CF-A3-cmu.yml

AWSTemplateFormatVersion: 2010-09-09
Parameters:

  LabRoleARN:
    Type: String
    Description: "Enter the ARN for LabRole you find here: IAM | Roles | click on LabRole | copy ARN"

  AccountID:
    Type: String
    Description: "Enter the Account ID you find by clicking the user on the top right of the AWS console"

  # Database credentials
  DBUsername:
    Description: Username for database access
    Type: String
    MinLength: '1'
    MaxLength: '16'
    AllowedPattern: '[a-zA-Z][a-zA-Z0-9]*'
    ConstraintDescription: Must begin with a letter and contain only alphanumeric characters.

  DBPassword:
    NoEcho: 'true'
    Description: Password for database access
    Type: String
    MinLength: '8'
    MaxLength: '41'
    AllowedPattern: '[a-zA-Z0-9]*'

  VpcBlock:
    Type: String
    Default: 192.168.0.0/16
    Description: The CIDR range for the VPC. This should be a valid private (RFC 1918) CIDR range.

  PublicSubnet1Block:
    Type: String
    Default: 192.168.0.0/18
    Description: CidrBlock for public subnet 01 within the VPC

  PublicSubnet2Block:
    Type: String
    Default: 192.168.64.0/18
    Description: CidrBlock for public subnet 02 within the VPC

  DBSubnet1Block:
    Type: String
    Default: 192.168.128.0/18
    Description: CidrBlock for private subnet 01 within the VPC

  DBSubnet2Block:
    Type: String
    Default: 192.168.192.0/18
    Description: CidrBlock for private subnet 02 within the VPC

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      -
        Label:
          default: "Worker Network Configuration"
        Parameters:
          - VpcBlock
          - PublicSubnet1Block
          - PublicSubnet2Block
          - DBSubnet1Block
          - DBSubnet2Block

Resources:

  # VPC
  # It's a virtual private network where within you launch resources you'll manage.
  # There are 1+ subnets defined in a VPC. Each subnet is a range of IP addresses and is limited to a single AZ.
  VpcBookstore:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock:  !Ref VpcBlock
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: !Sub '${AWS::StackName}-VpcBookstore'

  # Internet gateway
  # It enables the communication between the VPC and the public Internet. It provides routing and NAT services.
  InternetGateway:
    Type: "AWS::EC2::InternetGateway"
  VPCGatewayAttachment:
    Type: "AWS::EC2::VPCGatewayAttachment"
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref VpcBookstore

  # Route tables
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VpcBookstore
      Tags:
        - Key: Name
          Value: Public Subnets
        - Key: Network
          Value: Public

  # The public route table routes directly to the Internet Gateway
  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: VPCGatewayAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  NatGateway01:
    Type: AWS::EC2::NatGateway
    DependsOn:
      - NatGatewayElasticIP1
      - PublicSubnet1
      - VPCGatewayAttachment
    Properties:
      AllocationId: !GetAtt 'NatGatewayElasticIP1.AllocationId'
      SubnetId: !Ref PublicSubnet1
      Tags:
        - Key: Name
          Value: !Sub '${AWS::StackName}-NatGatewayAZ1'

  NatGateway02:
    Type: AWS::EC2::NatGateway
    DependsOn:
      - NatGatewayElasticIP2
      - PublicSubnet2
      - VPCGatewayAttachment
    Properties:
      AllocationId: !GetAtt 'NatGatewayElasticIP2.AllocationId'
      SubnetId: !Ref PublicSubnet2
      Tags:
        - Key: Name
          Value: !Sub '${AWS::StackName}-NatGatewayAZ2'

  NatGatewayElasticIP1:
    DependsOn:
      - VPCGatewayAttachment
    Type: 'AWS::EC2::EIP'
    Properties:
      Domain: vpc

  NatGatewayElasticIP2:
    DependsOn:
      - VPCGatewayAttachment
    Type: 'AWS::EC2::EIP'
    Properties:
      Domain: vpc

  # Public subnets for the K8S nodes
  # Each subnet is in a different availability zone (AZ)
  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Metadata:
      Comment: Subnet 01
    Properties:
      MapPublicIpOnLaunch: true
      AvailabilityZone:
        Fn::Select:
          - '0'
          - Fn::GetAZs:
              Ref: AWS::Region
      CidrBlock:
        Ref: PublicSubnet1Block
      VpcId:
        Ref: VpcBookstore
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-PublicSubnet1"
        - Key: kubernetes.io/role/elb
          Value: 1

