servers.yml

Description: Project 2 servers and security
Parameters:
  EnvironmentName:
    Description: An environment name that will be prefixed to resource names
    Type: String
  ProjectAMI:
    Description: The AMI used to initiate the EC2 instances
    Type: String
Resources:
  LBSecGroup:
    Type: "AWS::EC2::SecurityGroup"
    Properties:
      GroupDescription: Allow http to our load balancer
      VpcId: !ImportValue
        "Fn::Sub": "${EnvironmentName}-VPCID"
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
  WebServerSecGroup:
    Type: "AWS::EC2::SecurityGroup"
    Properties:
      GroupDescription: Allow http to our hosts and SSH from local only
      VpcId: !ImportValue
        "Fn::Sub": "${EnvironmentName}-VPCID"
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 0
          ToPort: 65535
          CidrIp: 0.0.0.0/0
  S3ReadOnlyforEC2:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - s3.amazonaws.com
            Action:
              - "sts:AssumeRole"
      Path: /
      Policies:
        - PolicyName: S3ReadOnlyforEC2
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - "s3:GetObject"
                  - "s3:ListBucket"
                Resource: "arn:aws:s3:::*"
  WebAppProfile:
    Type: "AWS::IAM::InstanceProfile"
    DependsOn: S3ReadOnlyforEC2
    Properties:
      Roles:
        - !Ref S3ReadOnlyforEC2
  WebAppLaunchConfig:
    Type: "AWS::AutoScaling::LaunchConfiguration"
    Properties:
      UserData: !Base64
        "Fn::Sub": |-
          #!/bin/bash
          [ `whoami` = root ] || { sudo "$0" "$@"; exit $?; }
          apt-get update -y
          apt-get install apache2 -y
          systemctl start apache2.service
          cd /var/www/html
          echo "it works! Udagram, Udacity" > index.html
      ImageId: !Ref ProjectAMI
      SecurityGroups:
        - !Ref WebServerSecGroup
      InstanceType: t3.medium
      IamInstanceProfile: !Ref WebAppProfile
      BlockDeviceMappings:
        - DeviceName: /dev/sdx
          Ebs:
            VolumeSize: "10"
  WebAppTargetGroup:
    Type: "AWS::ElasticLoadBalancingV2::TargetGroup"
    Properties:
      TargetGroupAttributes:
        - Key: slow_start.duration_seconds
          Value: 300
      HealthCheckIntervalSeconds: 10
      HealthCheckPath: /
      HealthCheckProtocol: HTTP
      HealthCheckTimeoutSeconds: 8
      HealthyThresholdCount: 2
      Port: 80
      Protocol: HTTP
      UnhealthyThresholdCount: 5
      VpcId: !ImportValue
        "Fn::Sub": "${EnvironmentName}-VPCID"
  WebAppGroup:
    Type: "AWS::AutoScaling::AutoScalingGroup"
    Properties:
      VPCZoneIdentifier:
        - !ImportValue
          "Fn::Sub": "${EnvironmentName}-PRIV-NETS"
      LaunchConfigurationName: !Ref WebAppLaunchConfig
      MinSize: "4"
      MaxSize: "4"
      TargetGroupARNs:
        - !Ref WebAppTargetGroup
  WebAppLB:
    Type: "AWS::ElasticLoadBalancingV2::LoadBalancer"
    Properties:
      Type: application
      Subnets:
        - !ImportValue
          "Fn::Sub": "${EnvironmentName}-PUB1-SN"
        - !ImportValue
          "Fn::Sub": "${EnvironmentName}-PUB2-SN"
      SecurityGroups:
        - !Ref LBSecGroup
  Listener:
    Type: "AWS::ElasticLoadBalancingV2::Listener"
    Properties:
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref WebAppTargetGroup
      LoadBalancerArn: !Ref WebAppLB
      Port: "80"
      Protocol: HTTP
  ALBListenerRule:
    Type: "AWS::ElasticLoadBalancingV2::ListenerRule"
    Properties:
      Actions:
        - Type: forward
          TargetGroupArn: !Ref WebAppTargetGroup
      Conditions:
        - Field: path-pattern
          Values:
            - /
      ListenerArn: !Ref Listener
      Priority: 1
Outputs:
  LoadBalancerDNS:
    Value: !Join
      - ""
      - - "http://"
        - !GetAtt
          - WebAppLB
          - DNSName
    Export:
      Name: WebAppLB-DNS-URL