bootstrap.yml

---
AWSTemplateFormatVersion: 2010-09-09
Resources:
  Vpc:
    Type: 'AWS::EC2::VPC'
    Properties:
      CidrBlock: 10.0.0.0/16
      Tags:
        - Key: Name
          Value: !Ref AWS::StackName

  Gateway:
    Type: 'AWS::EC2::InternetGateway'
    Properties:
      Tags:
        - Key: Name
          Value: !Ref AWS::StackName

  GatewayAttachment:
    Type: 'AWS::EC2::VPCGatewayAttachment'
    DependsOn: Gateway
    Properties:
      InternetGatewayId: !Ref Gateway
      VpcId: !Ref Vpc

  Eip0:
    Type: 'AWS::EC2::EIP'
    DependsOn: Vpc

  Eip1:
    Type: 'AWS::EC2::EIP'
    DependsOn: Vpc

  PrivateSubnet0:
    Type: 'AWS::EC2::Subnet'
    Properties:
      AvailabilityZone: !Ref AvailabilityZone0
      CidrBlock: 10.0.0.0/22
      MapPublicIpOnLaunch: false
      VpcId: !Ref Vpc
      Tags:
        - Key: Name
          Value: !Sub ${AWS::StackName} Private 0

  PrivateSubnet1:
    Type: 'AWS::EC2::Subnet'
    Properties:
      AvailabilityZone: !Ref AvailabilityZone1
      CidrBlock: 10.0.4.0/22
      MapPublicIpOnLaunch: false
      VpcId: !Ref Vpc
      Tags:
        - Key: Name
          Value: !Sub ${AWS::StackName} Private 1

  PublicSubnet0:
    Type: 'AWS::EC2::Subnet'
    Properties:
      AvailabilityZone: !Ref AvailabilityZone0
      CidrBlock: 10.0.255.235/28
      MapPublicIpOnLaunch: true
      VpcId: !Ref Vpc
      Tags:
        - Key: Name
          Value: !Sub ${AWS::StackName} Public 0

  PublicSubnet1:
    Type: 'AWS::EC2::Subnet'
    Properties:
      AvailabilityZone: !Ref AvailabilityZone1
      CidrBlock: 10.0.255.240/28
      MapPublicIpOnLaunch: true
      VpcId: !Ref Vpc
      Tags:
        - Key: Name
          Value: !Sub ${AWS::StackName} Public 1

  PrivateRoutes0:
    Type: 'AWS::EC2::RouteTable'
    Properties:
      VpcId: !Ref Vpc
      Tags:
        - Key: Name
          Value: !Sub ${AWS::StackName} Private 0

  PrivateRoutes1:
    Type: 'AWS::EC2::RouteTable'
    Properties:
      VpcId: !Ref Vpc
      Tags:
        - Key: Name
          Value: !Sub ${AWS::StackName} Private 1

  PublicRoutes0:
    Type: 'AWS::EC2::RouteTable'
    Properties:
      VpcId: !Ref Vpc
      Tags:
        - Key: Name
          Value: !Sub ${AWS::StackName} Public 0

  PublicRoutes1:
    Type: 'AWS::EC2::RouteTable'
    Properties:
      VpcId: !Ref Vpc
      Tags:
        - Key: Name
          Value: !Sub ${AWS::StackName} Public 1

  PrivateRouteDefault0:
    Type: 'AWS::EC2::Route'
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      RouteTableId: !Ref PrivateRoutes0
      NatGatewayId: !Ref Nat0

  PrivateRouteDefault1:
    Type: 'AWS::EC2::Route'
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      RouteTableId: !Ref PrivateRoutes1
      NatGatewayId: !Ref Nat1

  PublicRouteDefault0:
    Type: 'AWS::EC2::Route'
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      RouteTableId: !Ref PublicRoutes0
      GatewayId: !Ref Gateway

  PublicRouteDefault1:
    Type: 'AWS::EC2::Route'
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      RouteTableId: !Ref PublicRoutes1
      GatewayId: !Ref Gateway

