vpc-en.json

{
  "AWSTemplateFormatVersion" : "2010-09-09",

  "Description" : "VPC with 4 subnets. 2 private and 2 public.",

  "Parameters" : {

    "CorporateCidrIp" : {
      "Description" : "Corporate IP, will be able to SSH, RDP and ICMP into instances",
      "Type" : "String",
      "Default" :  "0.0.0.0/0"
    },

    "VPCCidrIP" : {
      "Description" : "VPC network, should be bigger then the others",
      "Type" : "String",
      "Default" :  "10.0.0.0/16"
    },

    "PublicSubnet1CidrIP" : {
      "Description" : "1st public subnet (MUST be inside the VPC network)",
      "Type" : "String",
      "Default" :  "10.0.0.0/24"
    },

    "PublicSubnet2CidrIP" : {
      "Description" : "2nd public subnet (MUST be inside the VPC network)",
      "Type" : "String",
      "Default" :  "10.0.10.0/24"
    },
    "PrivateSubnet1CidrIP" : {
      "Description" : "1st private subnet (MUST be inside the VPC network)",
      "Type" : "String",
      "Default" :  "10.0.1.0/24"
    },
    "PrivateSubnet2CidrIP" : {
      "Description" : "2nd private subnet (MUST be inside the VPC network)",
      "Type" : "String",
      "Default" :  "10.0.11.0/24"
    }
  },

  "Resources" : {
     "VPC" : {
      "Type" : "AWS::EC2::VPC",
      "Properties" : {
        "CidrBlock" : { "Ref" : "VPCCidrIP" }
      }
    },

    "InternetGateway" : {
      "Type" : "AWS::EC2::InternetGateway",
      "Properties" : {
      }
    },

    "AttachGateway" : {
       "Type" : "AWS::EC2::VPCGatewayAttachment",
       "Properties" : {
         "VpcId" : { "Ref" : "VPC" },
         "InternetGatewayId" : { "Ref" : "InternetGateway" }
       }
    },

    "PublicSubnet1" : {
      "Type" : "AWS::EC2::Subnet",
      "Properties" : {
        "VpcId" : { "Ref" : "VPC" },
        "CidrBlock" : { "Ref" : "PublicSubnet1CidrIP" },
        "AvailabilityZone" : { "Fn::Select" : [ "0", { "Fn::GetAZs" : "" } ] }
      }
    },

    "PublicSubnet2" : {
      "Type" : "AWS::EC2::Subnet",
      "Properties" : {
        "VpcId" : { "Ref" : "VPC" },
        "CidrBlock" : { "Ref" : "PublicSubnet2CidrIP" },
        "AvailabilityZone" : { "Fn::Select" : [ "1", { "Fn::GetAZs" : "" } ] }
      }
    },

    "PrivateSubnet1" : {
      "Type" : "AWS::EC2::Subnet",
      "Properties" : {
        "VpcId" : { "Ref" : "VPC" },
        "CidrBlock" : { "Ref" : "PrivateSubnet1CidrIP" },
        "AvailabilityZone" : { "Fn::Select" : [ "0", { "Fn::GetAZs" : "" } ] }
      }
    },

    "PrivateSubnet2" : {
      "Type" : "AWS::EC2::Subnet",
      "Properties" : {
        "VpcId" : { "Ref" : "VPC" },
        "CidrBlock" : { "Ref" : "PrivateSubnet2CidrIP" },
        "AvailabilityZone" : { "Fn::Select" : [ "1", { "Fn::GetAZs" : "" } ] }
      }
    },

    "PublicRouteTable" : {
      "Type" : "AWS::EC2::RouteTable",
      "Properties" : {
        "VpcId" : {"Ref" : "VPC"}
      }
    },

    "PrivateRouteTable" : {
      "Type" : "AWS::EC2::RouteTable",
      "Properties" : {
        "VpcId" : {"Ref" : "VPC"}
      }
    },

    "PublicRoute" : {
      "Type" : "AWS::EC2::Route",
      "Properties" : {
        "RouteTableId" : { "Ref" : "PublicRouteTable" },
        "DestinationCidrBlock" : "0.0.0.0/0",
        "GatewayId" : { "Ref" : "InternetGateway" }
      }
    },


