dynatrace-aws-log-forwarder-template.yaml

#   Copyright 2021 Dynatrace LLC
#
#   Licensed under the Apache License, Version 2.0 (the "License");
#   you may not use this file except in compliance with the License.
#   You may obtain a copy of the License at
#
#       http://www.apache.org/licenses/LICENSE-2.0
#
#   Unless required by applicable law or agreed to in writing, software
#   distributed under the License is distributed on an "AS IS" BASIS,
#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#   See the License for the specific language governing permissions and
#   limitations under the License.

AWSTemplateFormatVersion: "2010-09-09"
Description: Dynatrace - AWS Logs Ingest

Parameters:
  DynatraceEnvironmentUrl:
    Description: URL to Dynatrace environment
    Type: String
  DynatraceApiKey:
    Description: Dynatrace API key
    Type: String
    NoEcho: true
  VerifySSLTargetActiveGate:
    AllowedValues:
      - 'true'
      - 'false'
    Default: 'false'
    Description: "If false, expect target ActiveGate to have a self-signed SSL certificate and do not verify its validity"
    Type: String
  MaxLogContentLength:
    Type: Number
    MinValue: 20
    MaxValue: 65536
  UseExistingActiveGate:
    Type: String
    AllowedValues:
      - 'true'
      - 'false'
  DynatracePaasToken:
    Description: Dynatrace PaaS token
    Type: String
    NoEcho: true
  TenantId:
    Type: String
    Default: "not_provided"
    Description: "Needed to construct Lambda destination URL (path for AG) in scenario with new AG deployment"
  LatestAmazonLinuxAmiId:
    # this will query for latest AMI ID automatically
    # https://aws.amazon.com/blogs/compute/query-for-the-latest-amazon-linux-ami-ids-using-aws-systems-manager-parameter-store/
    Type: 'AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>'
    Default: '/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2'

Conditions:
  DeployAGwithVPC: !Equals [ !Ref UseExistingActiveGate, 'false' ]

Resources:
  Lambda:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        ZipFile: |
          def handler(event, context):
            raise Exception("Dynatrace Logs Lambda has not been uploaded")
      Handler: index.handler
      Runtime: python3.8
      MemorySize: 256
      Timeout: 60
      Environment:
        Variables:
          DEBUG: 'false'
          DYNATRACE_API_KEY: !Ref DynatraceApiKey
          DYNATRACE_ENV_URL: !If
            - DeployAGwithVPC
            - !Sub
              - "https://${EC2ActiveGateIP}:9999/e/${TenantId}"
              - EC2ActiveGateIP: !GetAtt EC2ActiveGate.PrivateIp
                TenantId: !Ref TenantId
            - !Ref DynatraceEnvironmentUrl
          VERIFY_SSL: !Ref VerifySSLTargetActiveGate
          MAX_LOG_CONTENT_LENGTH: !Ref MaxLogContentLength
          CLOUD_LOG_FORWARDER: !Sub '${AWS::AccountId}:${AWS::Region}:${AWS::StackName}'
      Role: !GetAtt LambdaRole.Arn
      VpcConfig: !If
        - DeployAGwithVPC
        - SecurityGroupIds: [ !Ref VPCSecurityGroup ]
          SubnetIds: [ !Ref VPCPrivateSubnet  ]
        - !Ref "AWS::NoValue"

  LambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: 'lambda.amazonaws.com'
            Action:
              - 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
      Policies:
        - PolicyName: 'CloudwatchPutMetricData'
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: 'cloudwatch:PutMetricData'
                Resource: '*'
        - !If
          - DeployAGwithVPC
          - PolicyName: 'SecurityGroupRequiredPermissions'
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action:
                   - 'ec2:DescribeNetworkInterfaces'
                   - 'ec2:CreateNetworkInterface'
                   - 'ec2:DeleteNetworkInterface'
                  Resource: '*'
          - !Ref AWS::NoValue

  FirehoseLogStreams:
    Type: AWS::KinesisFirehose::DeliveryStream
    Properties:
      DeliveryStreamType: DirectPut
      ExtendedS3DestinationConfiguration:
        BucketARN: !GetAtt DeliveryBucket.Arn
        BufferingHints:
          IntervalInSeconds: 60
          SizeInMBs: 5
        CompressionFormat: GZIP
        ErrorOutputPrefix: 'error-'
        Prefix: 'success-'
        ProcessingConfiguration:
          Enabled: 'true'
          Processors:
            - Parameters:
                - ParameterName: LambdaArn
                  ParameterValue: !GetAtt Lambda.Arn
              Type: Lambda
        RoleARN: !GetAtt DeliveryStreamRole.Arn

