VM CloudFormation template

vm-cfn.yaml

AWSTemplateFormatVersion: "2010-09-09"

Description: |

  VM for Azure DevOps build agent to execute terraform code

Resources:
    AzTFVpc:
      Type: AWS::EC2::VPC
      Properties:
        CidrBlock: 10.0.0.0/16
        InstanceTenancy: default
        EnableDnsSupport: 'true'
        EnableDnsHostnames: 'true'
        Tags:
          - Key: environment
            Value: dev
          - Key: Name
            Value: tf-vpc

    PublicSubnet:
      Type: AWS::EC2::Subnet
      Properties:
        CidrBlock: 10.0.0.0/24
        AvailabilityZone: eu-north-1a
        MapPublicIpOnLaunch: 'True'
        VpcId: !Ref 'AzTFVpc'
        Tags:
          - Key: environment
            Value: dev
          - Key: Name
            Value: tf-public-subnet

    PrivateSubnet:
      Type: AWS::EC2::Subnet
      Properties:
        CidrBlock: 10.0.2.0/24
        AvailabilityZone: eu-north-1a
        VpcId: !Ref 'AzTFVpc'
        Tags:
          - Key: environment
            Value: dev
          - Key: Name
            Value: tf-private-subnet


    TfIgw:
      Type: AWS::EC2::InternetGateway
      Properties:
        Tags:
          - Key: environment
            Value: dev
          - Key: Name
            Value: tf-igw

    NetworkACL:
      Type: AWS::EC2::NetworkAcl
      Properties:
        VpcId: !Ref 'AzTFVpc'
        Tags:
          - Key: environment
            Value: dev
          - Key: Name
            Value: tf-nacl

    RoutePublic:
      Type: AWS::EC2::RouteTable
      Properties:
        VpcId: !Ref 'AzTFVpc'
        Tags:
          - Key: environment
            Value: dev
          - Key: Name
            Value: tf-public-route

    RoutePrivate:
      Type: AWS::EC2::RouteTable
      Properties:
        VpcId: !Ref 'AzTFVpc'
        Tags:
          - Key: environment
            Value: dev
          - Key: Name
            Value: tf-private-route

    Instance:
      Type: AWS::EC2::Instance
      Properties:
        DisableApiTermination: 'false'
        InstanceInitiatedShutdownBehavior: stop
        ImageId: ami-0a3a4169ad7cb0d77
        InstanceType: t3.micro
        IamInstanceProfile: !Ref 'Ec2InstanceProfile'
        Monitoring: 'true'
        Tags:
          - Key: environment
            Value: dev
          - Key: Name
            Value: tf-instance
        NetworkInterfaces:
        - AssociatePublicIpAddress: 'true'
          DeleteOnTermination: 'true'
          Description: Primary network interface
          DeviceIndex: 0
          SubnetId: !Ref 'PublicSubnet'
          GroupSet: [!Ref 'TfSgApp']

    Ec2InstanceProfile:
      Type: AWS::IAM::InstanceProfile
      Properties:
        Path: /
        Roles: [ !Ref Ec2InstanceRole ]
    Ec2InstanceRole:
      Type: AWS::IAM::Role
      Properties:
        ManagedPolicyArns:
          - arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM
          - arn:aws:iam::aws:policy/AdministratorAccess
        AssumeRolePolicyDocument:
          Statement:
            - Effect: Allow
              Principal:
                Service: [ ec2.amazonaws.com ]
              Action:
                - sts:AssumeRole
        Path: /
    
    TfSgApp:
      Type: AWS::EC2::SecurityGroup
      Properties:
        GroupDescription: App server security group
        VpcId: !Ref 'AzTFVpc'
        SecurityGroupIngress:
         - IpProtocol: tcp
           CidrIp: 0.0.0.0/0
           FromPort: 80
           ToPort: 80
        Tags:
          - Key: environment
            Value: dev
          - Key: Name
            Value: AppServerSecurityGroup

    NACLEntry1:
      Type: AWS::EC2::NetworkAclEntry
      Properties:
        CidrBlock: 0.0.0.0/0
        Egress: 'true'
        Protocol: '-1'
        RuleAction: allow
        RuleNumber: '100'
        NetworkAclId: !Ref 'NetworkACL'

    NACLEntry2:
      Type: AWS::EC2::NetworkAclEntry
      Properties:
        CidrBlock: 0.0.0.0/0
        Protocol: '-1'
        RuleAction: allow
        RuleNumber: '100'
        NetworkAclId: !Ref 'NetworkACL'

    subnetacl1:
      Type: AWS::EC2::SubnetNetworkAclAssociation
      Properties:
        NetworkAclId: !Ref 'NetworkACL'
        SubnetId: !Ref 'PublicSubnet'

    subnetacl3:
      Type: AWS::EC2::SubnetNetworkAclAssociation
      Properties:
        NetworkAclId: !Ref 'NetworkACL'
        SubnetId: !Ref 'PrivateSubnet'


    IGWAttachment:
      Type: AWS::EC2::VPCGatewayAttachment
      Properties:
        VpcId: !Ref 'AzTFVpc'
        InternetGatewayId: !Ref 'TfIgw'

    subnetRoutePublicA:
      Type: AWS::EC2::SubnetRouteTableAssociation
      Properties:
        RouteTableId: !Ref 'RoutePublic'
        SubnetId: !Ref 'PublicSubnet'


    subnetRoutePrivateA:
      Type: AWS::EC2::SubnetRouteTableAssociation
      Properties:
        RouteTableId: !Ref 'RoutePrivate'
        SubnetId: !Ref 'PrivateSubnet'

    publicroute:
      Type: AWS::EC2::Route
      Properties:
        DestinationCidrBlock: 0.0.0.0/0
        RouteTableId: !Ref 'RoutePublic'
        GatewayId: !Ref 'TfIgw'
      DependsOn: TfIgw