spokeVpc.yaml

AWSTemplateFormatVersion: 2010-09-09
Description:  This template deploys a VPC with RAM to new AWS Accounts via CT.

Parameters:
  EnvironmentName:
    Description: An environment name that is prefixed to resource names
    Type: String
    Default: Prod

  AWSAccountId:
    Description: Please enter the target AWS Account ID to share this Network VPC (REQUIRED)
    Type: String
    Default: 930317599068
    AllowedPattern: ".+"

  VpcCIDR:
    Description: Please enter the IP range (CIDR notation) for this VPC
    Type: String
    Default: 10.148.24.0/21

  PublicSubnet1CIDR:
    Description: Please enter the IP range (CIDR notation) for the public subnet in the first Availability Zone
    Type: String
    Default: 10.148.30.0/26

  PublicSubnet2CIDR:
    Description: Please enter the IP range (CIDR notation) for the public subnet in the second Availability Zone
    Type: String
    Default: 10.148.30.64/26

  PrivateSubnet1CIDR:
    Description: Please enter the IP range (CIDR notation) for the private subnet in the first Availability Zone
    Type: String
    Default: 10.148.24.0/24

  PrivateSubnet2CIDR:
    Description: Please enter the IP range (CIDR notation) for the private subnet in the second Availability Zone
    Type: String
    Default: 10.148.25.0/24

  PrivateSubnet3CIDR:
    Description: Please enter the IP range (CIDR notation) for the private subnet in the second Availability Zone
    Type: String
    Default: 10.148.26.0/24

  PrivateSubnet4CIDR:
    Description: Please enter the IP range (CIDR notation) for the TGW Attachment in the first Availability Zone
    Type: String
    Default: 10.148.31.0/28

  PrivateSubnet5CIDR:
    Description: Please enter the IP range (CIDR notation) for the TGW Attachment in the second Availability Zone
    Type: String
    Default: 10.148.31.16/28

  PrivateSubnet6CIDR:
    Description: Please enter the IP range (CIDR notation) for the TGW Attachment in the second Availability Zone
    Type: String
    Default: 10.148.31.32/28

  PublicNetwork:
    Description: Create Public Network for Account (Yes or No)?.
    Default: "Yes"
    Type: String
    AllowedValues:
      - "Yes"
      - "No"
    ConstraintDescription: must specify Yes or No.

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
    - Label:
        default: "Network Configuration"
      Parameters:
      - AWSAccountId
      - EnvironmentName
      - VpcCIDR
    - Label:
        default: "Public Network Configuration"
      Parameters:
      - PublicNetwork
      - PublicSubnet1CIDR
      - PublicSubnet2CIDR
    - Label:
        default: "Private Network Configuration"
      Parameters:
      - PrivateSubnet1CIDR
      - PrivateSubnet2CIDR
      - PrivateSubnet3CIDR
      - PrivateSubnet4CIDR
      - PrivateSubnet5CIDR
      - PrivateSubnet6CIDR

Conditions: 
  CreatePublicNetResource: !Equals [ !Ref PublicNetwork, "Yes" ]

Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCIDR
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: !Ref EnvironmentName
        - Key: IsUsedForDeploy
          Value: "True"

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Condition: CreatePublicNetResource
    Properties:
      Tags:
        - Key: Name
          Value: !Ref EnvironmentName

  InternetGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Condition: CreatePublicNetResource
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref VPC

  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Condition: CreatePublicNetResource
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 0, !GetAZs '' ]
      CidrBlock: !Ref PublicSubnet1CIDR
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub subnet0-${AWS::Region}a-${EnvironmentName}-pub-01
        - Key: IsUsedForDeploy
          Value: "True"

  PublicSubnet2:
    Type: AWS::EC2::Subnet
    Condition: CreatePublicNetResource
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 1, !GetAZs  '' ]
      CidrBlock: !Ref PublicSubnet2CIDR
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub subnet0-${AWS::Region}b-${EnvironmentName}-pub-02
        - Key: IsUsedForDeploy
          Value: "True"

  PrivateSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 0, !GetAZs  '' ]
      CidrBlock: !Ref PrivateSubnet1CIDR
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub subnet0-${AWS::Region}a-${EnvironmentName}-priv-01
        - Key: IsUsedForDeploy
          Value: "True"

  PrivateSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 1, !GetAZs  '' ]
      CidrBlock: !Ref PrivateSubnet2CIDR
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub subnet0-${AWS::Region}b-${EnvironmentName}-priv-02
        - Key: IsUsedForDeploy
          Value: "True"

  PrivateSubnet3:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 2, !GetAZs  '' ]
      CidrBlock: !Ref PrivateSubnet3CIDR
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub subnet0-${AWS::Region}c-${EnvironmentName}-priv-03
        - Key: IsUsedForDeploy
          Value: "True"

  PrivateSubnet4:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 0, !GetAZs  '' ]
      CidrBlock: !Ref PrivateSubnet4CIDR
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName} TGW Private Subnet (AZ1)
        - Key: IsUsedForDeploy
          Value: "False"

  PrivateSubnet5:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 1, !GetAZs  '' ]
      CidrBlock: !Ref PrivateSubnet5CIDR
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName} TGW Private Subnet (AZ2)
        - Key: IsUsedForDeploy
          Value: "False"

  PrivateSubnet6:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 2, !GetAZs  '' ]
      CidrBlock: !Ref PrivateSubnet6CIDR
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName} TGW Private Subnet (AZ3)
        - Key: IsUsedForDeploy
          Value: "False"

##PublicRoutes -->>>

  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Condition: CreatePublicNetResource
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName} Public Routes

  DefaultPublicRoute:
    Type: AWS::EC2::Route
    Condition: CreatePublicNetResource
    DependsOn: InternetGatewayAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  PublicSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Condition: CreatePublicNetResource
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref PublicSubnet1

  PublicSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Condition: CreatePublicNetResource
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref PublicSubnet2

##PrivateRoutes -->>>

  PrivateRouteTable1:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName} Private Route 01

  DefaultPrivateRoute1:
    Type: AWS::EC2::Route
    DependsOn: TGWAttachment
    Properties:
      RouteTableId: !Ref PrivateRouteTable1
      DestinationCidrBlock: 0.0.0.0/0
      TransitGatewayId: !ImportValue TransitGatewayExport

  PrivateSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateRouteTable1
      SubnetId: !Ref PrivateSubnet1

  PrivateSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateRouteTable1
      SubnetId: !Ref PrivateSubnet2

  PrivateSubnet3RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateRouteTable1
      SubnetId: !Ref PrivateSubnet3

  PrivateRouteTable2:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName} Private Route TGW

  DefaultPrivateRoute2:
    Type: AWS::EC2::Route
    DependsOn: TGWAttachment
    Properties:
      RouteTableId: !Ref PrivateRouteTable2
      DestinationCidrBlock: 0.0.0.0/0
      TransitGatewayId: !ImportValue TransitGatewayExport

  PrivateSubnet4RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateRouteTable2
      SubnetId: !Ref PrivateSubnet4

  PrivateSubnet5RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateRouteTable2
      SubnetId: !Ref PrivateSubnet5

  PrivateSubnet6RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateRouteTable2
      SubnetId: !Ref PrivateSubnet6

## -->>> Security Groups for VPC Endpoints

  IngressSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W9
            reason: "Required for Central Network Solution"
          - id: W2
            reason: "Required for Central Network Solution"
          - id: F1000
            reason: "Required for Central Network Solution"  
    Properties:
      GroupDescription: "VPC Endpoint Ports Required"
      VpcId: !Ref VPC
      GroupName: "My SG Group VPC"
      SecurityGroupIngress:
        - FromPort: 443
          IpProtocol: tcp
          ToPort: 443
          CidrIp: 0.0.0.0/0
        - FromPort: 80
          IpProtocol: tcp
          ToPort: 80
          CidrIp: 0.0.0.0/0

  CreateVpcEndpointSSM:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcEndpointType: Interface
      SubnetIds:
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2
      SecurityGroupIds:
        - !Ref IngressSecurityGroup
      PrivateDnsEnabled: true
      ServiceName: !Sub com.amazonaws.${AWS::Region}.ssm
      VpcId: !Ref VPC

