AWSTemplateFormatVersion: '2010-09-09'
Description: Create a 3 AZ networking infrastructure for Kion (3az-3nat).
Metadata:
  Identifier:
    Value: Kion-network-infrastructure
  VersionDate:
    Value: '20180827'
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Network Configuration
        Parameters:
          - paramsvpc
          - paramsprivateSubnet0
          - paramsprivateSubnet1
          - paramsprivateSubnet2
          - paramspublicSubnet0
          - paramspublicSubnet1
          - paramspublicSubnet2
    ParameterLabels:
      paramsvpc:
        default: CIDR for VPC
      paramsprivateSubnet0:
        default: CIDR for Private Subnet 0
      paramsprivateSubnet1:
        default: CIDR for Private Subnet 1
      paramsprivateSubnet2:
        default: CIDR for Private Subnet 2
      paramspublicSubnet0:
        default: CIDR for Public Subnet 0
      paramspublicSubnet1:
        default: CIDR for Public Subnet 1
      paramspublicSubnet2:
        default: CIDR for Public Subnet 2
Parameters:
  paramsvpc:
    Description: IP address range for VPC.
    Type: String
    MinLength: '9'
    MaxLength: '18'
    Default: 10.224.36.0/23
    AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})
    ConstraintDescription: Must be a valid IP CIDR range of the form x.x.x.x/x.
  paramspublicSubnet1:
    Description: IP address range for PublicSubnet1.
    Type: String
    MinLength: '9'
    MaxLength: '18'
    Default: 10.224.37.0/26
    AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})
    ConstraintDescription: Must be a valid IP CIDR range of the form x.x.x.x/x.
  paramspublicSubnet0:
    Description: IP address range for PublicSubnet0.
    Type: String
    MinLength: '9'
    MaxLength: '18'
    Default: 10.224.36.192/26
    AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})
    ConstraintDescription: Must be a valid IP CIDR range of the form x.x.x.x/x.
  paramspublicSubnet2:
    Description: IP address range for PublicSubnet2.
    Type: String
    MinLength: '9'
    MaxLength: '18'
    Default: 10.224.37.64/26
    AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})
    ConstraintDescription: Must be a valid IP CIDR range of the form x.x.x.x/x.
  paramsprivateSubnet2:
    Description: IP address range for PrivateSubnet2.
    Type: String
    MinLength: '9'
    MaxLength: '18'
    Default: 10.224.36.128/26
    AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})
    ConstraintDescription: Must be a valid IP CIDR range of the form x.x.x.x/x.
  paramsprivateSubnet1:
    Description: IP address range for PrivateSubnet1.
    Type: String
    MinLength: '9'
    MaxLength: '18'
    Default: 10.224.36.64/26
    AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})
    ConstraintDescription: Must be a valid IP CIDR range of the form x.x.x.x/x.
  paramsprivateSubnet0:
    Description: IP address range for PrivateSubnet0.
    Type: String
    MinLength: '9'
    MaxLength: '18'
    Default: 10.224.36.0/26
    AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})
    ConstraintDescription: Must be a valid IP CIDR range of the form x.x.x.x/x.
