-
Notifications
You must be signed in to change notification settings - Fork 4
/
template.yaml
254 lines (233 loc) · 6.52 KB
/
template.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
Polls application resources
Parameters:
dbUserName:
NoEcho: true
Type: String
Default: root
bastionAMI:
Type: String
Default: ami-0b5eea76982371e91
keyPair:
Type: String
Default: MyPrivateKey
Globals:
Function:
Timeout: 150
Tags:
'lumigo:auto-trace': 'true'
Resources:
# VPC related resources
VPC:
Type: AWS::EC2::VPC
Properties:
CidrBlock: 10.0.0.0/16
EnableDnsSupport: true
EnableDnsHostnames: true
Tags:
- Key: Name
Value: django VPC
EIP:
Type: AWS::EC2::EIP
NATGateway:
Type: AWS::EC2::NatGateway
Properties:
SubnetId: !Ref PublicSubnet1
AllocationId: !GetAtt EIP.AllocationId
InternetGateway:
Type: AWS::EC2::InternetGateway
VPCGatewayAttachment:
Type: AWS::EC2::VPCGatewayAttachment
Properties:
VpcId: !Ref VPC
InternetGatewayId: !Ref InternetGateway
PublicSubnet1:
Type: AWS::EC2::Subnet
Properties:
VpcId: !Ref VPC
CidrBlock: 10.0.1.0/24
AvailabilityZone: us-east-1a
MapPublicIpOnLaunch: true
Tags:
- Key: Name
Value: django PublicSubnet1
PrivateSubnet1:
Type: AWS::EC2::Subnet
Properties:
VpcId: !Ref VPC
CidrBlock: 10.0.2.0/24
AvailabilityZone: us-east-1a
Tags:
- Key: Name
Value: django PrivateSubnet1
PrivateSubnet2:
Type: AWS::EC2::Subnet
Properties:
VpcId: !Ref VPC
CidrBlock: 10.0.4.0/24
AvailabilityZone: us-east-1b
Tags:
- Key: Name
Value: django PrivateSubnet1
BastionSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
VpcId: !Ref VPC
GroupDescription: Security group for Bastion
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 22
ToPort: 22
CidrIp: 0.0.0.0/0
PublicRouteTable:
Type: AWS::EC2::RouteTable
Properties:
VpcId: !Ref VPC
PrivateRouteTable:
Type: AWS::EC2::RouteTable
Properties:
VpcId: !Ref VPC
PrivateRoute:
Type: AWS::EC2::Route
Properties:
RouteTableId: !Ref PrivateRouteTable
DestinationCidrBlock: 0.0.0.0/0
NatGatewayId: !Ref NATGateway
PrivateSubnet1RouteTableAssociation:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
SubnetId: !Ref PrivateSubnet1
RouteTableId: !Ref PrivateRouteTable
PrivateSubnet2RouteTableAssociation:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
SubnetId: !Ref PrivateSubnet2
RouteTableId: !Ref PrivateRouteTable
InternetRoute:
Type: AWS::EC2::Route
Properties:
RouteTableId: !Ref PublicRouteTable
DestinationCidrBlock: 0.0.0.0/0
GatewayId: !Ref InternetGateway
PublicSubne1tRouteTableAssociation:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
SubnetId: !Ref PublicSubnet1
RouteTableId: !Ref PublicRouteTable
BastionHost:
Type: AWS::EC2::Instance
Properties:
Tags:
- Key: Name
Value: django Bastion
ImageId: !Ref bastionAMI
InstanceType: t2.micro
UserData:
'Fn::Base64': !Sub |
#!/bin/bash
sudo yum update -y
sudo yum install -y postgresql
sudo yum install -y ec2-instance-connect
sudo yum install -y git
sudo yum install -y gcc make patch zlib-devel bzip2 bzip2-devel readline-devel sqlite sqlite-devel openssl-devel tk-devel libffi-devel xz-devel
SecurityGroupIds:
- !Ref BastionSecurityGroup
SubnetId: !Ref PublicSubnet1
KeyName: !Ref keyPair
DependsOn: RDSInstance
# RDS related resources
RDSSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
VpcId: !Ref VPC
GroupDescription: Security group for RDS
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 5432
ToPort: 5432
CidrIp: 0.0.0.0/0
RDSInstance:
Type: AWS::RDS::DBInstance
Properties:
DBName: django
Engine: postgres
MasterUsername: !Ref dbUserName
MasterUserPassword: !Sub '{{resolve:secretsmanager:${DBCredentials}:SecretString}}'
AllocatedStorage: "5"
DBInstanceClass: db.t4g.micro
VPCSecurityGroups:
- !Ref RDSSecurityGroup
DBSubnetGroupName: !Ref DBSubnetGroup
DBSubnetGroup:
Type: AWS::RDS::DBSubnetGroup
Properties:
DBSubnetGroupDescription: Subnets available for the RDS instance
SubnetIds:
- !Ref PrivateSubnet1
- !Ref PrivateSubnet2
# Save User name and password in SSM
DBCredentials:
Type: 'AWS::SecretsManager::Secret'
Properties:
Name: DJangoRDSCredentials
GenerateSecretString:
PasswordLength: 16
ExcludePunctuation: true
DJangoSecretKey:
Type: 'AWS::SecretsManager::Secret'
Properties:
Name: DJangoSecretKey
GenerateSecretString:
PasswordLength: 34
# The actual Lambda
DjangoLambdaSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Security group for my function
VpcId: !Ref VPC
SecurityGroupIngress: []
SecurityGroupEgress:
- IpProtocol: tcp
CidrIp: 0.0.0.0/0
FromPort: 80
ToPort: 5432
PollsApp:
Type: AWS::Serverless::Function
Properties:
PackageType: Image
MemorySize: 1024
VpcConfig:
SecurityGroupIds:
- !Ref DjangoLambdaSecurityGroup
SubnetIds:
- !Ref PrivateSubnet1
- !Ref PrivateSubnet2
Policies:
- AWSSecretsManagerGetSecretValuePolicy:
SecretArn: !Ref DBCredentials
Environment:
Variables:
PORT: 8000
DB_HOST: !GetAtt RDSInstance.Endpoint.Address
SSM_PASSWORD_NAME: !Ref DBCredentials
DJANGO_SECRET_KEY: !Ref DJangoSecretKey
DJANGO_DEBUG: "False"
DB_USER: !Ref dbUserName
FunctionUrlConfig:
AuthType: NONE
Metadata:
DockerTag: v1
DockerContext: ./
Dockerfile: Dockerfile
Outputs:
PollsAppFunctionUrlEndpoint:
Description: "Polls Function URL Endpoint"
Value: !GetAtt PollsAppUrl.FunctionUrl
BastionPublicDns:
Description: The public DNS of the bastion host
Value: !GetAtt BastionHost.PublicDnsName
RDSHost:
Description: "RDS Host"
Value: !GetAtt RDSInstance.Endpoint.Address