snort_base.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: Pipeline Automation Template

Parameters:

  GitHubOwner:
    Type: String
    Default: filipeandre
    AllowedPattern: "[A-Za-z0-9-]+"
  GitHubRepo:
    Type: String
    Default: aws-gateway-load-balancer-snort3-ips-ids
    AllowedPattern: "[A-Za-z0-9-]+"
  GitHubBranch:
    Type: String
    Default: main
    AllowedPattern: "[A-Za-z0-9-]+"
  VpcName:
    Default: ips-service-vpc
    Description: Logical name for the filtration and unspection VPC
    Type: String
  VpcCidr:
    AllowedPattern: "^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\\/(1[6-9]|2[0-8]))$"
    Default: 192.168.1.0/25
    Description: CIDR block for the VPC
    Type: String
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/y
  PublicSubnet1Cidr:
    AllowedPattern: "^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\\/(1[6-9]|2[0-8]))$"
    Default: 192.168.1.0/28
    Description: CIDR block for the Public Subnet 1 located in AZ 1
    Type: String
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
  PublicSubnet2Cidr:
    AllowedPattern: "^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\\/(1[6-9]|2[0-8]))$"
    Default: 192.168.1.16/28
    Description: CIDR block for the Public Subnet 2 located in AZ 2
    Type: String
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
  PublicSubnet3Cidr:
    AllowedPattern: "^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\\/(1[6-9]|2[0-8]))$"
    Default: 192.168.1.32/28
    Description: CIDR block for the Public Subnet 3 located in AZ 3
    Type: String
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
  PrivateSubnet1Cidr:
    AllowedPattern: "^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\\/(1[6-9]|2[0-8]))$"
    Default: 192.168.1.48/28
    Description: CIDR block for the Private Subnet 1 located in AZ 1
    Type: String
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
  PrivateSubnet2Cidr:
    AllowedPattern: "^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\\/(1[6-9]|2[0-8]))$"
    Default: 192.168.1.64/28
    Description: CIDR block for the Private Subnet 2 located in AZ 2
    Type: String
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
  PrivateSubnet3Cidr:
    AllowedPattern: "^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\\/(1[6-9]|2[0-8]))$"
    Default: 192.168.1.80/28
    Description: CIDR block for the Private Subnet 3 located in AZ 3
    Type: String
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
  PipelineActions:
    Description: > 
      If CodePipeline actions are going to be ran in Parallel or in sequence. 
      Parallel is faster but in some special cases, such as using an AWS account provided by AWS for an workshop (Event Engine AWS Account) - CodePipeline might have limits on how many concurrent CodeBuild actions that can be ran in parallel.
      In those cases, change the value to 'sequence'.
    Default: parallel
    AllowedValues:
      - parallel
      - sequence
    Type: String
  Oinkcode:
    Description: >
      Oinkcodes are unique keys associated to your snort3 user account. The oinkcode acts as an api key for downloading rule packages. Please enter your unique oinkcode from your snort.org user account
    NoEcho: true
    Type: String
  HOMENET:
    Description: >
      Enter the CIDR range of the network you would like to protect. For example, to protect egress traffic from a VPC with CIDR, 10.0.0.0/16, enter 10.0.0.0/16
    Type: String
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
    Default: 10.0.0.0/16


Conditions:
  PipelineActionParallel:
    Fn::Equals: [!Ref PipelineActions, parallel]

Resources:
  # Pipeline #

  SnortEcrRepo:
    Type: AWS::ECR::Repository
    DeletionPolicy: Retain

  SnortBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    Properties: 
      BucketName: !Sub 
        - snort-cicd-${AWS::Region}-${AWS::AccountId}-${RandomizedValue}
        - RandomizedValue:
            Fn::Select: [0, Fn::Split: [-, Fn::Select: [2, Fn::Split: [/, !Ref AWS::StackId ]]]] # Takes the first part of the random GUID in the cloudformation stacks arn.
      AccessControl: Private
  

  CPipelineCloudFormationRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - cloudformation.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: cfnRolePolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              -
                Effect: Allow
                Action: '*'
                Resource: '*'

  CPipelineServiceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal: 
                Service: 
                  - codepipeline.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Policies:
        - PolicyName: CodePipelineRolePolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
                - Sid: CodeStarConnectionPolicy
                  Effect: Allow
                  Action:
                    - 'codestar-connections:UseConnection'
                  Resource: !Ref CodeStarConnection
                - Effect: Allow
                  Action:
                    - codebuild:StartBuild
                    - codebuild:BatchGetBuilds
                  Resource: 
                    - !GetAtt SnortBuildProject.Arn
                - Effect: Allow
                  Action:
                    - cloudformation:CreateStack
                    - cloudformation:DeleteStack
                    - cloudformation:DescribeStacks
                    - cloudformation:UpdateStack
                    - cloudformation:CreateChangeSet
                    - cloudformation:DeleteChangeSet
                    - cloudformation:DescribeChangeSet
                    - cloudformation:ExecuteChangeSet
                    - cloudformation:SetStackPolicy
                    - cloudformation:ValidateTemplate
                  Resource: "*"
                - Effect: Allow
                  Action:
                    - iam:PassRole
                  Resource:
                    - !GetAtt CPipelineCloudFormationRole.Arn
                - Effect: Allow
                  Action:
                    - s3:*
                  Resource: 
                    - !Sub ${SnortBucket.Arn}
                    - !Sub ${SnortBucket.Arn}/*

  CPipelineCodeBuildRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - codebuild.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: CodebuildRolePolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: '*'
              - Effect: Allow
                Action:
                  - ecr:PutImage
                  - ecr:PutImageTagMutability
                  - ecr:InitiateLayerUpload
                  - ecr:UploadLayerPart
                  - ecr:CompleteLayerUpload
                  - ecr:BatchCheckLayerAvailability
                  - ecr:GetAuthorizationToken
                  - ecr:BatchGetImage 
                  - ecr:GetDownloadUrlForLayer
                Resource:
                  - !Sub ${SnortEcrRepo.Arn}
              - Effect: Allow
                Action:
                  - ecr:GetAuthorizationToken
                Resource: '*'
              - Effect: Allow
                Action:
                  - ssm:GetParameter*
                  - ssm:PutParameter
                Resource: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${AWS::StackName}/codebuild/*
              - Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:GetObjectVersion
                  - s3:GetBucketAcl
                  - s3:GetBucketLocation
                Resource:
                  - !Sub ${SnortBucket.Arn}
                  - !Sub ${SnortBucket.Arn}/*


  SnortImageUriParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /${AWS::StackName}/codebuild/container/snort/uri
      Type:  String
      Value: " "
  
  SnortMd5sumParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /${AWS::StackName}/codebuild/container/snort/md5sum
      Type:  String
      Value: " "

  SnortBuildProject:
    Type: AWS::CodeBuild::Project
    Properties: 
      Artifacts: 
        Type: CODEPIPELINE
      Environment: 
#        Type: ARM_CONTAINER
#        Image: aws/codebuild/amazonlinux2-aarch64-standard:2.0
        Type: LINUX_CONTAINER
        Image: aws/codebuild/amazonlinux2-x86_64-standard:4.0
        ComputeType: BUILD_GENERAL1_LARGE
        PrivilegedMode: true
        ImagePullCredentialsType: CODEBUILD
        EnvironmentVariables:
          - Name: AWS_REGION
            Type: PLAINTEXT
            Value: !Ref AWS::Region
          - Name: MD5SUM_SSM_PARAMETER
            Type: PLAINTEXT
            Value: !Sub /${AWS::StackName}/codebuild/container/snort/md5sum
          - Name: CONTAINERURI_SSM_PARAMETER
            Type: PLAINTEXT
            Value: !Sub /${AWS::StackName}/codebuild/container/snort/uri
          - Name: AWS_ACCOUNT_ID
            Type: PLAINTEXT
            Value: !Ref AWS::AccountId
          - Name: IMAGE_REPO_NAME
            Type: PLAINTEXT
            Value: !Sub ${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${SnortEcrRepo}
      LogsConfig: 
        CloudWatchLogs:
          Status: ENABLED
          GroupName: codebuild
      ServiceRole: !GetAtt CPipelineCodeBuildRole.Arn
      Source: 
        Type: CODEPIPELINE
        BuildSpec: Dockerfiles/snort/buildspec.yml

  CodeStarConnection:
    Type: 'AWS::CodeStarConnections::Connection'
    Properties:
      ConnectionName: FilipeGitHubConnection
      ProviderType: GitHub

  CPipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties: 
      ArtifactStore: 
        Type: S3 
        Location: !Ref SnortBucket
      Name: !Sub ${AWS::StackName}-pipeline
      RoleArn: !GetAtt CPipelineServiceRole.Arn
      Stages:
      - Name: SourceStage
        Actions:
          - Name: Source
            ActionTypeId:
              Category: Source
              Owner: AWS
              Version: 1
              Provider: CodeStarSourceConnection
            OutputArtifacts:
              - Name: SourceArtifact
            Configuration:
              ConnectionArn: !Ref CodeStarConnection
              BranchName: !Ref GitHubBranch
              FullRepositoryId: !Sub ${GitHubOwner}/${GitHubRepo}
            RunOrder: 1
      - Name: BuildStage
        Actions:
          - Name: Snort
            ActionTypeId:
              Category: Build
              Owner: AWS
              Provider: CodeBuild
              Version: '1'
            Configuration:
              ProjectName: !Ref SnortBuildProject
            InputArtifacts:
              - Name: SourceArtifact
            Namespace: SnortBuild
            RunOrder: !If [PipelineActionParallel, 1, 2]
          - Name: CopyToS3
            ActionTypeId:
              Category: Deploy
              Owner: AWS
              Provider: S3
              Version: '1'
            InputArtifacts:
              - Name: SourceArtifact
            Configuration:
              BucketName: !Ref SnortBucket
              Extract: true
              ObjectKey: deployment
            RunOrder: !If [PipelineActionParallel, 1, 1]
      - Name: DeployApplicationStage
        Actions:
          - Name: CreateChangeSet
            ActionTypeId:
              Category: Deploy
              Owner: AWS
              Provider: CloudFormation
              Version: '1'
            InputArtifacts:
              - Name: SourceArtifact
            Configuration:
              ActionMode: CHANGE_SET_REPLACE
              Capabilities: CAPABILITY_IAM
              RoleArn: !GetAtt CPipelineCloudFormationRole.Arn
              StackName: !Sub ${AWS::StackName}-Snort-cluster
              ChangeSetName: !Sub ${AWS::StackName}-Snort-cluster-cset
              TemplatePath: SourceArtifact::cloudformation/Snort/cluster.yaml
              TemplateConfiguration: SourceArtifact::cloudformation/Snort/cluster-template-configuration.json
              ParameterOverrides: !Sub |
                {
                  "VpcId": "${VPC}",
                  "VpcCidr": "${VpcCidr}",
                  "PrivateSubnet1": "${PrivateSubnet1}",
                  "PrivateSubnet2": "${PrivateSubnet2}",
                  "PrivateSubnet3": "${PrivateSubnet3}",
                  "SnortImage": "#{SnortBuild.image}",
                  "Oinkcode": "${Oinkcode}",
                  "HOMENET": "${HOMENET}"
                }
            RunOrder: 1
          - Name: ExecuteChangeSet
            ActionTypeId:
              Category: Deploy
              Owner: AWS
              Provider: CloudFormation
              Version: '1'
            Configuration:
              ActionMode: CHANGE_SET_EXECUTE
              ChangeSetName: !Sub ${AWS::StackName}-Snort-cluster-cset
              RoleArn: !GetAtt CPipelineCloudFormationRole.Arn
              StackName: !Sub ${AWS::StackName}-Snort-cluster
            RunOrder: 2

  CPipelineCloudWatchEventRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Version: 2012-10-17
          Statement:
            -
              Effect: Allow
              Principal:
                Service:
                  - events.amazonaws.com
              Action: sts:AssumeRole
        Path: /
        Policies:
          - PolicyName: CWEvenetRolePolicy
            PolicyDocument:
              Version: 2012-10-17
              Statement:
                -
                  Effect: Allow
                  Action: codepipeline:StartPipelineExecution
                  Resource: !Sub arn:aws:codepipeline:${AWS::Region}:${AWS::AccountId}:${AWS::StackName}-pipeline

  CPipelineCloudWatchEventRule:
    Type: AWS::Events::Rule
    Properties:
      EventPattern:
        source:
          - aws.codecommit
        detail-type:
          - 'CodeCommit Repository State Change'
        resources:
          - !Sub arn:aws:codecommit:${AWS::Region}:${AWS::AccountId}:${AWS::StackName}-repository
        detail:
          event:
            - referenceCreated
            - referenceUpdated
          referenceType:
            - branch
          referenceName:
            - main
      Targets:
        - Arn: !Sub arn:aws:codepipeline:${AWS::Region}:${AWS::AccountId}:${AWS::StackName}-pipeline
          RoleArn: !GetAtt CPipelineCloudWatchEventRole.Arn
          Id: codepipeline-AppPipeline

