vpc.yaml

#
# Copyright 2018 Eonian Technologies.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

#
# CloudFormation template that creates a three-zone VPC with public and private
# subnets in each zone. The VPC and subnet CIDRs are customizable as long as
# they are wihin the 10/8 private network space. The template privides options
# for customizing DNS and DHCP, adding VPC endpoints, and allowing internet
# egress for private subnets over NAT Gateways. Sensible NACL rules are set up
# for HTTP, HTTPS, and SSH. You should use always use security groups on your
# instances to limit access to specific services.
#
AWSTemplateFormatVersion: '2010-09-09'
Description: Three-zone VPC.
Parameters:
  VPCCidr:
    Type: String
    Description: The IPv4 CIDR for the VPC. Must be part of the 10.0.0.0/8 CIDR.
    AllowedPattern: "10\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
    ConstraintDescription: Must be an IP CIDR range in the form of 10.x.x.x/x.
    Default: 10.0.0.0/16
  AutoAssignPublicAddress:
    Type: String
    Description: Assigns public IP addresses to instances in the public subnets.
    AllowedValues:
    - 'Yes'
    - 'No'
    Default: 'Yes'
  EnableDnsSupport:
    Type: String
    Description: Enables the Amazon provided DNS server.
    AllowedValues:
    - 'Yes'
    - 'No'
    Default: 'Yes'
  EnableDnsHostnames:
    Type: String
    Description: Assign Amazon provided DNS names to instances.
    AllowedValues:
    - 'Yes'
    - 'No'
    Default: 'Yes'
    Type: String
  DomainName:
    Type: String
    Description: A custom domain for private DNS names. Must also specify Name Servers.
  NameServers:
    Type: String
    Description: Up to four IP addresses separated by commas.
  NTPServers:
    Type: String
    Description: Up to four IP addresses separated by commas. Leave empty to use AWS NTP servers.
  PublicSubnet1Cidr:
    Type: String
    Description: IPv4 CIDR for the first public subnet. Must be part of the VPC CIDR.
    AllowedPattern: "10\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
    ConstraintDescription: Must be a valid subnet CIDR.
    Default: 10.0.192.0/20
  PublicSubnet2Cidr:
    Type: String
    Description: IPv4 CIDR for the second public subnet. Must be part of the VPC CIDR.
    AllowedPattern: "10\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
    ConstraintDescription: Must be a valid subnet CIDR.
    Default: 10.0.208.0/20
  PublicSubnet3Cidr:
    Type: String
    Description: IPv4 CIDR for the third public subnet. Must be part of the VPC CIDR.
    AllowedPattern: "10\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
    ConstraintDescription: Must be a valid subnet CIDR.
    Default: 10.0.224.0/20
  PrivateSubnet1Cidr:
    Type: String
    Description: IPv4 CIDR for the first private subnet. Must be part of the VPC CIDR.
    AllowedPattern: "10\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
    ConstraintDescription: Must be a valid subnet CIDR.
    Default: 10.0.0.0/18
  PrivateSubnet2Cidr:
    Type: String
    Description: IPv4 CIDR for the second private subnet. Must be part of the VPC CIDR.
    AllowedPattern: "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
    ConstraintDescription: Must be a valid subnet CIDR.
    Default: 10.0.64.0/18
  PrivateSubnet3Cidr:
    Type: String
    Description: IPv4 CIDR for the third private subnet. Must be part of the VPC CIDR.
    AllowedPattern: "10\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
    ConstraintDescription: Must be a valid subnet CIDR.
    Default: 10.0.128.0/18
  PrivateZoneEgress:
    Type: String
    Description: Allow HTTP and HTTPS requests to the internet from the private subnets.
    AllowedValues:
    - 'Yes'
    - 'No'
    Default: 'Yes'
  S3Endpoint:
    Type: String
    Description: Creates an S3 endpoint and adds it to the route tables for the public and private zones.
    AllowedValues:
    - 'Yes'
    - 'No'
    Default: 'Yes'
  DynamoDBEndpoint:
    Type: String
    Description: Creates a DynamoDB endpoint and adds it to the route tables for the public and private zones.
    AllowedValues:
    - 'Yes'
    - 'No'
    Default: 'Yes'

