vault-core-security.json

{
"AWSTemplateFormatVersion" : "2010-09-09",
"Description" : "Hashicorp Vault Reference: Core Security Infrastructure: This template creates a Private and Public Security Group and 1 Test EC2 instance.",

	"Metadata" :
	{
	},

	"Parameters" :
	{

      "VaultStackName":
      {
        "Description": "Name of the stack containing the vault networking",
        "Type": "String"
      }
  
  },

	"Mappings" :
	{
  },

	"Conditions" :
	{
  },

	"Resources" :
  {
    
	    "NetworkInfo":
	    {
	      "Type": "Custom::NetworkInfo",
	      "Properties":
	      {
	        "ServiceToken": {"Fn::GetAtt": ["LookupStackOutputs","Arn"]},
	        "StackName": {"Ref": "VaultStackName"}
	      }
	    },
	    
	    "LookupStackOutputs":
		  {
		        "Type": "AWS::Lambda::Function",
		        "Properties": {
		            "Handler": "index.handler",
		            "Role": {
		            "Fn::GetAtt": [
		                "LambdaExecutionRole",
		                "Arn"
		            ]
		            },
		            "Code": {
		            "ZipFile": {
		                "Fn::Join": [
		                "\n",
		                [
		                    "var response = require('cfn-response');",
		                    "exports.handler = function(event, context) {",
		                    "    console.log('REQUEST RECEIVED:\\n', JSON.stringify(event));",
		                    "    if (event.RequestType == 'Delete') {",
		                    "        response.send(event, context, response.SUCCESS);",
		                    "        return;",
		                    "    }",
		                    "    var stackName = event.ResourceProperties.StackName;",
		                    "    var responseData = {};",
		                    "    if (stackName) {",
		                    "        var aws = require('aws-sdk');",
		                    "        var cfn = new aws.CloudFormation();",
		                    "        cfn.describeStacks({StackName: stackName}, function(err, data) {",
		                    "            if (err) {",
		                    "                responseData = {Error: 'DescribeStacks call failed'};",
		                    "                console.log(responseData.Error + ':\\n', err);",
		                    "                response.send(event, context, response.FAILED, responseData);",
		                    "            }",
		                    "            else {",
		                    "                data.Stacks[0].Outputs.forEach(function(output) {",
		                    "                    responseData[output.OutputKey] = output.OutputValue.toLowerCase();",
		                    "                });",
		                    "                response.send(event, context, response.SUCCESS, responseData);",
		                    "            }",
		                    "        });",
		                    "    } else {",
		                    "        responseData = {Error: 'Stack name not specified'};",
		                    "        console.log(responseData.Error);",
		                    "        response.send(event, context, response.FAILED, responseData);",
		                    "    }",
		                    "};"
		                ]
		                ]
		            }
		            },
		            "Runtime": "nodejs4.3",
		            "Timeout": "30"
		        }
		        },
        
        
		        "LambdaExecutionRole": {
		        "Type": "AWS::IAM::Role",
		        "Properties": {
		            "AssumeRolePolicyDocument": {
		            "Version": "2012-10-17",
		            "Statement": [
		                {
		                "Effect": "Allow",
		                "Principal": {
		                    "Service": [
		                    "lambda.amazonaws.com"
		                    ]
		                },
		                "Action": [
		                    "sts:AssumeRole"
		                ]
		                }
		            ]
		            },
		            "Path": "/",
		            "Policies": [
		            {
		                "PolicyName": "root",
		                "PolicyDocument": {
		                "Version": "2012-10-17",
		                "Statement": [
		                    {
		                    "Effect": "Allow",
		                    "Action": [
		                        "logs:CreateLogGroup",
		                        "logs:CreateLogStream",
		                        "logs:PutLogEvents"
		                    ],
		                    "Resource": "arn:aws:logs:*:*:*"
		                    },
		                    {
		                    "Effect": "Allow",
		                    "Action": [
		                        "cloudformation:DescribeStacks",
		                        "ec2:DescribeImages"
		                    ],
		                    "Resource": "*"
		                    }
		                ]
		                }
		            }
		            ]
		        }
		  },
    