  PrivateRoutesAssociation0:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      SubnetId: !Ref PrivateSubnet0
      RouteTableId: !Ref PrivateRoutes0

  PrivateRoutesAssociation1:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      SubnetId: !Ref PrivateSubnet1
      RouteTableId: !Ref PrivateRoutes1

  PublicRoutesAssociation0:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      SubnetId: !Ref PublicSubnet0
      RouteTableId: !Ref PublicRoutes0

  PublicRoutesAssociation1:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      SubnetId: !Ref PublicSubnet1
      RouteTableId: !Ref PublicRoutes1

  Nat0:
    Type: 'AWS::EC2::NatGateway'
    DependsOn:
      - PublicRouteDefault0
      - PublicRoutesAssociation0
    Properties:
      SubnetId: !Ref PublicSubnet0
      AllocationId: !GetAtt Eip0.AllocationId

  Nat1:
    Type: 'AWS::EC2::NatGateway'
    DependsOn:
      - PublicRouteDefault1
      - PublicRoutesAssociation1
    Properties:
      SubnetId: !Ref PublicSubnet1
      AllocationId: !GetAtt Eip1.AllocationId

  SecretsBucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      LoggingConfiguration:
        DestinationBucketName: !Ref SecretsLoggingBucket
      VersioningConfiguration:
        Status: Enabled
      Tags:
        - Key: Name
          Value: !Sub ${AWS::StackName} Secrets

  SecretsLoggingBucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      AccessControl: LogDeliveryWrite
      Tags:
        - Key: Name
          Value: !Sub ${AWS::StackName} Secrets Access Logs

  ArtifactsBucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      LifecycleConfiguration:
        Rules:
          - Id: ObjectTimeToLive
            Status: Enabled
            Prefix: '*'
            ExpirationInDays: !Ref ArtifactLifespan
      Tags:
        - Key: Name
          Value: !Sub ${AWS::StackName} Artifacts

  DefaultManagedPolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Properties:
      ManagedPolicyName: DefaultManagedPolicy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: s3:PutObject
            Resource: !Sub 'arn:aws:s3:::${SecretsBucket}/terraform/*'
            Condition:
              StringEquals:
                s3:x-amz-server-side-encryption: [ 'AES256', 'true' ]
          - !If
            - AssumeRole
            - Effect: Allow
              Action: sts:AssumeRole
              Resource: !Ref AccountRoles
            - !Ref AWS::NoValue

  PackerManagedPolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Properties:
      ManagedPolicyName: PackerManagedPolicy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - ec2:AttachVolume
              - ec2:AuthorizeSecurityGroupIngress
              - ec2:CopyImage
              - ec2:CreateImage
              - ec2:CreateKeypair
              - ec2:CreateSecurityGroup
              - ec2:CreateSnapshot
              - ec2:CreateTags
              - ec2:CreateVolume
              - ec2:DeleteKeypair
              - ec2:DeleteSecurityGroup
              - ec2:DeleteSnapshot
              - ec2:DeleteVolume
              - ec2:DeregisterImage
              - ec2:DescribeImageAttribute
              - ec2:DescribeImages
              - ec2:DescribeInstanceStatus
              - ec2:DescribeInstances
              - ec2:DescribeKeyPairs
              - ec2:DescribeRegions
              - ec2:DescribeSecurityGroups
              - ec2:DescribeSnapshots
              - ec2:DescribeSubnets
              - ec2:DescribeTags
              - ec2:DescribeVolumes
              - ec2:DetachVolume
              - ec2:GetPasswordData
              - ec2:ModifyImageAttribute
              - ec2:ModifyInstanceAttribute
              - ec2:ModifySnapshotAttribute
              - ec2:RegisterImage
              - ec2:RunInstances
              - ec2:StopInstances
              - ec2:TerminateInstances
            Resource: '*'
            Condition:
              StringEqualsIfExists:
                ec2:Region: !Ref AWS::Region
                ec2:Vpc: !Sub arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:vpc/${PackerAllowedVpc}
                ec2:Subnet: !Sub arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:subnet/${PackerAllowedSubnet}
                ec2:InstanceType: !Ref PackerAllowedInstanceTypes