# Metadata
Metadata:
  AWS::CloudFormation::Interface:

    # Parameter Groups
    ParameterGroups:
    - Label:
        default: VPC Information
      Parameters:
      - VPCCidr
      - AutoAssignPublicAddress
      - S3Endpoint
      - DynamoDBEndpoint
    - Label:
        default: Amazon Provided DNS
      Parameters:
      - EnableDnsSupport
      - EnableDnsHostnames
    - Label:
        default: Custom DNS (will disable Amazon Provided DNS)
      Parameters:
      - DomainName
      - NameServers
    - Label:
        default: Other DHCP Options
      Parameters:
      - NTPServers
    - Label:
        default: Public Subnets
      Parameters:
      - PublicSubnet1Cidr
      - PublicSubnet2Cidr
      - PublicSubnet3Cidr
    - Label:
        default: Private Subnets
      Parameters:
      - PrivateSubnet1Cidr
      - PrivateSubnet2Cidr
      - PrivateSubnet3Cidr
      - PrivateZoneEgress

    # Parameter Lables.
    ParameterLabels:
      VPCCidr:
        default: VPC CIDR
      EnableDnsSupport:
        default: Enable DNS support
      EnableDnsHostnames:
        default: Enable DNS host names
      AutoAssignPublicAddress:
        default: Auto-assign public IP
      DomainName:
        default: Domain name
      NameServers:
        default: Name servers
      NTPServers:
        default: NTP servers
      PublicSubnet1Cidr:
        default: Pubic subnet 1
      PublicSubnet2Cidr:
        default: Pubic subnet 2
      PublicSubnet3Cidr:
        default: Pubic subnet 3
      PrivateSubnet1Cidr:
        default: Private subnet 1
      PrivateSubnet2Cidr:
        default: Private subnet 2
      PrivateSubnet3Cidr:
        default: Private subnet 3
      PrivateZoneEgress:
        default: Internet access
      S3Endpoint:
        default: Create S3 endpoint
      DynamoDBEndpoint:
        default: Create DynamoDB endpoint

# Conditions.
Conditions:
  HasDomainName: !Not [!Equals ['', !Ref DomainName]]
  HasNameServers: !Not [!Equals ['', !Ref NameServers]]
  HasNTPServers: !Not [!Equals ['', !Ref NTPServers]]
  IsUsEast1: !Equals [us-east-1, !Ref 'AWS::Region']
  AutoAssignPublicIP: !Equals ['Yes', !Ref AutoAssignPublicAddress]
  EnableDNS: !And [ !Not [!Condition HasDomainName], !Not [!Condition HasNameServers], !Equals ['Yes', !Ref EnableDnsSupport]]
  EnableHostnames: !And [ !Not [!Condition HasDomainName], !Not [!Condition HasNameServers], !Equals ['Yes', !Ref EnableDnsHostnames]]
  HasPrivateZoneEgress: !Equals ['Yes', !Ref PrivateZoneEgress]
  HasS3Endpoint: !Equals ['Yes', !Ref S3Endpoint]
  HasDynamoDBEndpoint: !Equals ['Yes', !Ref DynamoDBEndpoint]

# Resources.
Resources:

  # VPC.
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VPCCidr
      InstanceTenancy: default
      EnableDnsSupport: !If [EnableDNS, true, false]
      EnableDnsHostnames: !If [EnableHostnames, true, false]
      Tags:
      - Key: Name
        Value: !Ref 'AWS::StackName'

  # Public Subnet 1.
  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Select [0, 'Fn::GetAZs': !Ref 'AWS::Region']
      CidrBlock: !Ref PublicSubnet1Cidr
      MapPublicIpOnLaunch: !If [AutoAssignPublicIP, true, false]
      Tags:
      - Key: Name
        Value: !Sub ${AWS::StackName}-public-subnet-1
      - Key: network-type
        Value: public
      VpcId: !Ref VPC

  # Public Subnet 2.
  PublicSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Select [1, 'Fn::GetAZs': !Ref 'AWS::Region']
      CidrBlock: !Ref PublicSubnet2Cidr
      MapPublicIpOnLaunch: !If [AutoAssignPublicIP, true, false]
      Tags:
      - Key: Name
        Value: !Sub ${AWS::StackName}-public-subnet-2
      - Key: network-type
        Value: public
      VpcId: !Ref VPC