  PublicSubnet2:
    Type: AWS::EC2::Subnet
    Metadata:
      Comment: Subnet 02
    Properties:
      MapPublicIpOnLaunch: true
      AvailabilityZone:
        Fn::Select:
          - '1'
          - Fn::GetAZs:
              Ref: AWS::Region
      CidrBlock:
        Ref: PublicSubnet2Block
      VpcId:
        Ref: VpcBookstore
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-PublicSubnet2"
        - Key: kubernetes.io/role/elb
          Value: 1

  # Route table associated with subnets. Attaches a public subnets to a public route table.
  PublicSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet1
      RouteTableId: !Ref PublicRouteTable

  PublicSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet2
      RouteTableId: !Ref PublicRouteTable

  # Security group to be used for the EKS cluster. It is automatically applied to all nodes in the cluster.
  ControlPlaneSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Cluster communication with worker nodes
      VpcId: !Ref VpcBookstore


  #
  # EKS cluster
  #
  # The SubnetIds indicate the subnets where K8S control plane components (API server, scheduler, etc.) will be deployed.
  # The Logging property enables CloudWatch logging for these types of calls: api (calls to the API server),
  # audit (actions performed by users), and authenticator.
  #
  BookstoreEKSCluster:
    Type: AWS::EKS::Cluster
    Properties:
      Name: !Sub "BookstoreEKSCluster-${AWS::StackName}"
      RoleArn: !Ref LabRoleARN
      ResourcesVpcConfig:
        EndpointPrivateAccess: true
        EndpointPublicAccess: true
        SecurityGroupIds:
          - !Ref ControlPlaneSecurityGroup
        SubnetIds:
          - !Ref PublicSubnet1
          - !Ref PublicSubnet2
      Logging:
        ClusterLogging:
          EnabledTypes:
            - Type: api
            - Type: audit
            - Type: authenticator
      AccessConfig:
        AuthenticationMode: API_AND_CONFIG_MAP

  # Install the Amazon CloudWatch Observability EKS add-on (our goal is to see application logs)
  CloudObservabilityAddon:
    Type: AWS::EKS::Addon
    Properties:
      ClusterName: !Ref BookstoreEKSCluster
      AddonName: amazon-cloudwatch-observability

  # The console/shell user needs to be granted EKS cluster access with policy AmazonEKSClusterAdminPolicy.
  # The commented out resource below was supposed to grant that permission, but it didn't work. As it stands, you
  #  should add the access manually on the AWS console. (But you're welcome to try to make the AccessEntry below work.)

  # The access entry for the EKS cluster allows the LL console user to manage and deploy things to K8S.
#  EKSAccessToUser:
#    Type: AWS::EKS::AccessEntry
#    Properties:
#      ClusterName: !Ref BookstoreEKSCluster
#      PrincipalArn: arn:aws:iam::${AccountID}:role/voclabs
#      Type: STANDARD
#      AccessPolicies:
#        - PolicyArn: arn:aws:iam::aws:policy/AmazonEKSClusterPolicy
#          AccessScope:
#            Type: cluster
# Also tried: arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy, AmazonEKSClusterAdminPolicy


  # Node group with 1-5 nodes for the EKS cluster
  # Suubnets indicate the subnets where K8S worker nodes will be deployed
  MyNodeGroup:
    Type: AWS::EKS::Nodegroup
    Properties:
      ClusterName: !Ref BookstoreEKSCluster
      NodeRole: !Ref LabRoleARN
      Subnets:
        - !Ref PublicSubnet1
        - !Ref PublicSubnet2
#        - !Ref DBSubnet1
#        - !Ref DBSubnet2
      ScalingConfig:
        DesiredSize: 6
        MaxSize: 8
        MinSize: 2
      InstanceTypes:
        - t2.large


  #
  # Database configuration
  #

#  PrivateRouteTable01:
#    Type: AWS::EC2::RouteTable
#    Properties:
#      VpcId: !Ref VpcBookstore
#      Tags:
#        - Key: Name
#          Value: Private Subnet AZ1
#        - Key: Network
#          Value: Private01
#  PrivateRouteTable02:
#    Type: AWS::EC2::RouteTable
#    Properties:
#      VpcId: !Ref VpcBookstore
#      Tags:
#        - Key: Name
#          Value: Private Subnet AZ2
#        - Key: Network
#          Value: Private02

#  PrivateRoute01:
#    DependsOn:
#      - VPCGatewayAttachment
#      - NatGateway01
#    Type: AWS::EC2::Route
#    Properties:
#      RouteTableId: !Ref PrivateRouteTable01
#      DestinationCidrBlock: 0.0.0.0/0
#      NatGatewayId: !Ref NatGateway01
#  PrivateRoute02:
#    DependsOn:
#      - VPCGatewayAttachment
#      - NatGateway02
#    Type: AWS::EC2::Route
#    Properties:
#      RouteTableId: !Ref PrivateRouteTable02
#      DestinationCidrBlock: 0.0.0.0/0
#      NatGatewayId: !Ref NatGateway02

