cloud9-cfn.yaml

---
AWSTemplateFormatVersion: '2010-09-09'
Description: Cloud9 For Observability Workshop
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Cloud9 instance
        Parameters:
          - VpcCIDR
          - PublicSubnet1CIDR
          - PrivateSubnet1CIDR
          - C9InstanceType
          - C9StopTime
          - BootstrapScriptS3Uri
      - Label:
          default: Assets configuration
        Parameters:
          - OutputBucketName
          - QSS3BucketName
          - QSS3KeyPrefix
    ParameterLabels:
      VpcCIDR:
        default: Default IP range for VPC
      PublicSubnet1CIDR:
        default: Range IP for public subnet
      PrivateSubnet1CIDR:
        default: Range IP for private subnet
      C9InstanceType:
        default: Cloud9 instance type
      C9StopTime:
        default: Stop time
      BootstrapScriptS3Uri:
        default: Bootstrap script S3 URI
      OutputBucketName:
        default: Output S3 bucket name
      QSS3BucketName:
        default: Quick Start S3 bucket name
      QSS3KeyPrefix:
        default: Quick Start S3 key prefix
Parameters:
  VpcCIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(3[0-2]|[1-2][0-9]|[0-9]))$|(^Auto$)
    Description: Please enter the IP range for this VPC
    Type: String
    Default: 10.10.0.0/16
  PublicSubnet1CIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
    Description: Please enter the IP range for the public subnet
    Type: String
    Default: 10.10.10.0/24
  PrivateSubnet1CIDR:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
    Description: Please enter the IP range for the private subnet
    Type: String
    Default: 10.10.20.0/24
  C9InstanceType:
    Description:
      The instance type of the new Amazon EC2 instance that AWS Cloud9
      will launch for the development environment.
    Type: String
    Default: t2.medium
  C9StopTime:
    Description:
      The number of minutes until the running instance is shut down after
      the environment has last been used.
    Type: Number
    Default: 240
  BootstrapScriptS3Uri:
    Description: S3 URI to a shell script that will be executed on the Cloud9 instance. If left blank, no custom bootstrap will be run.
    Type: String
    Default: 's3://ee-assets-prod-us-east-1/modules/2a60741f901644fa9b5b924e9b4ab918/v1/scripts/bootstrap.sh'
  OutputBucketName:
    Description:
      'OPTIONAL: Bucket name where the zip file output should be placed.
      If left blank, a bucket name will be automatically generated.'
    Type: String
    Default: ''
  QSS3BucketName:
    AllowedPattern: ^[0-9a-zA-Z]+([0-9a-zA-Z-]*[0-9a-zA-Z])*$
    ConstraintDescription:
      Quick Start bucket name can include numbers, lowercase
      letters, uppercase letters, and hyphens (-). It cannot start or end with a hyphen
      (-).
    Default: ee-assets-prod-us-east-1
    Description:
      S3 bucket name for the Quick Start assets. This string can include
      numbers, lowercase letters, uppercase letters, and hyphens (-). It cannot start
      or end with a hyphen (-).
    Type: String
  QSS3KeyPrefix:
    AllowedPattern: ^[0-9a-zA-Z-/.]*$
    ConstraintDescription:
      Quick Start key prefix can include numbers, lowercase letters,
      uppercase letters, hyphens (-), dots(.) and forward slash (/).
    Default: modules/2a60741f901644fa9b5b924e9b4ab918/v1/
    Description:
      S3 key prefix for the Quick Start assets. Quick Start key prefix
