cloudformation.template

{
	"AWSTemplateFormatVersion": "2010-09-09",
	"Description": "VPC: public subnets in 3 AZs",
	"Parameters": {
		"ClassB": {
			"Description": "Class B subnet of VPC (10.XXX.0.0/16)",
			"Type": "String",
			"MinLength": "1",
			"MaxLength": "3"
		},
		"ChefServerUrl": {
			"Description": "Chef server endpoint Url",
			"Type": "String"
		},
		"ChefValidationClientName": {
			"Description": "Chef validation client name",
			"Type": "String"
		},
		"ChefPolicyName": {
			"Description": "Chef polivy name",
			"Type": "String"
		},
		"ChefPolicyGroup": {
			"Description": "Chef policy group name",
			"Type": "String"
		},
		"ChefValidationPemBase64": {
			"Description": "Base64-encoded validation.pem",
			"Type": "String"
		},
		"KeyName": {
			"Description": "Name of an existing EC2 KeyPair to enable SSH access to the instance",
			"Type": "AWS::EC2::KeyPair::KeyName",
			"ConstraintDescription": "must be the name of an existing EC2 KeyPair."
		}
	},
	"Resources": {
		"VPC": {
			"Type": "AWS::EC2::VPC",
			"Properties": {
				"CidrBlock": {
					"Fn::Join": ["", ["10.", {
						"Ref": "ClassB"
					}, ".0.0/16"]]
				},
				"EnableDnsSupport": true,
				"EnableDnsHostnames": true,
				"InstanceTenancy": "default",
				"Tags": [{
					"Key": "Name",
					"Value": {
						"Fn::Join": ["", ["10.", {
							"Ref": "ClassB"
						}, ".0.0/16"]]
					}
				}]
			}
		},
		"InternetGateway": {
			"Type": "AWS::EC2::InternetGateway",
			"Properties": {
				"Tags": [{
					"Key": "Name",
					"Value": {
						"Fn::Join": ["", ["10.", {
							"Ref": "ClassB"
						}, ".0.0/16"]]
					}
				}]
			}
		},
		"VPCGatewayAttachment": {
			"Type": "AWS::EC2::VPCGatewayAttachment",
			"Properties": {
				"VpcId": {
					"Ref": "VPC"
				},
				"InternetGatewayId": {
					"Ref": "InternetGateway"
				}
			}
		},
		"SubnetPublicA": {
			"Type": "AWS::EC2::Subnet",
			"Properties": {
				"AvailabilityZone": {
					"Fn::Select": ["0", {
						"Fn::GetAZs": ""
					}]
				},
				"CidrBlock": {
					"Fn::Join": ["", ["10.", {
						"Ref": "ClassB"
					}, ".0.0/20"]]
				},
				"MapPublicIpOnLaunch": true,
				"VpcId": {
					"Ref": "VPC"
				},
				"Tags": [{
					"Key": "Name",
					"Value": "Public A"
				}, {
					"Key": "Reach",
					"Value": "public"
				}]
			}
		},
		"SubnetPublicB": {
			"Type": "AWS::EC2::Subnet",
			"Properties": {
				"AvailabilityZone": {
					"Fn::Select": ["1", {
						"Fn::GetAZs": ""
					}]
				},
				"CidrBlock": {
					"Fn::Join": ["", ["10.", {
						"Ref": "ClassB"
					}, ".32.0/20"]]
				},
				"MapPublicIpOnLaunch": true,
				"VpcId": {
					"Ref": "VPC"
				},
				"Tags": [{
					"Key": "Name",
					"Value": "Public B"
				}, {
					"Key": "Reach",
					"Value": "public"
				}]
			}
		},
		"SubnetPublicC": {
			"Type": "AWS::EC2::Subnet",
			"Properties": {
				"AvailabilityZone": {
					"Fn::Select": ["2", {
						"Fn::GetAZs": ""
					}]
				},
				"CidrBlock": {
					"Fn::Join": ["", ["10.", {
						"Ref": "ClassB"
					}, ".64.0/20"]]
				},
				"MapPublicIpOnLaunch": true,
				"VpcId": {
					"Ref": "VPC"
				},
				"Tags": [{
					"Key": "Name",
					"Value": "Public C"
				}, {
					"Key": "Reach",
					"Value": "public"
				}]
			}
		},
		"RouteTablePublic": {
			"Type": "AWS::EC2::RouteTable",
			"Properties": {
				"VpcId": {
					"Ref": "VPC"
				},
				"Tags": [{
					"Key": "Name",
					"Value": "Public"
				}]
			}
		},
		"RouteTableAssociationPublicA": {
