template.yaml

AWSTemplateFormatVersion: '2010-09-09'

Parameters:
  AMIId:
    Type: String
    Default: ami-0ff21806645c5e492
  InstanceType:
    Type: String
    Default: t2.micro
  KeyName:
    Type: AWS::EC2::KeyPair::KeyName
  SourceCidrIp:
    Type: String
    Default: 0.0.0.0/0

Resources:
  Vpc:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.38.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
      - Key: Name
        Value: ConnectToS3WebsiteDemo-Vpc

  ######                                   #     #
  #     # #    # #####  #      #  ####     ##    # ###### ##### #    #  ####  #####  #    #
  #     # #    # #    # #      # #    #    # #   # #        #   #    # #    # #    # #   #
  ######  #    # #####  #      # #         #  #  # #####    #   #    # #    # #    # ####
  #       #    # #    # #      # #         #   # # #        #   # ## # #    # #####  #  #
  #       #    # #    # #      # #    #    #    ## #        #   ##  ## #    # #   #  #   #
  #        ####  #####  ###### #  ####     #     # ######   #   #    #  ####  #    # #    #
  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref Vpc
      CidrBlock: 10.38.0.0/24
      AvailabilityZone: !Select
      - 0
      - Fn::GetAZs: !Ref AWS::Region
      Tags:
      - Key: Name
        Value: ConnectToS3WebsiteDemo-PublicSubnet
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref Vpc
      Tags:
      - Key: Name
        Value: ConnectToS3WebsiteDemo-PublicRouteTable
  PublicRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref PublicSubnet
  InternetGateway:
    Type: AWS::EC2::InternetGateway
  InternetGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref Vpc
  PublicRoute:
    Type: AWS::EC2::Route
    Properties:
      GatewayId: !Ref InternetGateway
      DestinationCidrBlock: 0.0.0.0/0
      RouteTableId: !Ref PublicRouteTable

  PublicInstance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Ref AMIId
      InstanceType: !Ref InstanceType
      KeyName: !Ref KeyName
      IamInstanceProfile: !Ref InstanceProfile
      NetworkInterfaces:
      - AssociatePublicIpAddress: true
        DeviceIndex: 0
        GroupSet:
        - !GetAtt Vpc.DefaultSecurityGroup
        SubnetId: !Ref PublicSubnet
      Tags:
      - Key: Name
        Value: PublicInstance
  InstanceServerRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
       Version: 2012-10-17
       Statement:
       - Effect: Allow
         Principal:
           Service:
           - ec2.amazonaws.com
         Action:
            - sts:AssumeRole
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM
  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
      - !Ref InstanceServerRole

  ######                                         #     #                                               #
  #     # #####  # #    #   ##   ##### ######    ##    # ###### ##### #    #  ####  #####  #    #     ##
  #     # #    # # #    #  #  #    #   #         # #   # #        #   #    # #    # #    # #   #     # #
  ######  #    # # #    # #    #   #   #####     #  #  # #####    #   #    # #    # #    # ####        #
  #       #####  # #    # ######   #   #         #   # # #        #   # ## # #    # #####  #  #        #
  #       #   #  #  #  #  #    #   #   #         #    ## #        #   ##  ## #    # #   #  #   #       #
  #       #    # #   ##   #    #   #   ######    #     # ######   #   #    #  ####  #    # #    #    #####
  PrivateSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref Vpc
      CidrBlock: 10.38.1.0/24
      AvailabilityZone: !Select
      - 1
      - Fn::GetAZs: !Ref AWS::Region
      Tags:
      - Key: Name
        Value: ConnectToS3WebsiteDemo-PrivateSubnet1
  PrivateRouteTable1:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref Vpc
      Tags:
      - Key: Name
        Value: ConnectToS3WebsiteDemo-PrivateRouteTable1
  PrivateRouteTableAssociation1:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateRouteTable1
      SubnetId: !Ref PrivateSubnet1
  VPCEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref Vpc
      RouteTableIds:
      - !Ref PrivateRouteTable1
      ServiceName: !Sub "com.amazonaws.${AWS::Region}.s3"

  PrivateInstance1:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Ref AMIId
      InstanceType: !Ref InstanceType
      KeyName: !Ref KeyName
      NetworkInterfaces:
      - AssociatePublicIpAddress: true
        DeviceIndex: 0
        GroupSet:
        - !GetAtt Vpc.DefaultSecurityGroup
        SubnetId: !Ref PrivateSubnet1
      Tags:
      - Key: Name
        Value: PrivateInstance1

  ######                                         #     #                                              #####
  #     # #####  # #    #   ##   ##### ######    ##    # ###### ##### #    #  ####  #####  #    #    #     #
  #     # #    # # #    #  #  #    #   #         # #   # #        #   #    # #    # #    # #   #           #
  ######  #    # # #    # #    #   #   #####     #  #  # #####    #   #    # #    # #    # ####       #####
  #       #####  # #    # ######   #   #         #   # # #        #   # ## # #    # #####  #  #      #
  #       #   #  #  #  #  #    #   #   #         #    ## #        #   ##  ## #    # #   #  #   #     #
  #       #    # #   ##   #    #   #   ######    #     # ######   #   #    #  ####  #    # #    #    #######
  PrivateSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref Vpc
      CidrBlock: 10.38.2.0/24
      AvailabilityZone: !Select
      - 1
      - Fn::GetAZs: !Ref AWS::Region
      Tags:
      - Key: Name
        Value: ConnectToS3WebsiteDemo-PrivateSubnet2
  PrivateRouteTable2:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref Vpc
      Tags:
      - Key: Name
        Value: ConnectToS3WebsiteDemo-PrivateRouteTable2
  PrivateRouteTableAssociation2:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateRouteTable2
      SubnetId: !Ref PrivateSubnet2

