custom-vpc.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: "CloudFormation Template to Create a Custom VPC with Flowlogs Enabled."
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Data Retention Configuration
        Parameters:
          - pLambdaLogGroupRetention
      - Label:
          default: VPC Configuration
        Parameters:
          - pVpcSize
      - Label:
          default: Tagging Configuration
        Parameters:
          - pTagEnvironment
      - Label:
          default: Transit Gateway Attachment Configuration
        Parameters:
          - pTGWAssociateWith
          - pTGWPropagateTo
Parameters:
  pLambdaLogGroupRetention:
    AllowedValues: [1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 3653]
    Description: Specifies the number of days you want to retain log events
    Type: String
    Default: 365
  pVpcSize:
    Type: String
    Description: "Select the netmask length of the VPC being deployed. VPC Size - Small: /22, Medium: /20 or Large: /19"
    AllowedValues:
      - "Small"
      - "Medium"
      - "Large"
    Default: "Small"
  pTagEnvironment:
    Type: String
    Description: Select the Name of the Environment
    AllowedValues:
      - Production
      - Development
Mappings:
  mVpcSize:
    Small:
      VpcCidr: 22
      PublicCidr: 4
      HybridCidr: 6
      PrivateCidr: 6
    Medium:
      VpcCidr: 20
      PublicCidr: 4
      HybridCidr: 8
      PrivateCidr: 8
    Large:
      VpcCidr: 19
      PublicCidr: 4
      HybridCidr: 9
      PrivateCidr: 9
Resources:
  # CloudWatch Log Group for Lambda Functions
  rIpamGetPoolIdLambdaLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub /aws/lambda/${rIpamLambdaGetPoolId}
      RetentionInDays: !Ref pLambdaLogGroupRetention

  # IAM Role, Lambda Function and Custom Resource for Retrieving IPAM Pool ID that is used by VPC
  rCustomGetPoolId:
    Type: Custom::GetIpamPoolId
    Properties:
      ServiceToken: !GetAtt rIpamLambdaGetPoolId.Arn
  rIpamLambdaRoleGetPoolId:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service: "lambda.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
      Policies:
        - PolicyName: ipampolicy
          PolicyDocument:
            Statement:
              - Effect: "Allow"
                Action:
                  - "ec2:DescribeIpamPools"
                Resource: "*"
  rIpamLambdaGetPoolId:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        ZipFile: |
          import boto3
          import os
          import cfnresponse
          from botocore.exceptions import ClientError

          ec2_client = boto3.client('ec2')
          region = os.environ['AWS_REGION']
          environment = os.environ['ENVIRONMENT']

          def lambda_handler(event,context):
              responseData = {}
              if event['RequestType'] == 'Create':
                  try:
                      ipam_pool = ec2_client.describe_ipam_pools(
                          DryRun = False,
                          Filters = [
                              {
                                  'Name': 'locale',
                                  'Values': [region]
                              }
                          ]
                      )
                      print(ipam_pool)
                      status = cfnresponse.FAILED
                      if len(ipam_pool['IpamPools']) == 0:
                          print(f"No IPAM Pools Configured in {region}")
                      for ip_pool in ipam_pool['IpamPools']:
                          print(ip_pool)
                          if ip_pool['AllocationResourceTags']:
                              for tag in ip_pool['AllocationResourceTags']:
                                  if tag['Value'] == environment:
                                      ip_pool_id = ip_pool['IpamPoolId']
                                      print(ip_pool_id)
                                      responseData['Data'] = ip_pool_id
                                      status = cfnresponse.SUCCESS
                                      break
                                  else:
                                      print(f"No IPAM Pools with Allocation Resource Tags that match the Environment")
                          elif len(ip_pool['AllocationResourceTags']) == 0:
                              print(f"IPAM Pool has no Allocation Resource Tags applied")
                      cfnresponse.send(event, context, status, responseData)
