vpc.template

{
  "AWSTemplateFormatVersion" : "2010-09-09",

  "Description" : "Sigma Cloudformation template for VPC creation",

  "Parameters" : {
    "VPCPublicCIDR" : {
      "Type" : "String",
      "Description" : "IP Address range for the VPN connected VPC",
      "MinLength": "9",
      "MaxLength": "18",
      "Default": "10.70.13.0/24",
      "AllowedPattern": "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})",
      "ConstraintDescription": "must be a valid IP CIDR range of the form x.x.x.x/x."
    },
    "VPCPrivateCIDR" : {
      "Type" : "String",
      "Description" : "IP Address range for the VPN connected VPC",
      "MinLength": "9",
      "MaxLength": "18",
      "Default": "172.24.0.0/16",
      "AllowedPattern": "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})",
      "ConstraintDescription": "must be a valid IP CIDR range of the form x.x.x.x/x."
    },

    "PublicVPCSubnetACIDR" : {
      "Type" : "String",
      "Description" : "IP Address range for the VPN connected Subnet",
      "MinLength": "9",
      "MaxLength": "18",
      "Default": "10.70.13.0/25",
      "AllowedPattern": "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})",
      "ConstraintDescription": "must be a valid IP CIDR range of the form x.x.x.x/x."
    },

    "PublicVPCSubnetBCIDR" : {
      "Type" : "String",
      "Description" : "IP Address range for the VPN connected Subnet",
      "MinLength": "9",
      "MaxLength": "18",
      "Default": "10.70.13.128/25",
      "AllowedPattern": "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})",
      "ConstraintDescription": "must be a valid IP CIDR range of the form x.x.x.x/x."
    },

    "PrivateVPCSubnetACIDR" : {
      "Type" : "String",
      "Description" : "IP Address range for the VPN connected Subnet",
      "MinLength": "9",
      "MaxLength": "18",
      "Default": "172.24.0.0/21",
      "AllowedPattern": "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})",
      "ConstraintDescription": "must be a valid IP CIDR range of the form x.x.x.x/x."
    },

    "PrivateVPCSubnetBCIDR" : {
      "Type" : "String",
      "Description" : "IP Address range for the VPN connected Subnet",
      "MinLength": "9",
      "MaxLength": "18",
      "Default": "172.24.8.0/21",
      "AllowedPattern": "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})",
      "ConstraintDescription": "must be a valid IP CIDR range of the form x.x.x.x/x."
    },

    "Domain" : {
      "Type" : "String",
      "Description" : "Domain for naming purposes",
      "Default": "Sigma.test"
    }

  },

  "Resources" : {

    "PrivateVPC" : {
      "Type" : "AWS::EC2::VPC",
      "Properties" : {
        "EnableDnsSupport" : "true",
        "EnableDnsHostnames" : "true",
        "CidrBlock" : { "Ref" : "VPCPrivateCIDR" },
        "Tags" : [
          { "Key" : "Application", "Value" : { "Ref" : "AWS::StackName" } },
          { "Key" : "Network", "Value" : "VPN Connected VPC" },
          { "Key" : "Name", "Value" : { "Fn::Join" : [ "", [ { "Ref" : "Domain" }, " Private VPC" ] ] } }
        ]
      }
    },

    "PrivateSubnetA" : {
      "Type" : "AWS::EC2::Subnet",
      "Properties" : {
        "VpcId" : { "Ref" : "PrivateVPC" },
        "CidrBlock" : { "Ref" : "PrivateVPCSubnetACIDR" },
        "Tags" : [
          { "Key" : "Application", "Value" : { "Ref" : "AWS::StackName" } },
          { "Key" : "Network", "Value" : "VPN Connected Subnet" }
        ]
      }
    },

    "PrivateSubnetB" : {
      "Type" : "AWS::EC2::Subnet",
      "Properties" : {
        "VpcId" : { "Ref" : "PrivateVPC" },
        "CidrBlock" : { "Ref" : "PrivateVPCSubnetBCIDR" },
        "Tags" : [
          { "Key" : "Application", "Value" : { "Ref" : "AWS::StackName" } },
          { "Key" : "Network", "Value" : "VPN Connected Subnet" }
        ]
      }
    },