  Default:
    Type: 'AWS::CloudFormation::Stack'
    Properties:
      TemplateURL: !Sub https://s3.amazonaws.com/buildkite-aws-stack/${BuildkiteStackVersion}/aws-stack.yml
      Parameters:
        AgentsPerInstance: 1
        ArtifactsBucket: !Ref ArtifactsBucket
        AssociatePublicIpAddress: false
        BootstrapScriptUrl: !Ref BootstrapScriptUrl
        BuildkiteAgentRelease: !Ref BuildkiteAgentRelease
        BuildkiteAgentToken: !Ref BuildkiteAgentToken
        BuildkiteQueue: default
        InstanceType: !Ref DefaultQueueInstanceType
        KeyName: !Ref KeyName
        ManagedPolicyARN: !Ref DefaultManagedPolicy
        MaxSize: !Ref DefaultQueueMaxSize
        MinSize: !Ref DefaultQueueMinSize
        RootVolumeSize: !Ref DefaultQueueRootVolumeSize
        ScaleDownAdjustment: -1
        ScaleUpAdjustment: 5
        SecretsBucket: !Ref SecretsBucket
        SpotPrice: !Ref DefaultQueueSpotPrice
        Subnets: !Join [ ',', [ !Ref PrivateSubnet0, !Ref PrivateSubnet1 ] ]
        VpcId: !Ref Vpc

  Build:
    Type: 'AWS::CloudFormation::Stack'
    Properties:
      TemplateURL: !Sub https://s3.amazonaws.com/buildkite-aws-stack/${BuildkiteStackVersion}/aws-stack.yml
      Parameters:
        AgentsPerInstance: !Ref BuildQueueAgentsPerInstance
        ArtifactsBucket: !Ref ArtifactsBucket
        AssociatePublicIpAddress: false
        BootstrapScriptUrl: !Ref BootstrapScriptUrl
        BuildkiteAgentRelease: !Ref BuildkiteAgentRelease
        BuildkiteAgentToken: !Ref BuildkiteAgentToken
        BuildkiteQueue: build
        InstanceType: !Ref BuildQueueInstanceType
        KeyName: !Ref KeyName
        MaxSize: 1
        MinSize: 1
        RootVolumeSize: !Ref BuildQueueRootVolumeSize
        ScaleDownAdjustment: -1
        ScaleUpAdjustment: 5
        SecretsBucket: !Ref SecretsBucket
        SpotPrice: !Ref BuildQueueSpotPrice
        Subnets: !Join [ ',', [ !Ref PrivateSubnet0, !Ref PrivateSubnet1 ] ]
        VpcId: !Ref Vpc

  Packer:
    Type: 'AWS::CloudFormation::Stack'
    Properties:
      TemplateURL: !Sub https://s3.amazonaws.com/buildkite-aws-stack/${BuildkiteStackVersion}/aws-stack.yml
      Parameters:
        AgentsPerInstance: 1
        ArtifactsBucket: !Ref ArtifactsBucket
        AssociatePublicIpAddress: false
        BootstrapScriptUrl: !Ref BootstrapScriptUrl
        BuildkiteAgentRelease: !Ref BuildkiteAgentRelease
        BuildkiteAgentToken: !Ref BuildkiteAgentToken
        BuildkiteQueue: packer
        InstanceType: !Ref PackerQueueInstanceType
        KeyName: !Ref KeyName
        ManagedPolicyARN: !Ref PackerManagedPolicy
        MaxSize: 1
        MinSize: 0
        RootVolumeSize: !Ref PackerQueueRootVolumeSize
        ScaleDownAdjustment: -1
        ScaleUpAdjustment: 5
        SecretsBucket: !Ref SecretsBucket
        SpotPrice: !Ref PackerQueueSpotPrice
        Subnets: !Join [ ',', [ !Ref PrivateSubnet0, !Ref PrivateSubnet1 ] ]
        VpcId: !Ref Vpc

Outputs:
  VpcId:
    Value: !Ref Vpc
    Export:
      Name: !Sub ${AWS::StackName}-VpcId