  PrivateInstance2:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Ref AMIId
      InstanceType: !Ref InstanceType
      KeyName: !Ref KeyName
      NetworkInterfaces:
      - AssociatePublicIpAddress: true
        DeviceIndex: 0
        GroupSet:
        - !GetAtt Vpc.DefaultSecurityGroup
        SubnetId: !Ref PrivateSubnet2
      Tags:
      - Key: Name
        Value: PrivateInstance2

  ######                                   #     #                                              #####
  #     # #    # #####  #      #  ####     ##    # ###### ##### #    #  ####  #####  #    #    #     #
  #     # #    # #    # #      # #    #    # #   # #        #   #    # #    # #    # #   #           #
  ######  #    # #####  #      # #         #  #  # #####    #   #    # #    # #    # ####       #####
  #       #    # #    # #      # #         #   # # #        #   # ## # #    # #####  #  #            #
  #       #    # #    # #      # #    #    #    ## #        #   ##  ## #    # #   #  #   #     #     #
  #        ####  #####  ###### #  ####     #     # ######   #   #    #  ####  #    # #    #     #####
  PrivateSubnet3:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref Vpc
      CidrBlock: 10.38.3.0/24
      AvailabilityZone: !Select
      - 0
      - Fn::GetAZs: !Ref AWS::Region
      Tags:
      - Key: Name
        Value: ConnectToS3WebsiteDemo-PrivateSubnet3
  PrivateRouteTable3:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref Vpc
      Tags:
      - Key: Name
        Value: ConnectToS3WebsiteDemo-PrivateRouteTable3
  PrivateRouteTableAssociation3:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateRouteTable3
      SubnetId: !Ref PrivateSubnet3
  NatGatewayEIP:
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
  NatGateway:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt NatGatewayEIP.AllocationId
      SubnetId: !Ref PublicSubnet
      Tags:
      - Key: Name
        Value: ConnectToS3WebsiteDemo-NatGateway
  PrivateRoute3:
    Type: AWS::EC2::Route
    Properties:
      NatGatewayId: !Ref NatGateway
      DestinationCidrBlock: 0.0.0.0/0
      RouteTableId: !Ref PrivateRouteTable3

  PrivateInstance3:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Ref AMIId
      InstanceType: !Ref InstanceType
      KeyName: !Ref KeyName
      NetworkInterfaces:
      - AssociatePublicIpAddress: true
        DeviceIndex: 0
        GroupSet:
        - !GetAtt Vpc.DefaultSecurityGroup
        SubnetId: !Ref PrivateSubnet3
      Tags:
      - Key: Name
        Value: PrivateInstance3

  #     #                #####
  #  #  # ###### #####  #     # # ##### ######
  #  #  # #      #    # #       #   #   #
  #  #  # #####  #####   #####  #   #   #####
  #  #  # #      #    #       # #   #   #
  #  #  # #      #    # #     # #   #   #
   ## ##  ###### #####   #####  #   #   ######
  WebsiteBucket:
    Type: AWS::S3::Bucket
    Properties:
      WebsiteConfiguration:
        IndexDocument: index.html
      AccessControl: PublicRead
      LoggingConfiguration:
        DestinationBucketName: !Ref WebsiteLoggingBucket
  WebsiteLoggingBucket:
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: LogDeliveryWrite
  WebsiteBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref WebsiteBucket
      PolicyDocument:
        Statement:
        - Action:
          - s3:GetObject
          Effect: Allow
          Resource:
          - !Sub "arn:aws:s3:::${WebsiteBucket}"
          - !Sub "arn:aws:s3:::${WebsiteBucket}/*"
          Principal: "*"
          Condition:
            IpAddress:
              aws:SourceIp:
              - !Ref SourceCidrIp
        - Action:
          - s3:GetObject
          Effect: Allow
          Resource:
          - !Sub "arn:aws:s3:::${WebsiteBucket}"
          - !Sub "arn:aws:s3:::${WebsiteBucket}/*"
          Principal: "*"
          Condition:
            StringEquals:
              aws:sourceVpc: !Ref Vpc

Outputs:
  PrivateInstance1PrivateIp:
    Value: !GetAtt PrivateInstance1.PrivateIp
  PrivateInstance2PrivateIp:
    Value: !GetAtt PrivateInstance2.PrivateIp
  PrivateInstance3PrivateIp:
    Value: !GetAtt PrivateInstance3.PrivateIp
  ManagedInstancesUrl:
    Value: !Sub "https://${AWS::Region}.console.aws.amazon.com/systems-manager/managed-instances?region=${AWS::Region}"
  WebsiteBucket:
    Value: !Ref WebsiteBucket
  WebsiteUrl:
    Value: !Sub "http://${WebsiteBucket}.s3-website-${AWS::Region}.amazonaws.com/"
  WebSiteSecureUrl:
    Value: !Sub "https://s3-${AWS::Region}.amazonaws.com/${WebsiteBucket}/index.html"
  WebsiteLoggingBucket:
    Value: !Ref WebsiteLoggingBucket