keeping-secrets-vpc-20181108.yaml

# Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Permission is hereby granted, free of charge, to any person obtaining a copy of this
# software and associated documentation files (the "Software"), to deal in the Software
# without restriction, including without limitation the rights to use, copy, modify,
# merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
# permit persons to whom the Software is furnished to do so.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
# INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
# PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
# HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
# OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
# SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

# Keeping Secrets VPC.yaml
#
# This CloudFormation template creates the core VPC infrastructure for
#
# AWS Security Services.
#
# The template builds the following resources:
#
# - an Amazon VPC
# - an internet gateway with a gateway attachment to the VPC
# - a route table
# - a default route
#
# It also exports:
#
# - the VPC
# - the route table
# - the session manager subnets
# - the secrets manager subnets (on which the database will go)

---
AWSTemplateFormatVersion: '2010-09-09'

Description: VPC for 2018 re:Invent Keeping Secrets chalk talk.

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      -
        Label:
          default: 'Core Parameters'
        Parameters:
          - VpcCidrOctet1
          - VpcCidrOctet2
          - NamePrefix
          - ProjectTag
    ParameterLabels: 
      VpcCidrOctet1:
        default: 'Enter the value for the first octet of the VPC CIDR block:'
      VpcCidrOctet2:
        default: 'Enter the value for the second octet of the VPC CIDR block:'
      NamePrefix:
        default: 'Enter a prefix for the CloudFormation Name tag values:'
      ProjectTag:
        default: 'Enter the value for the Project tag:'

Parameters:

# VpcCidrOctet1 - First octet of VPC CIDR block

  VpcCidrOctet1:
    Type: Number
    AllowedValues:
    - 10
    - 172
    - 192
    Default: 10

# VpcCidrOctet2 - Second octet of VPC CIDR block

  VpcCidrOctet2:
    Type: Number
    MinValue: 1
    MaxValue: 254
    Default: 200

# NamePrefix - A prefix to apply to the Name tag of taggable resources.
# The Name tag will be set to the NamePrefix, a dash ("-"), and a suffix
# that varies based on the resource.  You would typically accept the default.

  NamePrefix:
    Type: String
    Default: 'keepingsecrets'
    MinLength: 2
    MaxLength: 15
    AllowedPattern: '[a-zA-Z][a-zA-Z0-9]*'

# ProjectTag - A value to apply to the Project tag of taggable resources. You
# would typically accept the default.

  ProjectTag:
    Type: String
    Default: 'keepingsecrets'
    MinLength: 2
    MaxLength: 15
    AllowedPattern: '[a-zA-Z][a-zA-Z0-9]*'

Resources:

# Vpc - Our VPC

  Vpc:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock:
        !Join
        - ''
        - - !Ref VpcCidrOctet1
          - '.'
          - !Ref VpcCidrOctet2
          - '.0.0/16'
      EnableDnsSupport: 'true'
      EnableDnsHostnames: 'true'
      Tags:
      - Key: Name
        Value: !Join [ '', [ Ref: NamePrefix, '-vpc' ]]
      - Key: Project
        Value: !Ref ProjectTag

# VpcIgw and VpcIgwAttachment - Set up the Internet gateway
# and the attachment.

  VpcIgw:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
      - Key: Name
        Value: !Join [ '', [ Ref: NamePrefix, '-igw' ]]
      - Key: Project
        Value: !Ref ProjectTag

  VpcIgwAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref VpcIgw
      VpcId: !Ref Vpc

# PublicRouteTable - The public route table

  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    DependsOn: VpcIgwAttachment
    Properties:
      VpcId: !Ref Vpc
      Tags:
      - Key: Name
        Value: !Join [ '', [ Ref: NamePrefix, '-rtb' ]]
      - Key: Project
        Value: !Ref ProjectTag

# DefaultPublicRoute - The default route to the public internet.

  DefaultPublicRoute:
    Type: AWS::EC2::Route
    DependsOn: VpcIgwAttachment
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref VpcIgw
      RouteTableId: !Ref PublicRouteTable

# LambdaExecutionRole - Lambda excution role for our Lambda functions
#
# I am using the same Lambda execution role for all of the functions.
# In a production scenario, I would use separate Lambda roles tailored to
# each Lambda function to enforce the principle of least privilege.