  CreateVpcEndpointSSMMessages:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcEndpointType: Interface
      SubnetIds:
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2
      SecurityGroupIds:
        - !Ref IngressSecurityGroup
      PrivateDnsEnabled: true
      ServiceName: !Sub com.amazonaws.${AWS::Region}.ssmmessages
      VpcId: !Ref VPC

  CreateVpcEndpointEC2Messages:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcEndpointType: Interface
      SubnetIds:
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2
      SecurityGroupIds:
        - !Ref IngressSecurityGroup
      PrivateDnsEnabled: true
      ServiceName: !Sub com.amazonaws.${AWS::Region}.ec2messages
      VpcId: !Ref VPC

##Transit Gateway Attachments and Propagations -->>>

  TGWAttachment:
    Type: AWS::EC2::TransitGatewayAttachment
    Properties:
      SubnetIds:
        - !Ref PrivateSubnet4
        - !Ref PrivateSubnet5
        - !Ref PrivateSubnet6
      TransitGatewayId: !ImportValue TransitGatewayExport
      VpcId: !Ref VPC
      Tags:
      - Key: Name
        Value: !Sub "${EnvironmentName}-Attach"

  TGWSubnetAttachmentFirewallRouteTable1:
    Type: AWS::EC2::TransitGatewayRouteTableAssociation
    DeletionPolicy: Retain
    DependsOn: TGWAttachment
    Properties:
      TransitGatewayAttachmentId: !Ref TGWAttachment
      TransitGatewayRouteTableId: !ImportValue TGWFirewallRouteTableSpoke

  TGWFirewallPropagationToSpoke:
    Type: AWS::EC2::TransitGatewayRouteTablePropagation
    DependsOn: TGWAttachment
    Properties: 
      TransitGatewayAttachmentId: !Ref TGWAttachment
      TransitGatewayRouteTableId: !ImportValue TGWFirewallRouteTableSpoke

  myPublicNetworkResourceShare:
    Type: "AWS::RAM::ResourceShare"
    Condition: CreatePublicNetResource
    Properties:
      AllowExternalPrincipals: true
      Name: !Sub "${EnvironmentName} Public Subnet Share"
      ResourceArns:
        - !Sub "arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:subnet/${PublicSubnet1}"
        - !Sub "arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:subnet/${PublicSubnet2}"
      Principals:
        - !Ref AWSAccountId
      Tags:
        - Key: "Name"
          Value: !Sub "Central ${EnvironmentName} PublicSubnetSharing"

  myPrivateMonitoringNetworkResourceShare:
    Type: "AWS::RAM::ResourceShare"
    DependsOn: myPublicNetworkResourceShare
    Properties:
      AllowExternalPrincipals: true
      Name: !Sub "${EnvironmentName} Private Subnet Share"
      ResourceArns:
        - !Sub "arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:subnet/${PrivateSubnet1}"
        - !Sub "arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:subnet/${PrivateSubnet2}"
        - !Sub "arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:subnet/${PrivateSubnet3}"
      Principals:
        - !Ref AWSAccountId
      Tags:
        - Key: "Name"
          Value: !Sub "Central ${EnvironmentName} PrivateSubnetSharing"

  NameSubnetIds:
      Type: AWS::Lambda::Function
      DependsOn: myPrivateMonitoringNetworkResourceShare
      Properties:
        Code:
          ZipFile: |
            import json
            import boto3
            import logging
            import urllib3
            import os
            http = urllib3.PoolManager()

            logger = logging.getLogger(__name__)
            logging.getLogger().setLevel(logging.INFO)

            SUCCESS = "SUCCESS"
            FAILED = "FAILED"

            client = boto3.client('ec2')
            vpcid = os.environ['VPCID']
            accountid = os.environ['ACCOUNTID']

            def lambda_handler(event, context):
                logger.info('Event: %s' % json.dumps(event))
                responseData={}
                try:
                    if event['RequestType'] == 'Delete':
                        print("Request Type:",event['RequestType'])
                        print("Delete Request - Nothing to delete")
                    elif event['RequestType'] == 'Create' or event['RequestType'] == 'Update':
                        print("Request Type:",event['RequestType'])
                        GETNAMES1=event['ResourceProperties']['GETNAMES1']
                        GetSubNames1=get_ids(GETNAMES1)
                        