			"Type": "AWS::EC2::SubnetRouteTableAssociation",
			"Properties": {
				"SubnetId": {
					"Ref": "SubnetPublicA"
				},
				"RouteTableId": {
					"Ref": "RouteTablePublic"
				}
			}
		},
		"RouteTableAssociationPublicB": {
			"Type": "AWS::EC2::SubnetRouteTableAssociation",
			"Properties": {
				"SubnetId": {
					"Ref": "SubnetPublicB"
				},
				"RouteTableId": {
					"Ref": "RouteTablePublic"
				}
			}
		},
		"RouteTableAssociationPublicC": {
			"Type": "AWS::EC2::SubnetRouteTableAssociation",
			"Properties": {
				"SubnetId": {
					"Ref": "SubnetPublicC"
				},
				"RouteTableId": {
					"Ref": "RouteTablePublic"
				}
			}
		},
		"RouteTablePublicInternetRoute": {
			"Type": "AWS::EC2::Route",
			"DependsOn": "VPCGatewayAttachment",
			"Properties": {
				"RouteTableId": {
					"Ref": "RouteTablePublic"
				},
				"DestinationCidrBlock": "0.0.0.0/0",
				"GatewayId": {
					"Ref": "InternetGateway"
				}
			}
		},
		"NetworkAclPublic": {
			"Type": "AWS::EC2::NetworkAcl",
			"Properties": {
				"VpcId": {
					"Ref": "VPC"
				},
				"Tags": [{
					"Key": "Name",
					"Value": "Public"
				}]
			}
		},
		"SubnetNetworkAclAssociationPublicA": {
			"Type": "AWS::EC2::SubnetNetworkAclAssociation",
			"Properties": {
				"SubnetId": {
					"Ref": "SubnetPublicA"
				},
				"NetworkAclId": {
					"Ref": "NetworkAclPublic"
				}
			}
		},
		"SubnetNetworkAclAssociationPublicB": {
			"Type": "AWS::EC2::SubnetNetworkAclAssociation",
			"Properties": {
				"SubnetId": {
					"Ref": "SubnetPublicB"
				},
				"NetworkAclId": {
					"Ref": "NetworkAclPublic"
				}
			}
		},
		"SubnetNetworkAclAssociationPublicC": {
			"Type": "AWS::EC2::SubnetNetworkAclAssociation",
			"Properties": {
				"SubnetId": {
					"Ref": "SubnetPublicC"
				},
				"NetworkAclId": {
					"Ref": "NetworkAclPublic"
				}
			}
		},
		"NetworkAclEntryInPublicAllowAll": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {
					"Ref": "NetworkAclPublic"
				},
				"RuleNumber": "99",
				"Protocol": "-1",
				"RuleAction": "allow",
				"Egress": "false",
				"CidrBlock": "0.0.0.0/0"
			}
		},
		"NetworkAclEntryOutPublicAllowAll": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {
					"Ref": "NetworkAclPublic"
				},
				"RuleNumber": "99",
				"Protocol": "-1",
				"RuleAction": "allow",
				"Egress": "true",
				"CidrBlock": "0.0.0.0/0"
			}
		},
		"RedisSecurityGroup": {
			"Type": "AWS::EC2::SecurityGroup",
			"Properties": {
				"GroupDescription": "Allow redis and sentinel traffic",
				"VpcId": {
					"Ref": "VPC"
				},
				"Tags": [{
					"Key": "Name",
					"Value": "RedisSecurityGroup"
				}]
			},
			"DependsOn": "VPC"
		},
		"RedisSecurityGroupIngress": {
			"Type": "AWS::EC2::SecurityGroupIngress",
			"Properties": {
				"GroupId": {
					"Ref": "RedisSecurityGroup"
				},
				"IpProtocol": "tcp",
				"ToPort": "6379",
				"FromPort": "6379",
				"SourceSecurityGroupId": {
					"Ref": "RedisSecurityGroup"
				}
			},
			"DependsOn": "RedisSecurityGroup"
		},
		"SentinelSecurityGroupIngress": {
			"Type": "AWS::EC2::SecurityGroupIngress",
			"Properties": {
				"GroupId": {
					"Ref": "RedisSecurityGroup"
				},
				"IpProtocol": "tcp",
				"ToPort": "46379",
				"FromPort": "46379",
				"SourceSecurityGroupId": {
					"Ref": "RedisSecurityGroup"
				}
			},
			"DependsOn": "RedisSecurityGroup"
		},
		"RedisInitialSeed": {
			"Type": "AWS::EC2::Instance",
			"DependsOn": [ "InternetGateway", "RedisSecurityGroup", "RouteTablePublicInternetRoute" ],
