code-server-stack.yaml

#------------------------------------------------------
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: MIT-0 
#------------------------------------------------------
AWSTemplateFormatVersion: "2010-09-09"
Description: deploy a vscode-server on an ec2 
#------------------------------------------------------
# Mappings CloudFront PrefixListId 
#------------------------------------------------------
Mappings: 
  CloudFrontPrefixListIdMappings:
    us-west-2:
      PrefixListId: "pl-82a045eb"
    us-east-1: 
      PrefixListId: "pl-3b927c52"
    us-east-2:
      PrefixListId: "pl-b6a144df"
    ap-southeast-1:
      PrefixListId: "pl-31a34658"
#------------------------------------------------------
# Parameters
#------------------------------------------------------
Parameters:
  VPCID: 
    Description: imported vpc id
    Type: String
    Default: "" 
  SubnetID:
    Description: imported subnet id
    Type: String
    Default: ""
  InstanceType:
    Description: WebServer EC2 instance type
    Type: String
    Default: t2.xlarge
    ConstraintDescription: must be a valid EC2 instance type.
  LatestAmiId:
    Description: latest image id for ubuntu
    Type: "AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>" 
    # Default: "/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64"
    Default: "/aws/service/canonical/ubuntu/server/22.04/stable/current/amd64/hvm/ebs-gp2/ami-id" 
  InternetCidrBlock:
    Type: String
    Description: UserCidrBlock
    Default: 0.0.0.0/0
  VSCodeServerVersion:
    Type: String
    Description: VSCodeServerVersion
    Default: 4.91.1
  OriginRequestPolicyId: 
    Type: String
    Description: origin request policy id
    Default: 216adef6-5c7f-47e4-b989-5492eafa07d3  
Conditions:
  ImportVPCIDNotEmpty: 
    Fn::Not:
      - Fn::Equals:
          - Ref: VPCID
          - ""
  ImportSubnetIDNotEmpty: 
    Fn::Not:
      - Fn::Equals:
          - Ref: SubnetID
          - ""
#------------------------------------------------------
# Security Group
#------------------------------------------------------
Resources:
  VSCodeServerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W40
            reason: allow ingress from the cloudfront prefix list
          - id: W5
            reason: allow ingress from the cloudfront prefix list
    Properties:
      GroupDescription: allow ingress from cloudfront prefix list
      VpcId:
        Fn::If:
          - ImportVPCIDNotEmpty
          - Ref: VPCID
          - Ref: AWS::NoValue 

  VSCodeServerSecurityGroupIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      Description: open port 8080 for the cloudfront prefix list
      GroupId: 
        Fn::GetAtt:
          - VSCodeServerSecurityGroup
          - GroupId
      IpProtocol: tcp
      FromPort: 8080
      ToPort: 8080
      SourcePrefixListId:
        Fn::FindInMap:
          - CloudFrontPrefixListIdMappings
          - Ref: AWS::Region
          - PrefixListId

  VSCodeServerSecurityGroupEgress:
    Type: AWS::EC2::SecurityGroupEgress
    Properties:
      Description: egress for vscode security group
      GroupId:
        Fn::GetAtt:
          - VSCodeServerSecurityGroup
          - GroupId
      IpProtocol: -1
      CidrIp: !Ref InternetCidrBlock
#------------------------------------------------------
# Role and Instance Profile
#------------------------------------------------------
  VSCodeServerIAMRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM
      Policies:
        - PolicyName: SSMParameterAccess
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - ssm:PutParameter
                  - ssm:GetParameter
                Resource: !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/code-server/*"
  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - Ref: VSCodeServerIAMRole
#------------------------------------------------------
# Elastic IP for EC2 Instance
#------------------------------------------------------
  VSCodeServerEIP:
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: Name
          Value: VSCodeServer-EIP

  VSCodeServerEIPAssociation:
    Type: AWS::EC2::EIPAssociation
    Properties:
      AllocationId: !GetAtt VSCodeServerEIP.AllocationId
      InstanceId: !Ref VSCodeServer
#------------------------------------------------------
# EC2 Instance for VSCode Server
#------------------------------------------------------
  VSCodeServer:
    Type: AWS::EC2::Instance
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W40
            reason: allow tcp 8080 from the cloudfront prefix list
    Properties:
      ImageId: !Ref LatestAmiId
      InstanceType: !Ref InstanceType
      IamInstanceProfile: !Ref InstanceProfile
      Tags:
        - Key: Name
          Value: VSCodeServer 
      NetworkInterfaces:
        - DeviceIndex: "0"
          AssociatePublicIpAddress: "true"
          SubnetId:
            Fn::If:
              - ImportSubnetIDNotEmpty
              - Ref: SubnetID
              - Ref: AWS::NoValue 
          GroupSet:
            - Fn::GetAtt:
                - VSCodeServerSecurityGroup
                - GroupId
      Monitoring: true
      UserData:
        Fn::Base64:
          Fn::Sub:
            - |
              #!/bin/bash
              echo "INFO: Starting UserData script execution"
                          
              # Install AWS CLI
              echo "INFO: Installing AWS CLI prerequisites"
              apt-get -o DPkg::Lock::Timeout=-1 update
              DEBIAN_FRONTEND=noninteractive apt-get -o DPkg::Lock::Timeout=-1 install -y curl unzip
              echo "INFO: Prerequisites installed, downloading AWS CLI"
              curl -fsSL https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip -o /tmp/aws-cli.zip
              echo "INFO: Extracting AWS CLI"
              unzip -q -d /tmp /tmp/aws-cli.zip
              echo "INFO: Installing AWS CLI"
              sudo /tmp/aws/install
              rm -rf /tmp/aws /tmp/aws-cli.zip
              echo "INFO: AWS CLI installation complete"
              aws --version
              
