lab-environment.yml

---
AWSTemplateFormatVersion: '2010-09-09'
Description: 'learn-iam-policy: lab environment'
Parameters:
  Subnet:
    Description: 'Choose a Subnet for the lab environment.'
    Type: 'AWS::EC2::Subnet::Id'
Mappings:
  RegionMap:
    'ap-south-1':
      AMI: 'ami-06bcd1131b2f55803'
    'eu-west-3':
      AMI: 'ami-051707cdba246187b'
    'eu-west-2':
      AMI: 'ami-0274e11dced17bb5b'
    'eu-west-1':
      AMI: 'ami-09693313102a30b2c'
    'ap-northeast-2':
      AMI: 'ami-0b4fdb56a00adb616'
    'ap-northeast-1':
      AMI: 'ami-0a2de1c3b415889d2'
    'sa-east-1':
      AMI: 'ami-0112d42866980b373'
    'ca-central-1':
      AMI: 'ami-076b4adb3f90cd384'
    'ap-southeast-1':
      AMI: 'ami-0b84d2c53ad5250c2'
    'ap-southeast-2':
      AMI: 'ami-08589eca6dcc9b39c'
    'eu-central-1':
      AMI: 'ami-034fffcc6a0063961'
    'us-east-1':
      AMI: 'ami-009d6802948d06e52'
    'us-east-2':
      AMI: 'ami-02e680c4540db351e'
    'us-west-1':
      AMI: 'ami-011b6930a81cd6aaf'
    'us-west-2':
      AMI: 'ami-01bbe152bf19d0289'
Resources:
  Ec2Instance:
    Type: 'AWS::EC2::Instance'
    Properties:
      ImageId: !FindInMap [RegionMap, !Ref 'AWS::Region', AMI]
      InstanceType: 't2.micro'
      IamInstanceProfile: !Ref IamInstanceProfile
      SubnetId: !Ref Subnet
      Tags:
      - Key: Name
        Value: !Ref 'AWS::StackName'
  IamInstanceProfile:
    Type: 'AWS::IAM::InstanceProfile'
    Properties:
      Roles:
      - !Ref IamRole
  IamRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: 'ec2.amazonaws.com'
          Action: 'sts:AssumeRole'
      Policies:
      - PolicyName: 'DO-NOT-CHANGE-LAB-SSM-CONNECTION'
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - 'ssm:DescribeAssociation'
            - 'ssm:GetDeployablePatchSnapshotForInstance'
            - 'ssm:GetDocument'
            - 'ssm:GetManifest'
            - 'ssm:GetParameters'
            - 'ssm:ListAssociations'
            - 'ssm:ListInstanceAssociations'
            - 'ssm:PutInventory'
            - 'ssm:PutComplianceItems'
            - 'ssm:PutConfigurePackageResult'
            - 'ssm:UpdateAssociationStatus'
            - 'ssm:UpdateInstanceAssociationStatus'
            - 'ssm:UpdateInstanceInformation'
            Resource: '*'
          - Effect: Allow
            Action:
            - 'ssmmessages:CreateControlChannel'
            - 'ssmmessages:CreateDataChannel'
            - 'ssmmessages:OpenControlChannel'
            - 'ssmmessages:OpenDataChannel'
            Resource: '*'
          - Effect: Allow
            Action:
            - 'ec2messages:AcknowledgeMessage'
            - 'ec2messages:DeleteMessage'
            - 'ec2messages:FailMessage'
            - 'ec2messages:GetEndpoint'
            - 'ec2messages:GetMessages'
            - 'ec2messages:SendReply'
            Resource: '*'
  S3Bucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      BucketName: !Sub 'learn-iam-policy-${AWS::StackName}'
  SsmParameterPathAValue1:
    Type: 'AWS::SSM::Parameter'
    Properties: 
      Name: !Sub '/${AWS::StackName}/a/1'
      Value: 'a1'
      Type: 'String'
  SsmParameterPathAValue2:
    Type: 'AWS::SSM::Parameter'
    Properties: 
      Name: !Sub '/${AWS::StackName}/a/2'
      Value: 'a2'
      Type: 'String'
  SsmParameterPathBValue1:
    Type: 'AWS::SSM::Parameter'
    Properties: 
      Name: !Sub '/${AWS::StackName}/b/1'
      Value: 'b1'
      Type: 'String'
Outputs:
  InstanceId:
    Description: 'The EC2 instance ID.'
    Value: !Ref Ec2Instance
  IamRole:
    Description: 'The name of the IAM role attached to the EC2 instance.'
    Value: !Ref IamRole
  S3Bucket:
    Description: 'The name of the S3 bucket.'
    Value: !Ref S3Bucket