opensearch_nginx.yaml

Description: This template will an OpenSearch Demo within a VPC with Subnets, Security Groups ...

Parameters:
  # Ask the user for the name of the EC2
  EC2KeyPairNameParameter:
    Type: AWS::EC2::KeyPair::KeyName
    Description: name of the key pair to ssh into the instance

Resources:
  
  # -----------------
  # VPC
  # ----------------- 
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: '10.0.0.0/16'
      Tags:
        - Key: Name
          Value: workshop vpc

  # -----------------
  # Internet Gateway
  # -----------------
  VPCInternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: workshop internet gateway
  # Attach InternetGateway to VPC
  AttachInternetGatewayVPC:
    Type: 'AWS::EC2::VPCGatewayAttachment'
    Properties:
      InternetGatewayId: 
        Ref: VPCInternetGateway
      VpcId:
        Ref: VPC

  # -----------------
  # Subnets
  # ----------------- 

  #
  # OS Subnet
  #
  OpenSearchSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: '10.0.0.0/28'
      AvailabilityZone: 'us-east-1a'
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: opensearch-subnet | us-east-1a

  #
  # EC2 Subnet
  #
  EC2Subnet:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: '10.0.2.0/28'
      AvailabilityZone: 'us-east-1a'
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: ec2-subnet | us-east-1a  

  # -----------------
  # Network Security Groups
  # -----------------
  
  #
  # OS Security Group
  #   
  OpenSearchSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: 'open search security group'
      GroupDescription: 'open search security group'
      VpcId: !Ref VPC
      # Egress rules
      SecurityGroupEgress:
        - IpProtocol: -1
          FromPort: -1 
          ToPort: -1
          CidrIp: '0.0.0.0/0'
      Tags:
        - Key: Name
          Value: 'os security group'
  # add a self reference ingress rule 
  OpenSearchSecurityGroupIngress1:
    Type: 'AWS::EC2::SecurityGroupIngress'
    Properties:
      # Ingress rules
      GroupId: !Ref OpenSearchSecurityGroup
      IpProtocol: -1
      FromPort: -1
      ToPort: -1
      SourceSecurityGroupId: !GetAtt OpenSearchSecurityGroup.GroupId
  # add a ingress rule for traffic from EC2 
  OpenSearchSecurityGroupIngress2:
    Type: 'AWS::EC2::SecurityGroupIngress'
    Properties:
      # Ingress rules
      GroupId: !Ref OpenSearchSecurityGroup
      IpProtocol: -1
      FromPort: -1
      ToPort: -1
      SourceSecurityGroupId: !GetAtt EC2SecurityGroup.GroupId

  #
  # EC2 Security Group
  #
  EC2SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: 'ec2 security group'
      GroupDescription: 'ec2 security group'
      VpcId: !Ref VPC
      # Egress rules
      SecurityGroupEgress:
        - IpProtocol: -1
          FromPort: -1 
          ToPort: -1
          CidrIp: '0.0.0.0/0'
      Tags:
        - Key: Name
          Value: 'ec2 security group'
  # Network Security Group + add a self reference ingress rule  
  EC2SecurityGroupGroupIngress:
    Type: 'AWS::EC2::SecurityGroupIngress'
    Properties:
      # Ingress rules
      GroupId: !Ref EC2SecurityGroup
      IpProtocol: -1
      FromPort: -1
      ToPort: -1
      SourceSecurityGroupId: !GetAtt EC2SecurityGroup.GroupId

  # -----------------
  # OpenSearch domain
  # -----------------
  OpenSearchDomain:
    Type: AWS::OpenSearchService::Domain
    Properties:
      DomainName: workshop-domain-vpc
      EngineVersion: 'OpenSearch_1.3'
      # Development configuration
      ClusterConfig:
        DedicatedMasterEnabled: false
        InstanceCount: '1'
        ZoneAwarenessEnabled: false
        InstanceType: 'r6g.large.search'
      EBSOptions:
        EBSEnabled: true
        VolumeSize: '20'
        VolumeType: 'gp2'
      # Node to node encrpytion must be enabled to use the advanced security options
      NodeToNodeEncryptionOptions:
        Enabled: true
      # Encryption at rest must be ebabled to use the advanced security options
      EncryptionAtRestOptions:
        Enabled: true
      # HTTPS must be required to use the advanced security options
      DomainEndpointOptions:
        EnforceHTTPS: true
      # Create a master user with a pre-defined username and password
      AdvancedSecurityOptions:
        Enabled: true
        InternalUserDatabaseEnabled: true
        MasterUserOptions:
          MasterUserName: 'OSMasterUser'
          MasterUserPassword: 'AwS#OpenSearch1'
      # Set an access policy open to any AWS resource
      AccessPolicies:
        Version: 2012-10-17
        Statement:
          Effect: 'Allow'
          Principal:
            AWS: '*'
          Action: 'es:*'
          Resource: '*'
      # VPC
      VPCOptions:
        SecurityGroupIds: 
          - Ref: OpenSearchSecurityGroup
        SubnetIds: 
          - Ref: OpenSearchSubnet

  # -----------------
  # IAM role
  # -----------------

  #
  # EC2 IAM Role
  #
  EC2IAMRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: 'Workshop_EC2'
      Description: 'IAM role for EC2 instance'
      # Trust relationships
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      # Premissions
      Policies:
        # EC2 premissions
        - PolicyName: ec2
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: 'ec2:*'
                Resource: '*'

  # IAM instance profile
  EC2InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties: 
      Path: /
      Roles: [!Ref EC2IAMRole]

  # -----------------
  # EC2
  # -----------------
  EC2Server:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: 'ami-052efd3df9dad4825'
      InstanceType: 't2.xlarge'
      SubnetId: !Ref EC2Subnet
      SecurityGroupIds:
        - !Ref EC2SecurityGroup
      KeyName: !Ref EC2KeyPairNameParameter
      IamInstanceProfile: !Ref EC2InstanceProfile
      Tags:
        - Key: Name
          Value: workshop-ec2

  # -----------------
  # Elastic IP
  # -----------------
  EC2ElasticIP:
    Type: AWS::EC2::EIP
    Properties:
      InstanceId: !Ref EC2Server

  # -----------------
  # Route Table
  # -----------------
  VPCRouteTable:
    Type: AWS::EC2::RouteTable
    Properties: 
      Tags: 
        - Key: Name
          Value: workshop route table
      VpcId: !Ref VPC
  # add a route to the internet gateway
  InternetGatewayRoute:
    Type: AWS::EC2::Route
    Properties: 
      RouteTableId: !Ref VPCRouteTable
      DestinationCidrBlock: '0.0.0.0/0'
      GatewayId: !Ref VPCInternetGateway

  # associate route table with subnets (OpenSearchSubnet, EC2Subnet)
  OpenSearchSubnetAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties: 
      RouteTableId: !Ref VPCRouteTable
      SubnetId: !Ref OpenSearchSubnet

  EC2SubnetAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref VPCRouteTable
      SubnetId: !Ref EC2Subnet

Outputs:

  # OpenSearch domain
  OSUserName:
    Description: 'OpenSearch Dashboard Login UserName'
    Value: 'OSMasterUser'
  OSPassword:
    Description: 'OpenSearch Dashboard Login Password'
    Value: 'AwS#OpenSearch1'
  EC2RDPIPAddress:
    Description: 'IP Address to connect to EC2 via. RDP'
    Value: !Ref EC2ElasticIP