                        sts_client = boto3.client('sts')

                        response = sts_client.assume_role(
                            RoleArn='arn:aws:iam::'+accountid+':role/TransitAccountRole',
                            RoleSessionName='assume_role_session'
                        )
                        
                        remoteresource = boto3.resource('ec2',
                                aws_access_key_id=response['Credentials']['AccessKeyId'],
                                aws_secret_access_key=response['Credentials']['SecretAccessKey'],
                                aws_session_token=response['Credentials']['SessionToken']
                        )

                        output = GetSubNames1
                        try:
                                for addtags in output:
                                    names = (addtags[0])
                                    subnetids = (addtags[1])
                                    subnet = remoteresource.Subnet(subnetids)
                                    subnet.create_tags(
                                        Tags=[
                                            {
                                                'Key': 'Name',
                                                'Value': names
                                            },
                                        ]
                                    )
                        except Exception as ex:
                            raise
                        
                        responseData={'GetSubNames1':GetSubNames1}
                        print("Sending CFN")
                    responseStatus = 'SUCCESS'
                except Exception as e:
                    print('Failed to process:', e)
                    responseStatus = 'FAILURE'
                    responseData = {'Failure': 'Check Logs.'}
                send(event, context, responseStatus, responseData)

            def get_ids(GETNAMES1):

                response = client.describe_subnets(
                    Filters=[ {
                            'Name': 'vpc-id',
                            'Values': [vpcid]},
                            {
                            'Name': 'tag:IsUsedForDeploy',
                            'Values': ['True']}
                    ]
                )

                tags = []
                for tag in response['Subnets']:
                    for value in tag['Tags']:
                        if value['Key'] == 'Name':
                            tags.append(value['Value'])

                subnets = []
                for subnetids in response['Subnets']:
                    subnets.append(subnetids['SubnetId'])

                output=[(tags[i],subnets[i]) for i in range(0,len(tags))]
                
                return output
                
            def send(event, context, responseStatus, responseData, physicalResourceId=None, noEcho=False):
                responseUrl = event['ResponseURL']
                print(responseUrl)
                responseBody = {'Status': responseStatus,
                                'Reason': 'See the details in CloudWatch Log Stream: ' + context.log_stream_name,
                                'PhysicalResourceId': physicalResourceId or context.log_stream_name,
                                'StackId': event['StackId'],
                                'RequestId': event['RequestId'],
                                'LogicalResourceId': event['LogicalResourceId'],
                                'Data': responseData}
                json_responseBody = json.dumps(responseBody)
                print("Response body:\n" + json_responseBody)
                headers = {
                    'content-type' : '',
                    'content-length' : str(len(json_responseBody))
                }
                try:
                    response = http.request('PUT', responseUrl, headers=headers, body=json_responseBody)
                    print("Status code:", response.status)
                except Exception as e:
                    print("send(..) failed executing http.request(..):", e)
        FunctionName: !Sub 'arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${EnvironmentName}-SubnetNameApply'
        Environment:
          Variables:
            VPCID: !Ref VPC
            ACCOUNTID: !Ref AWSAccountId
        Handler: "index.lambda_handler"
        Timeout: 30
        Role: !GetAtt 'LambdaRole.Arn'
        Runtime: python3.7
  Lambdatrigger:
     Type: 'Custom::NameSubIds'
     DependsOn: myPrivateMonitoringNetworkResourceShare
     Properties:
       ServiceToken: !GetAtt 'NameSubnetIds.Arn'
       GETNAMES1: !Ref NameSubnetIds
  LambdaRole:
    Type: AWS::IAM::Role
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: F3
            reason: "Required for Central Network Solution"
          - id: W11
            reason: "Required for Central Network Solution"  
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: "lambda-logs"
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - 'ec2:Describe*'
                Resource: '*'
              - Effect: Allow
                Action:
                  - sts:AssumeRole
                Resource:
                  - !Sub "arn:aws:iam::${AWSAccountId}:role/TransitAccountRole"
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - "arn:aws:logs:*:*:*"
Outputs:
  MyVPC:
    Description: A reference to the created VPC
    Value: !Ref VPC
    Export:
      Name: !Sub "${EnvironmentName}-VPCID"