cloudformation-example.json

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "EC2 and SSH showcase",
  "Metadata": {
    "AWS::CloudFormation::Interface": {
      "ParameterGroups": [
        {
          "Label": { "default": "Instance Configuration" },
          "Parameters": [
            "VPC",
            "Subnet",
            "KeyName",
            "IAMGroups",
            "LocalGroups"
          ]
        },
        {
          "Label": { "default": "Project Configuration" },
          "Parameters": [
            "Repo",
            "Branch"
          ]
        }
      ],
      "ParameterLabels": {
        "VPC": { "default": "VPC" },
        "Subnet": { "default": "Subnet" },
        "KeyName": { "default": "SSH Key Name" },
        "IAMGroups": { "default": "Authorized IAM Groups" },
        "LocalGroups": { "default": "Local Group Mappings" },
        "Repo": { "default": "Repository" },
        "Branch": { "default": "Branch" },
      }
    }
  },
  "Parameters": {
    "VPC": {
      "Description": "The VPC the EC2 instance is launched into.",
      "Type": "AWS::EC2::VPC::Id"
    },
    "Subnet": {
      "Description": "The subnet the EC2 instance is launched into.",
      "Type": "AWS::EC2::Subnet::Id"
    },
    "KeyName": {
      "Description": "The SSH keypair to use for ec2-user on the instance.",
      "Type": "AWS::EC2::KeyPair::KeyName"
    },
    "IAMGroups": {
      "Description": "A comma-separated list of IAM group names that are granted SSH access.",
      "Type": "CommaDelimitedList"
    },
    "LocalGroups": {
      "Description": "A comma-separated list of local group names that are mapped to IAM users.",
      "Type": "CommaDelimitedList",
      "Default": "wheel"
    },

    "Repo": {
      "Description": "The name of the GitHub repository.",
      "Type": "String",
      "Default": "widdix/aws-ec2-ssh",
    },
    "Branch": {
      "Description": "The branch for the GitHub repository.",
      "Type": "String",
      "Default": "master",
    }
  },
  "Mappings": {
    "RegionMap": {
      "eu-west-1": {"AMI": "ami-31328842"},
      "ap-southeast-1": {"AMI": "ami-e90dc68a"},
      "ap-southeast-2": {"AMI": "ami-f2210191"},
      "eu-central-1": {"AMI": "ami-e2df388d"},
      "ap-northeast-2": {"AMI": "ami-6598510b"},
      "ap-northeast-1": {"AMI": "ami-f80e0596"},
      "us-east-1": {"AMI": "ami-08111162"},
      "sa-east-1": {"AMI": "ami-1e159872"},
      "us-west-1": {"AMI": "ami-1b0f7d7b"},
      "us-west-2": {"AMI": "ami-c229c0a2"}
    }
  },
  "Resources": {
    "SecurityGroup": {
      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "GroupDescription": "ssh",
        "VpcId": {"Ref": "VPC"},
        "SecurityGroupIngress": [{
          "CidrIp": "0.0.0.0/0",
          "FromPort": 22,
          "IpProtocol": "tcp",
          "ToPort": 22
        }]
      }
    },
    "InstanceProfile": {
      "Type": "AWS::IAM::InstanceProfile",
      "Properties": {
        "Path": "/",
        "Roles": [{"Ref": "Role"}]
      }
    },
    "Role": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [{
            "Effect": "Allow",
            "Principal": {
              "Service": ["ec2.amazonaws.com"]
            },
            "Action": ["sts:AssumeRole"]
          }]
        },
        "Path": "/",
        "Policies": [{
          "PolicyName": "iam",
          "PolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [{
              "Effect": "Allow",
              "Action": [
                "iam:ListUsers",
                "iam:ListSSHPublicKeys",
                "iam:GetSSHPublicKey",