Outputs:
  KionVPCCIDRExport:
    Description: VPC CIDR for Kion
    Export:
      Name: vpc-cidr
    Value: KionVPC.CidrBlock
  KionVPCExport:
    Description: VPC for Kion
    Export:
      Name: vpc
    Value: KionVPC
  PrivateSecurityGroup0Export:
    Description: Kion Private Security Group
    Export:
      Name: private-sg0
    Value: PrivateSecurityGroup0
  PrivateSubnet0Export:
    Description: Kion VPC Private Subnet 0
    Export:
      Name: private-subnet0
    Value: PrivateSubnet0
  PrivateSubnet1Export:
    Description: Kion VPC Private Subnet 1
    Export:
      Name: private-subnet1
    Value: PrivateSubnet1
  PrivateSubnet2Export:
    Description: Kion VPC Private Subnet 2
    Export:
      Name: private-subnet2
    Value: PrivateSubnet2
  PublicSubnet0Export:
    Description: Kion VPC Public Subnet 0
    Export:
      Name: public-subnet0
    Value: PublicSubnet0
  PublicSubnet1Export:
    Description: Kion VPC Public Subnet 1
    Export:
      Name: public-subnet1
    Value: PublicSubnet1
  PublicSubnet2Export:
    Description: Kion VPC Public Subnet 2
    Export:
      Name: public-subnet2
    Value: PublicSubnet2
Resources:
  AttachIGW:
    Properties:
      InternetGatewayId: !Ref 'InternetGateway'
      VpcId: !Ref 'KionVPC'
    Type: AWS::EC2::VPCGatewayAttachment
  KionNat0:
    Properties:
      AllocationId: !GetAtt 'KionNatEip0.AllocationId'
      SubnetId: !Ref 'PublicSubnet0'
      Tags:
        - Key: Name
          Value: Kion NAT 0
    Type: AWS::EC2::NatGateway
  KionNat1:
    Properties:
      AllocationId: !GetAtt 'KionNatEip1.AllocationId'
      SubnetId: !Ref 'PublicSubnet1'
      Tags:
        - Key: Name
          Value: Kion NAT 1
    Type: AWS::EC2::NatGateway
  KionNat2:
    Properties:
      AllocationId: !GetAtt 'KionNatEip2.AllocationId'
      SubnetId: !Ref 'PublicSubnet2'
      Tags:
        - Key: Name
          Value: Kion NAT 2
    Type: AWS::EC2::NatGateway
  KionNatEip0:
    Properties:
      Domain: vpc
    Type: AWS::EC2::EIP
  KionNatEip1:
    Properties:
      Domain: vpc
    Type: AWS::EC2::EIP
  KionNatEip2:
    Properties:
      Domain: vpc
    Type: AWS::EC2::EIP
  KionVPC:
    Properties:
      CidrBlock: !Ref 'paramsvpc'
      EnableDnsHostnames: 'true'
      EnableDnsSupport: 'true'
      Tags:
        - Key: Name
          Value: Kion VPC
    Type: AWS::EC2::VPC
  InternetGateway:
    Properties:
      Tags:
        - Key: Name
          Value: Kion IGW
    Type: AWS::EC2::InternetGateway
  PrivateDefaultRoute0:
    Properties:
      DestinationCidrBlock: '0.0.0.0/0'
      NatGatewayId: !Ref 'KionNat0'
      RouteTableId: !Ref 'PrivateRouteTable0'
    Type: AWS::EC2::Route
  PrivateDefaultRoute1:
    Properties:
      DestinationCidrBlock: '0.0.0.0/0'
      NatGatewayId: !Ref 'KionNat1'
      RouteTableId: !Ref 'PrivateRouteTable1'
    Type: AWS::EC2::Route
  PrivateDefaultRoute2:
    Properties:
      DestinationCidrBlock: '0.0.0.0/0'
      NatGatewayId: !Ref 'KionNat2'
      RouteTableId: !Ref 'PrivateRouteTable2'
    Type: AWS::EC2::Route
  PrivateInAclEntry0:
    Properties:
      CidrBlock: '0.0.0.0/0'
      NetworkAclId: !Ref 'PrivateNetworkAcl'
      Protocol: '-1'
      RuleAction: allow
      RuleNumber: '100'
    Type: AWS::EC2::NetworkAclEntry
  PrivateNetworkAcl:
    Properties:
      Tags:
        - Key: Name
          Value: Kion Private ACL
      VpcId: !Ref 'KionVPC'
    Type: AWS::EC2::NetworkAcl