  # Public subnet 3.
  PublicSubnet3:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Select [2, 'Fn::GetAZs': !Ref 'AWS::Region']
      CidrBlock: !Ref PublicSubnet3Cidr
      MapPublicIpOnLaunch: !If [AutoAssignPublicIP, true, false]
      Tags:
      - Key: Name
        Value: !Sub ${AWS::StackName}-public-subnet-3
      - Key: network-type
        Value: public
      VpcId: !Ref VPC

  # Private Subnet 1.
  PrivateSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Select [0, 'Fn::GetAZs': !Ref 'AWS::Region']
      CidrBlock: !Ref PrivateSubnet1Cidr
      MapPublicIpOnLaunch: false
      Tags:
      - Key: Name
        Value: !Sub ${AWS::StackName}-private-subnet-1
      - Key: network-type
        Value: private
      VpcId: !Ref VPC

  # Private Subnet 2.
  PrivateSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Select [1, 'Fn::GetAZs': !Ref 'AWS::Region']
      CidrBlock: !Ref PrivateSubnet2Cidr
      MapPublicIpOnLaunch: false
      Tags:
      - Key: Name
        Value: !Sub ${AWS::StackName}-private-subnet-2
      - Key: network-type
        Value: private
      VpcId: !Ref VPC

  # Private Subnet 3.
  PrivateSubnet3:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Select [2, 'Fn::GetAZs': !Ref 'AWS::Region']
      CidrBlock: !Ref PrivateSubnet3Cidr
      MapPublicIpOnLaunch: false
      Tags:
      - Key: Name
        Value: !Sub ${AWS::StackName}-private-subnet-3
      - Key: network-type
        Value: private
      VpcId: !Ref VPC

  # DHCP Options Set.
  DHCPOptionsSet:
    Type: AWS::EC2::DHCPOptions
    Properties:
      DomainName: !If [HasDomainName, !Ref DomainName, !If [IsUsEast1, ec2.internal, compute.internal]]
      DomainNameServers: !If [HasNameServers, !Split [',', !Ref NameServers], [AmazonProvidedDNS]]
      NtpServers: !If [HasNTPServers, !Split [',', !Ref NTPServers], !Ref 'AWS::NoValue']
      Tags:
      - Key: Name
        Value: !Sub ${AWS::StackName}-dhcp-options-set

  # Associate DHCP Options Set.
  DHCPOptionsAssociate:
    Type: AWS::EC2::VPCDHCPOptionsAssociation
    Properties:
      VpcId: !Ref VPC
      DhcpOptionsId: !Ref DHCPOptionsSet

  # Internet Gateway.
  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
      - Key: Name
        Value: !Sub ${AWS::StackName}-internet-gateway

  # Attach Internet Gateway.
  AttachInternetGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  # NAT Gateway for public subnet 1.
  PublicSubnet1NAT:
    Type: AWS::EC2::NatGateway
    Condition: HasPrivateZoneEgress
    DependsOn: AttachInternetGateway
    Properties:
      AllocationId: !GetAtt EIPPublicSubnet1NAT.AllocationId
      SubnetId: !Ref PublicSubnet1
      Tags:
      - Key: Name
        Value: !Sub ${AWS::StackName}-nat-gateway-public-1

  # EIP for PublicSubnet1NAT.
  EIPPublicSubnet1NAT:
    Type: AWS::EC2::EIP
    Condition: HasPrivateZoneEgress
    Properties:
      Domain: vpc

  # NAT Gateway for public subnet 2.
  PublicSubnet2NAT:
    Type: AWS::EC2::NatGateway
    Condition: HasPrivateZoneEgress
    DependsOn: AttachInternetGateway
    Properties:
      AllocationId: !GetAtt EIPPublicSubnet2NAT.AllocationId
      SubnetId: !Ref PublicSubnet2
      Tags:
      - Key: Name
        Value: !Sub ${AWS::StackName}-nat-gateway-public-2

  # EIP for PublicSubnet2NAT.
  EIPPublicSubnet2NAT:
    Type: AWS::EC2::EIP
    Condition: HasPrivateZoneEgress
    Properties:
      Domain: vpc