                "iam:GetGroup"
              ],
              "Resource": [
                "*"
              ]
            }]
          }
        }]
      }
    },
    "Instance": {
      "Type": "AWS::EC2::Instance",
      "Metadata": {
        "AWS::CloudFormation::Init": {
          "config": {
            "files": {
              "/etc/cfn/cfn-hup.conf": {
                "content": {"Fn::Join": ["", [
                  "[main]", "\n",
                  "stack=", {"Ref": "AWS::StackId"}, "\n",
                  "region=", {"Ref": "AWS::Region"}, "\n"
                ]]},
                "mode": "000400",
                "owner": "root",
                "group": "root"
              },
              "/etc/cfn/hooks.d/cfn-auto-reloader.conf": {
                "content": {"Fn::Join": ["", [
                  "[cfn-auto-reloader-hook]", "\n",
                  "triggers=post.update", "\n",
                  "path=Resources.Instance.Metadata.AWS::CloudFormation::Init", "\n",
                  "action=/opt/aws/bin/cfn-init --verbose --stack=", {"Ref": "AWS::StackName"}, " --region=", {"Ref": "AWS::Region"}, " --resource=Instance", "\n",
                  "runas=root", "\n"
                ]]}
              }
            },
            "commands": {
              "configure_ec2_ssh": {
                "command": { "Fn::Join": [ "", [
                  "#!/bin/bash\n",
                  "export IAM_AUTHORIZED_GROUPS=", { "Fn::Join": [ ",", { "Ref": "IAMGroups" } ] }, "\n",
                  "export LOCAL_GROUPS=", { "Fn::Join": [ ",", { "Ref": "LocalGroups" } ] }, "\n",
                  "export REPO=", { "Ref": "Repo" }, "\n",
                  "export BRANCH=", { "Ref": "Branch" }, "\n",
                  "curl -sL -o /tmp/install-iam-ssh https://raw.github.com/${REPO}/${BRANCH}/install.sh\n",
                  "chmod +x /tmp/install-iam-ssh\n",
                  "/tmp/install-iam-ssh\n"
                ]]}
              }
            },
            "services": {
              "sysvinit": {
                "cfn-hup": {
                  "enabled": "true",
                  "ensureRunning": "true",
                  "files": ["/etc/cfn/cfn-hup.conf", "/etc/cfn/hooks.d/cfn-auto-reloader.conf"]
                },
                "sshd": {
                  "enabled": "true",
                  "ensureRunning": "true"
                }
              }
            }
          }
        }
      },
      "Properties": {
        "KeyName": { "Ref": "KeyName" },
        "ImageId": {"Fn::FindInMap": ["RegionMap", {"Ref": "AWS::Region"}, "AMI"]},
        "IamInstanceProfile": {"Ref": "InstanceProfile"},
        "InstanceType": "t2.micro",
        "SecurityGroupIds": [{"Ref": "SecurityGroup"}],
        "SubnetId": {"Ref": "Subnet"},
        "UserData": {"Fn::Base64": {"Fn::Join": ["", [
          "#!/bin/bash -x", "\n",
          "/opt/aws/bin/cfn-init --verbose --stack=", {"Ref": "AWS::StackName"}, " --region=", {"Ref": "AWS::Region"}, " --resource=Instance", "\n",
          "/opt/aws/bin/cfn-signal --exit-code=$? --stack=", {"Ref": "AWS::StackName"}, " --region=", {"Ref": "AWS::Region"}, " --resource=Instance", "\n"
        ]]}},
        "Tags": [{
          "Key": "Name",
          "Value": "ec2-ssh-showcase"
        }]
      },
      "CreationPolicy": {
        "ResourceSignal": {
          "Count": 1,
          "Timeout": "PT15M"
        }
      }
    }
  },
  "Outputs": {
    "PublicName": {
      "Description": "The public name of the EC2 instance.",
      "Value": {"Fn::GetAtt": ["Instance", "PublicDnsName"]}
    }
  }
}