  PrivateNetworkAclAssociation0:
    Properties:
      NetworkAclId: !Ref 'PrivateNetworkAcl'
      SubnetId: !Ref 'PrivateSubnet0'
    Type: AWS::EC2::SubnetNetworkAclAssociation
  PrivateNetworkAclAssociation1:
    Properties:
      NetworkAclId: !Ref 'PrivateNetworkAcl'
      SubnetId: !Ref 'PrivateSubnet1'
    Type: AWS::EC2::SubnetNetworkAclAssociation
  PrivateNetworkAclAssociation2:
    Properties:
      NetworkAclId: !Ref 'PrivateNetworkAcl'
      SubnetId: !Ref 'PrivateSubnet2'
    Type: AWS::EC2::SubnetNetworkAclAssociation
  PrivateOutAclEntry0:
    Properties:
      CidrBlock: '0.0.0.0/0'
      Egress: 'true'
      NetworkAclId: !Ref 'PrivateNetworkAcl'
      Protocol: '-1'
      RuleAction: allow
      RuleNumber: '100'
    Type: AWS::EC2::NetworkAclEntry
  PrivateRouteAssociation0:
    Properties:
      RouteTableId: !Ref 'PrivateRouteTable0'
      SubnetId: !Ref 'PrivateSubnet0'
    Type: AWS::EC2::SubnetRouteTableAssociation
  PrivateRouteAssociation1:
    Properties:
      RouteTableId: !Ref 'PrivateRouteTable1'
      SubnetId: !Ref 'PrivateSubnet1'
    Type: AWS::EC2::SubnetRouteTableAssociation
  PrivateRouteAssociation2:
    Properties:
      RouteTableId: !Ref 'PrivateRouteTable2'
      SubnetId: !Ref 'PrivateSubnet2'
    Type: AWS::EC2::SubnetRouteTableAssociation
  PrivateRouteTable0:
    Properties:
      Tags:
        - Key: Name
          Value: Kion Private RT 0
      VpcId: !Ref 'KionVPC'
    Type: AWS::EC2::RouteTable
  PrivateRouteTable1:
    Properties:
      Tags:
        - Key: Name
          Value: Kion Private RT 1
      VpcId: !Ref 'KionVPC'
    Type: AWS::EC2::RouteTable
  PrivateRouteTable2:
    Properties:
      Tags:
        - Key: Name
          Value: Kion Private RT 2
      VpcId: !Ref 'KionVPC'
    Type: AWS::EC2::RouteTable
  PrivateSecurityGroup0:
    Properties:
      GroupDescription: Private Security Group
      GroupName: Kion-default-private-sg
      SecurityGroupIngress: []
      Tags:
        - Key: Name
          Value: Kion Private SG
      VpcId: !Ref 'KionVPC'
    Type: AWS::EC2::SecurityGroup
  PrivateSubnet0:
    Properties:
      AvailabilityZone: !Select
        - '0'
        - !GetAZs ''
      CidrBlock: !Ref 'paramsprivateSubnet0'
      Tags:
        - Key: Name
          Value: Kion Private 0
        - Key: Zone
          Value: Private
      VpcId: !Ref 'KionVPC'
    Type: AWS::EC2::Subnet
  PrivateSubnet1:
    Properties:
      AvailabilityZone: !Select
        - '1'
        - !GetAZs ''
      CidrBlock: !Ref 'paramsprivateSubnet1'
      Tags:
        - Key: Name
          Value: Kion Private 1
        - Key: Zone
          Value: Private
      VpcId: !Ref 'KionVPC'
    Type: AWS::EC2::Subnet
  PrivateSubnet2:
    Properties:
      AvailabilityZone: !Select
        - '2'
        - !GetAZs ''
      CidrBlock: !Ref 'paramsprivateSubnet2'
      Tags:
        - Key: Name
          Value: Kion Private 2
        - Key: Zone
          Value: Private
      VpcId: !Ref 'KionVPC'
    Type: AWS::EC2::Subnet
  PublicDefaultRoute:
    DependsOn: AttachIGW
    Properties:
      DestinationCidrBlock: '0.0.0.0/0'
      GatewayId: !Ref 'InternetGateway'
      RouteTableId: !Ref 'PublicRouteTable'
    Type: AWS::EC2::Route
  PublicInAclEntry0:
    Properties:
      CidrBlock: '0.0.0.0/0'
      NetworkAclId: !Ref 'PublicNetworkAcl'
      Protocol: '-1'
      RuleAction: allow
      RuleNumber: '100'
