marketplace.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: AWS Native Chef Stack for Marketplace v5.1.1

Parameters:
  # Required Parameters
  AutomationBucket:
    Default: 'aws-native-chef-server'
    Type: String
    Description: AWS S3 bucket name that contains all of the cloudformation templates and scripts for this stack
  VPC:
    Description: Choose VPC to use
    Type: AWS::EC2::VPC::Id
  ServerSubnets:
    Description: Provide a list of Subnet IDs for the Chef Servers (must be within the specified VPC)
    Type: List<AWS::EC2::Subnet::Id>
  LoadBalancerSubnets:
    Description: Provide a comma separated list of Subnet IDs for the load balancers (Leave blank to use the ServerSubnets specified above)
    Type: CommaDelimitedList
    Default: ''
  DatabaseSubnets:
    Description: Provide a comma separated list of Subnet IDs for the Postgres database (Leave blank to use the ServerSubnets specified above)
    Type: CommaDelimitedList
    Default: ''
  ElasticSearchSubnets:
    Description: Provide a comma separated list of Subnet IDs for the ElasticSearch cluster (Leave blank to use the ServerSubnets specified above)
    Type: CommaDelimitedList
    Default: ''
  KeyName:
    Description: Name of an existing EC2 KeyPair to enable SSH access to the instance
    Type: AWS::EC2::KeyPair::KeyName
  InboundClientCidr:
    Description: Your internal network range in CIDR notation, from where client traffic will originate
    AllowedPattern: '((\d{1,3})\.){3}\d{1,3}/\d{1,2}'
    ConstraintDescription: Must be in CIDR notation (e.g. 10.0.0.0/8 or 0.0.0.0/0)
    Type: String
  InboundAdminCidr:
    Description: Your internal administrative network source range in CIDR notation
    AllowedPattern: '((\d{1,3})\.){3}\d{1,3}/\d{1,2}'
    ConstraintDescription: Must be in CIDR notation (e.g. 10.0.0.0/8 or 0.0.0.0/0)
    Type: String
  ContactEmail:
    Description: Contact email for Cloudwatch notifications and instance tagging
    Type: String
  ContactDept:
    Description: Contact department for resource tagging purposes
    Type: String
  Route53HostedZone:
    Type: String
    Default: ''
    Description: Supply a Route 53 Hosted Zone name (eg. mydomain.com) for auto-creating a DNS record. Do not append a dot at the end. (Leave blank to disable)
  ###############################################################################
  # Automate Stack Settings
  AutomateSSLCertificateARN:
    Description: ARN for SSL Certficate, pre-create this in AWS Certificate Manager
    Type: String
    AllowedPattern: "arn:aws:acm:.*"
  ChefAutomateAdminPassword:
    Description: Provide a password for the Chef Automate admin user
    NoEcho: true
    Type: String
    MinLength: 8
    MaxLength: 64
    ConstraintDescription: Must be at least 8 characters
  ChefAutomateToken:
    Description: The secret token used to communicate with the Chef Automate Server, for forwarding Visibility data.
    Type: String
    AllowedPattern: ^[a-z0-9]*$
    MinLength: 64
    MaxLength: 64
    ConstraintDescription: Must be 64 alphanumeric characters
  AutomateDnsRecordName:
    Description: The DNS A-record name to automatically create in the Route53 zone (if enabled). Do not include the domain name.
    Type: String
    Default: 'automate'
  AutomateInstanceType:
    Description: EC2 Instance type for Automate server (M5 class recommended)
    Default: t3.medium
    Type: String
    AllowedValues: [t3.medium, t3.large, t3.xlarge, t3.2xlarge,
      m5.large, m5.xlarge, m5.2xlarge, m5.4xlarge, m5.12xlarge, m5.24xlarge,
      c5.large, c5.xlarge, c5.2xlarge, c5.4xlarge, c5.9xlarge, c5.18xlarge]
  AutomateDataVolumeSize:
    Description: Amount of storage space in GB to allocate on a dedicated data volume (must be between 500 and 16000)
    Type: Number
    Default: 500
    MinValue: 500
    MaxValue: 16000
  ###############################################################################
  # Chef Server Stack Settings
  ChefSSLCertificateARN:
    Description: ARN for SSL Certficate, pre-create this in AWS Certificate Manager
    Type: String
    AllowedPattern: "arn:aws:acm:.*"
  ChefServerDnsRecordName:
    Description: The DNS A-record name to automatically create in the Route53 zone (if enabled). Do not include the domain name.
    Type: String
    Default: 'chef'
  ChefInstanceType:
    Description: EC2 Instance type for Chef Server Frontends (C5 recommended for performance)
    Default: t3.small
    Type: String
    AllowedValues: [t3.small, t3.medium, t3.large, t3.xlarge, t3.2xlarge,
