AWSTemplateFormatVersion: '2010-09-09'
Description: >-
  This template deploys two Web Application Proxy servers into public subnets in each
  availability zone, as well as two ADFS servers into the private subnets in each
  availability zone. **WARNING** This template creates Amazon EC2 Windows instance
  and related resources. You will be billed for the AWS resources used if you create
  a stack from this template. (qs-1qup6rai1)
Metadata:
  cfn-lint:
    config:
      ignore_checks:
        - W9006
  QuickStartDocumentation:
    EntrypointName: "Launch into a new VPC"
    Order: "1"
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Network Configuration
        Parameters:
          - AvailabilityZones
          - VPCCIDR
          - PrivateSubnet1CIDR
          - PrivateSubnet2CIDR
          - PublicSubnet1CIDR
          - PublicSubnet2CIDR
          - RDGWCIDR
      - Label:
          default: Amazon EC2 Configuration
        Parameters:
          - KeyPairName
          - ADServerInstanceType
          - ADServer1NetBIOSName
          - ADServer1PrivateIP
          - ADServer2NetBIOSName
          - ADServer2PrivateIP
          - DataDriveSizeGiB
          - RDGWInstanceType
          - WAPADFSInstanceType
          - WAPADFSEnableAdvancedAudtingandMetrics
      - Label:
          default: Microsoft Active Directory Configuration
        Parameters:
          - DomainDNSName
          - DomainNetBIOSName
          - DomainAdminUser
          - DomainAdminPassword
          - ADEnableAdvancedAudtingandMetrics
      - Label:
          default: Microsoft Active Directory Certificate Services Configuration
        Parameters:
          - PKI
          - OrCaServerNetBIOSName
          - EntCaServerNetBIOSName
          - PKIEnableAdvancedAudtingandMetrics
      - Label:
          default: Microsoft Remote Desktop Gateway Configuration
        Parameters:
          - NumberOfRDGWHosts
      - Label:
          default: AWS Quick Start Configuration
        Parameters:
          - QSS3BucketName
          - QSS3BucketRegion
          - QSS3KeyPrefix
    ParameterLabels:
      ADEnableAdvancedAudtingandMetrics:
        default: Advanced Auditing and Metrics for Domain Controller Instance
      ADServerInstanceType:
        default: Domain Controller 1 instance type
      ADServer1NetBIOSName:
        default: Domain Controller 1 NetBIOS name
      ADServer1PrivateIP:
        default: Domain Controller 1 private IP address
      ADServer2NetBIOSName:
        default: Domain Controller 2 NetBIOS Name
      ADServer2PrivateIP:
        default: Domain Controller 2 private IP address
      AvailabilityZones:
        default: Availability Zones
      DataDriveSizeGiB:
        default: Size of the domain controller data drive
      DomainAdminPassword:
        default: Domain Admin password
      DomainAdminUser:
        default: Domain Admin username
      DomainDNSName:
        default: Domain DNS name
      DomainNetBIOSName:
        default: Domain NetBIOS name
      EntCaServerNetBIOSName:
        default: Enterprise Root CA NetBIOS name
      KeyPairName:
        default: Key Pair name
      NumberOfRDGWHosts:
        default: Number of RDGW hosts
      OrCaServerNetBIOSName:
        default: Offline Root CA NetBIOS name
      PKI:
        default: Deploy PKI infrastructure
      PKIEnableAdvancedAudtingandMetrics:
        default: Advanced Auditing and Metrics for PKI Instance(s)
      PrivateSubnet1CIDR:
        default: Private Subnet 1 CIDR
      PrivateSubnet2CIDR:
        default: Private Subnet 2 CIDR
      PublicSubnet1CIDR:
        default: Public Subnet 1 CIDR
      PublicSubnet2CIDR:
        default: Public Subnet 2 CIDR
      QSS3BucketName:
        default: Quick Start S3 bucket name
      QSS3BucketRegion:
        default: Quick Start S3 bucket region
      QSS3KeyPrefix:
        default: Quick Start S3 key prefix
      RDGWCIDR:
        default: Allowed Remote Desktop Gateway external access CIDR
      RDGWInstanceType:
        default: Remote Desktop Gateway instance type
      VPCCIDR:
        default: VPC CIDR
      WAPADFSInstanceType:
        default: WAP and ADFS Server instance type
      WAPADFSEnableAdvancedAudtingandMetrics:
        default: Advanced Auditing and Metrics for WAP and ADFS Instances
Parameters:
  ADEnableAdvancedAudtingandMetrics:
    AllowedValues:
      - 'true'
      - 'false'
    Default: 'false'
    Description: Enable advanced auditing and metrics and upload them to CloudWatch using the Amazon Kinesis Agent for Microsoft Windows
    Type: String
  ADServerInstanceType:
    AllowedValues:
      - t3.medium
      - t3.large
      - t3.xlarge
      - t3.2xlarge
      - m5.large
      - m5.xlarge
      - m5.2xlarge
      - m5.4xlarge
    Default: m5.large
    Description: Amazon EC2 instance type for the Active Directory instances
    Type: String
  ADServer1NetBIOSName:
    AllowedPattern: '[a-zA-Z0-9\-]+'
    Default: DC1
    Description: NetBIOS name of the first Active Directory server (up to 15 characters)
    MaxLength: '15'
    MinLength: '1'
    Type: String
  ADServer1PrivateIP:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$
    Default: 10.0.0.10
    Description: Fixed private IP for the first Active Directory server located in Availability Zone 1
    Type: String
  ADServer2NetBIOSName:
    AllowedPattern: '[a-zA-Z0-9\-]+'
    Default: DC2
    Description: NetBIOS name of the second Active Directory server (up to 15 characters)
    MaxLength: '15'
    MinLength: '1'
    Type: String
  ADServer2PrivateIP:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$
    Default: 10.0.32.10
    Description: Fixed private IP for the second Active Directory server located in Availability Zone 2
    Type: String
  AvailabilityZones:
    Description: 'List of Availability Zones to use for the subnets in the VPC. Note: The logical order is preserved and only 2 AZs are used for this deployment.'