  # NAT Gateway for public subnet 3.
  PublicSubnet3NAT:
    Type: AWS::EC2::NatGateway
    Condition: HasPrivateZoneEgress
    DependsOn: AttachInternetGateway
    Properties:
      AllocationId: !GetAtt EIPPublicSubnet3NAT.AllocationId
      SubnetId: !Ref PublicSubnet3
      Tags:
      - Key: Name
        Value: !Sub ${AWS::StackName}-nat-gateway-public-3

  # EIP for PublicSubnet3NAT.
  EIPPublicSubnet3NAT:
    Type: AWS::EC2::EIP
    Condition: HasPrivateZoneEgress
    Properties:
      Domain: vpc

  # NACL for the public subnets.
  PublicNetworkAcl:
    Type: AWS::EC2::NetworkAcl
    Properties:
      VpcId: !Ref VPC
      Tags:
      - Key: Name
        Value: !Sub ${AWS::StackName}-public-nacl

  # NACL for the private subnets.
  PrivateNetworkAcl:
    Type: AWS::EC2::NetworkAcl
    Properties:
      VpcId: !Ref VPC
      Tags:
      - Key: Name
        Value: !Sub ${AWS::StackName}-private-nacl

  # Network ACL Association for public subnet 1
  AssociateAclPublicSubnet1:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    Properties:
      NetworkAclId: !Ref PublicNetworkAcl
      SubnetId: !Ref PublicSubnet1

  # Network ACL Association for public subnet 2
  AssociateAclPublicSubnet2:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    Properties:
      NetworkAclId: !Ref PublicNetworkAcl
      SubnetId: !Ref PublicSubnet2

  # Network ACL Association for public subnet 3
  AssociateAclPublicSubnet3:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    Properties:
      NetworkAclId: !Ref PublicNetworkAcl
      SubnetId: !Ref PublicSubnet3

  # Network ACL Association for private subnet 1
  AssociateAclPrivateSubnet1:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    Properties:
      NetworkAclId: !Ref PrivateNetworkAcl
      SubnetId: !Ref PrivateSubnet1

  # Network ACL Association for private subnet 2
  AssociateAclPrivateSubnet2:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    Properties:
      NetworkAclId: !Ref PrivateNetworkAcl
      SubnetId: !Ref PrivateSubnet2

  # Network ACL Association for private subnet 3
  AssociateAclPrivateSubnet3:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    Properties:
      NetworkAclId: !Ref PrivateNetworkAcl
      SubnetId: !Ref PrivateSubnet3

  # Route table for the public subnets.
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
      - Key: Name
        Value: !Sub ${AWS::StackName}-route-table-public

  # Route table for private subnet 1.
  PrivateRouteTable1:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
      - Key: Name
        Value: !Sub ${AWS::StackName}-route-table-private-1

  # Route table for private subnet 2.
  PrivateRouteTable2:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
      - Key: Name
        Value: !Sub ${AWS::StackName}-route-table-private-2

  # Route table for private subnet 3.
  PrivateRouteTable3:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
      - Key: Name
        Value: !Sub ${AWS::StackName}-route-table-private-3

  # Route table association for public subnet 1.
  AssociateTablePublicSubnet1:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref PublicSubnet1

  # Route table association for public subnet 2.
  AssociateTablePublicSubnet2:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref PublicSubnet2

  # Route table association for public subnet 3.
  AssociateTablePublicSubnet3:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref PublicSubnet3

  # Route table association for private subnet 1.
  AssociateTablePrivateSubnet1:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateRouteTable1
      SubnetId: !Ref PrivateSubnet1

  # Route table association for private subnet 2.
  AssociateTablePrivateSubnet2:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateRouteTable2
      SubnetId: !Ref PrivateSubnet2

  # Route table association for private subnet 3.
  AssociateTablePrivateSubnet3:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateRouteTable3
      SubnetId: !Ref PrivateSubnet3

  # Route to the internet gateway.
  PublicRouteTableIGRoute:
    Type: AWS::EC2::Route
    DependsOn: AttachInternetGateway
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      RouteTableId: !Ref PublicRouteTable
      GatewayId: !Ref InternetGateway

  # Route to PublicSubnet1NAT.
  PrivateRouteTable1NATRoute:
    Type: AWS::EC2::Route
    Condition: HasPrivateZoneEgress
    Properties:
      RouteTableId: !Ref PrivateRouteTable1
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref PublicSubnet1NAT