      can include numbers, lowercase letters, uppercase letters, hyphens (-), dots(.) and
      forward slash (/).
    Type: String
Conditions:
  UsingDefaultBucket: !Equals [!Ref QSS3BucketName, 'aws-quickstart']
  CreateZipsBucket: !Equals [!Ref 'OutputBucketName', '']
  DoCustomBootstrap: !Not [!Equals [!Ref 'BootstrapScriptS3Uri', '']]
Resources:
  VPC:
    Type: 'AWS::EC2::VPC'
    Properties:
      CidrBlock: !Ref VpcCIDR
      EnableDnsSupport: 'true'
      EnableDnsHostnames: 'true'
  InternetGateway:
    Type: 'AWS::EC2::InternetGateway'
  InternetGatewayAttachment:
    Type: 'AWS::EC2::VPCGatewayAttachment'
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref VPC
  PublicSubnet1:
    Type: 'AWS::EC2::Subnet'
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select
        - 0
        - !GetAZs ''
      CidrBlock: !Ref PublicSubnet1CIDR
      MapPublicIpOnLaunch: true
  PrivateSubnet1:
    Type: 'AWS::EC2::Subnet'
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select
        - 0
        - !GetAZs ''
      CidrBlock: !Ref PrivateSubnet1CIDR
      MapPublicIpOnLaunch: false
  PublicRouteTable:
    Type: 'AWS::EC2::RouteTable'
    Properties:
      VpcId: !Ref VPC
  DefaultPublicRoute:
    Type: 'AWS::EC2::Route'
    DependsOn: InternetGatewayAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway
  PublicSubnet1RouteTableAssociation:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref PublicSubnet1
  LambdaZipsBucket:
    Condition: CreateZipsBucket
    Type: AWS::S3::Bucket
    Properties: {}
  Cloud9Env:
    Type: AWS::Cloud9::EnvironmentEC2
    Properties:
      Name: observabilityworkshop
      Description: 'IDE Workshop'
      AutomaticStopTimeMinutes: !Ref C9StopTime
      InstanceType: !Ref C9InstanceType
      SubnetId: !Ref PublicSubnet1
  Cloud9Role:
    Type: AWS::IAM::Role
    Properties:
      RoleName: 'observabilityworkshop-admin'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AdministratorAccess
      Path: /
  Cloud9InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      InstanceProfileName: 'observabilityworkshop-profile'
      Roles: [!Ref Cloud9Role]
  CopyZipsRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Path: /
      Policies:
        - PolicyName: lambda-copier
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: s3:GetObject
                Resource: !Sub
                  - arn:${AWS::Partition}:s3:::${S3Bucket}/${QSS3KeyPrefix}*
                  - S3Bucket:
                      !If [
                        UsingDefaultBucket,
                        !Sub '${QSS3BucketName}-${AWS::Region}',
                        !Ref QSS3BucketName,
                      ]
              - Effect: Allow
                Action: ['s3:PutObject', 's3:DeleteObject']
                Resource:
                  'Fn::Sub':
                    - 'arn:aws:s3:::${ZipsBucket}/${QSS3KeyPrefix}*'
                    - ZipsBucket:
                        !If [
                          CreateZipsBucket,
                          Ref: LambdaZipsBucket,
                          Ref: OutputBucketName,
                        ]
  CopyZipsFunction:
    Type: AWS::Lambda::Function
    Properties:
      Description: Copies objects from a source S3 bucket to a destination
      Handler: index.handler
      Runtime: python3.6
      Role: !GetAtt CopyZipsRole.Arn
      Timeout: 240
      Code:
        ZipFile: |
          import json
          import logging
          import threading
          import boto3
          import cfnresponse