			"Properties": {
				"KeyName": {
					"Ref": "KeyName"
				},
				"SecurityGroupIds" : [ {"Ref" : "RedisSecurityGroup"} ],
				"SubnetId": {"Ref" : "SubnetPublicA"},
				"InstanceType": "t2.micro",
				"ImageId": "ami-4f680658",
				"UserData": {
					"Fn::Base64": {
						"Fn::Join": ["", [
							{ "Fn::FindInMap": ["Constants", "InstanceValues", "userDataPre"]},
							"cat >/etc/chef/first-run.json <<EOF\n{\n  \"policy_name\": \"",
							{
								"Ref": "ChefPolicyName"
							},
							"\", \"policy_group\": \"",
							{
								"Ref": "ChefPolicyGroup"
							},
							"\"\n}\nEOF\n",
							"cat >/etc/chef/client.rb <<EOF\nlog_level        :info\nlog_location     STDOUT\nchef_server_url  '",
							{
								"Ref": "ChefServerUrl"
							},
							"'\nvalidation_client_name '",
							{
								"Ref": "ChefValidationClientName"
							},
							"'\nvalidation_key '/etc/chef/validator.pem'\nEOF\necho \"",
							{
								"Ref": "ChefValidationPemBase64"
							},
							"\" | base64 --decode >/etc/chef/validator.pem\n",
							
							{"Fn::FindInMap": ["Constants", "InstanceValues", "userDataPost"]},
							{
								"Ref": "AWS::StackName"
							},
							"\n"
						]]
					}
				},
				"Tags": [{
					"Key": "Name",
					"Value": "redis"
				}, {
					"Key": "initialSeed",
					"Value": "true"
				}]
			},
			"CreationPolicy": {
				"ResourceSignal": {
					"Timeout": "PT10M"
				}
			}
		},
		"Redis1": {
			"Type": "AWS::EC2::Instance",
			"DependsOn": [ "InternetGateway", "RedisInitialSeed", "RedisSecurityGroupIngress" ],
			"Properties": {
				"KeyName": {
					"Ref": "KeyName"
				},
				"SecurityGroupIds" : [ {"Ref" : "RedisSecurityGroup"} ],
				"SubnetId": {"Ref" : "SubnetPublicA"},
				"InstanceType": "t2.micro",
				"ImageId": "ami-4f680658",
				"UserData": {
					"Fn::Base64": {
						"Fn::Join": ["", [
							{ "Fn::FindInMap": ["Constants", "InstanceValues", "userDataPre"]},
							"cat >/etc/chef/first-run.json <<EOF\n{\n  \"policy_name\": \"",
							{
								"Ref": "ChefPolicyName"
							},
							"\", \"policy_group\": \"",
							{
								"Ref": "ChefPolicyGroup"
							},
							"\"\n}\nEOF\n",
							"cat >/etc/chef/client.rb <<EOF\nlog_level        :info\nlog_location     STDOUT\nchef_server_url  '",
							{
								"Ref": "ChefServerUrl"
							},
							"'\nvalidation_client_name '",
							{
								"Ref": "ChefValidationClientName"
							},
							"'\nvalidation_key '/etc/chef/validator.pem'\nEOF\necho \"",
							{
								"Ref": "ChefValidationPemBase64"
							},
							"\" | base64 --decode >/etc/chef/validator.pem\n",
							
							{"Fn::FindInMap": ["Constants", "InstanceValues", "userDataPost"]},
							{
								"Ref": "AWS::StackName"
							},
							"\n"
						]]
					}
				},
				"Tags": [{
					"Key": "Name",
					"Value": "redis"
				}]
			}
		},
		"Redis2": {
			"Type": "AWS::EC2::Instance",
			"DependsOn": [ "InternetGateway", "RedisInitialSeed", "RedisSecurityGroupIngress" ],
			"Properties": {
				"KeyName": {
					"Ref": "KeyName"
				},
				"SecurityGroupIds" : [ {"Ref" : "RedisSecurityGroup"} ],
				"SubnetId": {"Ref" : "SubnetPublicA"},
				"InstanceType": "t2.micro",
				"ImageId": "ami-4f680658",
				"UserData": {
					"Fn::Base64": {
						"Fn::Join": ["", [
							{ "Fn::FindInMap": ["Constants", "InstanceValues", "userDataPre"]},
							"cat >/etc/chef/first-run.json <<EOF\n{\n  \"policy_name\": \"",