      m5.large, m5.xlarge, m5.2xlarge, m5.4xlarge, m5.12xlarge, m5.24xlarge,
      c5.large, c5.xlarge, c5.2xlarge, c5.4xlarge, c5.9xlarge, c5.18xlarge]
  ChefDBInstanceClass:
    Description: EC2 Instance type for RDS DBs (M5 class recommended for performance)
    Default: 'db.t3.small'
    Type: String
    AllowedValues: [db.t3.small, db.t3.medium, db.t3.large, db.t3.xlarge, db.t3.2xlarge,
      db.m4.large, db.m4.xlarge, db.m4.2xlarge, db.m4.4xlarge, db.m4.10xlarge, db.m4.16xlarge,
      db.r4.large, db.r4.xlarge, db.r4.2xlarge, db.r4.4xlarge, db.r4.8xlarge, db.r4.16xlarge,
      db.m5.large, db.m5.xlarge, db.m5.2xlarge, db.m5.4xlarge, db.m5.12xlarge, db.m5.24xlarge]
  ChefDBStorageType:
    Description: Select gp2 or io1 DB storage. io1 is much higher performing, must select minimum 100GB storage and an IOPS value
    Default: 'gp2'
    Type: String
    AllowedValues: [gp2, io1]
  ChefDBAllocatedStorage:
    Description: Storage size allocated for the database (gp2 minimum 20, maximum 16000) (io1 minimum 100, maximum 32768)
    Default: '20'
    Type: String
  ChefDBIops:
    Description: IOPS reserved for DB storage, only applicable if ChefDBStorageType is io1 (ChefDBAllocatedStorage * 10)
    Default: '1000'
    Type: String
  ChefDBBackupDaystoKeep:
    Description: Number of days of automatic DB backups to keep
    Default: 5
    Type: Number
    MinValue: 0
    MaxValue: 35
  ChefDBPassword:
    Description: Create a strong RDS admin password
    NoEcho: true
    Type: String
    MinLength: 8
    MaxLength: 64
  ChefElasticSearchInstanceType:
    Description: The Instance type to use for ElasticSearch instances (i3 recommended for performance)
    Type: String
    Default: 'm3.medium.elasticsearch'
    AllowedValues: [
      'i3.large.elasticsearch', 'i3.xlarge.elasticsearch', 'i3.2xlarge.elasticsearch', 'i3.4xlarge.elasticsearch', 'i3.8xlarge.elasticsearch', 'i3.16xlarge.elasticsearch',
      'i2.xlarge.elasticsearch', 'i2.2xlarge.elasticsearch',
      'm3.medium.elasticsearch', 'm3.large.elasticsearch', 'm3.xlarge.elasticsearch', 'm3.medium.elasticsearch',
      'r3.large.elasticsearch', 'r3.xlarge.elasticsearch', 'r3.2xlarge.elasticsearch', 'r3.4xlarge.elasticsearch', 'r3.8xlarge.elasticsearch' ]
  ChefElasticSearchVersion:
    Description: Version of ElasticSearch to use. (5.6 recommended for new installs)
    Type: String
    Default: '5.6'
    AllowedValues:
    - '5.6'
  ChefElasticSearchShardCount:
    Description: Number of ElasticSearch hosts to provision at launch (3 recommended, 2 provides HA)
    Default: 2
    Type: Number
    MinValue: 2
    MaxValue: 3
  ###############################################################################
  # Automate Stack Settings
  SupermarketSSLCertificateARN:
    Description: ARN for SSL Certficate, pre-create this in AWS Certificate Manager
    Type: String
    AllowedPattern: "arn:aws:acm:.*"
  SupermarketDnsRecordName:
    Description: The DNS A-record name to automatically create in the Route53 zone (if enabled). Do not include the domain name.
    Type: String
    Default: 'supermarket'
  SupermarketInstanceType:
    Description: EC2 Instance type for Supermarket server (M5 class recommended)
    Default: t3.small
    Type: String
    AllowedValues: [t3.small, t3.medium, t3.large, t3.xlarge, t3.2xlarge,
      m5.large, m5.xlarge, m5.2xlarge, m5.4xlarge, m5.12xlarge, m5.24xlarge,
      c5.large, c5.xlarge, c5.2xlarge, c5.4xlarge, c5.9xlarge, c5.18xlarge]
  SupermarketDataVolumeSize:
    Description: Amount of storage space in GB to allocate for the Supermarket OS+data volume
    Type: Number
    Default: 20
###############################################################################
# Security Settings (these apply to all stacks)
  LoadBalancerScheme:
    Description: Network Scheme for the ELB
    Type: String
    Default: internet-facing
    AllowedValues:
    - 'internet-facing'
    - 'internal'
  AssociatePublicIpAddress:
    Description: Assign public IP addresses to the Chef Servers or not
    Type: String
    Default: true
    AllowedValues:
    - true
    - false
  ###############################################################################
  # Other Settings
  TemplateVersion:
    Description: The version of this template to use (do not change this unless directed by support)
    Type: String
    Default: "5.1.1"
  LogsRetentionInDays:
    Description: Specifies the number of days you want to retain cloudwatch log events.
    Type: Number
    Default: 90
    AllowedValues: [1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 3653]