  DeliveryBucket:
    Type: AWS::S3::Bucket
    Properties:
      LifecycleConfiguration:
        Rules:
          - ExpirationInDays: '7'
            Status: 'Enabled'
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

  DeliveryStreamRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: ''
            Effect: Allow
            Principal:
              Service: firehose.amazonaws.com
            Action: 'sts:AssumeRole'
      Policies:
        - PolicyName: firehose_delivery_policy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - 's3:AbortMultipartUpload'
                  - 's3:GetBucketLocation'
                  - 's3:GetObject'
                  - 's3:ListBucket'
                  - 's3:ListBucketMultipartUploads'
                  - 's3:PutObject'
                Resource:
                  - !GetAtt DeliveryBucket.Arn
                  - !Join [ '/', [ !GetAtt DeliveryBucket.Arn, '*' ] ]
        - PolicyName: firehose_lambda_invocation_policy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - 'lambda:InvokeFunction'
                  - 'lambda:GetFunctionConfiguration'
                Resource:
                  - !GetAtt Lambda.Arn

  CloudWatchLogsRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: !Sub "logs.${AWS::Region}.amazonaws.com"
            Action:
              - 'sts:AssumeRole'
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - 'firehose:PutRecord'
                  - 'firehose:PutRecordBatch'
                Resource: !GetAtt FirehoseLogStreams.Arn
      Description: Role for Subscription Filters (to write to Firehose)