    Type: List<AWS::EC2::AvailabilityZone::Name>
  DataDriveSizeGiB:
    Default: '20'
    Description: Size of data drive that contains SYSVOL and NTDS
    Type: Number
  DomainAdminPassword:
    AllowedPattern: (?=^.{6,255}$)((?=.*\d)(?=.*[A-Z])(?=.*[a-z])|(?=.*\d)(?=.*[^A-Za-z0-9])(?=.*[a-z])|(?=.*[^A-Za-z0-9])(?=.*[A-Z])(?=.*[a-z])|(?=.*\d)(?=.*[A-Z])(?=.*[^A-Za-z0-9]))^.*
    Description: Password for the alternate domain admin user. Must be at least 8 characters containing letters, numbers and symbols
    MaxLength: '32'
    MinLength: '8'
    NoEcho: 'true'
    Type: String
  DomainAdminUser:
    AllowedPattern: '[a-zA-Z0-9]*'
    Default: Admin
    Description: User name for the account that will be added as alternate Domain Administrator. This is separate from the default "Administrator" account
    MaxLength: '25'
    MinLength: '5'
    Type: String
  DomainDNSName:
    AllowedPattern: '^([a-zA-Z0-9]+[\.\-])+([a-zA-Z0-9])+$'
    Default: example.com
    Description: Fully qualified domain name (FQDN) of the forest root domain e.g. example.com
    MaxLength: '25'
    MinLength: '3'
    Type: String
  DomainNetBIOSName:
    AllowedPattern: '[a-zA-Z0-9\-]+'
    Default: example
    Description: NetBIOS name of the domain (up to 15 characters) for users of earlier versions of Windows e.g. EXAMPLE
    MaxLength: '15'
    MinLength: '1'
    Type: String
  EntCaServerNetBIOSName:
    AllowedPattern: '[a-zA-Z0-9\-]+'
    Default: ENTCA1
    Description: NetBIOS name of the Enterprise Root or Subordinate CA server (up to 15 characters)
    MaxLength: '15'
    MinLength: '1'
    Type: String
  KeyPairName:
    Description: Public/private key pairs allow you to securely connect to your instance after it launches
    Type: AWS::EC2::KeyPair::KeyName
  NumberOfRDGWHosts:
    AllowedValues:
      - '0'
      - '1'
      - '2'
      - '3'
      - '4'
    Default: '0'
    Description: Enter the number of Remote Desktop Gateway hosts to create
    Type: String
  OrCaServerNetBIOSName:
    AllowedPattern: '[a-zA-Z0-9\-]+'
    Default: ORCA1
    Description: NetBIOS name of the Offline Root CA server (Only Used For Two Tier PKI) (up to 15 characters)
    MaxLength: '15'
    MinLength: '1'
    Type: String
  PKI:
    AllowedValues:
      - One-Tier
      - Two-Tier
      - 'No'
    Default: One-Tier
    Description: Do you want to Deploy PKI Infrastructure if so what kind, Two Tier or One Tier
    Type: String
  PKIEnableAdvancedAudtingandMetrics:
    AllowedValues:
      - 'true'
      - 'false'
    Default: 'false'
    Description: Enable advanced auditing and metrics and upload them to CloudWatch using the Amazon Kinesis Agent for Microsoft Windows
    Type: String
  PrivateSubnet1CIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
    Default: 10.0.0.0/19
    Description: CIDR block for private subnet 1 located in Availability Zone 1.
