---
AWSTemplateFormatVersion: '2010-09-09'
Description: This example template creates a VPC infrastructure for a multi-AZ, multi-tier
  deployment of a workload on AWS. It deploys a VPC with bastions and a workload cluster
  behind an ELB. The cluster is configured to use an S3 bucket for storage  **WARNING**
  This template creates EC2 instances and related resources. You will be billed for
  the AWS resources used if you create a stack from this template. (qs-1s1eguahh)
Metadata:
  cfn-lint:
    config:
      ignore_checks:
        - W9006 # temporary to get rid of warnings
        - W9002 # temporary to get rid of warnings
        - W9003 # temporary to get rid of warnings
        - W9901 # Not passing all the default parameters to reduce verbosity
  AWS::CloudFormation::Interface:
    ParameterGroups:
    - Label:
        default: Network configuration
      Parameters:
      - AvailabilityZones
      - VPCCIDR
      - PrivateSubnet1CIDR
      - PrivateSubnet2CIDR
      - PublicSubnet1CIDR
      - PublicSubnet2CIDR
      - RemoteAccessCIDR
    - Label:
        default: Amazon EC2 configuration
      Parameters:
      - KeyPairName
      - BastionAMIOS
      - BastionInstanceType
      - WorkloadInstanceType
    - Label:
        default: Workload nodes configuration
      Parameters:
      - WorkloadNodesMinSize
      - WorkloadNodesMaxSize
      - OperatorEmail
    - Label:
        default: Workload storage configuration
      Parameters:
      - S3BucketName
    - Label:
        default: AWS Quick Start configuration
      Parameters:
      - QSS3BucketName
      - QSS3BucketRegion
      - QSS3KeyPrefix
    ParameterLabels:
      AvailabilityZones:
        default: Availability Zones
      BastionAMIOS:
        default: Bastion AMI operating system
      BastionInstanceType:
        default: Bastion instance type
      KeyPairName:
        default: Key pair name
      OperatorEmail:
        default: Operator email
      PrivateSubnet1CIDR:
        default: Private subnet 1 CIDR
      PrivateSubnet2CIDR:
        default: Private subnet 2 CIDR
      PublicSubnet1CIDR:
        default: Public subnet 1 CIDR
      PublicSubnet2CIDR:
        default: Public subnet 2 CIDR
      QSS3BucketName:
        default: Quick Start S3 bucket name
      QSS3BucketRegion:
        default: Quick Start S3 bucket region
      QSS3KeyPrefix:
        default: Quick Start S3 Key Prefix
      S3BucketName:
        default: S3 bucket name
      RemoteAccessCIDR:
        default: Allowed bastion external access CIDR
      VPCCIDR:
        default: VPC CIDR
      WorkloadInstanceType:
        default: Workload servers instance type
      WorkloadNodesMaxSize:
        default: Workload nodes max size
      WorkloadNodesMinSize:
        default: Workload nodes min size
Parameters:
  AvailabilityZones:
    Description: List of Availability Zones to use for the subnets in the VPC. Only
      two Availability Zones are used for this deployment, and the logical order of
      your selections is preserved.
    Type: List<AWS::EC2::AvailabilityZone::Name>
  BastionAMIOS:
    AllowedValues:
      - Amazon-Linux2-HVM
      - CentOS-7-HVM
      - Ubuntu-Server-20.04-LTS-HVM
      - SUSE-SLES-15-HVM
    Default: Amazon-Linux2-HVM
    Description: Linux distribution for the AMI to be used for the bastion instances.
    Type: String
  BastionInstanceType:
    AllowedValues:
    - t2.nano
    - t2.micro
    - t2.small
    - t2.medium
    - t2.large
    - m3.large
    - m3.xlarge
    - m3.2xlarge
    - m4.large
    - m4.xlarge
    - m4.2xlarge
    - m4.4xlarge
    Default: t2.micro
    Description: Amazon EC2 instance type for the bastion instances.
    Type: String
  KeyPairName:
    Description: Name of an existing public/private key pair, which allows you
      to securely connect to your instance after it launches.
    Type: AWS::EC2::KeyPair::KeyName
  OperatorEmail:
    AllowedPattern: ([a-zA-Z0-9_\-\.]+)@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.)|(([a-zA-Z0-9\-]+\.)+))([a-zA-Z]{2,4}|[0-9]{1,3})(\]?)
    ConstraintDescription: Must be a valid email address.
    Description: Email address that notifications of any scaling operations will be
      sent to.
    Type: String
  PrivateSubnet1CIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
    Default: 10.0.0.0/19
    Description: CIDR block for private subnet 1 located in Availability Zone 1.
    Type: String
  PrivateSubnet2CIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
    Default: 10.0.32.0/19
    Description: CIDR block for private subnet 2 located in Availability Zone 2.
    Type: String
  PublicSubnet1CIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
    Default: 10.0.128.0/20
    Description: CIDR block for the public (DMZ) subnet 1 located in Availability
      Zone 1.
    Type: String
  PublicSubnet2CIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
    Default: 10.0.144.0/20
    Description: CIDR block for the public (DMZ) subnet 2 located in Availability
      Zone 2.
    Type: String
  QSS3BucketName:
    AllowedPattern: ^[0-9a-zA-Z]+([0-9a-zA-Z-]*[0-9a-zA-Z])*$
    ConstraintDescription: Quick Start bucket name can include numbers, lowercase
      letters, uppercase letters, and hyphens (-). It cannot start or end with a hyphen
      (-).
    Default: aws-quickstart
    Description: S3 bucket name for the Quick Start assets. This string can include
      numbers, lowercase letters, uppercase letters, and hyphens (-). It cannot start
      or end with a hyphen (-).