  SelfMonitoringDashboard:
    Type: AWS::CloudWatch::Dashboard
    Properties:
      DashboardName: !Sub
        - "DynatraceLogForwarder-SelfMonitoring-${__Region__}-${__StackName__}"
        - __StackName__: !Ref 'AWS::StackName'
          __Region__: !Ref 'AWS::Region'
      DashboardBody: !Sub
        - |
          {
            "widgets": [
            {
              "height": 6,
              "width": 12,
              "y": 6,
              "x": 0,
              "type": "metric",
              "properties": {
                "metrics": [
                [ "DT/LogsStreaming", "Kinesis record age", "function_name", "${__LambdaName__}", { "stat": "Minimum" } ],
                [ "...", { "stat": "Average" } ],
                [ "..." ]
                ],
                "view": "timeSeries",
                "stacked": false,
                "region": "${__Region__}",
                "stat": "Maximum",
                "period": 60,
                "liveData": true,
                "setPeriodToTimeRange": true,
                "legend": {
                  "position": "bottom"
                },
                "title": "Kinesis - record age"
              }
            },
            {
              "height": 6,
              "width": 12,
              "y": 18,
              "x": 12,
              "type": "metric",
              "properties": {
                "metrics": [
                [ "DT/LogsStreaming", "Kinesis record.data decompressed size", "function_name", "${__LambdaName__}" ],
                [ "...", { "stat": "Average" } ],
                [ "...", { "stat": "Maximum" } ]
                ],
                "view": "timeSeries",
                "stacked": false,
                "region": "${__Region__}",
                "stat": "Minimum",
                "period": 60,
                "title": "Kinesis - record.data decompressed size"
              }
            },
            {
              "height": 6,
              "width": 12,
              "y": 18,
              "x": 0,
              "type": "metric",
              "properties": {
                "metrics": [
                [ "DT/LogsStreaming", "Kinesis record.data compressed size", "function_name", "${__LambdaName__}" ],
                [ "...", { "stat": "Average" } ],
                [ "...", { "stat": "Maximum" } ]
                ],
                "view": "timeSeries",
                "stacked": false,
                "region": "${__Region__}",
                "stat": "Minimum",
                "period": 60,
                "title": "Kinesis - record.data compressed size"
              }
            },
            {
              "height": 6,
              "width": 12,
              "y": 24,
              "x": 0,
              "type": "metric",
              "properties": {
                "metrics": [
                [ { "expression": "SEARCH('{AWS/Logs,FilterName,LogGroupName,DestinationType} FilterName=\"${__StackName__}\" MetricName=\"ForwardedLogEvents\"', 'Sum', 60)", "label": "[${!PROP('Dim.LogGroupName')}]", "id": "e1", "region": "${__Region__}" } ]
                ],
                "view": "timeSeries",
                "stacked": false,
                "region": "${__Region__}",
                "period": 300,
                "stat": "Average",
                "title": "Log Groups - log entries received from CloudWatch"
              }
            },
            {
              "height": 6,
              "width": 12,
              "y": 30,
              "x": 12,
              "type": "metric",
              "properties": {
                "metrics": [
                [ { "expression": "SEARCH('{AWS/Logs,FilterName,LogGroupName,DestinationType} FilterName=\"${__StackName__}\" MetricName=\"ForwardedBytes\"', 'Sum', 60)", "label": "[${!PROP('Dim.LogGroupName')}]", "id": "e1", "region": "${__Region__}" } ]
                ],
                "view": "timeSeries",
                "stacked": false,
                "region": "${__Region__}",
                "period": 300,
                "stat": "Average",
                "title": "Log Groups - bytes received from CloudWatch"
              }
            },
            {
              "height": 6,
              "width": 12,
              "y": 30,
              "x": 0,
              "type": "metric",
              "properties": {
                "metrics": [
                [ "DT/LogsStreaming", "Batches prepared", "function_name", "${__LambdaName__}" ],
                [ ".", "Batches delivered", ".", "." ]
                ],
                "view": "timeSeries",
                "stacked": false,
                "region": "${__Region__}",
                "stat": "Sum",
                "period": 60,
                "title": "Delivery - batches"
              }
            },
            {
              "height": 6,
              "width": 12,
              "y": 36,
              "x": 0,
              "type": "metric",
              "properties": {
                "metrics": [
                [ "DT/LogsStreaming", "Log entries prepared", "function_name", "${__LambdaName__}" ],
                [ ".", "Log entries delivered", ".", "." ]
                ],
                "view": "timeSeries",
                "stacked": false,
                "region": "${__Region__}",
                "stat": "Sum",
                "period": 60,
                "title": "Delivery - log entries"
              }
            },
            {
              "height": 6,
              "width": 12,
              "y": 36,
              "x": 12,
              "type": "metric",
              "properties": {
                "metrics": [
                [ "DT/LogsStreaming", "Data volume prepared", "function_name", "${__LambdaName__}" ],
                [ ".", "Data volume delivered", ".", "." ]
                ],
                "view": "timeSeries",
                "stacked": false,
                "region": "${__Region__}",
                "title": "Delivery - data volume",
                "period": 60,
                "stat": "Sum"
              }
            },
            {
              "height": 6,
              "width": 12,
              "y": 48,
              "x": 0,
              "type": "metric",
              "properties": {
                "metrics": [
                [ { "expression": "SEARCH('{DT/LogsStreaming,function_name,status_code} function_name=\"${__LambdaName__}\" MetricName=\"Requests status code count\"', 'Sum', 60)", "label": "Status code - [${!PROP('Dim.status_code')}]", "id": "e1", "region": "${__Region__}" } ]
                ],
                "view": "timeSeries",
                "stacked": false,
                "region": "${__Region__}",
                "title": "Requests - status codes",
                "period": 300,
                "stat": "Average"
              }
            },
            {
              "height": 6,
              "width": 12,
              "y": 42,
              "x": 0,
              "type": "metric",
              "properties": {
                "metrics": [
                [ "DT/LogsStreaming", "Requests duration", "function_name", "${__LambdaName__}", { "stat": "Minimum" } ],
                [ "..." ],
                [ "...", { "stat": "Maximum" } ]
                ],
                "view": "timeSeries",
                "stacked": false,
                "region": "${__Region__}",
                "period": 60,
                "stat": "Average",
                "title": "Requests - durations"
              }
            },
            {
              "height": 6,
              "width": 12,
              "y": 48,
              "x": 12,
              "type": "metric",
              "properties": {
                "metrics": [
                [ { "expression": "SEARCH('{DT/LogsStreaming,function_name,type} function_name=\"${__LambdaName__}\" MetricName=\"Issues\"', 'Sum', 60)", "label": "Issues - [${!PROP('Dim.type')}]", "id": "e1", "region": "${__Region__}" } ]
                ],
                "view": "timeSeries",
                "stacked": false,
                "region": "${__Region__}",
                "stat": "Sum",
                "period": 60,
                "title": "Delivery - issues"
              }
            },
            {
              "height": 6,
              "width": 12,
              "y": 42,
              "x": 12,
              "type": "metric",
              "properties": {
                "metrics": [
                [ "DT/LogsStreaming", "Log attr trimmed", "function_name", "${__LambdaName__}" ],
                [ ".", "Log content trimmed", ".", "." ]
                ],
                "view": "timeSeries",
                "stacked": false,
                "region": "${__Region__}",
                "period": 60,
                "title": "Logs - trimmed",
                "stat": "Sum"
              }
            },
            {
              "height": 6,
              "width": 12,
              "y": 6,
              "x": 12,
              "type": "metric",
              "properties": {
                "metrics": [
                [ "DT/LogsStreaming", "Log age min", "function_name", "${__LambdaName__}", { "stat": "Minimum" } ],
                [ "DT/LogsStreaming", "Log age avg", "function_name", "${__LambdaName__}" ],
                [ "DT/LogsStreaming", "Log age max", "function_name", "${__LambdaName__}", { "stat": "Maximum" } ]
                ],
                "view": "timeSeries",
                "stacked": false,
                "title": "Logs - age",
                "region": "${__Region__}",
                "period": 60,
                "stat": "Average"
              }
            },
            {
              "height": 6,
              "width": 12,
              "y": 0,
              "x": 0,
              "type": "metric",
              "properties": {
                "view": "timeSeries",
                "stacked": false,
                "metrics": [
                [ "AWS/Lambda", "Invocations", "FunctionName", "${__LambdaName__}" ]
                ],
                "region": "${__Region__}",
                "title": "Lambda - invocations"
              }
            },
            {
              "height": 6,
              "width": 12,
              "y": 0,
              "x": 12,
              "type": "metric",
              "properties": {
                "view": "timeSeries",
                "stacked": false,
                "metrics": [
                [ "AWS/Lambda", "Duration", "FunctionName", "${__LambdaName__}" ]
                ],
                "region": "${__Region__}",
                "title": "Lambda - duration"
              }
            },
            {
              "height": 6,
              "width": 12,
              "y": 12,
              "x": 12,
              "type": "metric",
              "properties": {
                "metrics": [
                [ "AWS/Lambda", "Errors", "FunctionName", "${__LambdaName__}" ]
                ],
                "view": "timeSeries",
                "stacked": false,
                "region": "${__Region__}",
                "stat": "Sum",
                "period": 60,
                "title": "Lambda errors"
              }
            },
            {
              "height": 6,
              "width": 12,
              "y": 12,
              "x": 0,
              "type": "metric",
              "properties": {
                "metrics": [
                [ "DT/LogsStreaming", "Kinesis record age", "function_name", "${__LambdaName__}", { "label": "Kinesis records" } ]
                ],
                "view": "timeSeries",
                "stacked": false,
                "region": "${__Region__}",
                "stat": "SampleCount",
                "period": 60,
                "title": "Kinesis - records number"
              }
            },
            {
              "height": 6,
              "width": 12,
              "y": 24,
              "x": 12,
              "type": "metric",
              "properties": {
                "metrics": [
                [ "DT/LogsStreaming", "Kinesis record.data decompressed size", "function_name", "${__LambdaName__}" ]
                ],
                "view": "timeSeries",
                "stacked": false,
                "region": "${__Region__}",
                "stat": "Sum",
                "period": 60,
                "title": "Kinesis - sum record.data decompressed size"
              }
            }
            ]
          }
        - __Region__: !Ref 'AWS::Region'
          __LambdaName__: !Ref Lambda
          __StackName__: !Ref 'AWS::StackName'