          def copy_objects(source_bucket, dest_bucket, prefix, objects):
              s3 = boto3.client('s3')
              for o in objects:
                  key = prefix + o
                  copy_source = {
                      'Bucket': source_bucket,
                      'Key': key
                  }
                  print('copy_source: %s' % copy_source)
                  print('dest_bucket = %s'%dest_bucket)
                  print('key = %s' %key)
                  s3.copy_object(CopySource=copy_source, Bucket=dest_bucket,
                        Key=key)


          def delete_objects(bucket, prefix, objects):
              s3 = boto3.client('s3')
              objects = {'Objects': [{'Key': prefix + o} for o in objects]}
              s3.delete_objects(Bucket=bucket, Delete=objects)


          def timeout(event, context):
              logging.error('Execution is about to time out, sending failure response to CloudFormation')
              cfnresponse.send(event, context, cfnresponse.FAILED, {}, None)


          def handler(event, context):
              # make sure we send a failure to CloudFormation if the function
              # is going to timeout
              timer = threading.Timer((context.get_remaining_time_in_millis()
                        / 1000.00) - 0.5, timeout, args=[event, context])
              timer.start()

              print('Received event: %s' % json.dumps(event))
              status = cfnresponse.SUCCESS
              try:
                  source_bucket = event['ResourceProperties']['SourceBucket']
                  dest_bucket = event['ResourceProperties']['DestBucket']
                  prefix = event['ResourceProperties']['Prefix']
                  objects = event['ResourceProperties']['Objects']
                  if event['RequestType'] == 'Delete':
                      delete_objects(dest_bucket, prefix, objects)
                  else:
                      copy_objects(source_bucket, dest_bucket, prefix, objects)
              except Exception as e:
                  logging.error('Exception: %s' % e, exc_info=True)
                  status = cfnresponse.FAILED
              finally:
                  timer.cancel()
                  cfnresponse.send(event, context, status, {}, None)
  CopyZips:
    Type: Custom::CopyZips
    Properties:
      ServiceToken: !GetAtt 'CopyZipsFunction.Arn'
      DestBucket:
        !If [CreateZipsBucket, Ref: LambdaZipsBucket, Ref: OutputBucketName]
      SourceBucket:
        !If [
          UsingDefaultBucket,
          !Sub '${QSS3BucketName}-${AWS::Region}',
          !Ref QSS3BucketName,
        ]
      Prefix: !Ref QSS3KeyPrefix
      Objects:
        - functions/packages/c9bootstrap/lambda.zip
        - functions/packages/c9InstanceProfile/lambda.zip
        - functions/packages/c9DiskResize/lambda.zip
  C9SetupRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Path: /
      Policies:
        - PolicyName: lambda-AttachRoleC9
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - cloudformation:DescribeStackResources
                  - ec2:AssociateIamInstanceProfile
                  - ec2:AuthorizeSecurityGroupIngress
                  - ec2:DescribeInstances
                  - ec2:DescribeInstanceStatus
                  - ec2:DescribeInstanceAttribute
                  - ec2:DescribeIamInstanceProfileAssociations
                  - ec2:DescribeVolumes
                  - ec2:DesctibeVolumeAttribute
                  - ec2:DescribeVolumesModifications
                  - ec2:DescribeVolumeStatus
                  - ec2:StartInstances
                  - ec2:StopInstances
                  - ssm:DescribeInstanceInformation
                  - ec2:ModifyVolume
                  - ec2:ReplaceIamInstanceProfileAssociation
                  - ec2:ReportInstanceStatus
                  - ssm:SendCommand
                  - ssm:GetCommandInvocation
                  - s3:GetObject
                Resource: '*'
              - Effect: Allow
                Action: iam:PassRole
                Resource: !GetAtt 'Cloud9Role.Arn'
              - Effect: Allow
                Action: ['lambda:AddPermission', 'lambda:RemovePermission']
                Resource: '*'
              - Effect: Allow
                Action:
                  [
                    'events:PutRule',
                    'events:DeleteRule',
                    'events:PutTargets',
                    'events:RemoveTargets',
                  ]
                Resource: '*'
  C9InstanceProfileLambda:
    DependsOn: CopyZips
    Type: AWS::Lambda::Function
    Properties:
      Description: Runs custom setup actions on Cloud9 environment
      Handler: lambda_function.handler
      Runtime: python3.6
      Role: !GetAtt 'C9SetupRole.Arn'
      Timeout: 900
      Code:
        S3Bucket:
          !If [CreateZipsBucket, Ref: LambdaZipsBucket, Ref: OutputBucketName]
        S3Key: !Sub '${QSS3KeyPrefix}functions/packages/c9InstanceProfile/lambda.zip'
  C9InstanceProfile:
    Type: Custom::C9InstanceProfileLambda
    Properties:
      ServiceToken: !GetAtt 'C9InstanceProfileLambda.Arn'
      InstanceProfile: !Ref Cloud9InstanceProfile
      Cloud9Environment: !Ref Cloud9Env
  C9DiskResizeLambda:
    DependsOn: CopyZips
    Type: AWS::Lambda::Function
    Properties:
      Description: Runs custom setup actions on Cloud9 environment
      Handler: lambda_function.handler
      Runtime: python3.6
      Role: !GetAtt 'C9SetupRole.Arn'
      Timeout: 900
      Code:
        S3Bucket:
          !If [CreateZipsBucket, Ref: LambdaZipsBucket, Ref: OutputBucketName]
        S3Key: !Sub '${QSS3KeyPrefix}functions/packages/c9DiskResize/lambda.zip'
  C9DiskResize:
    Type: Custom::C9DiskResizeLambda
    Properties:
      ServiceToken: !GetAtt 'C9DiskResizeLambda.Arn'
      InstanceId: !Ref C9InstanceProfile
      Region: !Sub '${AWS::Region}'
      EBSVolumeSize: 32
  C9BootstrapLambda:
    Condition: DoCustomBootstrap
    DependsOn: CopyZips
    Type: AWS::Lambda::Function
    Properties:
      Description: Runs custom setup actions on Cloud9 environment
      Handler: lambda_function.handler
      Runtime: python3.6
      Role: !GetAtt 'C9SetupRole.Arn'
      Timeout: 900
      Code:
        S3Bucket:
          !If [CreateZipsBucket, Ref: LambdaZipsBucket, Ref: OutputBucketName]
        S3Key: !Sub '${QSS3KeyPrefix}functions/packages/c9bootstrap/lambda.zip'
  C9Bootstrap:
    Condition: DoCustomBootstrap
    DependsOn: C9DiskResize
    Type: Custom::C9BootstrapLambda
    Properties:
      ServiceToken: !GetAtt 'C9BootstrapLambda.Arn'
      InstanceId: !Ref C9InstanceProfile
      BootstrapPath: !Ref BootstrapScriptS3Uri
      BootstrapArguments: ''
Outputs:
  Cloud9Env:
    Description: Cloud9 Instance Name
    Value: !Ref Cloud9Env