#  DBSubnet1RouteTableAssociation:
#    Type: AWS::EC2::SubnetRouteTableAssociation
#    Properties:
#      SubnetId: !Ref DBSubnet1
#      RouteTableId: !Ref PrivateRouteTable01
#  DBSubnet2RouteTableAssociation:
#    Type: AWS::EC2::SubnetRouteTableAssociation
#    Properties:
#      SubnetId: !Ref DBSubnet2
#      RouteTableId: !Ref PrivateRouteTable02


  # Private subnets for the RDS database instances
  DBSubnet1:
    Type: AWS::EC2::Subnet
    Metadata:
      Comment: Subnet 03
    Properties:
      AvailabilityZone:
        Fn::Select:
          - '0'
          - Fn::GetAZs:
              Ref: AWS::Region
      CidrBlock:
        Ref: DBSubnet1Block
      VpcId:
        Ref: VpcBookstore
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-DBSubnet1"
        - Key: kubernetes.io/role/internal-elb
          Value: 1
  DBSubnet2:
    Type: AWS::EC2::Subnet
    Metadata:
      Comment: Private Subnet 02
    Properties:
      AvailabilityZone:
        Fn::Select:
          - '1'
          - Fn::GetAZs:
              Ref: AWS::Region
      CidrBlock:
        Ref: DBSubnet2Block
      VpcId:
        Ref: VpcBookstore
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-DBSubnet2"
        - Key: kubernetes.io/role/internal-elb
          Value: 1


  # DB Subnet group
  # It defines the subnets where RDS DB instances will reside. Each subnet should be in a separate AZ.
  MyDBSubnetGroup:
    Type: 'AWS::RDS::DBSubnetGroup'
    Properties:
      DBSubnetGroupName: MyDBSubnetGroup
      DBSubnetGroupDescription: My subnet group for RDS
      SubnetIds:
        - !Ref DBSubnet1
        - !Ref DBSubnet2

  # DB Security group
  # Port 3306 is the default TCP port used by MySQL databases.
  DBSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: DBSecurityGroup
      GroupDescription: Open database for access
      VpcId: !Ref VpcBookstore
      SecurityGroupEgress:
        - Description: Allow all outbound traffic
          IpProtocol: "-1"
          CidrIp: 0.0.0.0/0
      SecurityGroupIngress:
        - IpProtocol: tcp  # port 3306 opened to the worker nodes in the EKS cluster
          FromPort: 3306
          ToPort: 3306
          SourceSecurityGroupId:
            Ref: ControlPlaneSecurityGroup

  # RDS Aurora cluster
  # By declaring two DB instances in the cluster, Aurora will make the 1st instance the primary and the second the
  # replica, and will manage the primary/replica roles automatically from then on.
  DBClusterAuroraBookstore:
    Type: AWS::RDS::DBCluster
    Properties:
      Engine: aurora-mysql
      MasterUsername: !Ref DBUsername
      MasterUserPassword: !Ref DBPassword
      BackupRetentionPeriod: '7'
      PreferredBackupWindow: 01:00-02:00
      PreferredMaintenanceWindow: mon:03:00-mon:04:00
      DBSubnetGroupName: !Ref MyDBSubnetGroup
      Port: 3306
      VpcSecurityGroupIds:
        - !Ref DBSecurityGroup
      StorageEncrypted: true

  DBAuroraA:
    Type: AWS::RDS::DBInstance
    Properties:
      Engine: aurora-mysql
      DBClusterIdentifier: !Ref DBClusterAuroraBookstore
      DBInstanceClass: db.t3.medium
      DBSubnetGroupName: !Ref MyDBSubnetGroup
      PubliclyAccessible: false

  DBAuroraB:
    Type: AWS::RDS::DBInstance
    Properties:
      Engine: aurora-mysql
      DBClusterIdentifier: !Ref DBClusterAuroraBookstore
      DBInstanceClass: db.t3.medium
      DBSubnetGroupName: !Ref MyDBSubnetGroup
      PubliclyAccessible: false


Outputs:

  SubnetIds:
    Description: Subnets IDs in the VPC
    Value: !Join [ ",", [ !Ref PublicSubnet1, !Ref PublicSubnet2, !Ref DBSubnet1, !Ref DBSubnet2 ] ]

  SecurityGroups:
    Description: Security group for the cluster control plane communication with worker nodes
    Value: !Join [ ",", [ !Ref ControlPlaneSecurityGroup ] ]

  VpcId:
    Description: The VPC Id
    Value: !Ref VpcBookstore