							{
								"Ref": "ChefPolicyName"
							},
							"\", \"policy_group\": \"",
							{
								"Ref": "ChefPolicyGroup"
							},
							"\"\n}\nEOF\n",
							"cat >/etc/chef/client.rb <<EOF\nlog_level        :info\nlog_location     STDOUT\nchef_server_url  '",
							{
								"Ref": "ChefServerUrl"
							},
							"'\nvalidation_client_name '",
							{
								"Ref": "ChefValidationClientName"
							},
							"'\nvalidation_key '/etc/chef/validator.pem'\nEOF\necho \"",
							{
								"Ref": "ChefValidationPemBase64"
							},
							"\" | base64 --decode >/etc/chef/validator.pem\n",
							
							{"Fn::FindInMap": ["Constants", "InstanceValues", "userDataPost"]},
							{
								"Ref": "AWS::StackName"
							},
							"\n"
						]]
					}
				},
				"Tags": [{
					"Key": "Name",
					"Value": "redis"
				}]
			}
		},
		"Redis3": {
			"Type": "AWS::EC2::Instance",
			"DependsOn": [ "InternetGateway", "RedisInitialSeed", "RedisSecurityGroupIngress" ],
			"Properties": {
				"KeyName": {
					"Ref": "KeyName"
				},
				"SecurityGroupIds" : [ {"Ref" : "RedisSecurityGroup"} ],
				"SubnetId": {"Ref" : "SubnetPublicA"},
				"InstanceType": "t2.micro",
				"ImageId": "ami-4f680658",
				"UserData": {
					"Fn::Base64": {
						"Fn::Join": ["", [
							{ "Fn::FindInMap": ["Constants", "InstanceValues", "userDataPre"]},
							"cat >/etc/chef/first-run.json <<EOF\n{\n  \"policy_name\": \"",
							{
								"Ref": "ChefPolicyName"
							},
							"\", \"policy_group\": \"",
							{
								"Ref": "ChefPolicyGroup"
							},
							"\"\n}\nEOF\n",
							"cat >/etc/chef/client.rb <<EOF\nlog_level        :info\nlog_location     STDOUT\nchef_server_url  '",
							{
								"Ref": "ChefServerUrl"
							},
							"'\nvalidation_client_name '",
							{
								"Ref": "ChefValidationClientName"
							},
							"'\nvalidation_key '/etc/chef/validator.pem'\nEOF\necho \"",
							{
								"Ref": "ChefValidationPemBase64"
							},
							"\" | base64 --decode >/etc/chef/validator.pem\n",
							
							{"Fn::FindInMap": ["Constants", "InstanceValues", "userDataPost"]},
							{
								"Ref": "AWS::StackName"
							},
							"\n"
						]]
					}
				},
				"Tags": [{
					"Key": "Name",
					"Value": "redis"
				}]
			}
		}
	},

	"Outputs": {
		"VPC": {
			"Description": "VPC.",
			"Value": {
				"Ref": "VPC"
			}
		},
		"SubnetPublicA": {
			"Description": "Subnet public A.",
			"Value": {
				"Ref": "SubnetPublicA"
			}
		},
		"SubnetPublicB": {
			"Description": "Subnet public B.",
			"Value": {
				"Ref": "SubnetPublicB"
			}
		},
		"SubnetPublicC": {
			"Description": "Subnet public C.",
			"Value": {
				"Ref": "SubnetPublicC"
			}
		},
		"RouteTablePublic": {
			"Description": "Route table public.",
			"Value": {
				"Ref": "RouteTablePublic"
			}
		},
		"SecurityGroup": {
			"Description": "Security Group id",
			"Value": {
				"Ref": "RedisSecurityGroup"
			}
		}
	},
	"Mappings": {
		"Constants": {
			"InstanceValues": {
				"userDataPre": "#!/bin/bash -xe\napt-get update && apt-get install -y python-pip && pip install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-latest.tar.gz\nmkdir /etc/chef;",
				"userDataPost": "\ncurl -L https://www.opscode.com/chef/install.sh | bash\nmkdir /usr/lib/systemd/system; ln -s /bin/systemctl /usr/bin/systemctl\nchef-client -j /etc/chef/first-run.json\n/usr/local/bin/cfn-signal -e $? --resource RedisInitialSeed --stack "
			}
		}
	}
}