  EC2ActiveGate:
    Condition: DeployAGwithVPC
    Type: AWS::EC2::Instance
    DependsOn: VPCPublicRouteInternet
    Properties:
      ImageId: !Ref LatestAmazonLinuxAmiId
      InstanceType: "t3.small"
      BlockDeviceMappings:
        - DeviceName: "/dev/sdm"
          Ebs:
            VolumeType: "io1"
            Iops: "200"
            DeleteOnTermination: "true"
            VolumeSize: "8"
      SecurityGroupIds: [ !Ref VPCSecurityGroup ]
      Tags:
        - Key: Name
          Value: !Join [ "-", [ !Ref 'AWS::StackName', "active-gate" ] ]
      UserData:
        Fn::Base64:
          !Sub
          - |
            #!/bin/bash -xe
            wget -O Dynatrace-ActiveGate-Linux-x86.sh "${DynatraceEnvironmentUrl}/api/v1/deployment/installer/gateway/unix/latest?arch=x86&flavor=default" --header="Authorization: Api-Token ${DynatracePaasToken}"
            wget https://ca.dynatrace.com/dt-root.cert.pem ; ( echo 'Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="--SIGNED-INSTALLER"'; echo ; echo ; echo '----SIGNED-INSTALLER' ; cat Dynatrace-ActiveGate-Linux-x86.sh ) | openssl cms -verify -CAfile dt-root.cert.pem > /dev/null
            /bin/sh Dynatrace-ActiveGate-Linux-x86.sh

