key-manager-example.cft

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "An example of an instance managed by key-manager",
  "Mappings": {
    "AWSRegionToAMI": {
      "eu-central-1": {
        "hvm": "ami-f0e8f09c",
        "pv": "ami-e8ebf384"
      },
      "ap-northeast-1": {
        "hvm": "ami-a93802c7",
        "pv": "ami-673b0109"
      },
      "us-gov-west-1": {
        "hvm": "ami-46e05c27",
        "pv": "ami-87d66ae6"
      },
      "sa-east-1": {
        "hvm": "ami-6c1a9a00",
        "pv": "ami-a41b9bc8"
      },
      "ap-southeast-2": {
        "hvm": "ami-d0a783b3",
        "pv": "ami-2da1854e"
      },
      "ap-southeast-1": {
        "hvm": "ami-4a65aa29",
        "pv": "ami-8f69a6ec"
      },
      "us-east-1": {
        "hvm": "ami-dfb699b5",
        "pv": "ami-94b49bfe"
      },
      "us-west-2": {
        "hvm": "ami-abc82ecb",
        "pv": "ami-e6c82e86"
      },
      "us-west-1": {
        "hvm": "ami-4d2d5b2d",
        "pv": "ami-912d5bf1"
      },
      "eu-west-1": {
        "hvm": "ami-1461d767",
        "pv": "ami-9063d5e3"
      }
    }
  },

  "Parameters": {

    "TrustedIpBlock": {
      "AllowedPattern": "^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\\\/([0-9]|[1-2][0-9]|3[0-2]))$",
      "ConstraintDescription": "Must be valid CIDR notation",
      "Default": "0.0.0.0/32",
      "Description": "The net block (CIDR) that this instance will accept SSH connections from.",
      "Type": "String"
    },

    "VPC" : {
      "Type" : "AWS::EC2::VPC::Id",
      "Description" : "Enter the VPC you want to deploy the instance to."
    },

    "Subnet" : {
      "Type" : "AWS::EC2::Subnet::Id",
      "Description" : "Enter the subnet you want to deploy the instance to."
    },

    "Key" : {
      "Description": "The name of an EC2 Key Pair to allow SSH access to the instance.",
      "Type": "AWS::EC2::KeyPair::KeyName"
    },

    "InstanceType": {
      "AllowedValues": [
        "t2.micro",
        "t2.small",
        "t2.medium"
      ],
      "ConstraintDescription": "Must be a valid EC2 HVM instance type.",
      "Default": "t2.micro",
      "Description": "EC2 HVM instance type (m3.medium, etc).",
      "Type": "String"
    },

    "S3Bucket" : {
      "Default": "myorg-keys",
      "Description": "The name of the s3 bucket to be used as the key group mangement backend",
      "Type": "String"
    },

    "S3BucketRegion" : {
      "Default": "eu-west-1",
      "Description": "The region the s3 bucket is located",
      "Type": "String"
    },

    "AccessGroupsTag" : {
      "Default": "developers",
      "Description": "A comma separated list of access group names",
      "Type": "String"
    }

  },

  "Resources": {

    "InstanceSG": {
      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "GroupDescription": "Allow SSH to the instance",
        "VpcId" : {"Ref": "VPC"},
        "SecurityGroupIngress": [
          { "IpProtocol": "tcp", "FromPort": "22","ToPort": "22", "CidrIp": {"Ref": "TrustedIpBlock"} }
        ],
        "Tags": [
          {"Key": "Name", "Value": { "Fn::Join": [ "-", [ { "Ref": "AWS::StackName" }, "sg" ]]}}
        ]
      }
    },


    "Role": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [ {
            "Effect": "Allow",
            "Principal": {
              "Service":["ec2.amazonaws.com"]
            },
            "Action": "sts:AssumeRole"
          }]
        },
        "Path": "/",
        "Policies": [ {
          "PolicyName": "key-manager",
          "PolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
              {
                "Action": [
                  "s3:GetObject"
                ],
                "Effect": "Allow",
                "Resource": { "Fn::Join": [ "", [ "arn:aws:s3:::", {"Ref": "S3Bucket"} ,"/*" ]]}
              },
              {
                "Action": [
                  "ec2:DescribeTags"
                ],
                "Effect": "Allow",
                "Resource": "*"
              }
            ]
          }
        }]
      }
    },

    "InstanceProfile": {
      "Type": "AWS::IAM::InstanceProfile",
      "Properties": {
        "Path": "/",
        "Roles": [{"Ref": "Role"}]
      }
    },


    "Instance": {
      "Type": "AWS::EC2::Instance",
      "Properties": {
        "ImageId": { "Fn::FindInMap": [ "AWSRegionToAMI", { "Ref": "AWS::Region" }, "hvm" ]},
        "KeyName": { "Ref" : "Key" },
        "InstanceType": { "Ref" : "InstanceType" },
        "IamInstanceProfile": {"Ref":"InstanceProfile"},
        "SecurityGroupIds": [
          { "Fn::GetAtt": [ "InstanceSG", "GroupId" ] }
        ],
        "SourceDestCheck": true,
        "SubnetId": { "Ref" : "Subnet" },
        "Tags": [
          {"Key": "Name", "Value": { "Fn::Join": [ "-", [ { "Ref": "AWS::StackName" } ]]}},
          {"Key": "access-groups", "Value": { "Ref": "AccessGroupsTag" }}
        ],
        "UserData" : { "Fn::Base64":
          { "Fn::Join": [ "", [
            "#cloud-config\n\n",

            "write_files:\n",
            "  - path: /etc/ssh/sshd_config\n",
            "    content: |\n",
            "      AuthorizedKeysCommand /root/bin/ssh-authorizedkeys-command %u %k %t %f\n",
            "      AuthorizedKeysCommandUser root\n",
            "      PermitRootLogin no\n",

            "  - path: /root/bin/ssh-authorizedkeys-command\n",
            "    owner: \"root\"\n",
            "    permissions: \"0111\"\n",
            "    content: |\n",
            "      #!/bin/bash\n",
            "      docker run --rm alexrudd/key-manager:latest -u=$1 -k=$2 -t=$3 -f=$4 -s3_bucket=", {"Ref": "S3Bucket"}, " -s3_region=", {"Ref": "S3BucketRegion"}, "\n",
            "      docker pull alexrudd/key-manager:latest 2>&1 >/dev/null &\n",
            "      exit 0\n",

            ""
            ] ]
          }
        }
      }
    }
  },

  "Outputs" : {

    "InstanceIp" : {
      "Description" : "IP of the Instance.",
      "Value" : { "Fn::GetAtt": [ "Instance", "PublicIp" ] }
    },

    "InstanceDnsName" : {
      "Description" : "DNS Name of the Instance.",
      "Value" : { "Fn::GetAtt": [ "Instance", "PublicDnsName" ] }
    }
  }
}