                  except ClientError as e:
                      print(e.response['Error']['Message'])
                      cfnresponse.send(event, context, cfnresponse.FAILED, e.response)
              if event['RequestType'] == 'Update':
                  cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData)
              if event['RequestType'] == 'Delete':
                  cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData)
      Environment:
        Variables:
          ENVIRONMENT: !Ref pTagEnvironment
      Handler: index.lambda_handler
      MemorySize: 128
      Role: !GetAtt rIpamLambdaRoleGetPoolId.Arn
      Runtime: python3.9
      Timeout: 60
      Tags:
        - Key: Environment
          Value: !Ref pTagEnvironment

  # VPC
  rVpc:
    Type: AWS::EC2::VPC
    Properties:
      Ipv4IpamPoolId: !GetAtt rCustomGetPoolId.Data
      Ipv4NetmaskLength: !FindInMap [mVpcSize, !Ref pVpcSize, VpcCidr]
      EnableDnsSupport:  true
      EnableDnsHostnames: true
      Tags:
        - Key: Environment
          Value: !Ref pTagEnvironment
  rInternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Environment
          Value: !Ref pTagEnvironment
  rVpcGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref rVpc
      InternetGatewayId: !Ref rInternetGateway
  rPublicSubnetA:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref rVpc
      AvailabilityZone: !Select [ 0, !GetAZs '' ]
      CidrBlock: !Select [ 0, !Cidr [ !GetAtt rVpc.CidrBlock, 9, !FindInMap [mVpcSize, !Ref pVpcSize, PublicCidr]]]
      Tags:
        - Key: Environment
          Value: !Ref pTagEnvironment
  rPublicSubnetB:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref rVpc
      AvailabilityZone: !Select [ 1, !GetAZs '' ]
      CidrBlock: !Select [ 1, !Cidr [ !GetAtt rVpc.CidrBlock, 9, !FindInMap [mVpcSize, !Ref pVpcSize, PublicCidr]]]
      Tags:
        - Key: Environment
          Value: !Ref pTagEnvironment
  rPublicSubnetC:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref rVpc
      AvailabilityZone: !Select [ 2, !GetAZs '' ]
      CidrBlock: !Select [ 2, !Cidr [ !GetAtt rVpc.CidrBlock, 9, !FindInMap [mVpcSize, !Ref pVpcSize, PublicCidr]]]
      Tags:
        - Key: Environment
          Value: !Ref pTagEnvironment
  rHybridSubnetA:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref rVpc
      AvailabilityZone: !Select [ 0, !GetAZs '' ]
      CidrBlock: !Select [ 3, !Cidr [ !GetAtt rVpc.CidrBlock, 9, !FindInMap [mVpcSize, !Ref pVpcSize, HybridCidr]]]
      Tags:
        - Key: Environment
          Value: !Ref pTagEnvironment
  rHybridSubnetB:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref rVpc
      AvailabilityZone: !Select [ 1, !GetAZs '' ]
      CidrBlock: !Select [ 4, !Cidr [ !GetAtt rVpc.CidrBlock, 9, !FindInMap [mVpcSize, !Ref pVpcSize, HybridCidr]]]
      Tags:
        - Key: Environment
          Value: !Ref pTagEnvironment
  rHybridSubnetC:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref rVpc
      AvailabilityZone: !Select [ 2, !GetAZs '' ]
      CidrBlock: !Select [ 5, !Cidr [ !GetAtt rVpc.CidrBlock, 9, !FindInMap [mVpcSize, !Ref pVpcSize, HybridCidr]]]
      Tags:
        - Key: Environment
          Value: !Ref pTagEnvironment
  rPrivateSubnetA:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref rVpc
      AvailabilityZone: !Select [ 0, !GetAZs '' ]
      CidrBlock: !Select [ 6, !Cidr [ !GetAtt rVpc.CidrBlock, 9, !FindInMap [mVpcSize, !Ref pVpcSize, PrivateCidr]]]
      Tags:
        - Key: Environment
          Value: !Ref pTagEnvironment
  rPrivateSubnetB:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref rVpc
      AvailabilityZone: !Select [ 1, !GetAZs '' ]
      CidrBlock: !Select [ 7, !Cidr [ !GetAtt rVpc.CidrBlock, 9, !FindInMap [mVpcSize, !Ref pVpcSize, PrivateCidr]]]
      Tags:
        - Key: Environment
          Value: !Ref pTagEnvironment
  rPrivateSubnetC:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref rVpc
      AvailabilityZone: !Select [ 2, !GetAZs '' ]
      CidrBlock: !Select [ 8, !Cidr [ !GetAtt rVpc.CidrBlock, 9, !FindInMap [mVpcSize, !Ref pVpcSize, PrivateCidr]]]
      Tags:
        - Key: Environment
          Value: !Ref pTagEnvironment
  rPublicSubnetRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref rVpc
      Tags:
        - Key: Environment
          Value: !Ref pTagEnvironment
  rPublicSubnetDefaultRoute:
    DependsOn: rVpcGatewayAttachment