    Type: AWS::EC2::NetworkAclEntry
  PublicNetworkAcl:
    Properties:
      Tags:
        - Key: Name
          Value: Kion Public ACL
      VpcId: !Ref 'KionVPC'
    Type: AWS::EC2::NetworkAcl
  PublicNetworkAclAssociation0:
    Properties:
      NetworkAclId: !Ref 'PublicNetworkAcl'
      SubnetId: !Ref 'PublicSubnet0'
    Type: AWS::EC2::SubnetNetworkAclAssociation
  PublicNetworkAclAssociation1:
    Properties:
      NetworkAclId: !Ref 'PublicNetworkAcl'
      SubnetId: !Ref 'PublicSubnet1'
    Type: AWS::EC2::SubnetNetworkAclAssociation
  PublicNetworkAclAssociation2:
    Properties:
      NetworkAclId: !Ref 'PublicNetworkAcl'
      SubnetId: !Ref 'PublicSubnet2'
    Type: AWS::EC2::SubnetNetworkAclAssociation
  PublicOutAclEntry0:
    Properties:
      CidrBlock: '0.0.0.0/0'
      Egress: 'true'
      NetworkAclId: !Ref 'PublicNetworkAcl'
      Protocol: '-1'
      RuleAction: allow
      RuleNumber: '100'
    Type: AWS::EC2::NetworkAclEntry
  PublicRouteAssociation0:
    Properties:
      RouteTableId: !Ref 'PublicRouteTable'
      SubnetId: !Ref 'PublicSubnet0'
    Type: AWS::EC2::SubnetRouteTableAssociation
  PublicRouteAssociation1:
    Properties:
      RouteTableId: !Ref 'PublicRouteTable'
      SubnetId: !Ref 'PublicSubnet1'
    Type: AWS::EC2::SubnetRouteTableAssociation
  PublicRouteAssociation2:
    Properties:
      RouteTableId: !Ref 'PublicRouteTable'
      SubnetId: !Ref 'PublicSubnet2'
    Type: AWS::EC2::SubnetRouteTableAssociation
  PublicRouteTable:
    Properties:
      Tags:
        - Key: Name
          Value: Kion Public RT
      VpcId: !Ref 'KionVPC'
    Type: AWS::EC2::RouteTable
  PublicSubnet0:
    Properties:
      AvailabilityZone: !Select
        - '0'
        - !GetAZs ''
      CidrBlock: !Ref 'paramspublicSubnet0'
      MapPublicIpOnLaunch: 'true'
      Tags:
        - Key: Name
          Value: Kion Public 0
        - Key: Zone
          Value: Public
      VpcId: !Ref 'KionVPC'
    Type: AWS::EC2::Subnet
  PublicSubnet1:
    Properties:
      AvailabilityZone: !Select
        - '1'
        - !GetAZs ''
      CidrBlock: !Ref 'paramspublicSubnet1'
      MapPublicIpOnLaunch: 'true'
      Tags:
        - Key: Name
          Value: Kion Public 1
        - Key: Zone
          Value: Public
      VpcId: !Ref 'KionVPC'
    Type: AWS::EC2::Subnet
  PublicSubnet2:
    Properties:
      AvailabilityZone: !Select
        - '2'
        - !GetAZs ''
      CidrBlock: !Ref 'paramspublicSubnet2'
      MapPublicIpOnLaunch: 'true'
      Tags:
        - Key: Name
          Value: Kion Public 2
        - Key: Zone
          Value: Public
      VpcId: !Ref 'KionVPC'
    Type: AWS::EC2::Subnet
  S3VPCEndpoint:
    Properties:
      PolicyDocument:
        Statement:
          - Action:
              - '*'
            Effect: Allow
            Principal: '*'
            Resource:
              - '*'
        Version: '2012-10-17'
      RouteTableIds:
        - !Ref 'PrivateRouteTable0'
        - !Ref 'PrivateRouteTable1'
        - !Ref 'PrivateRouteTable2'
        - !Ref 'PublicRouteTable'
      ServiceName: !Join
        - ''
        - - com.amazonaws.
          - !Ref 'AWS::Region'
          - .s3
      VpcId: !Ref 'KionVPC'
    Type: AWS::EC2::VPCEndpoint
  privateToSelfRule:
    Properties:
      GroupId: !Ref 'PrivateSecurityGroup0'
      IpProtocol: '-1'
      SourceSecurityGroupId: !Ref 'PrivateSecurityGroup0'
    Type: AWS::EC2::SecurityGroupIngress
