Sub '${ParentVPCStack}-SubnetsPublic'
    CreationPolicy:
      ResourceSignal:
        Count: 1
        Timeout: PT10M
    UpdatePolicy:
      AutoScalingRollingUpdate:
        PauseTime: PT10M
        WaitOnResourceSignals: true
  CPUTooHighAlarm:
    Condition: HasAlertTopic
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmDescription: 'Average CPU utilization over last 10 minutes higher than 80%'
      Namespace: 'AWS/EC2'
      MetricName: CPUUtilization
      Statistic: Average
      Period: 600
      EvaluationPeriods: 1
      ComparisonOperator: GreaterThanThreshold
      Threshold: 80
      AlarmActions:
      - 'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'
      Dimensions:
      - Name: AutoScalingGroupName
        Value: !Ref NATAutoScalingGroup
Outputs:
  TemplateID:
    Description: 'cloudonaut.io template id'
    Value: 'vpc/vpc-nat-instance'
  IPAddress:
    Description: 'The public IP address of the NAT instance.'
    Value: !Ref EIP
    Export:
      Name: !Sub '${AWS::StackName}-IPAddress'