vault-core-instances.json

{
"AWSTemplateFormatVersion" : "2010-09-09",
"Description" : "Hashicorp Vault Reference: Core EC2 Instances: This template creates the EC2 instances used to run Hashicorp Vault.",

	"Metadata" :
	{
	},

	"Parameters" :
	{

      "VaultChildStackName":
      {
        "Description": "Name of the stack containing the vault security",
        "Type": "String"
      }
  
  },

	"Mappings" :
	{
  },

	"Conditions" :
	{
  },

	"Resources" :
  {
    
	    "NetworkInfo":
	    {
	      "Type": "Custom::NetworkInfo",
	      "Properties":
	      {
	        "ServiceToken": {"Fn::GetAtt": ["LookupStackOutputs","Arn"]},
	        "StackName": {"Ref": "VaultChildStackName"}
	      }
	    },
	    
	    "LookupStackOutputs":
		  {
		        "Type": "AWS::Lambda::Function",
		        "Properties": {
		            "Handler": "index.handler",
		            "Role": {
		            "Fn::GetAtt": [
		                "LambdaExecutionRole",
		                "Arn"
		            ]
		            },
		            "Code": {
		            "ZipFile": {
		                "Fn::Join": [
		                "\n",
		                [
		                    "var response = require('cfn-response');",
		                    "exports.handler = function(event, context) {",
		                    "    console.log('REQUEST RECEIVED:\\n', JSON.stringify(event));",
		                    "    if (event.RequestType == 'Delete') {",
		                    "        response.send(event, context, response.SUCCESS);",
		                    "        return;",
		                    "    }",
		                    "    var stackName = event.ResourceProperties.StackName;",
		                    "    var responseData = {};",
		                    "    if (stackName) {",
		                    "        var aws = require('aws-sdk');",
		                    "        var cfn = new aws.CloudFormation();",
		                    "        cfn.describeStacks({StackName: stackName}, function(err, data) {",
		                    "            if (err) {",
		                    "                responseData = {Error: 'DescribeStacks call failed'};",
		                    "                console.log(responseData.Error + ':\\n', err);",
		                    "                response.send(event, context, response.FAILED, responseData);",
		                    "            }",
		                    "            else {",
		                    "                data.Stacks[0].Outputs.forEach(function(output) {",
		                    "                    responseData[output.OutputKey] = output.OutputValue.toLowerCase();",
		                    "                });",
		                    "                response.send(event, context, response.SUCCESS, responseData);",
		                    "            }",
		                    "        });",
		                    "    } else {",
		                    "        responseData = {Error: 'Stack name not specified'};",
		                    "        console.log(responseData.Error);",
		                    "        response.send(event, context, response.FAILED, responseData);",
		                    "    }",
		                    "};"
		                ]
		                ]
		            }
		            },
		            "Runtime": "nodejs4.3",
		            "Timeout": "30"
		        }
		        },
        
        
		        "LambdaExecutionRole": {
		        "Type": "AWS::IAM::Role",
		        "Properties": {
		            "AssumeRolePolicyDocument": {
		            "Version": "2012-10-17",
		            "Statement": [
		                {
		                "Effect": "Allow",
		                "Principal": {
		                    "Service": [
		                    "lambda.amazonaws.com"
		                    ]
		                },
		                "Action": [
		                    "sts:AssumeRole"
		                ]
		                }
		            ]
		            },
		            "Path": "/",
		            "Policies": [
		            {
		                "PolicyName": "root",
		                "PolicyDocument": {
		                "Version": "2012-10-17",
		                "Statement": [
		                    {
		                    "Effect": "Allow",
		                    "Action": [
		                        "logs:CreateLogGroup",
		                        "logs:CreateLogStream",
		                        "logs:PutLogEvents"
		                    ],
		                    "Resource": "arn:aws:logs:*:*:*"
		                    },
		                    {
		                    "Effect": "Allow",
		                    "Action": [
		                        "cloudformation:DescribeStacks",
		                        "ec2:DescribeImages"
		                    ],
		                    "Resource": "*"
		                    }
		                ]
		                }
		            }
		            ]
		        }
		  },
      
