parse-development-example.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: >-
  AWS CloudFormation Template demonstrating how to create a development Parse application 
  with an Elastic Beanstalk environment in a VPC. The stack contains 1 public subnet that
  allows HTTP and SSH access to the 'single instance' Elastic Beanstalk host.
  You will be billed for the AWS resources used if you create a stack from this template.
Parameters:
  KeyName:
    Description: >-
      Name of an existing EC2 KeyPair to enable SSH access to the Elastic
      Beanstalk hosts
    Type: 'AWS::EC2::KeyPair::KeyName'
    ConstraintDescription: must be the name of an existing EC2 KeyPair.
  SSHLocation:
    Description: >-
      Lockdown SSH access to the bastion host (default can be accessed from
      anywhere)
    Type: String
    MinLength: '9'
    MaxLength: '18'
    Default: 0.0.0.0/0
    AllowedPattern: '(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})'
    ConstraintDescription: must be a valid CIDR range of the form x.x.x.x/x.
  DevelopmentMongoDBURI:
    Description: >-
      The connection string for your DEVELOPMENT database, i.e.
      mongodb://user:pass@host1:port1,host2:port2/dbname?replicaSet=replicasetname.
      Be sure to URL encode your password if your password has special
      characters.
    Type: String
    ConstraintDescription: must be the URI of an existing MongoDB deployment
  AppId:
    Description: >-
      The application id to host with this server instance. You can use any
      arbitrary string.
    Type: String
  MasterKey:
    Description: >-
      The master key to use for overriding ACL security. You can use any
      arbitrary string. Keep it secret!
    Type: String
Mappings:
  SubnetConfig:
    VPC:
      CIDR: 172.31.0.0/16
    Public:
      CIDR: 172.31.1.0/24
  AWSInstanceType2Arch:
    t2.nano:
      Arch: HVM64
    t2.micro:
      Arch: HVM64
    t2.small:
      Arch: HVM64
    t2.medium:
      Arch: HVM64
    t2.large:
      Arch: HVM64
    t2.xlarge:
      Arch: HVM64
    t2.2xlarge:
      Arch: HVM64
    m5.large:
      Arch: HVM64
    m5.xlarge:
      Arch: HVM64
    m5.2xlarge:
      Arch: HVM64
    m5.4xlarge:
      Arch: HVM64
    m5.12xlarge:
      Arch: HVM64
    c4.large:
      Arch: HVM64
    c4.xlarge:
      Arch: HVM64
    c4.2xlarge:
      Arch: HVM64
    c4.4xlarge:
      Arch: HVM64
    c4.9xlarge:
      Arch: HVM64
  AWSRegionArch2AMI:
    us-east-1:
      HVM64: ami-6869aa05
    us-west-2:
      HVM64: ami-7172b611
    us-west-1:
      HVM64: ami-31490d51
    eu-west-1:
      HVM64: ami-f9dd458a
    eu-west-2:
      HVM64: ami-886369ec
    eu-west-3:
      HVM64: NOT_SUPPORTED
    eu-central-1:
      HVM64: ami-ea26ce85
    ap-northeast-1:
      HVM64: ami-374db956
    ap-northeast-2:
      HVM64: ami-2b408b45
    ap-southeast-1:
      HVM64: ami-a59b49c6
    ap-southeast-2:
      HVM64: ami-dc361ebf
    ap-south-1:
      HVM64: ami-ffbdd790
    us-east-2:
      HVM64: ami-f6035893
    ca-central-1:
      HVM64: ami-730ebd17
    sa-east-1:
      HVM64: ami-6dd04501
    cn-north-1:
      HVM64: ami-8e6aa0e3
    cn-northwest-1:
      HVM64: ami-cb858fa9
  Region2Principal:
    us-east-1:
      EC2Principal: ec2.amazonaws.com
      OpsWorksPrincipal: opsworks.amazonaws.com
    us-west-2:
      EC2Principal: ec2.amazonaws.com
      OpsWorksPrincipal: opsworks.amazonaws.com
    us-west-1:
      EC2Principal: ec2.amazonaws.com
      OpsWorksPrincipal: opsworks.amazonaws.com
    eu-west-1:
      EC2Principal: ec2.amazonaws.com
      OpsWorksPrincipal: opsworks.amazonaws.com
    eu-west-2:
      EC2Principal: ec2.amazonaws.com
      OpsWorksPrincipal: opsworks.amazonaws.com
    eu-west-3:
      EC2Principal: ec2.amazonaws.com
      OpsWorksPrincipal: opsworks.amazonaws.com
    ap-southeast-1:
      EC2Principal: ec2.amazonaws.com
      OpsWorksPrincipal: opsworks.amazonaws.com
    ap-northeast-1:
      EC2Principal: ec2.amazonaws.com
      OpsWorksPrincipal: opsworks.amazonaws.com
    ap-northeast-2:
      EC2Principal: ec2.amazonaws.com