    "PublicVPC" : {
      "Type" : "AWS::EC2::VPC",
      "Properties" : {
        "EnableDnsSupport" : "true",
        "EnableDnsHostnames" : "true",
        "CidrBlock" : { "Ref" : "VPCPublicCIDR" },
        "Tags" : [
          { "Key" : "Application", "Value" : { "Ref" : "AWS::StackName" } },
          { "Key" : "Network", "Value" : "VPN Connected VPC" },
          { "Key" : "Name", "Value" : { "Fn::Join" : [ "", [ { "Ref" : "Domain" }, " Public VPC" ] ] } }
        ]
      }
    },

    "PublicSubnetA" : {
      "Type" : "AWS::EC2::Subnet",
      "Properties" : {
        "VpcId" : { "Ref" : "PublicVPC" },
        "CidrBlock" : { "Ref" : "PublicVPCSubnetACIDR" },
        "Tags" : [
          { "Key" : "Application", "Value" : { "Ref" : "AWS::StackName" } },
          { "Key" : "Network", "Value" : "VPN Connected Subnet" }
        ]
      }
    },

    "PublicSubnetB" : {
      "Type" : "AWS::EC2::Subnet",
      "Properties" : {
        "VpcId" : { "Ref" : "PublicVPC" },
        "CidrBlock" : { "Ref" : "PublicVPCSubnetBCIDR" },
        "Tags" : [
          { "Key" : "Application", "Value" : { "Ref" : "AWS::StackName" } },
          { "Key" : "Network", "Value" : "VPN Connected Subnet" }
        ]
      }
    },
    "PrivateRouteTable" : {
      "Type" : "AWS::EC2::RouteTable",
      "Properties" : {
        "VpcId" : { "Ref" : "PrivateVPC" },
        "Tags" : [
          { "Key" : "Application", "Value" : { "Ref" : "AWS::StackName" } },
          { "Key" : "Network", "Value" : "VPN Connected Subnet" }
        ]
      }
    },

    "PublicRouteTable" : {
      "Type" : "AWS::EC2::RouteTable",
      "Properties" : {
        "VpcId" : { "Ref" : "PublicVPC" },
        "Tags" : [
          { "Key" : "Application", "Value" : { "Ref" : "AWS::StackName" } },
          { "Key" : "Network", "Value" : "VPN Connected Subnet" }
        ]
      }
    },

    "PublicSubnetARouteTableAssociation" : {
      "Type" : "AWS::EC2::SubnetRouteTableAssociation",
      "Properties" : {
        "SubnetId" : { "Ref" : "PublicSubnetA" },
        "RouteTableId" : { "Ref" : "PublicRouteTable" }
      }
    },


    "PublicSubnetBARouteTableAssociation" : {
      "Type" : "AWS::EC2::SubnetRouteTableAssociation",
      "Properties" : {
        "SubnetId" : { "Ref" : "PublicSubnetB" },
        "RouteTableId" : { "Ref" : "PublicRouteTable" }
      }
    },

    "PrivateSubnetARouteTableAssociation" : {
      "Type" : "AWS::EC2::SubnetRouteTableAssociation",
      "Properties" : {
        "SubnetId" : { "Ref" : "PrivateSubnetA" },
        "RouteTableId" : { "Ref" : "PrivateRouteTable" }
      }
    },

    "PrivateSubnetBARouteTableAssociation" : {
      "Type" : "AWS::EC2::SubnetRouteTableAssociation",
      "Properties" : {
        "SubnetId" : { "Ref" : "PrivateSubnetB" },
        "RouteTableId" : { "Ref" : "PrivateRouteTable" }
      }
    },

    "PublicNetworkAcl" : {
      "Type" : "AWS::EC2::NetworkAcl",
      "Properties" : {
        "VpcId" : { "Ref" : "PublicVPC" },
        "Tags" : [
          { "Key" : "Application", "Value" : { "Ref" : "AWS::StackName" } },
          { "Key" : "Network", "Value" : "Public" }
        ]
      }
    },

    "PrivateNetworkAcl" : {
      "Type" : "AWS::EC2::NetworkAcl",
      "Properties" : {
        "VpcId" : { "Ref" : "PrivateVPC" },
        "Tags" : [
          { "Key" : "Application", "Value" : { "Ref" : "AWS::StackName" } },
          { "Key" : "Network", "Value" : "Private" }
        ]
      }
    },