      "VaultPublicInstanceSecurityGroup" :
      {
          "Type" : "AWS::EC2::SecurityGroup",
          "Properties" :
          {
            "GroupDescription" : "Allow http to client host",
            "VpcId" : { "Fn::GetAtt" : ["NetworkInfo","VaultRefVPC"] },
            "SecurityGroupIngress" : [{
                "IpProtocol" : "tcp",
                "FromPort" : "22",
                "ToPort" : "22",
                "CidrIp" : { "Fn::GetAtt" : ["NetworkInfo","VaultCIDRBastionAccess"] }
            }],
            
            "SecurityGroupEgress" : [{
                "IpProtocol" : "tcp",
                "FromPort" : "22",
                "ToPort" : "22",
                "CidrIp" : "0.0.0.0/0"
            }]
          }
      },
      
      "VaultPrivateInstanceSecurityGroup" :
      {
          "Type" : "AWS::EC2::SecurityGroup",
          "Properties" :
          {
            "GroupDescription" : "Allow http to client host",
            "VpcId" : { "Fn::GetAtt" : ["NetworkInfo","VaultRefVPC"] },
            "SecurityGroupIngress" : [{
                "IpProtocol" : "tcp",
                "FromPort" : "22",
                "ToPort" : "22",
                "CidrIp" :  "0.0.0.0/0"
            }],
            
            "SecurityGroupEgress" : [{
                "IpProtocol" : "tcp",
                "FromPort" : "443",
                "ToPort" : "443",
                "CidrIp" : "0.0.0.0/0"
            }]
          }
      }
      
    
      
      
  },

	"Outputs" :
	{
	  
	  "VaultRefVPC":
		{
	     "Value": { "Fn::GetAtt" : ["NetworkInfo","VaultRefVPC"] },
	     "Description": "VPC ID"
	   },
	  
	  "VaultPublicSubnet1" :
	  {
      "Description": "ID of Public Subnet 1",
      "Value" : { "Fn::GetAtt" : ["NetworkInfo","VaultPublicSubnet1"] }
    },
	  
		"VaultPublicSubnet2" :
	  {
      "Description": "ID of Public Subnet 2",
      "Value" : { "Fn::GetAtt" : ["NetworkInfo","VaultPublicSubnet2"] }
    },
    
    "VaultPublicSubnet3" :
	  {
      "Description": "ID of Public Subnet 3",
      "Value" : { "Fn::GetAtt" : ["NetworkInfo","VaultPublicSubnet3"] }
    },
	
	  "VaultPrivateSubnet1" :
	  {
      "Description": "ID of Private Subnet 1",
      "Value" : { "Fn::GetAtt" : ["NetworkInfo","VaultPrivateSubnet1"] }
    },
    
    "VaultPrivateSubnet1Toggle" :
	  {
      "Description": "Should we Deploy Private Subnet 1? yes/no",
      "Value" : { "Fn::GetAtt" : ["NetworkInfo","VaultPrivateSubnet1Toggle"] }
    },
    
  	"VaultPrivateSubnet2" :
	  {
      "Description": "ID of Private Subnet 2",
      "Value" : { "Fn::GetAtt" : ["NetworkInfo","VaultPrivateSubnet2"] }
    },
    
    "VaultPrivateSubnet2Toggle" :
	  {
      "Description": "Should we Deploy Private Subnet 2? yes/no",
      "Value" : { "Fn::GetAtt" : ["NetworkInfo","VaultPrivateSubnet2Toggle"] }
    },
    
    "VaultPrivateSubnet3" :
	  {
      "Description": "ID of Private Subnet 3",
      "Value" : { "Fn::GetAtt" : ["NetworkInfo","VaultPrivateSubnet3"] }
    },
    
    "VaultPrivateSubnet3Toggle" :
	  {
      "Description": "Should we Deploy Private Subnet 3? yes/no",
      "Value" : { "Fn::GetAtt" : ["NetworkInfo","VaultPrivateSubnet3Toggle"] }
    },
    
    "VaultPublicSG" :
	  {
      "Description": "Vault Public Instance Security Group",
      "Value" : { "Ref" : "VaultPublicInstanceSecurityGroup"}
    },
    
    "VaultPrivateSG" :
	  {
      "Description": "Vault Private Instance Security Group",
      "Value" : { "Ref" : "VaultPrivateInstanceSecurityGroup"}
    }
	  
  }
}