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref rPublicSubnetRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref rInternetGateway
  rPublicSubnetARouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref rPublicSubnetA
      RouteTableId: !Ref rPublicSubnetRouteTable
  rPublicSubnetBRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref rPublicSubnetB
      RouteTableId: !Ref rPublicSubnetRouteTable
  rPublicSubnetCRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref rPublicSubnetC
      RouteTableId: !Ref rPublicSubnetRouteTable
  rHybridSubnetARouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref rVpc
      Tags:
        - Key: Environment
          Value: !Ref pTagEnvironment
  rHybridSubnetBRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref rVpc
      Tags:
        - Key: Environment
          Value: !Ref pTagEnvironment
  rHybridSubnetCRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref rVpc
      Tags:
        - Key: Environment
          Value: !Ref pTagEnvironment
  rHybridSubnetADefaultRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref rHybridSubnetARouteTable
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref rNatGatewayA
  rHybridSubnetBDefaultRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref rHybridSubnetBRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref rNatGatewayB
  rHybridSubnetCDefaultRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref rHybridSubnetCRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref rNatGatewayC
  rHybridSubnetARouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref rHybridSubnetA
      RouteTableId: !Ref rHybridSubnetARouteTable
  rHybridSubnetBRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref rHybridSubnetB
      RouteTableId: !Ref rHybridSubnetBRouteTable
  rHybridSubnetCRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref rHybridSubnetC
      RouteTableId: !Ref rHybridSubnetCRouteTable
  rPrivateSubnetARouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref rVpc
      Tags:
        - Key: Environment
          Value: !Ref pTagEnvironment
  rPrivateSubnetBRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref rVpc
      Tags:
        - Key: Environment
          Value: !Ref pTagEnvironment
  rPrivateSubnetCRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref rVpc
      Tags:
        - Key: Environment
          Value: !Ref pTagEnvironment
  rPrivateSubnetADefaultRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref rPrivateSubnetARouteTable
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref rNatGatewayA
  rPrivateSubnetBDefaultRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref rPrivateSubnetBRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref rNatGatewayB
  rPrivateSubnetCDefaultRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref rPrivateSubnetCRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref rNatGatewayC
  rPrivateSubnetARouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref rPrivateSubnetA
      RouteTableId: !Ref rPrivateSubnetARouteTable
  rPrivateSubnetBRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref rPrivateSubnetB
      RouteTableId: !Ref rPrivateSubnetBRouteTable
  rPrivateSubnetCRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref rPrivateSubnetC
      RouteTableId: !Ref rPrivateSubnetCRouteTable
  rNatAEip:
    DependsOn: rVpcGatewayAttachment
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: Environment
          Value: !Ref pTagEnvironment
  rNatBEip:
    DependsOn: rVpcGatewayAttachment
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: Environment
          Value: !Ref pTagEnvironment
  rNatCEip:
    DependsOn: rVpcGatewayAttachment
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: Environment
          Value: !Ref pTagEnvironment
  rNatGatewayA:
    DependsOn: rVpcGatewayAttachment
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt rNatAEip.AllocationId
      SubnetId: !Ref rPublicSubnetA
      Tags:
        - Key: Environment
          Value: !Ref pTagEnvironment
  rNatGatewayB:
    DependsOn: rVpcGatewayAttachment
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt rNatBEip.AllocationId
      SubnetId: !Ref rPublicSubnetB
      Tags:
        - Key: Environment
          Value: !Ref pTagEnvironment
  rNatGatewayC:
    DependsOn: rVpcGatewayAttachment
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt rNatCEip.AllocationId
      SubnetId: !Ref rPublicSubnetC
      Tags:
        - Key: Environment
          Value: !Ref pTagEnvironment