Arm-VHT-CloudFormation-Template.yaml

AWSTemplateFormatVersion: 2010-09-09
Parameters:
  S3BucketName:
    Type: String
    Description: VHT S3 Bucket. Name must be unique.
  VpcId:
    Type: String
    Description: VPC ID to be associated with the VHT Security Group (e.g. vpc-0dc320e47b6a8077f)
Resources:
  VHTS3Bucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      AccessControl: Private
      BucketName:
        Ref: S3BucketName
      Tags:
        - Key: VHT
          Value: true
  VHTEC2SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow ssh communication and outbound traffic
      GroupName: VHTEC2SecurityGroup
      VpcId:
         Ref: VpcId
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0
  VHTIAMProfile:
    Type: "AWS::IAM::InstanceProfile"
    Properties:
      InstanceProfileName: VHTRole
      Path: "/"
      Roles:
        - Ref: "VHTRole"
    DependsOn:
      - VHTRole
  VHTPassrole:
    Type: 'AWS::IAM::Policy'
    Properties:
      PolicyName: VHTPassRole
      PolicyDocument: |
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": "iam:PassRole",
              "Resource": "*"
            }
          ]
        }
      Users:
       - VHTUser
    DependsOn: VHTUser
  VHTRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: |
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": "ec2.amazonaws.com"
              },
              "Action": "sts:AssumeRole"
            }
          ]
        }
      Description: Allows EC2 instances to call AWS services on VHT behalf.
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonS3FullAccess
        - arn:aws:iam::aws:policy/AmazonSSMFullAccess
      RoleName: VHTRole
      Tags:
       - Key: VHT
         Value: true
  VHTUser:
    Type: 'AWS::IAM::User'
    Properties:
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/AmazonEC2FullAccess'
        - 'arn:aws:iam::aws:policy/AmazonS3FullAccess'
        - 'arn:aws:iam::aws:policy/AmazonSSMFullAccess'
      UserName: VHTUser
      Tags:
        - Key: VHT
          Value: true
  VHTUserAccessKey:
    Type: AWS::IAM::AccessKey
    Properties:
      Status: Active
      UserName: VHTUser
    DependsOn: VHTUser
Outputs:
  VHTIAMProfile:
    Value:
      !Ref VHTIAMProfile
    Description:
      IAM Instance Profile created in the stack
  VHTAccessKeyId:
    Value:
      !Ref VHTUserAccessKey
    Description:
      Access Key Id for the created IAM User
  VHTSecretAccessKey:
    Value:
      !GetAtt VHTUserAccessKey.SecretAccessKey
    Description:
      Secret Access Key for the created IAM User
  VHTS3BucketName:
    Value:
      !Ref S3BucketName
    Description:
      S3 Bucket created in the stack
  VHTEC2SecurityGroupId:
    Value:
      !GetAtt VHTEC2SecurityGroup.GroupId
    Description:
      EC2 Security Group created in the stack