            echo "[aws_monitoring]
            aws_monitoring_enabled = false
            [azure_monitoring]
            azure_monitoring_enabled = false
            [cloudfoundry_monitoring]
            cloudfoundry_monitoring_enabled = false
            [kubernetes_monitoring]
            kubernetes_monitoring_enabled = false
            [vmware_monitoring]
            vmware_monitoring_enabled = false
            [rpm]
            rpm_enabled = false
            [beacon_forwarder]
            beacon_forwarder_enabled = false
            [extension_controller]
            extension_controller_enabled = false
            [dbAgent]
            dbAgent_enabled = false
            [metrics_ingest]
            metrics_ingest_enabled = false
            [collector]
            MSGrouter = false" >> /var/lib/dynatrace/gateway/config/custom.properties

            systemctl restart dynatracegateway

            touch /home/ec2-user/userdata-ag-installation-success
          - DynatraceEnvironmentUrl: !Ref DynatraceEnvironmentUrl
            DynatracePaasToken: !Ref DynatracePaasToken
      SubnetId: !Ref VPCPrivateSubnet

  VPC:
    Condition: DeployAGwithVPC
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: "172.31.0.0/16"
      EnableDnsSupport: true
      EnableDnsHostnames: true

  VPCPublicSubnet:
    Condition: DeployAGwithVPC
    Type: 'AWS::EC2::Subnet'
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 0, !GetAZs ]
      CidrBlock: 172.31.1.0/27
      MapPublicIpOnLaunch: true

  VPCPrivateSubnet:
    Condition: DeployAGwithVPC
    Type: 'AWS::EC2::Subnet'
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 0, !GetAZs ]
      CidrBlock: 172.31.2.0/27
      MapPublicIpOnLaunch: false

  VPCInternetGateway:
    Condition: DeployAGwithVPC
    Type: AWS::EC2::InternetGateway
    DependsOn: VPC

  VPCInternetGatewayAttach:
    Condition: DeployAGwithVPC
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref VPCInternetGateway

  VPCNatGatewayElasticIP:
    Condition: DeployAGwithVPC
    Type: AWS::EC2::EIP
    Properties:
      Domain: VPC

  VPCNatGateway:
    Condition: DeployAGwithVPC
    Type: "AWS::EC2::NatGateway"
    Properties:
      AllocationId: !GetAtt VPCNatGatewayElasticIP.AllocationId
      SubnetId: !Ref VPCPublicSubnet

  VPCPublicRouteTable:
    Condition: DeployAGwithVPC
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC

  VPCPublicRouteInternet:
    Condition: DeployAGwithVPC
    Type: AWS::EC2::Route
    DependsOn: VPCInternetGatewayAttach
    Properties:
      RouteTableId: !Ref VPCPublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref VPCInternetGateway

  VPCPublicSubnetRouteTableAssoc:
    Condition: DeployAGwithVPC
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref VPCPublicSubnet
      RouteTableId: !Ref VPCPublicRouteTable

  VPCPrivateRouteTable:
    Condition: DeployAGwithVPC
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC

  VPCPrivateRouteToNat:
    Condition: DeployAGwithVPC
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref VPCPrivateRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref VPCNatGateway

  VPCPrivateSubnetRouteTableAssoc:
    Condition: DeployAGwithVPC
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref VPCPrivateSubnet
      RouteTableId: !Ref VPCPrivateRouteTable

  VPCSecurityGroup:
    Condition: DeployAGwithVPC
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow ActiveGate ingress
      VpcId: !Ref VPC

  VPCSecurityGroupActiveGateInbound:
    Condition: DeployAGwithVPC
    Type: 'AWS::EC2::SecurityGroupIngress'
    Properties:
      GroupId: !GetAtt VPCSecurityGroup.GroupId
      IpProtocol: tcp
      FromPort: '9999'
      ToPort: '9999'
      SourceSecurityGroupId: !GetAtt VPCSecurityGroup.GroupId

Outputs:
  LambdaArn:
    Description: "Lambda ARN"
    Value: !GetAtt Lambda.Arn

  FirehoseArn:
    Description: "Firehose ARN"
    Value: !GetAtt FirehoseLogStreams.Arn
    Export:
      Name: !Join [ ":", [ !Ref "AWS::StackName", FirehoseARN ] ]

  CloudWatchLogsRoleArn:
    Description: "CloudWatch Logs role ARN allowing streaming to Firehose"
    Value: !GetAtt CloudWatchLogsRole.Arn
    Export:
      Name: !Join [ ":", [ !Ref "AWS::StackName", CloudWatchARN ] ]

  EC2ActiveGateHostname:
    Description: "EC2ActiveGateHostname"
    Value: !If
      - DeployAGwithVPC
      - !GetAtt EC2ActiveGate.PrivateDnsName
      - "not_applicable"