  # Route to PublicSubnet2NAT.
  PrivateRouteTable2NATRoute:
    Type: AWS::EC2::Route
    Condition: HasPrivateZoneEgress
    Properties:
      RouteTableId: !Ref PrivateRouteTable2
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref PublicSubnet2NAT

  # Route to PublicSubnet3NAT.
  PrivateRouteTable3NATRoute:
    Type: AWS::EC2::Route
    Condition: HasPrivateZoneEgress
    Properties:
      RouteTableId: !Ref PrivateRouteTable3
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref PublicSubnet3NAT

  #
  # NACL Rules for the public subnets.
  #

  # Inbound to TCP/80 from anywhere.
  PublicAclIngress100:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      CidrBlock: 0.0.0.0/0
      Protocol: '6'
      RuleAction: allow
      RuleNumber: '100'
      PortRange:
        From: '80'
        To: '80'
      NetworkAclId: !Ref PublicNetworkAcl

  # Inbound to TCP/443 from anywhere.
  PublicAclIngress110:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      CidrBlock: 0.0.0.0/0
      Protocol: '6'
      RuleAction: allow
      RuleNumber: '110'
      PortRange:
        From: '443'
        To: '443'
      NetworkAclId: !Ref PublicNetworkAcl

  # Inbound return traffic on ephemeral ports from anywhere.
  PublicAclIngress120:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      CidrBlock: 0.0.0.0/0
      Protocol: '6'
      RuleAction: allow
      RuleNumber: '120'
      PortRange:
        From: '1024'
        To: '65535'
      NetworkAclId: !Ref PublicNetworkAcl

  # Inbound ICMP from the wider private network.
  PublicAclIngress130:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      CidrBlock: 10.0.0.0/8
      Protocol: '1'
      RuleAction: allow
      RuleNumber: '130'
      Icmp:
        Code: '-1'
        Type: '-1'
      PortRange:
        From: '-1'
        To: '-1'
      NetworkAclId: !Ref PublicNetworkAcl

  # Inbound SSH/22 from the wider private network.
  PublicAclIngress140:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      CidrBlock: 10.0.0.0/8
      Protocol: '6'
      RuleAction: allow
      RuleNumber: '140'
      PortRange:
        From: '22'
        To: '22'
      NetworkAclId: !Ref PublicNetworkAcl

  # Outbound TCP/80 to anywhere.
  PublicAclEgress100:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      Egress: true
      CidrBlock: 0.0.0.0/0
      Protocol: '6'
      RuleAction: allow
      RuleNumber: '100'
      PortRange:
        From: '80'
        To: '80'
      NetworkAclId: !Ref PublicNetworkAcl

  # Outbound TCP/443 to anywhere.
  PublicAclEgress110:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      Egress: true
      CidrBlock: 0.0.0.0/0
      Protocol: '6'
      RuleAction: allow
      RuleNumber: '110'
      PortRange:
        From: '443'
        To: '443'
      NetworkAclId: !Ref PublicNetworkAcl

  # Outbound response traffic on ephemeral ports to anywhere.
  PublicAclEgress120:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      Egress: true
      CidrBlock: 0.0.0.0/0
      Protocol: '6'
      RuleAction: allow
      RuleNumber: '120'
      PortRange:
        From: '1024'
        To: '65535'
      NetworkAclId: !Ref PublicNetworkAcl

  # Outbound ICMP to the wider private network.
  PublicAclEgress130:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      Egress: true
      CidrBlock: 0.0.0.0/0
      Protocol: '1'
      RuleAction: allow
      RuleNumber: '130'
      Icmp:
        Code: '-1'
        Type: '-1'
      PortRange:
        From: '-1'
        To: '-1'
      NetworkAclId: !Ref PublicNetworkAcl

  # Outbound SSH/22 to the wider private network.
  PublicAclEgress140:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      Egress: true
      CidrBlock: 10.0.0.0/8
      Protocol: '6'
      RuleAction: allow
      RuleNumber: '140'
      PortRange:
        From: '22'
        To: '22'
      NetworkAclId: !Ref PublicNetworkAcl

