AWSTemplateFormatVersion: '2010-09-09'

Description: TGW HandsOn VPC for Onpremises

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "EC2 KeyPair"
        Parameters:
          - KeyName
      - Label:
          default: "VPC CIDR for VPC-Ompremises"
        Parameters:
          - VpcCidr1
      - Label:
          default: "Subnet CIDR for Subnet-Ompremises"
        Parameters:
          - Subnet1Cidr
          - Subnet2Cidr
          
Parameters:
  KeyName:
    Description: Name of an existing EC2 KeyPair to enable SSH access to the instance
    Type: 'AWS::EC2::KeyPair::KeyName'

  VpcCidr1:
    Description: CIDR Block
    Type: String
    MinLength: 9
    MaxLength: 18
    Default: 192.168.0.0/16
    AllowedPattern: "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
    ConstraintDescription: Must be like 192.168.0.0/16

  Subnet1Cidr:
    Description: CIDR Block for SUBNETONPREMISES1
    Type: String
    MinLength: 9
    MaxLength: 18
    Default: 192.168.0.0/24
    AllowedPattern: "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
    ConstraintDescription: Must be like 192.168.0.0/24

  Subnet2Cidr:
    Description: CIDR Block for SUBNETONPREMISES2
    Type: String
    MinLength: 9
    MaxLength: 18
    Default: 192.168.1.0/24
    AllowedPattern: "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
    ConstraintDescription: Must be like 192.168.0.0/24

Resources:
#
# VPC-Ompremises
#
  VPCONPREMISES:
    Type: 'AWS::EC2::VPC'
    Properties:
      CidrBlock: !Ref VpcCidr1
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: VPC-Onpremises

  SUBNETONPREMISES2:
    Type: 'AWS::EC2::Subnet'
    Properties:
      VpcId: !Ref VPCONPREMISES
      CidrBlock: !Ref Subnet2Cidr
      AvailabilityZone: us-east-1a
      Tags:
        - Key: Name
          Value: Subnet-Onpremises-2

  SUBNETONPREMISES2RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPCONPREMISES
      Tags:
        - Key: Name
          Value: RTB-Onpremises-2

  SUBNETONPREMISES2Assoc:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref SUBNETONPREMISES2
      RouteTableId: !Ref SUBNETONPREMISES2RouteTable

  SGONPREMISES1:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: SG-Onpremises-1
      GroupName: SG-Onpremises-1
      SecurityGroupIngress:
        - CidrIp: 0.0.0.0/0
          IpProtocol: '-1'
      VpcId: !Ref VPCONPREMISES
      
  SUBNETONPREMISES1:
    Type: 'AWS::EC2::Subnet'
    Properties:
      CidrBlock: !Ref Subnet1Cidr
      AvailabilityZone: us-east-1a
      Tags:
        - Key: Name
          Value: Subnet-Onpremises-1
      VpcId: !Ref VPCONPREMISES

  SUBNETONPREMISES1RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPCONPREMISES
      Tags:
        - Key: Name
          Value: RTB-Onpremises-1

  SUBNETONPREMISES1Assoc:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref SUBNETONPREMISES1
      RouteTableId: !Ref SUBNETONPREMISES1RouteTable

  SGONPREMISES2:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: SG-Onpremises-2
      GroupName: SG-Onpremises-2
      SecurityGroupIngress:
        - CidrIp: 0.0.0.0/0
          IpProtocol: '-1'
      VpcId: !Ref VPCONPREMISES

  IGWONPREMISES:
    Type: 'AWS::EC2::InternetGateway'
    Properties:
      Tags:
        - Key: Name
          Value: IGW-Onpremises

  AttachGateway:
    Type: 'AWS::EC2::VPCGatewayAttachment'
    Properties:
      VpcId: !Ref VPCONPREMISES
      InternetGatewayId: !Ref IGWONPREMISES

  NATGWONPREMISES:
    Type: 'AWS::EC2::NatGateway'
    Properties:
      SubnetId: !Ref SUBNETONPREMISES1
      AllocationId: !GetAtt 
        - EC2EIP1FSCG
        - AllocationId
      Tags:
        - Key: Name
          Value: NATGW-Onpremises
    DependsOn: IGWONPREMISES

  EC2EIP1FSCG:
    Type: 'AWS::EC2::EIP'
    Properties:
      Domain: vpc

  EC2EIP4AIEU:
    Type: 'AWS::EC2::EIP'
    Properties:
      Domain: vpc

  IAMR3XJT64:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM'
      Path: /

  IAMIP3UK0E5:
    Type: 'AWS::IAM::InstanceProfile'
    Properties:
      Path: /
      Roles:
        - !Ref IAMR3XJT64

  onpVyOS:
    Type: 'AWS::EC2::Instance'
    Properties:
      ImageId: ami-11cc316c
      InstanceType: t2.micro
      KeyName: !Ref KeyName
      SourceDestCheck: false
      Tags:
        - Key: Name
          Value: onp VyOS 1.1.8
      SecurityGroupIds:
        - !Ref SGONPREMISES1
      SubnetId: !Ref SUBNETONPREMISES1
      IamInstanceProfile: !Ref IAMIP3UK0E5
    DependsOn:
      - IAMR3XJT64

  ElasticIPAssociate:
    Type: 'AWS::EC2::EIPAssociation'
    Properties:
      AllocationId: !GetAtt 
        - EC2EIP4AIEU
        - AllocationId
      InstanceId: !Ref onpVyOS

  onpClient:
    Type: 'AWS::EC2::Instance'
    Properties:
      ImageId: ami-0b898040803850657
      InstanceType: t2.micro
      KeyName: !Ref KeyName
      Tags:
        - Key: Name
          Value: onp Client
      SecurityGroupIds:
        - !Ref SGONPREMISES2
      SubnetId: !Ref SUBNETONPREMISES2
      IamInstanceProfile: !Ref IAMIP3UK0E5
      UserData:
        Fn::Base64: |
            #!/bin/bash
            yum update -y
            yum install -y httpd
            sudo systemctl start httpd

Outputs:
  onpVyOSIPaddress:
    Description: IP address of onpVyOS
    Value: !Ref EC2EIP4AIEU