Conditions:
  2ZoneES:
    !Equals [!Ref ChefElasticSearchShardCount, 2]
  UseServerSubnetsForLoadBalancers:
    !Equals [ !Select [ 0, !Ref LoadBalancerSubnets], '' ]
  UseServerSubnetsForDatabase:
    !Equals [ !Select [ 0, !Ref DatabaseSubnets], '' ]
  UseServerSubnetsForElasticSearch:
    !Equals [ !Select [ 0, !Ref ElasticSearchSubnets], '' ]

Metadata:
  cfn-lint:
    config:
      ignore_checks:
        - W2507
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "Required Parameters"
        Parameters:
          - VPC
          - ServerSubnets
          - LoadBalancerSubnets
          - DatabaseSubnets
          - ElasticSearchSubnets
          - KeyName
          - InboundClientCidr
          - InboundAdminCidr
          - ContactEmail
          - ContactDept
          - Route53HostedZone
          - ChefAutomateAdminPassword
          - AutomateSSLCertificateARN
          - ChefSSLCertificateARN
          - SupermarketSSLCertificateARN
          - ChefDBPassword
      - Label:
          default: "Chef Automate 2 Settings"
        Parameters:
          - ChefAutomateToken
          - AutomateDnsRecordName
          - AutomateInstanceType
          - AutomateDataVolumeSize
      - Label:
          default: "Chef Server Settings"
        Parameters:
          - ChefServerDnsRecordName
          - ChefInstanceType
          - ChefDBInstanceClass
          - ChefDBStorageType
          - ChefDBAllocatedStorage
          - ChefDBIops
          - ChefDBBackupDaystoKeep
          - ChefElasticSearchInstanceType
          - ChefElasticSearchVersion
          - ChefElasticSearchShardCount
      - Label:
          default: "Supermarket Settings"
        Parameters:
          - SupermarketDnsRecordName
          - SupermarketInstanceType
          - SupermarketDataVolumeSize
      - Label:
          default: "Security Settings"
        Parameters:
          - LoadBalancerScheme
          - AssociatePublicIpAddress

