# Copyright 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. # Permission is hereby granted, free of charge, to any person obtaining a copy of this # software and associated documentation files (the "Software"), to deal in the Software # without restriction, including without limitation the rights to use, copy, modify, # merge, publish, distribute, sublicense, and/or sell copies of the Software, and to # permit persons to whom the Software is furnished to do so. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, # INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A # PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT # HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION # OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE # SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. AWSTemplateFormatVersion: 2010-09-09 Description: >- This template creates a the encrypted S3 Bucket which stores Nginx Config files. This template also creates the roles utilized for setting up the Nginx Proxies. Parameters: Environment: AllowedValues: - 'dev' - 'devops' - 'uat' Description: >- Set environment in which the VPC will be created. Type: String DemoConfigS3BucketName: Type: String EC2InstanceRoleName: Type: String Default: EC2InstanceRole EC2ImageBuilderRoleName: Type: String Default: EC2ImageBuilderRole S3PutLambdaRoleName: Type: String Default: NginxS3PutLambdaRole NetworkStackName: Description: Stack name which has all of the VPC configuration Type: String KMSStackName: Description: Stack name which has all of the KMS configuration Type: String Resources: # S3 Bucket where Nginx Config and Image Builder Config will live S3Bucket: Type: AWS::S3::Bucket Properties: BucketName: !Ref DemoConfigS3BucketName VersioningConfiguration: Status: Enabled BucketEncryption: ServerSideEncryptionConfiguration: - ServerSideEncryptionByDefault: SSEAlgorithm: aws:kms KMSMasterKeyID: Fn::ImportValue: !Sub "${KMSStackName}-KeyId" PublicAccessBlockConfiguration: BlockPublicAcls: true IgnorePublicAcls: true BlockPublicPolicy: true RestrictPublicBuckets: true S3BucketPolicy: Type: AWS::S3::BucketPolicy Properties: Bucket: !Ref S3Bucket PolicyDocument: Version: 2012-10-17 Statement: - Action: - 's3:GetObject' Effect: Deny Resource: - !GetAtt 'S3Bucket.Arn' - !Sub '${S3Bucket.Arn}/*' Principal: '*' Condition: Bool: 'aws:SecureTransport': - 'false' S3PutLambdaRole: Type: AWS::IAM::Role Properties: RoleName: !Ref S3PutLambdaRoleName AssumeRolePolicyDocument: Version: '2012-10-17' Statement: - Effect: Allow Principal: Service: - lambda.amazonaws.com Action: - sts:AssumeRole Path: / ManagedPolicyArns: - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole Policies: - PolicyName: root PolicyDocument: Version: '2012-10-17' Statement: - Effect: Allow Action: - s3:PutObject - s3:DeleteObject Resource: !Sub '${S3Bucket.Arn}*' EC2InstanceRole: Type: AWS::IAM::Role Properties: RoleName: !Ref EC2InstanceRoleName AssumeRolePolicyDocument: Version: '2012-10-17' Statement: - Effect: Allow Principal: Service: - lambda.amazonaws.com - ssm.amazonaws.com - ec2.amazonaws.com - s3.amazonaws.com Action: - sts:AssumeRole Path: / ManagedPolicyArns: - arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM - arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy Policies: - PolicyName: root PolicyDocument: Version: '2012-10-17' Statement: - Effect: Allow Action: - s3:Get* - s3:List* - s3:Put* Resource: !Sub '${S3Bucket.Arn}*' - Effect: Allow Action: - ec2:ModifyInstanceAttribute Resource: '*' - Effect: Allow Action: - kms:Decrypt Resource: '*' ImageBuilderIamRole: Type: AWS::IAM::Role Properties: # RoleName: !Sub '${AWS::StackName}-EC2ImageBuilderRole' RoleName: !Ref EC2ImageBuilderRoleName Description: 'This role will grant EC2 ImageBuilder minimum neccessary permissions to allow pipelines to execute' MaxSessionDuration: 3600 # in seconds Path: / AssumeRolePolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Principal: Service: - ec2.amazonaws.com - ssm.amazonaws.com - imagebuilder.amazonaws.com AWS: !Sub 'arn:aws:iam::${AWS::AccountId}:root' Action: - sts:AssumeRole ManagedPolicyArns: - 'arn:aws:iam::aws:policy/EC2InstanceProfileForImageBuilder' - 'arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore' Policies: - PolicyName: GrantS3Read PolicyDocument: Statement: - Sid: GrantS3Read Effect: Allow Action: - s3:List* - s3:Get* - s3:Put* Resource: !Sub 'arn:aws:s3:::${S3Bucket}*' - PolicyName: DecryptKms PolicyDocument: Statement: - Sid: DecryptKms Effect: Allow Action: - kms:Decrypt - kms:Encrypt - kms:GenerateDataKey* - ec2:DescribeImages - ssm:PutParameter Resource: '*' - PolicyName: GrantSsm PolicyDocument: Statement: - Sid: GrantSsm Effect: Allow Action: - ssm:SendCommand Resource: - 'arn:aws:ssm:us-east-1::document/AmazonInspector-ManageAWSAgent' - !Sub 'arn:aws:ec2:us-east-1:${AWS::AccountId}:*/*' - PolicyName: Ec2Tags PolicyDocument: Statement: - Sid: TagOnCreate Effect: Allow Action: - ec2:CreateTags - ec2:RunInstances Resource: !Sub 'arn:aws:ec2:us-east-1:${AWS::AccountId}:*/*' - PolicyName: InspectorResource PolicyDocument: Statement: - Sid: InspectorGroup Effect: Allow Action: - inspector:Create* - inspector:Get* - inspector:Describe* - inspector:List* - inspector:Set* - inspector:Start* - inspector:Stop* - inspector:PreviewAgents Resource: '*' - PolicyName: NginxScript PolicyDocument: Statement: - Sid: NginxRunScript Effect: Allow Action: - cloudformation:SignalResource - ec2:ModifyInstanceAttribute Resource: !Sub 'arn:aws:ec2:us-east-1:${AWS::AccountId}:*/*' Outputs: EC2InstanceRoleArn: Value: !GetAtt EC2InstanceRole.Arn Export: Name: !Sub "${AWS::StackName}-Nginx-Instance-Role-ARN" EC2InstanceRoleName: Value: !Ref EC2InstanceRole Export: Name: !Sub "${AWS::StackName}-Nginx-Instance-Role-Name" S3PutLambdaRoleArn: Value: !GetAtt S3PutLambdaRole.Arn Export: Name: !Sub "${AWS::StackName}-S3-Put-Lambda-Role-ARN" S3PutLambdaRoleName: Value: !Ref S3PutLambdaRole Export: Name: !Sub "${AWS::StackName}-S3-Put-Lambda-Role-Name" ImageBuilderRoleArn: Value: !GetAtt ImageBuilderIamRole.Arn Export: Name: !Sub "${AWS::StackName}-Image-Builder-Role-ARN" ImageBuilderRoleName: Value: !Ref ImageBuilderIamRole Export: Name: !Sub "${AWS::StackName}-Image-Builder-Role-Name" S3BucketArn: Description: S3 Bucket ARN Value: !GetAtt S3Bucket.Arn Export: Name: Fn::Sub: "${AWS::StackName}-Bucket-ARN" S3BucketName: Description: S3 Bucket Name Value: !Ref S3Bucket Export: Name: Fn::Sub: "${AWS::StackName}-Bucket-Name"