    "InboundPublicNetworkAclEntry" : {
      "Type" : "AWS::EC2::NetworkAclEntry",
      "Properties" : {
        "NetworkAclId" : { "Ref" : "PublicNetworkAcl" },
        "RuleNumber" : "100",
        "Protocol" : "6",
        "RuleAction" : "allow",
        "Egress" : "false",
        "CidrBlock" : "0.0.0.0/0",
        "PortRange" : { "From" : "0", "To" : "65535" }
      }
    },

    "OutBoundPublicNetworkAclEntry" : {
      "Type" : "AWS::EC2::NetworkAclEntry",
      "Properties" : {
        "NetworkAclId" : { "Ref" : "PublicNetworkAcl" },
        "RuleNumber" : "100",
        "Protocol" : "6",
        "RuleAction" : "allow",
        "Egress" : "true",
        "CidrBlock" : "0.0.0.0/0",
        "PortRange" : { "From" : "0", "To" : "65535" }
      }
    },
    
       "InboundUDPPublicNetworkAclEntry" : {
      "Type" : "AWS::EC2::NetworkAclEntry",
      "Properties" : {
        "NetworkAclId" : { "Ref" : "PublicNetworkAcl" },
        "RuleNumber" : "101",
        "Protocol" : "17",
        "RuleAction" : "allow",
        "Egress" : "false",
        "CidrBlock" : "0.0.0.0/0",
        "PortRange" : { "From" : "0", "To" : "65535" }
      }
    },

    "OutBoundUDPPublicNetworkAclEntry" : {
      "Type" : "AWS::EC2::NetworkAclEntry",
      "Properties" : {
        "NetworkAclId" : { "Ref" : "PublicNetworkAcl" },
        "RuleNumber" : "101",
        "Protocol" : "17",
        "RuleAction" : "allow",
        "Egress" : "true",
        "CidrBlock" : "0.0.0.0/0",
        "PortRange" : { "From" : "0", "To" : "65535" }
      }
    }, 

    "InboundPrivateNetworkAclEntry" : {
      "Type" : "AWS::EC2::NetworkAclEntry",
      "Properties" : {
        "NetworkAclId" : { "Ref" : "PrivateNetworkAcl" },
        "RuleNumber" : "100",
        "Protocol" : "6",
        "RuleAction" : "allow",
        "Egress" : "false",
        "CidrBlock" : "0.0.0.0/0",
        "PortRange" : { "From" : "0", "To" : "65535" }
      }
    },

    "OutBoundPrivateNetworkAclEntry" : {
      "Type" : "AWS::EC2::NetworkAclEntry",
      "Properties" : {
        "NetworkAclId" : { "Ref" : "PrivateNetworkAcl" },
        "RuleNumber" : "100",
        "Protocol" : "6",
        "RuleAction" : "allow",
        "Egress" : "true",
        "CidrBlock" : "0.0.0.0/0",
        "PortRange" : { "From" : "0", "To" : "65535" }
      }
    },

    "InboundUDPPrivateNetworkAclEntry" : {
      "Type" : "AWS::EC2::NetworkAclEntry",
      "Properties" : {
        "NetworkAclId" : { "Ref" : "PrivateNetworkAcl" },
        "RuleNumber" : "101",
        "Protocol" : "17",
        "RuleAction" : "allow",
        "Egress" : "false",
        "CidrBlock" : "0.0.0.0/0",
        "PortRange" : { "From" : "0", "To" : "65535" }
      }
    },

    "OutBoundUDPPrivateNetworkAclEntry" : {
      "Type" : "AWS::EC2::NetworkAclEntry",
      "Properties" : {
        "NetworkAclId" : { "Ref" : "PrivateNetworkAcl" },
        "RuleNumber" : "101",
        "Protocol" : "17",
        "RuleAction" : "allow",
        "Egress" : "true",
        "CidrBlock" : "0.0.0.0/0",
        "PortRange" : { "From" : "0", "To" : "65535" }
      }
    },

    "PublicSubnetANetworkAclAssociation" : {
      "Type" : "AWS::EC2::SubnetNetworkAclAssociation",
      "Properties" : {
        "SubnetId" : { "Ref" : "PublicSubnetA" },
        "NetworkAclId" : { "Ref" : "PublicNetworkAcl" }
      }
    },

    "PublicSubnetBNetworkAclAssociation" : {
      "Type" : "AWS::EC2::SubnetNetworkAclAssociation",
      "Properties" : {
        "SubnetId" : { "Ref" : "PublicSubnetB" },
        "NetworkAclId" : { "Ref" : "PublicNetworkAcl" }
      }
    },