    "PublicSubnetRouteTableAssociation1" : {
      "Type" : "AWS::EC2::SubnetRouteTableAssociation",
      "Properties" : {
        "SubnetId" : { "Ref" : "PublicSubnet1" },
        "RouteTableId" : { "Ref" : "PublicRouteTable" }
      }
    },

    "PublicSubnetRouteTableAssociation2" : {
      "Type" : "AWS::EC2::SubnetRouteTableAssociation",
      "Properties" : {
        "SubnetId" : { "Ref" : "PublicSubnet2" },
        "RouteTableId" : { "Ref" : "PublicRouteTable" }
      }
    },

    "PrivateSubnetRouteTableAssociation1" : {
      "Type" : "AWS::EC2::SubnetRouteTableAssociation",
      "Properties" : {
        "SubnetId" : { "Ref" : "PrivateSubnet1" },
        "RouteTableId" : { "Ref" : "PrivateRouteTable" }
      }
    },
    "PrivateSubnetRouteTableAssociation2" : {
      "Type" : "AWS::EC2::SubnetRouteTableAssociation",
      "Properties" : {
        "SubnetId" : { "Ref" : "PrivateSubnet2" },
        "RouteTableId" : { "Ref" : "PrivateRouteTable" }
      }
    },

    "PublicSubnetAcl" : {
      "Type" : "AWS::EC2::NetworkAcl",
      "Properties" : {
        "VpcId" : {"Ref" : "VPC"}
      }
    },
    "PrivateSubnetAcl" : {
      "Type" : "AWS::EC2::NetworkAcl",
      "Properties" : {
        "VpcId" : {"Ref" : "VPC"}
      }
    },

    "PublicInSubnetAclEntry" : {
      "Type" : "AWS::EC2::NetworkAclEntry",
      "Properties" : {
        "NetworkAclId" : {"Ref" : "PublicSubnetAcl"},
        "RuleNumber" : "32000",
        "Protocol" : "-1",
        "RuleAction" : "allow",
        "Egress" : "false",
        "CidrBlock" : "0.0.0.0/0",
        "Icmp" : { "Code" : "-1", "Type" : "-1"},
        "PortRange" : {"From" : "1", "To" : "65535"}
      }
    },

    "PublicOutSubnetAclEntry" : {
      "Type" : "AWS::EC2::NetworkAclEntry",
      "Properties" : {
        "NetworkAclId" : {"Ref" : "PublicSubnetAcl"},
        "RuleNumber" : "32000",
        "Protocol" : "-1",
        "RuleAction" : "allow",
        "Egress" : "true",
        "CidrBlock" : "0.0.0.0/0",
        "Icmp" : { "Code" : "-1", "Type" : "-1"},
        "PortRange" : {"From" : "1", "To" : "65535"}
      }
    },

    "PrivateInSubnetAclEntry" : {
      "Type" : "AWS::EC2::NetworkAclEntry",
      "Properties" : {
        "NetworkAclId" : {"Ref" : "PrivateSubnetAcl"},
        "RuleNumber" : "32000",
        "Protocol" : "-1",
        "RuleAction" : "allow",
        "Egress" : "false",
        "CidrBlock" : "0.0.0.0/0",
        "Icmp" : { "Code" : "-1", "Type" : "-1"},
        "PortRange" : {"From" : "1", "To" : "65535"}
      }
    },

    "PrivateOutSubnetAclEntry" : {
      "Type" : "AWS::EC2::NetworkAclEntry",
      "Properties" : {
        "NetworkAclId" : {"Ref" : "PrivateSubnetAcl"},
        "RuleNumber" : "32000",
        "Protocol" : "-1",
        "RuleAction" : "allow",
        "Egress" : "true",
        "CidrBlock" : "0.0.0.0/0",
        "Icmp" : { "Code" : "-1", "Type" : "-1"},
        "PortRange" : {"From" : "1", "To" : "65535"}
      }
    },