    "VaultEC2InstanceRole" :
    {
      "Type" : "AWS::IAM::Role",
      "Properties" :
      {
        "AssumeRolePolicyDocument" :
        {
          "Statement" :
          [{
            "Action" : ["sts:AssumeRole"],
            "Effect" : "Allow",
            "Principal" :
            {
             "Service" : [ "ec2.amazonaws.com"]
            }
          }]
        }
      }
    },

    "VaultEC2InstanceProfile" :
    {
      "Type" : "AWS::IAM::InstanceProfile",
      "Properties" :
      {
        "Path" : "/",
        "Roles" : [{ "Ref" : "VaultEC2InstanceRole" }]
      }
    },

    "VaultEC2InstancePolicy" :
    {
      "Type" : "AWS::IAM::Policy",
      "Properties" :
      {
        "PolicyDocument" :
        {
          "Statement" :
          [
          {
           "Effect" : "Allow",
           "Action" : [
             "ec2:RunInstances",
             "dynamodb:DescribeTable",
             "dynamodb:CreateTable"
           ],
           "Resource" : "*"
          }
          ]
        },
        "PolicyName" : "Vault-Reference-Instance-Policy",
        "Roles" : [ { "Ref" : "VaultEC2InstanceRole"}]
        }
      
    },
    
    "VaultEC2Access" :
    {
        "Type" : "AWS::EC2::Instance",
        "Properties" :
        {
          "EbsOptimized" : "false",
          "ImageId" : "ami-70edb016",
          "InstanceType" : "t2.micro",
          "KeyName" : "palindrome_2017",
          "NetworkInterfaces": [
          {
                "AssociatePublicIpAddress": true,
                "DeleteOnTermination": true,
                "DeviceIndex": "0",
                "SubnetId" : { "Fn::GetAtt" : ["NetworkInfo","VaultPublicSubnet1"] },
                "GroupSet" : [{ "Fn::GetAtt" : ["NetworkInfo","VaultPublicSG"] }]
            }
          ],
          "IamInstanceProfile" : { "Ref" : "VaultEC2InstanceProfile"},
          "Tags" : [ { "Key" : "Name", "Value" : "vault_public_access_instance" } ]
        }
    },
    
    "VaultEC2Instance1" :
    {
        "Type" : "AWS::EC2::Instance",
        "Properties" :
        {
          "EbsOptimized" : "false",
          "ImageId" : "ami-70edb016",
          "InstanceType" : "t2.micro",
          "KeyName" : "palindrome_2017",
          "SecurityGroupIds" : [{ "Fn::GetAtt" : ["NetworkInfo","VaultPrivateSG"] }],
          "SubnetId" : { "Fn::GetAtt" : ["NetworkInfo","VaultPrivateSubnet1"] },
          "IamInstanceProfile" : { "Ref" : "VaultEC2InstanceProfile"},
          "Tags" : [ { "Key" : "Name", "Value" : "vault_private_instance" } ],
          "UserData" :
             {
               "Fn::Base64" : { "Fn::Join" : [ "",
                ["#!/bin/bash -v\n",
                "sudo yum -y update\n",
                "builtin cd /usr/local/bin/\n",
                "wget https://releases.hashicorp.com/vault/0.7.0/vault_0.7.0_linux_amd64.zip\n",
                "wget https://releases.hashicorp.com/vault/0.7.0/vault_0.7.0_SHA256SUMS\n",
                "sha256sum -c vault_0.7.0_SHA256SUMS 2>&1 | grep OK\n",
                "unzip vault_0.7.0_linux_amd64.zip\n",
                "sudo rm vault_0.7.0_linux_amd64.zip\n",
                "builtin cd /usr/local/etc/\n",
                "wget https://raw.githubusercontent.com/mike-goodwin/aws-vault-reference-infrastructure/master/config.hcl\n",
                "sudo easy_install supervisor\n",
                "builtin cd /usr/local/etc/\n",
                "wget https://raw.githubusercontent.com/mike-goodwin/aws-vault-reference-infrastructure/master/supervisord.conf\n",
                "builtin cd /etc/init.d/\n",
                "sudo wget https://raw.githubusercontent.com/mike-goodwin/aws-vault-reference-infrastructure/master/supervisord\n",
                "sudo chmod +x /etc/init.d/supervisord\n",
                "sudo chkconfig --add supervisord\n",
                "sudo service supervisord start\n"
                
              ]
              ] }
            }
         }
	 
    }
      
      
      
  },

	"Outputs" :
	{
  }
}