    Type: String
  PrivateSubnet2CIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
    Default: 10.0.32.0/19
    Description: CIDR block for private subnet 2 located in Availability Zone 2.
    Type: String
  PublicSubnet1CIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
    Default: 10.0.128.0/20
    Description: CIDR Block for the public DMZ subnet 1 located in Availability Zone 1
    Type: String
  PublicSubnet2CIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
    Default: 10.0.144.0/20
    Description: CIDR Block for the public DMZ subnet 2 located in Availability Zone 2
    Type: String
  QSS3BucketName:
    AllowedPattern: ^[0-9a-zA-Z]+([0-9a-zA-Z-]*[0-9a-zA-Z])*$
    ConstraintDescription: Quick Start bucket name can include numbers, lowercase letters, uppercase letters, and hyphens (-). It cannot start or end with a hyphen (-).
    Default: aws-quickstart
    Description: S3 bucket name for the Quick Start assets. Quick Start bucket name can include numbers, lowercase letters, uppercase letters, and hyphens (-). It cannot start or end with a hyphen (-).
    Type: String
  QSS3BucketRegion:
    Default: us-east-1
    Description: The AWS Region where the Quick Start S3 bucket (QSS3BucketName) is hosted. When using your own bucket, you must specify this value.
    Type: String
  QSS3KeyPrefix:
    AllowedPattern: ^[0-9a-zA-Z-/]*$
    ConstraintDescription: Quick Start key prefix can include numbers, lowercase letters, uppercase letters, hyphens (-), and forward slash (/).
    Default: quickstart-microsoft-wapadfs/
    Description: S3 key prefix for the Quick Start assets. Quick Start key prefix can include numbers, lowercase letters, uppercase letters, hyphens (-), and forward slash (/).
    Type: String
  RDGWCIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/x
    Description: Allowed CIDR Block for external access to the Remote Desktop Gateways
    Type: String
  RDGWInstanceType:
    AllowedValues:
      - t2.small
      - t2.medium
      - t2.large
      - t3.micro
      - t3.small
      - t3.medium
      - t3.large
      - t3.xlarge
      - t3.2xlarge
      - t3a.micro
      - t3a.small
      - t3a.medium
      - t3a.large
      - t3a.xlarge
      - t3a.2xlarge
      - m5.large
      - m5.xlarge
      - m5.2xlarge
      - m5.4xlarge
      - m5a.large
      - m5a.xlarge
      - m5a.2xlarge
    Default: m5.large
    Description: Amazon EC2 instance type for the Remote Desktop Gateway instances
    Type: String
  VPCCIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
    Default: 10.0.0.0/16
    Description: CIDR Block for the VPC
    Type: String
  WAPADFSInstanceType:
    AllowedValues:
      - t3.medium
      - t3.large
      - t3.xlarge
      - t3.2xlarge
      - m5.large
      - m5.xlarge
      - m5.2xlarge
      - m5.4xlarge
    Default: m5.large
    Description: Amazon EC2 instance type for the WAP and ADFS servers
    Type: String
  WAPADFSEnableAdvancedAudtingandMetrics:
    AllowedValues:
      - 'true'
      - 'false'
    Default: 'false'
    Description: Enable advanced auditing and metrics and upload them to CloudWatch using the Amazon Kinesis Agent for Microsoft Windows
    Type: String
Conditions:
  IncludeRDGW: !Not
    - !Equals
      - !Ref NumberOfRDGWHosts
      - '0'
  UsingDefaultBucket: !Equals [!Ref QSS3BucketName, 'aws-quickstart']
Resources:
  VPCStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL:
        !Sub
          - 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}submodules/quickstart-aws-vpc/templates/aws-vpc.template.yaml'
          - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion]
            S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
      Parameters:
        AvailabilityZones: !Join
          - ','
          - !Ref 'AvailabilityZones'
        NumberOfAZs: '2'
        PrivateSubnet1ACIDR: !Ref 'PrivateSubnet1CIDR'
        PrivateSubnet2ACIDR: !Ref 'PrivateSubnet2CIDR'
        PublicSubnet1CIDR: !Ref 'PublicSubnet1CIDR'
        PublicSubnet2CIDR: !Ref 'PublicSubnet2CIDR'
        VPCCIDR: !Ref 'VPCCIDR'
  ADStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL:
        !Sub