      OpsWorksPrincipal: opsworks.amazonaws.com
    ap-southeast-2:
      EC2Principal: ec2.amazonaws.com
      OpsWorksPrincipal: opsworks.amazonaws.com
    ap-south-1:
      EC2Principal: ec2.amazonaws.com
      OpsWorksPrincipal: opsworks.amazonaws.com
    us-east-2:
      EC2Principal: ec2.amazonaws.com
      OpsWorksPrincipal: opsworks.amazonaws.com
    ca-central-1:
      EC2Principal: ec2.amazonaws.com
      OpsWorksPrincipal: opsworks.amazonaws.com
    sa-east-1:
      EC2Principal: ec2.amazonaws.com
      OpsWorksPrincipal: opsworks.amazonaws.com
    cn-north-1:
      EC2Principal: ec2.amazonaws.com.cn
      OpsWorksPrincipal: opsworks.amazonaws.com.cn
    cn-northwest-1:
      EC2Principal: ec2.amazonaws.com.cn
      OpsWorksPrincipal: opsworks.amazonaws.com.cn
    eu-central-1:
      EC2Principal: ec2.amazonaws.com
      OpsWorksPrincipal: opsworks.amazonaws.com
Resources:
  VPC:
    Type: 'AWS::EC2::VPC'
    Properties:
      CidrBlock: !FindInMap 
        - SubnetConfig
        - VPC
        - CIDR
      EnableDnsSupport: 'true'
      EnableDnsHostnames: 'true'
      Tags:
        - Key: Application
          Value: !Ref 'AWS::StackId'
        - Key: Name
          Value: ParseDevelopmentVPC
  PublicSubnet:
    Type: 'AWS::EC2::Subnet'
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !FindInMap 
        - SubnetConfig
        - Public
        - CIDR
      MapPublicIpOnLaunch: 'true'
      AvailabilityZone: "us-east-1a"
      Tags:
        - Key: Application
          Value: !Ref 'AWS::StackId'
        - Key: Name
          Value: PublicSubnet
        - Key: Network
          Value: Public
  InternetGateway:
    Type: 'AWS::EC2::InternetGateway'
    Properties:
      Tags:
        - Key: Application
          Value: !Ref 'AWS::StackId'
        - Key: Name
          Value: ParseDevelopmentIG
        - Key: Network
          Value: Public
  GatewayToInternet:
    Type: 'AWS::EC2::VPCGatewayAttachment'
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway
  PublicRouteTable:
    Type: 'AWS::EC2::RouteTable'
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Application
          Value: !Ref 'AWS::StackId'
        - Key: Name
          Value: ParsePublicRouteTable
        - Key: Network
          Value: Public
  PublicRoute:
    Type: 'AWS::EC2::Route'
    DependsOn: GatewayToInternet
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway
  PublicSubnetRouteTableAssociation:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      SubnetId: !Ref PublicSubnet
      RouteTableId: !Ref PublicRouteTable
  PublicNetworkAcl:
    Type: 'AWS::EC2::NetworkAcl'
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Application
          Value: !Ref 'AWS::StackId'
        - Key: Name
          Value: ParseDevelopmentPublicACL
        - Key: Network
          Value: Public
  InboundHTTPPublicNetworkAclEntry:
    Type: 'AWS::EC2::NetworkAclEntry'
    Properties:
      NetworkAclId: !Ref PublicNetworkAcl
      RuleNumber: '100'
      Protocol: '6'
      RuleAction: allow
      Egress: 'false'
      CidrBlock: 0.0.0.0/0
      PortRange:
        From: '80'
        To: '80'
  InboundHTTPSPublicNetworkAclEntry:
    Type: 'AWS::EC2::NetworkAclEntry'
    Properties:
      NetworkAclId: !Ref PublicNetworkAcl
      RuleNumber: '101'
      Protocol: '6'
      RuleAction: allow
      Egress: 'false'
      CidrBlock: 0.0.0.0/0
      PortRange:
        From: '443'
        To: '443'
  InboundSSHPublicNetworkAclEntry:
    Type: 'AWS::EC2::NetworkAclEntry'
    Properties:
      NetworkAclId: !Ref PublicNetworkAcl
      RuleNumber: '102'
      Protocol: '6'
      RuleAction: allow
      Egress: 'false'
      CidrBlock: !Ref SSHLocation
      PortRange:
        From: '22'
        To: '22'
  InboundEphemeralPublicNetworkAclEntry:
    Type: 'AWS::EC2::NetworkAclEntry'
    Properties:
      NetworkAclId: !Ref PublicNetworkAcl
      RuleNumber: '103'
      Protocol: '6'
      RuleAction: allow
      Egress: 'false'
      CidrBlock: 0.0.0.0/0
      PortRange:
        From: '1024'