    Type: String
  QSS3BucketRegion:
    Default: 'us-east-1'
    Description: 'The AWS Region where the Quick Start S3 bucket (QSS3BucketName) is hosted. When using your own bucket, you must specify this value.'
    Type: String
  QSS3KeyPrefix:
    AllowedPattern: ^[0-9a-zA-Z-/]*$
    ConstraintDescription: Quick Start key prefix can include numbers, lowercase letters,
      uppercase letters, hyphens (-), and forward slash (/).
    Default: quickstart-examples/
    Description: S3 key prefix for the Quick Start assets. Quick Start key prefix
      can include numbers, lowercase letters, uppercase letters, hyphens (-), and
      forward slash (/).
    Type: String
  RemoteAccessCIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/x
    Description: CIDR IP range that is permitted to access the bastions. We recommend
      that you set this value to a trusted IP range.
    Type: String
  S3BucketName:
    AllowedPattern: ^[a-z0-9][a-z0-9-.]*$
    Default: type-unique-value-here-in-lowercase
    Description: Name of the S3 bucket that will be created for your workload to store
      data. Enter a unique name that does not include uppercase characters.
    Type: String
  VPCCIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
    Default: 10.0.0.0/16
    Description: CIDR block for the VPC.
    Type: String
  WorkloadInstanceType:
    AllowedValues:
    - t2.large
    - m4.large
    - m4.xlarge
    - m4.2xlarge
    - m4.4xlarge
    - m4.10xlarge
    - m3.medium
    - m3.large
    - m3.xlarge
    - m3.2xlarge
    - c4.large
    - c4.xlarge
    - c4.2xlarge
    - c4.4xlarge
    - c4.8xlarge
    - c3.large
    - c3.xlarge
    - c3.2xlarge
    - c3.4xlarge
    - c3.8xlarge
    - r3.large
    - r3.xlarge
    ConstraintDescription: Must contain valid instance type
    Default: m4.xlarge
    Description: EC2 instance type for the workload instances.
    Type: String
  WorkloadNodesDesiredCapacity:
    Default: '2'
    Description: Desired capacity for the workload nodes Auto Scaling group.
    Type: String
  WorkloadNodesMaxSize:
    Default: '4'
    Description: Maximum size of the Auto Scaling group.
    Type: String
  WorkloadNodesMinSize:
    Default: '2'
    Description: Minimum size of the Auto Scaling group.
    Type: String
Conditions:
  UsingDefaultBucket: !Equals [!Ref QSS3BucketName, 'aws-quickstart']
Resources:
  VPCStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL:
        !Sub
          - 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}submodules/quickstart-aws-vpc/templates/aws-vpc.template.yaml'
          - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion]
            S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
      Parameters:
        AvailabilityZones:
          Fn::Join:
          - ','
          - Ref: AvailabilityZones
        NumberOfAZs: '2'
        PrivateSubnet1ACIDR:
          Ref: PrivateSubnet1CIDR
        PrivateSubnet2ACIDR:
          Ref: PrivateSubnet2CIDR
        PublicSubnet1CIDR:
          Ref: PublicSubnet1CIDR
        PublicSubnet2CIDR:
          Ref: PublicSubnet2CIDR
        VPCCIDR:
          Ref: VPCCIDR
  BastionStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL:
        !Sub
          - 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}submodules/quickstart-linux-bastion/templates/linux-bastion.template'
          - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion]
            S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
      Parameters:
        QSS3BucketName: 
          Ref: QSS3BucketName
        QSS3BucketRegion: 
          Ref: QSS3BucketRegion
        QSS3KeyPrefix: !Sub '${QSS3KeyPrefix}submodules/quickstart-linux-bastion/'
        BastionAMIOS:
          Ref: BastionAMIOS
        BastionInstanceType:
          Ref: BastionInstanceType
        KeyPairName:
          Ref: KeyPairName
        PublicSubnet1ID:
          Fn::GetAtt:
          - VPCStack
          - Outputs.PublicSubnet1ID
        PublicSubnet2ID:
          Fn::GetAtt:
          - VPCStack
          - Outputs.PublicSubnet2ID
        RemoteAccessCIDR:
          Ref: RemoteAccessCIDR
        VPCID:
          Fn::GetAtt:
          - VPCStack
          - Outputs.VPCID
  WorkloadStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL:
        !Sub
          - 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}templates/workload-yaml.template.yaml'
          - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion]
            S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
      Parameters:
        WorkloadInstanceType:
          Ref: WorkloadInstanceType
        WorkloadNodesDesiredCapacity:
          Ref: WorkloadNodesDesiredCapacity
        WorkloadNodesMaxSize:
          Ref: WorkloadNodesMaxSize
        WorkloadNodesMinSize:
          Ref: WorkloadNodesMinSize
        BastionSecurityGroupID:
          Fn::GetAtt:
          - BastionStack
          - Outputs.BastionSecurityGroupID
        KeyPairName:
          Ref: KeyPairName
        OperatorEmail:
          Ref: OperatorEmail
        PrivateSubnet1ID:
          Fn::GetAtt:
          - VPCStack
          - Outputs.PrivateSubnet1AID
        PrivateSubnet2ID:
          Fn::GetAtt:
          - VPCStack
          - Outputs.PrivateSubnet2AID
        PublicSubnet1ID:
          Fn::GetAtt:
          - VPCStack
          - Outputs.PublicSubnet1ID
        PublicSubnet2ID:
          Fn::GetAtt:
          - VPCStack
          - Outputs.PublicSubnet2ID
        QSS3BucketName:
          Ref: QSS3BucketName
        QSS3KeyPrefix:
          Ref: QSS3KeyPrefix
        S3BucketName:
          Ref: S3BucketName
        VPCID:
          Fn::GetAtt:
          - VPCStack
          - Outputs.VPCID