# STOP:  Do not replace the AMI list unless you 100% know what you're doing
#        and are fully prepared to lose all support. This template now depends
#        on AMIs that are pre-baked with all needed packages and scripts.
Mappings:
  AMI:
    eu-north-1:
      centos: ami-0b9af355d644500ce
    ap-south-1:
      centos: ami-0d55d5856a64a8918
    eu-west-3:
      centos: ami-0dedf3f53f2557591
    eu-west-2:
      centos: ami-04c86e4a44288c442
    eu-west-1:
      centos: ami-0b34ea9402583cc17
    ap-northeast-2:
      centos: ami-021ab66ea3552f872
    ap-northeast-1:
      centos: ami-083a80ec77b6c48f5
    sa-east-1:
      centos: ami-034441c2a437922b1
    ca-central-1:
      centos: ami-0fae7558a8c3d4683
    ap-southeast-1:
      centos: ami-073d575257d1d42ea
    ap-southeast-2:
      centos: ami-0595dd171f0627906
    eu-central-1:
      centos: ami-0ad4e9dfe9704c7a5
    us-east-1:
      centos: ami-093b02d3970c7616d
    us-east-2:
      centos: ami-0aa5e3a0d1fda1498
    us-west-1:
      centos: ami-08e6c19ae4c1a2267
    us-west-2:
      centos: ami-01ddf45199de44e71

Resources:
  ChefRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action:
          - sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - ec2.amazonaws.com
        Version: '2012-10-17'
      Path: /

  RolePolicies:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub ${AWS::StackName}-ChefStack-Policy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        # Allow all actions to one bucket (the supplied one, or the one you provided)
        - Action: s3:*
          Effect: Allow
          Resource:
            - !Join ['', [ 'arn:aws:s3:::', !Ref ChefBucket]]
            - !Join ['', [ 'arn:aws:s3:::', !Ref ChefBucket, '/*' ]]
        # Allow ability to list all buckets
        - Action: s3:List*
          Effect: Allow
          Resource: arn:aws:s3:::*
        # Allow instances to set themselves as unhealthy if one of the scripts fail
        - Action: autoscaling:*
          Effect: Allow
          Resource: "*"
        # Allow instance to create a nightly snapshot
        - Action: ["ec2:CreateSnapshot", "ec2:CreateTags", "ec2:DeleteSnapshot", "ec2:DescribeSnapshots", "ec2:DescribeVolumes"]
          Effect: Allow
          Resource: "*"
        # Allow instances to read their own tags (needed for setup script below)
        - Action: ec2:DescribeTags
          Effect: Allow
          Resource: "*"
        - Action: cloudwatch:PutMetricData
          Effect: Allow
          Resource: "*"
        - Action: cloudwatch:GetMetricStatistics
          Effect: Allow
          Resource: "*"
        - Action: cloudwatch:ListMetrics
          Effect: Allow
          Resource: "*"
        # Allow instances to write to cloudwatch logs
        - Action: ["logs:PutLogEvents", "logs:CreateLogStream", "logs:CreateLogGroup"]
          Effect: Allow
          Resource: !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:*
      Roles:
      - !Ref ChefRole

  ChefBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      AccessControl: Private
      VersioningConfiguration:
        Status: Enabled

  InboundAdminSecurityGroupId:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Trusted IP addresses, ranges or security groups
      SecurityGroupIngress:
      - CidrIp: !Ref InboundAdminCidr
        IpProtocol: tcp
        FromPort: 22
        ToPort: 22
      - CidrIp: !Ref InboundAdminCidr
        IpProtocol: tcp
        FromPort: 443
        ToPort: 443
      Tags:
      - Key: Name
        Value: !Sub ${AWS::StackName}-Trusted-SG
      VpcId: !Ref VPC

  FrontendSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Setup Ingress/Egress for Automate Server
      SecurityGroupEgress:
      - CidrIp: 0.0.0.0/0
        FromPort: 0
        IpProtocol: tcp
        ToPort: 65535
      SecurityGroupIngress:
      - FromPort: 80
        IpProtocol: tcp
        SourceSecurityGroupId: !Ref LoadBalancerSecurityGroup
        ToPort: 80
      - FromPort: 443
        IpProtocol: tcp
        SourceSecurityGroupId: !Ref LoadBalancerSecurityGroup
        ToPort: 443
      Tags:
      - Key: Name
        Value: !Sub ${AWS::StackName}-FE-SG
      VpcId: !Ref VPC

  LoadBalancerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Setup Ingress/Egress for Automate Load Balancer
      SecurityGroupEgress:
      - CidrIp: 0.0.0.0/0
        FromPort: 0
        IpProtocol: tcp
        ToPort: 65535
      SecurityGroupIngress:
      - CidrIp: !Ref InboundClientCidr
        FromPort: 80
        IpProtocol: tcp
        ToPort: 80
      - CidrIp: !Ref InboundClientCidr
        FromPort: 443
        IpProtocol: tcp
        ToPort: 443
      Tags:
      - Key: Name
        Value: !Sub ${AWS::StackName}-ELB-SG
      VpcId: !Ref VPC