  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: '/'
      Policies:
      - PolicyName: root
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            Resource: arn:aws:logs:*:*:*
          - Effect: Allow
            Action:
            - ec2:DescribeVpcEndpointServices
            Resource: '*'

# VpcEndpointServiceAzsFunction
#
# This is the AWS Lambda function that supports a CloudFormation custom
# resource that is used to look up the available Availability Zones for
# a VPC interface endpoint service.  VPC interface endpoints may only be
# offered in some, perhaps not all, AZs within a given region. This function
# can help you to design CloudFormation templates that choose subnets based
# on their ability to provide such endpoint interfaces.
#
# Resource properties (e.g. input "parameters") for the function:
#
# ServiceName - required - string - the name of the service.  This should be
# something like 'com.amazonaws.us-east-1.secretsmanager'
#
# DesiredNumAzs - required - string - the minimum number of Availability Zones
# that must offer the service (usually '2' or '3').  This should be a whole
# number (i.e. a non-negative integer).
#
#
# Return values via GetAtt:
#
# NumAzs - string - the number of Availability Zones that offer the interface
# endpoint.
#
# Azs - string - a comma-separated list of the AZs.
#
# Errors:
#
# If there are any errors, the Lambda function returns a FAILED status which
# normally triggers a rollback in AWS CloudFormation.   You can see the errors
# in the Amazon CloudWatch Logs.
#
# Notes:
#
# (1) Lambda function code inside of CloudFormation templates cannot exceed
# 4096 characters.

  VpcEndpointServiceAzsFunction:
    Type: AWS::Lambda::Function
    Properties: 
      Description: 'Look up the AZs that are available for a VPC endpoint for a service'
      Handler: index.handler
      MemorySize: 128
      Role: !GetAtt LambdaExecutionRole.Arn
      Runtime: 'python3.6'
      Timeout: 30
      Code:
        ZipFile: |
          import boto3
          import cfnresponse
          import uuid
          import json

          def handler(event, context):

            responseData = {}      
            responseData['StackId'] = event['StackId']
            responseData['RequestId'] = event['RequestId']
            responseData['LogicalResourceId'] = event['LogicalResourceId']

            if event['RequestType'] == 'Delete':
              responseData['Status'] = cfnresponse.SUCCESS
              cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData)
              return

            # Since we are creating or updating the resource, create a new
            # PhysicalResourceId.
            
            responseData['PhysicalResourceId'] = (
              'VpcEndpointServiceAZs' +
              str(uuid.uuid1())
            )

            try:
              desiredNumAzsStr = event['ResourceProperties']['DesiredNumAzs']
              desiredNumAzs = int(desiredNumAzsStr)
            except:
              responseData['Status'] = cfnresponse.FAILED
              responseData['Reason'] = (
                'DesiredNumAzs is required and must be a whole number'
              )
              print(responseData['Reason'])
              cfnresponse.send(event, context, cfnresponse.FAILED, responseData)
              return

            if desiredNumAzs < 0:
              responseData['Status'] = cfnresponse.FAILED
              responseData['Reason'] = (
                'DesiredNumAzs is required and must be a whole number'
              )
              print(responseData['Reason'])
              cfnresponse.send(event, context, cfnresponse.FAILED, responseData)
              return

            try:
              ec2=boto3.client('ec2')
            except:
              responseData['Status'] = cfnresponse.FAILED
              responseData['Reason'] = 'unable to set up ec2 client'
              print(responseData['Reason'])
              cfnresponse.send(event, context, cfnresponse.FAILED, responseData)
              return
            
            try:
              serviceName = event['ResourceProperties']['ServiceName']
              response = ec2.describe_vpc_endpoint_services(
                ServiceNames = [ serviceName ]
              )
            except:
              responseData['Status'] = cfnresponse.FAILED
              responseData['Reason'] = 'unable to rerieve endpoint service info'
              print(responseData['Reason'])
              cfnresponse.send(event, context, cfnresponse.FAILED, responseData)
              return
            
            print(json.dumps(response))
            
            numberOfServices = len(response['ServiceDetails'])
            if numberOfServices != 1:
              responseData['Status'] = cfnresponse.FAILED
              responseData['Reason'] = (
                'number of services should be 1 but is: ' +
                str(numberOfServices)
              )
              print(responseData['Reason'])
              cfnresponse.send(event, context, cfnresponse.FAILED, responseData)
              return
            