  # NACL Rules for private subnets.

  # Inbound TCP/80 from the wider private network.
  # TODO This might need to be 0.0.0.0/0 when using an ALB in the public zone.
  PrivateAclIngress100:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      CidrBlock: 10.0.0.0/8
      Protocol: '6'
      RuleAction: allow
      RuleNumber: '100'
      PortRange:
        From: '80'
        To: '80'
      NetworkAclId: !Ref PrivateNetworkAcl

  # Inbound TCP/443 from the wider private network.
  # TODO This might need to be 0.0.0.0/0 when using an ALB in the public zone.
  PrivateAclIngress110:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      CidrBlock: 10.0.0.0/8
      Protocol: '6'
      RuleAction: allow
      RuleNumber: '110'
      PortRange:
        From: '443'
        To: '443'
      NetworkAclId: !Ref PrivateNetworkAcl

  # Inbound return traffic on ephemeral ports from everywhere or the wider
  # private network depending on the value of HasPrivateZoneEgress.
  PrivateAclIngress120:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      CidrBlock: !If [HasPrivateZoneEgress, 0.0.0.0/0, 10.0.0.0/8]
      Protocol: '6'
      RuleAction: allow
      RuleNumber: '120'
      PortRange:
        From: '1024'
        To: '65535'
      NetworkAclId: !Ref PrivateNetworkAcl

  # Inbound ICMP from the wider private network.
  PrivateAclIngress130:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      CidrBlock: 10.0.0.0/8
      Protocol: '1'
      RuleAction: allow
      RuleNumber: '130'
      Icmp:
        Code: '-1'
        Type: '-1'
      PortRange:
        From: '-1'
        To: '-1'
      NetworkAclId: !Ref PrivateNetworkAcl

  # Inbound SSH/22 from the wider private network.
  PrivateAclIngress140:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      CidrBlock: 10.0.0.0/8
      Protocol: '6'
      RuleAction: allow
      RuleNumber: '140'
      PortRange:
        From: '22'
        To: '22'
      NetworkAclId: !Ref PrivateNetworkAcl

  # Outbound TCP/80 to everywhere or the wider private network
  # depending on the value of HasPrivateZoneEgress.
  PrivateAclEgress100:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      Egress: true
      CidrBlock: !If [HasPrivateZoneEgress, 0.0.0.0/0, 10.0.0.0/8]
      Protocol: '6'
      RuleAction: allow
      RuleNumber: '100'
      PortRange:
        From: '80'
        To: '80'
      NetworkAclId: !Ref PrivateNetworkAcl

  # Outbound TCP/443 to everywhere or the wider private network depending on
  # the value of HasPrivateZoneEgress.
  PrivateAclEgress110:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      Egress: true
      CidrBlock: !If [HasPrivateZoneEgress, 0.0.0.0/0, 10.0.0.0/8]
      Protocol: '6'
      RuleAction: allow
      RuleNumber: '110'
      PortRange:
        From: '443'
        To: '443'
      NetworkAclId: !Ref PrivateNetworkAcl

  # Outbound response traffic on ephemeral ports to the wider private network.
  # TODO This might need to be 0.0.0.0/0 when using an ALB in the public zone.
  PrivateAclEgress120:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      Egress: true
      CidrBlock: 10.0.0.0/8
      Protocol: '6'
      RuleAction: allow
      RuleNumber: '120'
      PortRange:
        From: '1024'
        To: '65535'
      NetworkAclId: !Ref PrivateNetworkAcl

  # Outbound ICMP traffic to the wider private network depending on
  # the value of HasPrivateZoneEgress.
  PrivateAclEgress130:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      Egress: true
      CidrBlock: !If [HasPrivateZoneEgress, 0.0.0.0/0, 10.0.0.0/8]
      Protocol: '1'
      RuleAction: allow
      RuleNumber: '130'
      Icmp:
        Code: '-1'
        Type: '-1'
      PortRange:
        From: '-1'
        To: '-1'
      NetworkAclId: !Ref PrivateNetworkAcl

  # Outbound SSH/22 to the wider private network.
  PrivateAclEgress140:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      Egress: true
      CidrBlock: 10.0.0.0/8
      Protocol: '6'
      RuleAction: allow
      RuleNumber: '140'
      PortRange:
        From: '22'
        To: '22'
      NetworkAclId: !Ref PrivateNetworkAcl

