詳細な解説は後日改めて追記予定
# ============================================================
# SourceFile: sample-Product-VPC-001.yml
# ============================================================
AWSTemplateFormatVersion: '2010-09-09'
Description: VPC
Parameters:
SystemName:
Type: String
Description: SystemName
Default: sample
Env:
Description: Environment
Type: String
AllowedValues:
- prd
- stg
- dev
LogGroupDays:
Type: String
Description: LogGroupRetentionInDays
Default: 14
Mappings:
Env:
prd:
cidr: 10.100.0.0/16
stg:
cidr: 10.200.0.0/16
dev:
cidr: 172.31.0.0/16
Resources:
###########################################
# VPC
###########################################
VPC:
Type: AWS::EC2::VPC
Properties:
CidrBlock: !FindInMap [Env, !Ref Env, cidr]
EnableDnsSupport: 'true'
EnableDnsHostnames: 'true'
Tags:
- Key: Name
Value: !Join [ "-", [ !Ref SystemName, !Ref Env, vpc]]
###########################################
# IAM Role for VPCFlowLogs
###########################################
VPCFlowLogsIAMRole:
Type: "AWS::IAM::Role"
Properties:
RoleName: !Join [ "-", [ !Ref SystemName, !Ref Env, vpc, flowlogs, role]]
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Principal:
Service:
- "vpc-flow-logs.amazonaws.com"
Action:
- "sts:AssumeRole"
###########################################
# IAM Policy for VPCFlowLogs
###########################################
VPCFlowLogsIAMManagedPolicy:
Type: 'AWS::IAM::ManagedPolicy'
Properties:
ManagedPolicyName: !Join [ "-", [ !Ref SystemName, !Ref Env, vpc, flowlogs, role, policy]]
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action:
- "logs:CreateLogGroup"
- "logs:CreateLogStream"
- "logs:PutLogEvents"
- "logs:DescribeLogGroups"
- "logs:DescribeLogStreams"
Resource: "*"
Roles:
- !Ref VPCFlowLogsIAMRole
###########################################
# LogGroup
###########################################
LogGroup:
Type: "AWS::Logs::LogGroup"
Properties:
LogGroupName: !Join [ "-", [ !Ref SystemName, !Ref Env, vpc, flowlogs, log, group ]]
RetentionInDays: !Ref LogGroupDays
###########################################
# VPCFlowLogs
###########################################
VPCFlowLogs:
Type: "AWS::EC2::FlowLog"
Properties:
DeliverLogsPermissionArn: !GetAtt VPCFlowLogsIAMRole.Arn
LogGroupName: !Ref LogGroup
ResourceId: !Ref VPC
ResourceType: "VPC"
LogFormat: ${start} ${end} ${srcaddr} ${dstaddr} ${dstport} ${srcport} ${protocol} ${packets} ${bytes} ${action} ${flow-direction} ${traffic-path} ${tcp-flags}
TrafficType: ALL
Tags:
- Key: Name
Value: !Join [ "-", [ !Ref SystemName, !Ref Env, vpc, flowlogs, to, cloudwatch ]]
VPCFlowLogsToS3:
Type: "AWS::EC2::FlowLog"
Properties:
LogDestinationType: s3
LogDestination:
Fn::ImportValue: !Join [ "-", [ !Ref SystemName, !Ref Env, infra, logs, bucket, arn ]]
ResourceId: !Ref VPC
ResourceType: "VPC"
TrafficType: ALL
Tags:
- Key: Name
Value: !Join [ "-", [ !Ref SystemName, !Ref Env, vpc, flowlogs, to, s3 ]]
###########################################
# RouteTable
###########################################