          - 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}submodules/quickstart-microsoft-activedirectory/templates/ad-1.template'
          - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion]
            S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
      Parameters:
        ADServer1InstanceType: !Ref 'ADServerInstanceType'
        ADServer1NetBIOSName: !Ref 'ADServer1NetBIOSName'
        ADServer1PrivateIP: !Ref 'ADServer1PrivateIP'
        ADServer2InstanceType: !Ref 'ADServerInstanceType'
        ADServer2NetBIOSName: !Ref 'ADServer2NetBIOSName'
        ADServer2PrivateIP: !Ref 'ADServer2PrivateIP'
        DataDriveSizeGiB: !Ref 'DataDriveSizeGiB'
        DomainAdminPassword: !Ref 'DomainAdminPassword'
        DomainAdminUser: !Ref 'DomainAdminUser'
        DomainDNSName: !Ref 'DomainDNSName'
        DomainNetBIOSName: !Ref 'DomainNetBIOSName'
        EnableAdvancedAudtingandMetrics: !Ref ADEnableAdvancedAudtingandMetrics
        PKI: !Ref 'PKI'
        PKIEnableAdvancedAudtingandMetrics: !Ref PKIEnableAdvancedAudtingandMetrics
        OrCaServerNetBIOSName: !Ref 'OrCaServerNetBIOSName'
        EntCaServerNetBIOSName: !Ref 'EntCaServerNetBIOSName'
        KeyPairName: !Ref 'KeyPairName'
        PrivateSubnet1ID: !GetAtt 'VPCStack.Outputs.PrivateSubnet1AID'
        PrivateSubnet2ID: !GetAtt 'VPCStack.Outputs.PrivateSubnet2AID'
        QSS3BucketName: !Ref 'QSS3BucketName'
        QSS3BucketRegion: !Ref 'QSS3BucketRegion'
        QSS3KeyPrefix: !Sub '${QSS3KeyPrefix}submodules/quickstart-microsoft-activedirectory/'
        VPCCIDR: !Ref 'VPCCIDR'
        VPCID: !GetAtt 'VPCStack.Outputs.VPCID'
  RDGWStack:
    Condition: IncludeRDGW
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL:
        !Sub
          - 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}submodules/quickstart-microsoft-rdgateway/templates/rdgw-domain.template'
          - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion]
            S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
      Parameters:
        DomainAdminPassword: !Ref 'DomainAdminPassword'
        DomainAdminUser: !Ref 'DomainAdminUser'
        DomainDNSName: !Ref 'DomainDNSName'
        DomainMemberSGID: !GetAtt 'ADStack.Outputs.DomainMemberSGID'
        DomainNetBIOSName: !Ref 'DomainNetBIOSName'
        KeyPairName: !Ref 'KeyPairName'
        NumberOfRDGWHosts: !Ref 'NumberOfRDGWHosts'
        PublicSubnet1ID: !GetAtt 'VPCStack.Outputs.PublicSubnet1ID'
        PublicSubnet2ID: !GetAtt 'VPCStack.Outputs.PublicSubnet2ID'
        QSS3BucketName: !Ref 'QSS3BucketName'
        QSS3BucketRegion: !Ref 'QSS3BucketRegion'
        QSS3KeyPrefix: !Sub '${QSS3KeyPrefix}submodules/quickstart-microsoft-rdgateway/'
        RDGWInstanceType: !Ref 'RDGWInstanceType'
        RDGWCIDR: !Ref 'RDGWCIDR'
        VPCID: !GetAtt 'VPCStack.Outputs.VPCID'
  WAPADFSStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL:
        !Sub
          - 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}templates/wap-adfs.template'
          - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion]
            S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
      Parameters:
        DomainAdminUserSecret: !GetAtt 'ADStack.Outputs.ADSecretsArn'
        DomainController1IP: !Ref 'ADServer1PrivateIP'
        DomainController2IP: !Ref 'ADServer2PrivateIP'
        DomainDNSName: !Ref 'DomainDNSName'
        DomainMemberSGID: !GetAtt 'ADStack.Outputs.DomainMemberSGID'
        DomainNetBIOSName: !Ref 'DomainNetBIOSName'
        EnableAdvancedAudtingandMetrics: !Ref WAPADFSEnableAdvancedAudtingandMetrics
        KeyPairName: !Ref 'KeyPairName'
        PrivateSubnet1ID: !GetAtt 'VPCStack.Outputs.PrivateSubnet1AID'
        PrivateSubnet2ID: !GetAtt 'VPCStack.Outputs.PrivateSubnet2AID'
        PublicSubnet1ID: !GetAtt 'VPCStack.Outputs.PublicSubnet1ID'
        PublicSubnet2ID: !GetAtt 'VPCStack.Outputs.PublicSubnet2ID'
        QSS3BucketName: !Ref 'QSS3BucketName'
        QSS3BucketRegion: !Ref 'QSS3BucketRegion'
        QSS3KeyPrefix: !Ref 'QSS3KeyPrefix'
        VPCCIDR: !Ref 'VPCCIDR'
        VPCID: !GetAtt 'VPCStack.Outputs.VPCID'
        WAPADFSInstanceType: !Ref 'WAPADFSInstanceType'