  # Network #

  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCidr
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: "Name"
          Value:  !Ref VpcName

  InternetGateway:
    Type: AWS::EC2::InternetGateway

  InternetGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  # Public Subnets
  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: !Ref PublicSubnet1Cidr
      AvailabilityZone: !Select [0, Fn::GetAZs: !Ref 'AWS::Region']
      VpcId: !Ref VPC
      MapPublicIpOnLaunch: true

  PublicSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: !Ref PublicSubnet2Cidr
      AvailabilityZone: !Select [1, Fn::GetAZs: !Ref 'AWS::Region']
      VpcId: !Ref VPC
      MapPublicIpOnLaunch: true

  PublicSubnet3:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: !Ref PublicSubnet3Cidr
      AvailabilityZone: !Select [2, Fn::GetAZs: !Ref 'AWS::Region']
      VpcId: !Ref VPC
      MapPublicIpOnLaunch: true

  PublicSubnetRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC

  PublicSubnetDefaultIPv4Route:
    Type: AWS::EC2::Route
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      RouteTableId: !Ref PublicSubnetRouteTable
      GatewayId: !Ref InternetGateway

  PublicSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicSubnetRouteTable
      SubnetId: !Ref PublicSubnet1

  PublicSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicSubnetRouteTable
      SubnetId: !Ref PublicSubnet2

  PublicSubnet3RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicSubnetRouteTable
      SubnetId: !Ref PublicSubnet3

  # NAT

  NatGwPublicSubnet1:
    Type: AWS::EC2::NatGateway
    Properties:
        AllocationId: !Sub ${NatGwPublicSubnet1EIP.AllocationId}
        SubnetId: !Ref PublicSubnet1

  NatGwPublicSubnet1EIP:
    Type: AWS::EC2::EIP
    Properties:
        Domain: vpc

  NatGwPublicSubnet2:
    Type: AWS::EC2::NatGateway
    Properties:
        AllocationId: !Sub ${NatGwPublicSubnet2EIP.AllocationId}
        SubnetId: !Ref PublicSubnet2

  NatGwPublicSubnet2EIP:
    Type: AWS::EC2::EIP
    Properties:
        Domain: vpc

  NatGwPublicSubnet3:
    Type: AWS::EC2::NatGateway
    Properties:
        AllocationId: !Sub ${NatGwPublicSubnet3EIP.AllocationId}
        SubnetId: !Ref PublicSubnet3

  NatGwPublicSubnet3EIP:
    Type: AWS::EC2::EIP
    Properties:
        Domain: vpc

  # Private Subnets

  PrivateSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: !Ref PrivateSubnet1Cidr
      AvailabilityZone: !Select [0, Fn::GetAZs: !Ref 'AWS::Region']
      VpcId: !Ref VPC
      MapPublicIpOnLaunch: false

  PrivateSubnet1RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC

  PrivateSubnet1DefaultIPv4Route:
    Type: AWS::EC2::Route
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      RouteTableId: !Ref PrivateSubnet1RouteTable
      NatGatewayId: !Ref NatGwPublicSubnet1

  PrivateSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateSubnet1RouteTable
      SubnetId: !Ref PrivateSubnet1

  PrivateSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: !Ref PrivateSubnet2Cidr
      AvailabilityZone: !Select [1, Fn::GetAZs: !Ref 'AWS::Region']
      VpcId: !Ref VPC
      MapPublicIpOnLaunch: false

  PrivateSubnet2RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC

  PrivateSubnet2DefaultIPv4Route:
    Type: AWS::EC2::Route
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      RouteTableId: !Ref PrivateSubnet2RouteTable
      NatGatewayId: !Ref NatGwPublicSubnet2

  PrivateSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateSubnet2RouteTable
      SubnetId: !Ref PrivateSubnet2

  PrivateSubnet3:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: !Ref PrivateSubnet3Cidr
      AvailabilityZone: !Select [2, Fn::GetAZs: !Ref 'AWS::Region']
      VpcId: !Ref VPC
      MapPublicIpOnLaunch: false

  PrivateSubnet3RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC

  PrivateSubnet3DefaultIPv4Route:
    Type: AWS::EC2::Route
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      RouteTableId: !Ref PrivateSubnet3RouteTable
      NatGatewayId: !Ref NatGwPublicSubnet3

  PrivateSubnet3RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateSubnet3RouteTable
      SubnetId: !Ref PrivateSubnet3