RouteTablePublic:
Type: "AWS::EC2::RouteTable"
Properties:
VpcId: !Ref VPC
Tags:
- Key: Name
Value: !Join [ "-", [ !Ref SystemName, !Ref Env, public, routetable ]]
RouteTablePrivate01:
Type: "AWS::EC2::RouteTable"
Properties:
VpcId: !Ref VPC
Tags:
- Key: Name
Value: !Join [ "-", [ !Ref SystemName, !Ref Env, private, routetable, ap-northeast-1a ]]
RouteTablePrivate02:
Type: "AWS::EC2::RouteTable"
Properties:
VpcId: !Ref VPC
Tags:
- Key: Name
Value: !Join [ "-", [ !Ref SystemName, !Ref Env, private, routetable, ap-northeast-1c ]]
###########################################
# RouteTable --Route--
###########################################
RoutePublic01:
Type: AWS::EC2::Route
Properties:
RouteTableId: !Ref RouteTablePublic
DestinationCidrBlock: 0.0.0.0/0
GatewayId: !Ref InternetGateway
###########################################
# InternetGateway
###########################################
InternetGateway:
Type: AWS::EC2::InternetGateway
Properties:
Tags:
- Key: Name
Value: !Join [ "-", [ !Ref SystemName, !Ref Env, igw ]]
AttachInternetGateway:
Type: AWS::EC2::VPCGatewayAttachment
Properties:
InternetGatewayId: !Ref InternetGateway
VpcId: !Ref VPC
###########################################
# DHCPOptions
###########################################
DHCPOptions:
Type: AWS::EC2::DHCPOptions
Properties:
DomainName: ap-northeast-1.compute.internal
DomainNameServers:
- AmazonProvidedDNS
DHCPOptionsAssociation:
Type: AWS::EC2::VPCDHCPOptionsAssociation
Properties:
DhcpOptionsId: !Ref DHCPOptions
VpcId: !Ref VPC
###########################################
# NACL
###########################################
NACL:
Type: AWS::EC2::NetworkAcl
Properties:
VpcId: !Ref VPC
#Default Rule
NACLEntryInbound:
Type: AWS::EC2::NetworkAclEntry
Properties:
Egress: false
RuleNumber: 100
RuleAction: allow
Protocol: -1
CidrBlock: 0.0.0.0/0
NetworkAclId: !Ref NACL
#Default Rule
NACLEntryOutbound:
Type: AWS::EC2::NetworkAclEntry
Properties:
Egress: true
RuleNumber: 100
RuleAction: allow
Protocol: -1
CidrBlock: 0.0.0.0/0
NetworkAclId: !Ref NACL
Outputs:
VPCId:
Value: !Ref VPC
Export:
Name: !Join [ "-", [ !Ref SystemName, !Ref Env, vpc, id ]]
VPCCidr:
Value: !GetAtt VPC.CidrBlock
Export:
Name: !Join [ "-", [ !Ref SystemName, !Ref Env, vpc, cidr ]]
InternetGatewayId:
Value: !Ref InternetGateway
Export:
Name: !Join [ "-", [ !Ref SystemName, !Ref Env, igw, id ]]
VPCFlowLogsIAMRoleArn:
Value: !GetAtt VPCFlowLogsIAMRole.Arn
Export:
Name: !Join [ "-", [ !Ref SystemName, !Ref Env, vpc, flowlogs, role, arn]]
VPCNACLId:
Value: !Ref NACL
Export:
Name: !Join [ "-", [ !Ref SystemName, !Ref Env, vpc, nacl, id ]]
RouteTablePublic:
Value: !Ref RouteTablePublic
Export:
Name: !Join [ "-", [ !Ref SystemName, !Ref Env, public, route, id ]]
RouteTablePrivate01:
Value: !Ref RouteTablePrivate01
Export:
Name: !Join [ "-", [ !Ref SystemName, !Ref Env, private, route, ap-northeast-1a, id ]]
RouteTablePrivate02:
Value: !Ref RouteTablePrivate02
Export:
Name: !Join [ "-", [ !Ref SystemName, !Ref Env, private, route, ap-northeast-1c, id ]]