        To: '65535'
  OutboundPublicNetworkAclEntry:
    Type: 'AWS::EC2::NetworkAclEntry'
    Properties:
      NetworkAclId: !Ref PublicNetworkAcl
      RuleNumber: '100'
      Protocol: '6'
      RuleAction: allow
      Egress: 'true'
      CidrBlock: 0.0.0.0/0
      PortRange:
        From: '0'
        To: '65535'
  PublicSubnetNetworkAclAssociation:
    Type: 'AWS::EC2::SubnetNetworkAclAssociation'
    Properties:
      SubnetId: !Ref PublicSubnet
      NetworkAclId: !Ref PublicNetworkAcl
  EC2SecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupName: Parse Development EC2 SG
      GroupDescription: Allow EB to connect to EC2
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - 
          IpProtocol: tcp
          FromPort: '80'
          ToPort: '80'
          CidrIp: 0.0.0.0/0
        -
          IpProtocol: tcp
          FromPort: '22'
          ToPort: '22'
          CidrIp: 0.0.0.0/0
      SecurityGroupEgress:
        - IpProtocol: '-1'
          CidrIp: 0.0.0.0/0
  WebServerRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - !FindInMap 
                  - Region2Principal
                  - !Ref 'AWS::Region'
                  - EC2Principal
            Action:
              - 'sts:AssumeRole'
      Path: /
  WebServerRolePolicy:
    Type: 'AWS::IAM::Policy'
    Properties:
      PolicyName: WebServerRole
      PolicyDocument:
        Statement:
          - Effect: Allow
            NotAction: 'iam:*'
            Resource: '*'
      Roles:
        - !Ref WebServerRole
  WebServerInstanceProfile:
    Type: 'AWS::IAM::InstanceProfile'
    Properties:
      Path: /
      Roles:
        - !Ref WebServerRole
  ParseApplication:
    Type: 'AWS::ElasticBeanstalk::Application'
    Properties:
      ApplicationName: ParseDevelopmentApplication
      Description: AWS Elastic Beanstalk Parse Application
  ParseApplicationVersion:
    Type: 'AWS::ElasticBeanstalk::ApplicationVersion'
    Properties:
      Description: Version 1.0
      ApplicationName: !Ref ParseApplication
      SourceBundle:
        S3Bucket: changy
        S3Key: chrisckchang-parse.zip
  ParseDevelopmentEnvironment:
    Type: 'AWS::ElasticBeanstalk::Environment'
    Properties:
      ApplicationName: !Ref ParseApplication
      Description: Development Parse Environment
      EnvironmentName: "DevelopmentParseEnv"
      SolutionStackName: 64bit Amazon Linux 2017.09 v4.4.4 running Node.js
      VersionLabel: !Ref ParseApplicationVersion
      OptionSettings:
        - Namespace: 'aws:elasticbeanstalk:application'
          OptionName: Application Healthcheck URL
          Value: '/'
        - Namespace: 'aws:elasticbeanstalk:application:environment'
          OptionName: DATABASE_URI
          Value: !Ref DevelopmentMongoDBURI
        - Namespace: 'aws:elasticbeanstalk:application:environment'
          OptionName: APP_ID
          Value: !Ref AppId
        - Namespace: 'aws:elasticbeanstalk:application:environment'
          OptionName: MASTER_KEY
          Value: !Ref MasterKey
        - Namespace: 'aws:elasticbeanstalk:environment'
          OptionName: EnvironmentType
          Value: SingleInstance
        - Namespace: 'aws:autoscaling:launchconfiguration'
          OptionName: InstanceType
          Value: t2.micro
        - Namespace: 'aws:autoscaling:launchconfiguration'
          OptionName: EC2KeyName
          Value: !Ref KeyName
        - Namespace: 'aws:autoscaling:launchconfiguration'
          OptionName: SecurityGroups
          Value: !Ref EC2SecurityGroup
        - Namespace: 'aws:ec2:vpc'
          OptionName: VPCId
          Value: !Ref VPC
        - Namespace: 'aws:ec2:vpc'
          OptionName: Subnets
          Value: !Ref PublicSubnet
        - Namespace: 'aws:autoscaling:launchconfiguration'
          OptionName: IamInstanceProfile
          Value: !Ref WebServerInstanceProfile
Outputs:
  URL:
    Description: The URL of the development Parse application
    Value: !Join 
      - ''
      - - 'http://'
        - !GetAtt 
          - ParseDevelopmentEnvironment
          - EndpointURL