    "PublicSubnetAclAssociation1" : {
      "Type" : "AWS::EC2::SubnetNetworkAclAssociation",
      "Properties" : {
        "SubnetId" : { "Ref" : "PublicSubnet1" },
        "NetworkAclId" : {"Ref" : "PublicSubnetAcl"}
      }
    },

    "PublicSubnetAclAssociation2" : {
      "Type" : "AWS::EC2::SubnetNetworkAclAssociation",
      "Properties" : {
        "SubnetId" : { "Ref" : "PublicSubnet2" },
        "NetworkAclId" : {"Ref" : "PublicSubnetAcl"}
      }
    },

    "PrivateSubnetAclAssociation1" : {
      "Type" : "AWS::EC2::SubnetNetworkAclAssociation",
      "Properties" : {
        "SubnetId" : { "Ref" : "PrivateSubnet1" },
        "NetworkAclId" : {"Ref" : "PrivateSubnetAcl"}
      }
    },

    "PrivateSubnetAclAssociation2" : {
      "Type" : "AWS::EC2::SubnetNetworkAclAssociation",
      "Properties" : {
        "SubnetId" : { "Ref" : "PrivateSubnet2" },
        "NetworkAclId" : {"Ref" : "PrivateSubnetAcl"}
      }
    },

    "PrivateSG" : {
      "Type" : "AWS::EC2::SecurityGroup",
      "Properties" : {
        "GroupDescription" : "Servers in the Private Subnets",
        "VpcId" : {"Ref" : "VPC"},
        "SecurityGroupIngress" : [
          { "IpProtocol" : "tcp", "FromPort" : "0", "ToPort" : "65535", "CidrIp" : { "Ref" : "PublicSubnet1CidrIP" } },
          { "IpProtocol" : "udp", "FromPort" : "0", "ToPort" : "65535", "CidrIp" : { "Ref" : "PublicSubnet1CidrIP" } },
          { "IpProtocol" : "icmp", "FromPort" : "-1", "ToPort" : "-1", "CidrIp" : { "Ref" : "PublicSubnet1CidrIP" } },
          { "IpProtocol" : "tcp", "FromPort" : "0", "ToPort" : "65535", "CidrIp" : { "Ref" : "PublicSubnet2CidrIP" } },
          { "IpProtocol" : "udp", "FromPort" : "0", "ToPort" : "65535", "CidrIp" : { "Ref" : "PublicSubnet2CidrIP" } },
          { "IpProtocol" : "icmp", "FromPort" : "-1", "ToPort" : "-1", "CidrIp" : { "Ref" : "PublicSubnet2CidrIP" } }
        ]
      }
    },
    "PublicSG" : {
      "Type" : "AWS::EC2::SecurityGroup",
      "Properties" : {
        "GroupDescription" : "Servers in the Public Subnets",
        "VpcId" : {"Ref" : "VPC"},
        "SecurityGroupIngress" : [
          { "IpProtocol" : "tcp", "FromPort" : "22", "ToPort" : "22", "CidrIp" : { "Ref" : "CorporateCidrIp" } },
          { "IpProtocol" : "tcp", "FromPort" : "3389", "ToPort" : "3389", "CidrIp" : { "Ref" : "CorporateCidrIp" } },
          { "IpProtocol" : "icmp", "FromPort" : "-1", "ToPort" : "-1", "CidrIp" : { "Ref" : "CorporateCidrIp" } }
        ]
      }
    }

  },

  "Outputs" : {

    "VPC" : {
      "Description" : "VPC",
      "Value" : {"Ref" : "VPC"}
    },

    "PublicSubnets" : {
      "Description" : "Public Subnets",
      "Value" : { "Fn::Join":["", [
			{"Ref" : "PublicSubnet1" }, ", ",
			{"Ref" : "PublicSubnet2" }
        ]]}
    },

    "PrivateSubnets" : {
      "Description" : "Private Subnets",
      "Value" : { "Fn::Join":["", [
			{"Ref" : "PrivateSubnet1" }, ", ",
			{"Ref" : "PrivateSubnet2" }
        ]]}
    }

  }


}