              # Install code-server
              echo "INFO: Installing code-server"
              curl -fOL https://github.com/coder/code-server/releases/download/v${VERSION}/code-server_${VERSION}_amd64.deb
              sudo dpkg -i code-server_${VERSION}_amd64.deb
              echo "INFO: Enabling and starting code-server"
              sudo systemctl enable --now code-server@ubuntu
              sleep 30
              
              # Configure password
              echo "INFO: Configuring code-server"
              # sed -i.bak 's/auth: password/auth: none/' /home/ubuntu/.config/code-server/config.yaml
              # Expose code server service 
              sed -i.bak 's/bind-addr: 127.0.0.1:8080/bind-addr: 0.0.0.0:8080/' /home/ubuntu/.config/code-server/config.yaml
              
              # Restart code server
              echo "INFO: Restarting code-server"
              sudo systemctl restart code-server@ubuntu
              
              # Install extension amazonwebservices.amazon-q-vscode
              echo "INFO: Installing Amazon Q extension"
              sudo -u ubuntu code-server --install-extension amazonwebservices.amazon-q-vscode
              
              # Restart code server
              echo "INFO: Final restart of code-server"
              sudo systemctl restart code-server@ubuntu
              
              # Store password in SSM Parameter Store for easy retrieval
              echo "INFO: Storing password in SSM Parameter Store"
              sleep 10  # Wait for config file to be fully written
              CODE_SERVER_PASSWORD=$(sudo grep "^password:" /home/ubuntu/.config/code-server/config.yaml | cut -d' ' -f2)
              echo "INFO: Extracted password, creating SSM parameter"
              aws ssm put-parameter \
                --name "/code-server/password" \
                --value "$CODE_SERVER_PASSWORD" \
                --type "SecureString" \
                --region ${AWS::Region} \
                --overwrite
              echo "INFO: SSM parameter creation complete"
              echo "INFO: UserData script execution finished"
            - VERSION: !Ref VSCodeServerVersion
#------------------------------------------------------
# CloudFront Cached Policy
#------------------------------------------------------ 
  VSCodeServerCloudFrontCachePolicy:
    Type: AWS::CloudFront::CachePolicy
    Properties:
      CachePolicyConfig:
        DefaultTTL: 86400
        MaxTTL: 31536000
        MinTTL: 1
        Name: !Join ['-', ['VSCodeServer', !Select [4, !Split ['-', !Select [2, !Split ['/', !Ref AWS::StackId]]]]]]
        ParametersInCacheKeyAndForwardedToOrigin:
          CookiesConfig:
            CookieBehavior: all
          EnableAcceptEncodingGzip: False
          HeadersConfig:
            HeaderBehavior: whitelist
            Headers: 
              - Accept-Charset
              - Authorization
              - Origin
              - Accept
              - Referer
              - Host
              - Accept-Language
              - Accept-Encoding
              - Accept-Datetime
          QueryStringsConfig:
            QueryStringBehavior: all
#------------------------------------------------------
# CloudFront Distribution
#------------------------------------------------------ 
  VSCodeServerCloudFront:
    Type: AWS::CloudFront::Distribution
    DependsOn: VSCodeServerEIPAssociation
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W10
            reason: disable access logging for demo purpose 
          - id: W70
            reason: no TLS version for demo purpose 
    Properties:
      DistributionConfig:
        Origins:
          - DomainName: !GetAtt VSCodeServer.PublicDnsName
            Id: VS-code-server
            CustomOriginConfig:
              HTTPPort: 8080
              OriginProtocolPolicy: http-only
        Enabled: true
        DefaultCacheBehavior:
          AllowedMethods:
            - GET
            - HEAD
            - OPTIONS
            - PUT 
            - POST 
            - PATCH 
            - DELETE
          ForwardedValues:
            QueryString: 'false'
          Compress: false
          TargetOriginId: VS-code-server
          ViewerProtocolPolicy: allow-all
          OriginRequestPolicyId: !Ref OriginRequestPolicyId 
          CachePolicyId: !Ref VSCodeServerCloudFrontCachePolicy 
#------------------------------------------------------
# Exported output
#------------------------------------------------------ 
Outputs:
  VSCodeServerCloudFrontDomainName:
    Value: 
      !Sub 
        - "https://${domain}"
        - { domain: !GetAtt VSCodeServerCloudFront.DomainName }
    Export:
      Name: !Sub ${AWS::StackName}-domain-name
  VSCodeServerPublicIP:
    Value: !Ref VSCodeServerEIP
    Export:
      Name: !Sub ${AWS::StackName}-code-server-public-ip
  VSCodeServerPrivateIP:
    Value: !GetAtt VSCodeServer.PrivateIp
    Export:
      Name: !Sub ${AWS::StackName}-code-server-private-ip
  VSCodeServerRoleARN:
    Value: !GetAtt VSCodeServerIAMRole.Arn
    Export:
      Name: !Sub ${AWS::StackName}-code-server-role-arn
  VSCodeServerInstanceId:
    Value: !Ref VSCodeServer
    Export:
      Name: !Sub ${AWS::StackName}-code-server-instance-id
  VSCodeServerPasswordSSM:
    Description: SSM Parameter containing the code-server password
    Value: "/code-server/password"
    Export:
      Name: !Sub ${AWS::StackName}-code-server-password-ssm