  AlertNotificationTopic:
    Type: AWS::SNS::Topic
    Properties:
      Subscription:
        - Endpoint:
            !Ref ContactEmail
          Protocol: email

# Logging Groups (Cloudwatch Logs)
#########################################################################################
  SystemLogs:
    Type: AWS::Logs::LogGroup
    Properties:
      RetentionInDays: !Ref LogsRetentionInDays
  ChefAppLogs:
    Type: AWS::Logs::LogGroup
    Properties:
      RetentionInDays: !Ref LogsRetentionInDays
  SupermarketAppLogs:
    Type: AWS::Logs::LogGroup
    Properties:
      RetentionInDays: !Ref LogsRetentionInDays
  AutomateAppLogs:
    Type: AWS::Logs::LogGroup
    Properties:
      RetentionInDays: !Ref LogsRetentionInDays

# Automate Stack
#########################################################################################
  AutomateStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Sub https://${AutomationBucket}.s3.amazonaws.com/${TemplateVersion}/automate.yaml
      Parameters:
        VPC: !Ref VPC
        AutomateSubnet: !Select [ "0", !Ref ServerSubnets ]
        SSLCertificateARN: !Ref AutomateSSLCertificateARN
        AutomateAdminPassword: !Ref ChefAutomateAdminPassword
        InboundAdminSecurityGroupId: !Ref InboundAdminSecurityGroupId
        ImageId: !FindInMap [AMI, !Ref "AWS::Region", centos]
        KeyName: !Ref KeyName
        ContactEmail: !Ref ContactEmail
        ContactDept: !Ref ContactDept
        AlertNotificationTopic: !Ref AlertNotificationTopic
        InstanceType: !Ref AutomateInstanceType
        DataVolumeSize: !Ref AutomateDataVolumeSize
        AutomateDataCollectorToken: !Ref ChefAutomateToken
        LoadBalancerScheme: !Ref LoadBalancerScheme
        LoadBalancerSecurityGroupId: !Ref LoadBalancerSecurityGroup
        LoadBalancerSubnets: !If [UseServerSubnetsForLoadBalancers, !Join [ ",", !Ref ServerSubnets ], !Join [ ",", !Ref LoadBalancerSubnets ] ]
        FrontendSecurityGroupId: !Ref FrontendSecurityGroup
        AutomateIamRole: !Ref ChefRole
        Route53HostedZone: !Ref Route53HostedZone
        Route53RecordName: !Ref AutomateDnsRecordName
        SystemLogsGroup: !Ref SystemLogs
        AppLogsGroup: !Ref AutomateAppLogs