    "PrivateSubnetANetworkAclAssociation" : {
      "Type" : "AWS::EC2::SubnetNetworkAclAssociation",
      "Properties" : {
        "SubnetId" : { "Ref" : "PrivateSubnetA" },
        "NetworkAclId" : { "Ref" : "PrivateNetworkAcl" }
      }
    },

    "PrivateSubnetBNetworkAclAssociation" : {
      "Type" : "AWS::EC2::SubnetNetworkAclAssociation",
      "Properties" : {
        "SubnetId" : { "Ref" : "PrivateSubnetB" },
        "NetworkAclId" : { "Ref" : "PrivateNetworkAcl" }
      }
    },
  
    "InternetGateway": {
      "Type": "AWS::EC2::InternetGateway"
     },
 
    "AttachGateway": {
      "Type": "AWS::EC2::VPCGatewayAttachment",
      "Properties": {
        "VpcId": {
          "Ref": "PublicVPC"
        },
        "InternetGatewayId": {
          "Ref": "InternetGateway"
        }
      }
    },
  
    "PublicRoute": {
      "Type": "AWS::EC2::Route",
      "DependsOn": "AttachGateway",
      "Properties": {
        "RouteTableId": {
          "Ref": "PublicRouteTable"
        },
        "DestinationCidrBlock": "0.0.0.0/0",
        "GatewayId": {
          "Ref": "InternetGateway"
        }
      }
    },

    "VPCPeeringConnection": {
      "Type": "AWS::EC2::VPCPeeringConnection",
      "Properties": {
        "VpcId": {"Ref": "PublicVPC"},
        "PeerVpcId": {"Ref": "PrivateVPC"}
      }
    },

    "PrivatePeeringRoute" : {
      "Type" : "AWS::EC2::Route",
        "Properties" : {
          "DestinationCidrBlock": { "Ref" : "VPCPrivateCIDR" },
          "RouteTableId" : { "Ref" : "PublicRouteTable" },
          "VpcPeeringConnectionId" : { "Ref" : "VPCPeeringConnection" }
        }
    },

    "PublicPeeringRoute" : {
      "Type" : "AWS::EC2::Route",
        "Properties" : {
          "DestinationCidrBlock": { "Ref" : "VPCPublicCIDR" },
          "RouteTableId" : { "Ref" : "PrivateRouteTable" },
          "VpcPeeringConnectionId" : { "Ref" : "VPCPeeringConnection" }
        }
    },

    "PrivateS3Endpoint" : {
      "Type" : "AWS::EC2::VPCEndpoint",
      "Properties" : {
        "RouteTableIds" : [ {"Ref" : "PrivateRouteTable"} ],
        "ServiceName" : { "Fn::Join": [ "", [ "com.amazonaws.", { "Ref": "AWS::Region" }, ".s3" ] ] },
        "VpcId" : { "Ref" : "PrivateVPC" }
      }
    },

    "PublicS3Endpoint" : {
      "Type" : "AWS::EC2::VPCEndpoint",
      "Properties" : {
        "RouteTableIds" : [ {"Ref" : "PublicRouteTable"} ],
        "ServiceName" : { "Fn::Join": [ "", [ "com.amazonaws.", { "Ref": "AWS::Region" }, ".s3" ] ] },
        "VpcId" : { "Ref" : "PublicVPC" }
      }
    },
  },

  "Outputs" : {
    "PublicVPCId" : {
      "Description" : "VPCId of the newly created VPC",
      "Value" :  { "Ref" : "PublicVPC" }
    },
    "PublicSubnetB" : {
      "Description" : "SubnetId of the VPN connected subnet",
      "Value" :  { "Ref" : "PublicSubnetB" }
    },
    "PublicSubnetA" : {
      "Description" : "SubnetId of the VPN connected subnet",
      "Value" :  { "Ref" : "PublicSubnetA" }
    },
    "PrivateVPCId" : {
      "Description" : "VPCId of the newly created VPC",
      "Value" :  { "Ref" : "PrivateVPC" }
    },
    "PrivateSubnetB" : {
      "Description" : "SubnetId of the VPN connected subnet",
      "Value" :  { "Ref" : "PrivateSubnetB" }
    },
    "PrivateSubnetA" : {
      "Description" : "SubnetId of the VPN connected subnet",
      "Value" :  { "Ref" : "PrivateSubnetA" }
    }
  }
}