AWSTemplateFormatVersion: '2010-09-09'

Description: TGW HandsOn VPC for Part2

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "EC2 KeyPair"
        Parameters:
          - KeyName
      - Label:
          default: "VPC CIDR for VPC3"
        Parameters:
          - VpcCidr1
      - Label:
          default: "Subnet CIDR for VPC3"
        Parameters:
          - VPC1PrvSubCidr1
          
Parameters:
  KeyName:
    Description: Name of an existing EC2 KeyPair to enable SSH access to the instance
    Type: 'AWS::EC2::KeyPair::KeyName'

  VpcCidr1:
    Description: CIDR Block for the VPC3
    Type: String
    MinLength: 9
    MaxLength: 18
    Default: 10.1.3.0/24
    AllowedPattern: "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
    ConstraintDescription: Must be like 10.1.0.0/16

  VPC1PrvSubCidr1:
    Description: CIDR Block for VPC3 private subnet 1
    Type: String
    MinLength: 9
    MaxLength: 18
    Default: 10.1.3.0/26
    AllowedPattern: "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
    ConstraintDescription: Must be like 10.1.1.0/24

Resources:
#
# VPC3
#
  VPC1:
    Type: 'AWS::EC2::VPC'
    Properties:
      CidrBlock: !Ref VpcCidr1
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: VPC-3

  VPC1PrvSub1:
    Type: 'AWS::EC2::Subnet'
    Properties:
      VpcId: !Ref VPC1
      CidrBlock: !Ref VPC1PrvSubCidr1
      AvailabilityZone: ap-northeast-1a
      Tags:
        - Key: Name
          Value: VPC3PrvSub1

  VPC1PrivateRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC1
      Tags:
        - Key: Name
          Value: VPC3 Private RouteTable

  VPC1PrvSub1Assoc:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref VPC1PrvSub1
      RouteTableId: !Ref VPC1PrivateRouteTable

  SGApplication1:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: SG-Application-3
      GroupName: SG-Application-3
      VpcId: !Ref VPC1

  SGApplication1In1:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref SGApplication1
      IpProtocol: "-1"
      CidrIp: 10.0.0.0/8

  SGApplication1In2:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref SGApplication1
      IpProtocol: "-1"
      SourceSecurityGroupId: !Ref SGApplication1

  SGApplication1In3:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref SGApplication1
      IpProtocol: "-1"
      SourceSecurityGroupId: !Ref SGVPCEndpoint1

  SGVPCEndpoint1:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: SG-Endpoint-3
      GroupName: SG-Endpoint-3
      VpcId: !Ref VPC1

  SGVPCEndpoint1In1:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref SGVPCEndpoint1
      IpProtocol: "-1"
      SourceSecurityGroupId: !Ref SGVPCEndpoint1

  SGVPCEndpoint1In2:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref SGVPCEndpoint1
      IpProtocol: "-1"
      SourceSecurityGroupId: !Ref SGApplication1

  IAMR3XJT62:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM'
      Path: /

  ApplicationServer1:
    Type: 'AWS::EC2::Instance'
    Properties:
      ImageId: ami-0c3fd0f5d33134a76
      InstanceType: t2.micro
      KeyName: !Ref KeyName
      Tags:
        - Key: Name
          Value: Application Server3
      NetworkInterfaces:
        - DeviceIndex: '0'
          SubnetId: !Ref VPC1PrvSub1
          GroupSet:
            - !Ref SGApplication1
      IamInstanceProfile: !Ref IAMIP3UK0E3
      UserData:
          Fn::Base64: |
            #!/bin/bash
            yum update -y
            yum install -y httpd
            sudo systemctl start httpd
    DependsOn:
      - IAMR3XJT62

  IAMIP3UK0E3:
    Type: 'AWS::IAM::InstanceProfile'
    Properties:
      Path: /
      Roles:
        - !Ref IAMR3XJT62

  SSMEndpoint1:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      ServiceName: !Join
        - ''
        - - com.amazonaws.
          - !Ref 'AWS::Region'
          - .ssm
      SubnetIds:
        - !Ref VPC1PrvSub1
      VpcId: !Ref VPC1
      VpcEndpointType: Interface
      SecurityGroupIds:
        - !Ref SGVPCEndpoint1
      PrivateDnsEnabled: true

  EC2MessageEndpoint1:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      ServiceName: !Sub "com.amazonaws.${AWS::Region}.ec2messages"
      VpcEndpointType: Interface
      PrivateDnsEnabled: true
      VpcId: !Ref VPC1
      SubnetIds:
        - !Ref VPC1PrvSub1
      SecurityGroupIds:
        - !Ref SGVPCEndpoint1

  SSMAgentEndpoint1:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      ServiceName: !Sub "com.amazonaws.${AWS::Region}.ssmmessages"
      VpcEndpointType: Interface
      PrivateDnsEnabled: true
      VpcId: !Ref VPC1
      SubnetIds:
        - !Ref VPC1PrvSub1
      SecurityGroupIds:
        - !Ref SGVPCEndpoint1