# Chef Server Stack
#########################################################################################
  ChefServerStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Sub https://${AutomationBucket}.s3.amazonaws.com/${TemplateVersion}/chef_server_ha.yaml
      Parameters:
        AutomationBucket: !Ref AutomationBucket
        VPC: !Ref VPC
        ChefServerSubnets: !Join [ ",", !Ref ServerSubnets ]
        SSLCertificateARN: !Ref ChefSSLCertificateARN
        InboundAdminSecurityGroupId: !Ref InboundAdminSecurityGroupId
        ImageId: !FindInMap [AMI, !Ref "AWS::Region", centos]
        KeyName: !Ref KeyName
        DBPassword: !Ref ChefDBPassword
        ContactEmail: !Ref ContactEmail
        ContactDept: !Ref ContactDept
        AlertNotificationTopic: !Ref AlertNotificationTopic
        InstanceType: !Ref ChefInstanceType
        DBInstanceClass: !Ref ChefDBInstanceClass
        DBStorageType: !Ref ChefDBStorageType
        DBAllocatedStorage: !Ref ChefDBAllocatedStorage
        DBIops: !Ref ChefDBIops
        DBBackupDaystoKeep: !Ref ChefDBBackupDaystoKeep
        DatabaseSubnets: !If [UseServerSubnetsForDatabase, !Join [",", !Ref ServerSubnets], !Join [",", !Ref DatabaseSubnets]]
        ElasticSearchInstanceType: !Ref ChefElasticSearchInstanceType
        ElasticSearchVersion: !Ref ChefElasticSearchVersion
        ElasticSearchShardCount: !Ref ChefElasticSearchShardCount
        ElasticSearchReplicaCount: !If [2ZoneES, 1, 2]
        ElasticSearchSubnets: !If [UseServerSubnetsForElasticSearch, !Join [ ",", !Ref ServerSubnets ], !Join [ ",", !Ref ElasticSearchSubnets ] ]
        LoadBalancerScheme: !Ref LoadBalancerScheme
        LoadBalancerSecurityGroupId: !Ref LoadBalancerSecurityGroup
        LoadBalancerSubnets: !If [UseServerSubnetsForLoadBalancers, !Join [ ",", !Ref ServerSubnets ], !Join [ ",", !Ref LoadBalancerSubnets ] ]
        FrontendSecurityGroupId: !Ref FrontendSecurityGroup
        ChefServerAssociatePublicIpAddress: !Ref AssociatePublicIpAddress
        ChefServerIamRole: !Ref ChefRole
        ChefSecretsBucket: !Ref ChefBucket
        ChefAutomateServerUrl: !Sub "https://${AutomateStack.Outputs.DNSName}"
        ChefAutomateToken: !Ref ChefAutomateToken
        SupermarketUrl: !Sub "https://${SupermarketDnsRecordName}.${Route53HostedZone}"
        Route53HostedZone: !Ref Route53HostedZone
        Route53RecordName: !Ref ChefServerDnsRecordName
        SystemLogsGroup: !Ref SystemLogs
        AppLogsGroup: !Ref ChefAppLogs
        TemplateVersion: !Ref TemplateVersion

# Supermarket Stack
#########################################################################################
  SupermarketStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Sub https://${AutomationBucket}.s3.amazonaws.com/${TemplateVersion}/supermarket.yaml
      Parameters:
        VPC: !Ref VPC
        LoadBalancerSubnets: !If [UseServerSubnetsForLoadBalancers, !Join [ ",", !Ref ServerSubnets ], !Join [ ",", !Ref LoadBalancerSubnets ] ]
        SupermarketSubnet: !Select [ "0", !Ref ServerSubnets ]
        SSLCertificateARN: !Ref SupermarketSSLCertificateARN
        InboundAdminSecurityGroupId: !Ref InboundAdminSecurityGroupId
        ImageId: !FindInMap [AMI, !Ref "AWS::Region", centos]
        KeyName: !Ref KeyName
        ContactEmail: !Ref ContactEmail
        ContactDept: !Ref ContactDept
        AlertNotificationTopic: !Ref AlertNotificationTopic
        ChefUrl: !Sub "https://${ChefServerStack.Outputs.DNSName}"
        InstanceType: !Ref SupermarketInstanceType
        DataVolumeSize: !Ref SupermarketDataVolumeSize
        LoadBalancerScheme: !Ref LoadBalancerScheme
        LoadBalancerSecurityGroupId: !Ref LoadBalancerSecurityGroup
        FrontendSecurityGroupId: !Ref FrontendSecurityGroup
        SupermarketIamRole: !Ref ChefRole
        ChefSecretsBucket: !Ref ChefBucket
        ChefStackName: !GetAtt ChefServerStack.Outputs.StackName
        Route53HostedZone: !Ref Route53HostedZone
        Route53RecordName: !Ref SupermarketDnsRecordName
        SystemLogsGroup: !Ref SystemLogs
        AppLogsGroup: !Ref SupermarketAppLogs

Outputs:
  AutomateUrl:
    Description: The URL of the Chef Automate Server
    Value: !Sub "https://${AutomateStack.Outputs.DNSName}"
    Export:
      Name: !Sub "${AWS::StackName}-AutomateURL"
  ChefServerUrl:
    Description: The URL of the Chef Automate Server
    Value: !Sub "https://${ChefServerStack.Outputs.DNSName}"
    Export:
      Name: !Sub "${AWS::StackName}-ChefServerURL"
  SupermarketUrl:
    Description: The URL of the Chef Automate Server
    Value: !Sub "https://${SupermarketStack.Outputs.DNSName}"
    Export:
      Name: !Sub "${AWS::StackName}-SupermarketURL"