  # S3 Endpoint
  S3VPCEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Condition: HasS3Endpoint
    Properties:
      RouteTableIds:
      - !Ref PublicRouteTable
      - !Ref PrivateRouteTable1
      - !Ref PrivateRouteTable2
      - !Ref PrivateRouteTable3
      ServiceName: !Sub com.amazonaws.${AWS::Region}.s3
      VpcId: !Ref VPC

  # DynamoDB Endpoint
  DynamoDBVPCEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Condition: HasDynamoDBEndpoint
    Properties:
      RouteTableIds:
      - !Ref PublicRouteTable
      - !Ref PrivateRouteTable1
      - !Ref PrivateRouteTable2
      - !Ref PrivateRouteTable3
      ServiceName: !Sub com.amazonaws.${AWS::Region}.dynamodb
      VpcId: !Ref VPC

# Outputs
Outputs:
  VPC:
    Description: The ID of the vpc.
    Value: !Ref VPC
    Export:
      Name: !Sub ${AWS::StackName}:vpc
  VPCCIDR:
    Description: The IPv4 CIDR of the VPC.
    Value: !GetAtt VPC.CidrBlock
    Export:
      Name: !Sub ${AWS::StackName}:vpc-cidr
  PublicSubnet1:
    Description: The ID of the first public subnet.
    Value: !Ref PublicSubnet1
    Export:
      Name: !Sub ${AWS::StackName}:public-subnet-1
  PublicSubnet1AZ:
    Description: The AZ of the first public subnet.
    Value: !GetAtt PublicSubnet1.AvailabilityZone
    Export:
      Name: !Sub ${AWS::StackName}:public-subnet-1-az
  PublicSubnet2:
    Description: The ID of the second public subnet.
    Value: !Ref PublicSubnet2
    Export:
      Name: !Sub ${AWS::StackName}:public-subnet-2
  PublicSubnet2AZ:
    Description: The AZ of the second public subnet.
    Value: !GetAtt PublicSubnet2.AvailabilityZone
    Export:
      Name: !Sub ${AWS::StackName}:public-subnet-2-az
  PublicSubnet3:
    Description: The ID of the third public subnet.
    Value: !Ref PublicSubnet3
    Export:
      Name: !Sub ${AWS::StackName}:public-subnet-3
  PublicSubnet3AZ:
    Description: The AZ of the third public subnet.
    Value: !GetAtt PublicSubnet3.AvailabilityZone
    Export:
      Name: !Sub ${AWS::StackName}:public-subnet-3-az
  PrivateSubnet1:
    Description: The ID of the first private subnet.
    Value: !Ref PrivateSubnet1
    Export:
      Name: !Sub ${AWS::StackName}:private-subnet-1
  PrivateSubnet1AZ:
    Description: The AZ of the first private subnet.
    Value: !GetAtt PrivateSubnet1.AvailabilityZone
    Export:
      Name: !Sub ${AWS::StackName}:private-subnet-1-az
  PrivateSubnet2:
    Description: The ID of the second private subnet.
    Value: !Ref PrivateSubnet2
    Export:
      Name: !Sub ${AWS::StackName}:private-subnet-2
  PrivateSubnet2AZ:
    Description: The AZ of the second private subnet.
    Value: !GetAtt PrivateSubnet2.AvailabilityZone
    Export:
      Name: !Sub ${AWS::StackName}:private-subnet-2-az
  PrivateSubnet3:
    Description: The ID of the third private subnet.
    Value: !Ref PrivateSubnet3
    Export:
      Name: !Sub ${AWS::StackName}:private-subnet-3
  PrivateSubnet3AZ:
    Description: The AZ of the third private subnet.
    Value: !GetAtt PrivateSubnet3.AvailabilityZone
    Export:
      Name: !Sub ${AWS::StackName}:private-subnet-3-az
  PublicNACL:
    Description: The NACL for the public subnets.
    Value: !Ref PublicNetworkAcl
    Export:
      Name: !Sub ${AWS::StackName}:public-nacl
  PrivateNACL:
    Description: The NACL for the private subnets.
    Value: !Ref PrivateNetworkAcl
    Export:
      Name: !Sub ${AWS::StackName}:private-nacl