            Azs = response['ServiceDetails'][0]['AvailabilityZones']
            numAzs = len(Azs)
            if numAzs < desiredNumAzs:
              responseData['Status'] = cfnresponse.FAILED
              responseData['Reason'] = (
                'insufficient number of availability zones - found: ' + 
                str(numAzs)
              )
              print(responseData['Reason'])
              cfnresponse.send(event, context, cfnresponse.FAILED, responseData)
              return
            
            responseData['Status'] = cfnresponse.SUCCESS
            responseData['NumAzs'] = str(numAzs)
            responseData['Azs'] = ','.join(Azs)
            
            cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData)
            return

# VpcEndpointSeviceAzsLogGroup - CloudWatch Logs log group for
# VpcEndPointServiceAzsFunction

  VpcEndpointServiceAzsLogGroup:
    Type: AWS::Logs::LogGroup
    Properties: 
      LogGroupName: !Join [ '', [ '/aws/lambda/', Ref: VpcEndpointServiceAzsFunction ] ]
      RetentionInDays: 1

# SecretsManagerAzs:  Look up the AZs that offer AWS Secrets Manager interface
# endpoints

  SecretsManagerAzs:
    Type: Custom::SecretsManagerAzs
    DependsOn: VpcEndpointServiceAzsLogGroup
    Properties:
      ServiceToken: !GetAtt VpcEndpointServiceAzsFunction.Arn
      ServiceName:
        !Join
        - ''
        - - 'com.amazonaws.'
          - !Ref 'AWS::Region'
          - '.secretsmanager'
      DesiredNumAzs: 2

# SessionManagerAzs:  Look up the AZs that offer AWS Systems Manager interface
# endpoints

  SessionManagerAzs:
    Type: Custom::SessionManagerAzs
    DependsOn: VpcEndpointServiceAzsLogGroup
    Properties:
      ServiceToken: !GetAtt VpcEndpointServiceAzsFunction.Arn
      ServiceName:
        !Join
        - ''
        - - 'com.amazonaws.'
          - !Ref 'AWS::Region'
          - '.ssmmessages'
      DesiredNumAzs: 2

# SecretsMgrSubnet01 and SecretsMgrSubnet02 - Note that the EC2 and
# RDS instances will only go into SecretsMgrSubnet01.  We need, however, another
# subnet for the DB subnet group regardless.

  SecretsMgrSubnet01:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Select [0, !Split [",", !GetAtt SecretsManagerAzs.Azs]]
      CidrBlock:
        !Join
        - ''
        - - !Ref VpcCidrOctet1
          - '.'
          - !Ref VpcCidrOctet2
          - '.11.0/24'
      MapPublicIpOnLaunch: 'true'
      Tags:
      - Key: Name
        Value: !Join [ '', [ Ref: NamePrefix, '-secretsmgrsn01' ]]
      - Key: Project
        Value: !Ref ProjectTag
      VpcId: !Ref Vpc

  SecretsMgrSubnet02:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Select [1, !Split [",", !GetAtt SecretsManagerAzs.Azs]]
      CidrBlock:
        !Join
        - ''
        - - !Ref VpcCidrOctet1
          - '.'
          - !Ref VpcCidrOctet2
          - '.12.0/24'
      MapPublicIpOnLaunch: 'true'
      Tags:
      - Key: Name
        Value: !Join [ '', [ Ref: NamePrefix, '-secretsmgrsn02' ]]
      - Key: Project
        Value: !Ref ProjectTag
      VpcId: !Ref Vpc