  Subnets:
    Value: !Join [ ',', [ !Ref PrivateSubnet0, !Ref PrivateSubnet1 ] ]
    Export:
      Name: !Sub ${AWS::StackName}-Subnets

  SecretsBucket:
    Value: !Ref SecretsBucket
    Export:
      Name: !Sub ${AWS::StackName}-SecretsBucket

  ArtifactsBucket:
    Value: !Ref ArtifactsBucket
    Export:
      Name: !Sub ${AWS::StackName}-ArtifactsBucket

  KeyName:
    Value: !Ref KeyName
    Export:
      Name: !Sub ${AWS::StackName}-KeyName

Parameters:
  ArtifactLifespan:
    Type: Number
    Default: 7
    MinValue: 1
    Description: How long to keep artifacts in days

  BuildkiteAgentToken:
    Type: String
    Description: Buildkite agent token
    NoEcho: true
    MinLength: 1

  BuildkiteStackVersion:
    Type: String
    Description: 'The stack version to use. Default is latest.'
    Default: latest
    MinLength: 1

  BuildkiteAgentRelease:
    Type: String
    Default: stable
    AllowedValues:
      - stable
      - beta
      - edge

  KeyName:
    Type: 'AWS::EC2::KeyPair::KeyName'

  DefaultQueueInstanceType:
    Type: String
    Description: Instance type
    Default: t2.nano
    MinLength: 1

  DefaultQueueMinSize:
    Type: Number
    Description: Minimum number of instances for default queue
    Default: 0
    MinValue: 0

  DefaultQueueMaxSize:
    Type: Number
    Description: Maximum number of instances for default queue
    Default: 10
    MinValue: 1

  DefaultQueueRootVolumeSize:
    Type: Number
    Description: Size of each instance's root EBS volume (in GB)
    Default: 50
    MinValue: 50

  DefaultQueueSpotPrice:
    Type: Number
    Description: The price for spot instances. Leave blank to not use spot instances.

  AccountRoles:
    Type: 'CommaDelimitedList'
    Description: A comma separated list roles that can be assumed as
    Default: ''

  BuildQueueInstanceType:
    Type: String
    Description: Instance type
    Default: t2.nano
    MinLength: 1

  BuildQueueAgentsPerInstance:
    Type: Number
    Description: Number of Buildkite agents to run on each the build instance
    Default: 1
    MinValue: 1

  BuildQueueSpotPrice:
    Type: Number
    Description: The price for spot instances. Leave blank to not use spot instances.

  BuildQueueRootVolumeSize:
    Type: Number
    Description: Size of each instance's root EBS volume (in GB)
    Default: 50
    MinValue: 50

  PackerQueueInstanceType:
    Type: String
    Description: Instance type
    Default: t2.nano
    MinLength: 1

  PackerQueueSpotPrice:
    Type: Number
    Description: The price for spot instances. Leave blank to not use spot instances.

  PackerQueueRootVolumeSize:
    Type: Number
    Description: Size of each instance's root EBS volume (in GB)
    Default: 50
    MinValue: 50

  PackerAllowedVpc:
    Type: 'AWS::EC2::VPC::Id'
    Description: The VPC permitted to launch EC2 instances

  PackerAllowedSubnet:
    Type: 'AWS::EC2::Subnet::Id'
    Description: The subnet permitted to launch EC2 instances

  PackerAllowedInstanceTypes:
    Type: CommaDelimitedList
    Description: The EC2 instance types permitted
    Default: t2.nano

  AvailabilityZone0:
    Type: 'AWS::EC2::AvailabilityZone::Name'
    Description: The availability zone for the first subnet
    Default: us-east-1a

  AvailabilityZone1:
    Type: 'AWS::EC2::AvailabilityZone::Name'
    Description: The availability zone for the second subnet
    Default: us-east-1b

  BootstrapScriptUrl:
    Type: String
    Description: A script that is executed on boot on each instance

Conditions:
  AssumeRole: !Not
    - !Equals [ !Join [ ',', !Ref AccountRoles ], '' ]