AWSTemplateFormatVersion: 2010-09-09
Description: NICE DCV Security Group and IAM role 

Metadata:
  License:
    Description: >
      Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
      SPDX-License-Identifier: MIT-0
      
      Permission is hereby granted, free of charge, to any person obtaining a copy of this
      software and associated documentation files (the "Software"), to deal in the Software
      without restriction, including without limitation the rights to use, copy, modify,
      merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
      permit persons to whom the Software is furnished to do so.
      
      THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
      INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
      PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
      HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
      OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
      SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Parameters:
  instanceProfileName:
    Type: String
    Description: Instance profile name ( https://docs.aws.amazon.com/dcv/latest/adminguide/setting-up-license.html#setting-up-license-ec2 )
    Default: EC2-DCV-Profile
  securityGroupName:
    Type: String
    Description: Security Group name
    Default: EC2-DCV-SecurityGroup
  ingressIPv4:
    Type: String
    Description: Source IPv4 prefix ( https://checkip.amazonaws.com )
    Default: 0.0.0.0/0
  ingressIPv6:
    Type: String
    Description: Source IPv6 prefix
    Default: ::/0
  vpcID:
    Type: AWS::EC2::VPC::Id
    Description: VPC must have internet connectivity
    ConstraintDescription: must be an existing VPC

Resources:
  securityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow inbound DCV 
      VpcId: !Ref vpcID
      SecurityGroupIngress:
        - Description: NICE DCV (IPv4)
          IpProtocol: "tcp"
          FromPort: 8443
          ToPort: 8443
          CidrIp: !Ref ingressIPv4
        - Description: NICE DCV (IPv6)
          IpProtocol: "tcp"
          FromPort: 8443
          ToPort: 8443
          CidrIpv6: !Ref ingressIPv6
        - Description: NICE DCV QUIC (IPv4)
          IpProtocol: "udp"
          FromPort: 8443
          ToPort: 8443
          CidrIp: !Ref ingressIPv4
        - Description: NICE DCV QUIC (IPv6)
          IpProtocol: "udp"
          FromPort: 8443
          ToPort: 8443
          CidrIpv6: !Ref ingressIPv6
      SecurityGroupEgress:
        - Description: Allow all outbound traffic (IPv4)
          IpProtocol: "-1"
          CidrIp: 0.0.0.0/0          
        - Description: Allow all outbound traffic (IPv6)
          IpProtocol: "-1"
          CidrIpv6: "::/0" 
      Tags:
        - Key: StackName
          Value: !Sub ${AWS::StackName}
        - Key: StackId
          Value: !Sub ${AWS::StackId}
        - Key: Name
          Value: !Ref securityGroupName
        - Key: GitHub
          Value: https://github.com/aws-samples/amazon-ec2-nice-dcv-samples

  instanceIamRole:
    Type: AWS::IAM::Role
    Properties: 
      AssumeRolePolicyDocument: 
        Statement:
          - Effect: Allow
            Principal:
              Service: [ec2.amazonaws.com]
            Action: ['sts:AssumeRole']
      Path: /
      Policies: # https://docs.aws.amazon.com/dcv/latest/adminguide/setting-up-license.html
      - PolicyName: dcvLicensing
        PolicyDocument:
          Version: '2012-10-17'  
          Statement:
          - Effect: Allow
            Action: 
              - s3:GetObject
            Resource: !Sub "arn:aws:s3:::dcv-license.${AWS::Region}/*"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
      Tags:
        - Key: StackName
          Value: !Sub ${AWS::StackName}
        - Key: StackId
          Value: !Sub ${AWS::StackId}
        - Key: GitHub
          Value: https://github.com/aws-samples/amazon-ec2-nice-dcv-samples

  instanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties: 
      InstanceProfileName: !Ref instanceProfileName
      Path: /
      Roles: 
      - !Ref instanceIamRole
       
Outputs:
  securityGroupID:
    Description: NICE DCV Security Group
    Value: !Ref securityGroup
    Export:
      Name: !Sub "${AWS::StackName}-SecurityGroup"

  instanceProfileID:
    Description: EC2 instance profile
    Value: !Ref instanceProfile
    Export: 
      Name: !Sub "${AWS::StackName}-InstanceProfile"