# SessionMgrSubnet01 and 02: Subnets for the Session Manaager Endpoint
 
  SessionMgrSubnet01:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Select [0, !Split [",", !GetAtt SessionManagerAzs.Azs]]
      CidrBlock:
        !Join
        - ''
        - - !Ref VpcCidrOctet1
          - '.'
          - !Ref VpcCidrOctet2
          - '.21.0/24'
      MapPublicIpOnLaunch: 'true'
      Tags:
      - Key: Name
        Value: !Join [ '', [ Ref: NamePrefix, '-sessmgrsn01' ]]
      - Key: Project
        Value: !Ref ProjectTag
      VpcId: !Ref Vpc

  SessionMgrSubnet02:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Select [1, !Split [",", !GetAtt SessionManagerAzs.Azs]]
      CidrBlock:
        !Join
        - ''
        - - !Ref VpcCidrOctet1
          - '.'
          - !Ref VpcCidrOctet2
          - '.22.0/24'
      MapPublicIpOnLaunch: 'true'
      Tags:
      - Key: Name
        Value: !Join [ '', [ Ref: NamePrefix, '-sessmgrsn01' ]]
      - Key: Project
        Value: !Ref ProjectTag
      VpcId: !Ref Vpc

# Associate subnets with the routng table.

  SecretsMgrSubnet01Rtb:
    Type: AWS::EC2::SubnetRouteTableAssociation
    DependsOn: VpcIgwAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref SecretsMgrSubnet01

  SecretsMgrSubnet02Rtb:
    Type: AWS::EC2::SubnetRouteTableAssociation
    DependsOn: VpcIgwAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref SecretsMgrSubnet02

  SessionMgrSubnet01Rtb:
    Type: AWS::EC2::SubnetRouteTableAssociation
    DependsOn: VpcIgwAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref SessionMgrSubnet01

  SessionMgrSubnet02Rtb:
    Type: AWS::EC2::SubnetRouteTableAssociation
    DependsOn: VpcIgwAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref SessionMgrSubnet02

Outputs:
  VpcId:
    Value: !Ref Vpc
    Export: 
      Name: VpcId

  PublicRouteTableId:
    Value: !Ref PublicRouteTable
    Export: 
      Name: PublicRouteTableId

  SecretsMgrSubnet01Id:
    Value: !Ref SecretsMgrSubnet01
    Export: 
      Name: SecretsMgrSubnet01Id

  SecretsMgrSubnet01Az:
    Value: !GetAtt SecretsMgrSubnet01.AvailabilityZone
    Export:
      Name: SecretsMgrSubnet01Az

  SecretsMgrSubnet02Id:
    Value: !Ref SecretsMgrSubnet02
    Export: 
      Name: SecretsMgrSubnet02Id

  SecretsMgrSubnet02Az:
    Value: !GetAtt SecretsMgrSubnet02.AvailabilityZone
    Export:
      Name: SecretsMgrSubnet02Az

  SessionMgrSubnet01Id:
    Value: !Ref SessionMgrSubnet01
    Export: 
      Name: SessionMgrSubnet01Id

  SessionMgrSubnet01Az:
    Value: !GetAtt SessionMgrSubnet01.AvailabilityZone
    Export:
      Name: SessionMgrSubnet01Az

  SessionMgrSubnet02Id:
    Value: !Ref SessionMgrSubnet02
    Export:
      Name: SessionMgrSubnet02Id

  SessionMgrSubnet02Az:
    Value: !GetAtt SessionMgrSubnet02.AvailabilityZone
    Export:
      Name: SessionMgrSubnet02Az

  NamePrefix:
    Value: !Ref NamePrefix
    Export:
      Name: NamePrefix

  ProjectTag:
    Value: !Ref ProjectTag
    Export:
      Name: ProjectTag

  VpcCidrOctet1:
    Value: !Ref VpcCidrOctet1
    Export:
      Name: VpcCidrOctet1

  VpcCidrOctet2:
    Value: !Ref VpcCidrOctet2
    Export:
      Name: VpcCidrOctet2