chef-compliance.json

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Lab Chef Compliance Webapp Server by Levon Becker v20160502-0830",
  "Parameters": {
    "Ec2KeyPair": {
      "Description": "Select Keypair to Assign to Chef Compliance EC2 Instance.",
      "Type": "AWS::EC2::KeyPair::KeyName"
    },
    "Owner": {
      "Description": "Enter Team or Individual Name Responsible for the Stack.",
      "Type": "String",
      "Default": "FirstName LastName"
    },
    "Project": {
      "Description": "Enter Project Name.",
      "Type": "String",
      "Default": "Chef Compliance Webapp Server"
    },
    "DeleteAfter": {
      "Description": "Enter Date It's Ok to Delete the Stack or 'Never' if meant to be persistent.",
      "Type": "String",
      "Default": "00/00/201x"
    },
    "VPC": {
      "Description": "Select VPC.",
      "Type": "AWS::EC2::VPC::Id"
    },
    "PublicSubnet": {
      "Description": "Public Subnet to Deploy Chef Compliance Instance.",
      "Type": "AWS::EC2::Subnet::Id"
    },
    "InternalAccessSecurityGroup": {
      "Description": "Security Group That Allows Chef Compliance Host Access to Instances.",
      "Type": "AWS::EC2::SecurityGroup::Id"
    },
    "RemoteSecurityGroup": {
      "Description": "Remote Network or IP that can Access the instances of VPN or Direct Connect.",
      "Type": "AWS::EC2::SecurityGroup::Id"
    }
  },
  "Mappings": {
    "RegionMap": {
      "us-west-2": {
        "ChefComplianceVersion": "0.15.13-1",
        "AMIChefCompliance": "ami-9ebb55fe",
        "InstanceTypeChefCompliance": "t2.medium"
      },
      "us-east-1": {
        "ChefComplianceVersion": "0.15.13-1",
        "AMIChefCompliance": "ami-a83b3fc2",
        "InstanceTypeChefCompliance": "t2.medium"
      }
    },
    "bootstrap": {
      "rhel": {
        "warmebs": "echo 'ACTION: Performing EBS Warming' && dd if=/dev/xvda of=/dev/xvda conv=notrunc bs=1M status=progress",
        "installpackages": "yum install -y curl wget mlocate ca-certificates openssl vim",
        "updatechefcompliance": "echo 'ACTION: Upgrading Chef Marketplace to the Latest' && chef-marketplace-ctl upgrade -y && chef-compliance-ctl restart"
      }
    }
  },
  "Resources": {
    "IamRole": {
      "Type"  : "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [{"Effect": "Allow", "Principal": {"Service": ["ec2.amazonaws.com"]}, "Action": ["sts:AssumeRole"]}]
        },
        "Path": "/"
      }
    },
    "IamPolicies": {
      "Type": "AWS::IAM::Policy",
      "Properties": {
        "PolicyName": {"Fn::Join": ["", [{"Ref": "AWS::StackName"}, "-instance-policy"]]},
        "PolicyDocument": {
          "Statement": [{
            "Effect": "Allow",
            "Action": [
              "s3:*",
              "ec2:Describe*",
              "elasticloadbalancing:Describe*",
              "autoscaling:Describe*",
              "cloudwatch:*",
              "logs:*",
              "sns:*"
            ],
            "Resource": "*"
          }]
        },
        "Roles": [{"Ref": "IamRole"}]
      }
    },
    "IamInstanceProfile": {
      "Type": "AWS::IAM::InstanceProfile",
      "Properties": {
        "Path": "/",
        "Roles": [{"Ref": "IamRole"}]
      }
    },
    "InternetToChefComplianceServerSecurityGroup": {
      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "GroupDescription": "Internet to Chef Compliance Server Access",
        "VpcId": {"Ref": "VPC"},
        "Tags": [
          {
            "Key": "Name",
            "Value": {"Fn::Join": ["", [{"Ref": "AWS::StackName"}, "-internet-to-chefcompliance"]]}
          },
          {
            "Key": "Owner",
            "Value": {"Ref": "Owner"}
          },
          {
            "Key": "Project",
            "Value": {"Ref": "Project"}
          }
        ],
        "SecurityGroupIngress": [
          {
            "IpProtocol": "tcp",
            "FromPort": "80",
            "ToPort": "80",
            "CidrIp": "0.0.0.0/0"
          },
          {
            "IpProtocol": "tcp",
            "FromPort": "443",
            "ToPort": "443",
            "CidrIp": "0.0.0.0/0"
          },
          {
            "IpProtocol": "tcp",
            "FromPort": "8443",
            "ToPort": "8443",
            "CidrIp": "0.0.0.0/0"
          }
        ],
        "SecurityGroupEgress": [
          {
            "IpProtocol": "-1",
            "CidrIp": "0.0.0.0/0"
          }
        ]
      }
    },
    "EIP": {
      "Type": "AWS::EC2::EIP",
      "Properties": {
        "Domain" : "vpc"
      }
    },
    "EIPAssociation": {
      "Type": "AWS::EC2::EIPAssociation",
      "DependsOn": [
        "EC2Instance",
        "EIP"
      ],
      "Properties": {
        "InstanceId": {"Ref": "EC2Instance"},
        "AllocationId": { "Fn::GetAtt" : [ "EIP", "AllocationId" ]}
      }
    },
    "EC2Instance": {
      "DependsOn": [
        "InternetToChefComplianceServerSecurityGroup",
        "IamInstanceProfile"
      ],
      "Type": "AWS::EC2::Instance",
      "Properties": {
        "InstanceType": {
          "Fn::FindInMap": [
            "RegionMap",
            {"Ref": "AWS::Region"},
            "InstanceTypeChefCompliance"
          ]
        },
        "IamInstanceProfile": {"Ref": "IamInstanceProfile"},
        "ImageId": {
          "Fn::FindInMap": [
            "RegionMap",
            {"Ref": "AWS::Region"},
            "AMIChefCompliance"
          ]
        },
        "SecurityGroupIds": [
          {"Ref": "InternetToChefComplianceServerSecurityGroup"},
          {"Ref": "InternalAccessSecurityGroup"},
          {"Ref": "RemoteSecurityGroup"}
        ],
        "SubnetId": {"Ref": "PublicSubnet"},
        "KeyName": {"Ref": "Ec2KeyPair"},
        "BlockDeviceMappings": [
          {
            "DeviceName": "/dev/sda1",
            "Ebs": {
              "DeleteOnTermination": "true",
              "VolumeType": "gp2"
            }
          }
        ],
        "UserData": {
          "Fn::Base64": {
            "Fn::Join": [
              "", [
                "#!/bin/bash\n",
                {"Fn::FindInMap": ["bootstrap", "rhel", "warmebs"]},
                "\n",
                {"Fn::FindInMap": ["bootstrap", "rhel", "installpackages"]},
                "\n",
                {"Fn::FindInMap": ["bootstrap", "rhel", "updatechefcompliance"]},
                "\n",
                "echo sleeping and then running Chef Compliance Update again because it can error if upgrading the Chef Client and simply needs to be ran again.",
                "sleep 20s",
                "\n",
                {"Fn::FindInMap": ["bootstrap", "rhel", "updatechefcompliance"]},
                "\n"
              ]
            ]
          }
        },
        "Tags": [
          {
            "Key": "Name",
            "Value": {"Ref": "AWS::StackName"}
          },
          {
            "Key": "Owner",
            "Value": {"Ref": "Owner"}
          },
          {
            "Key": "Project",
            "Value": {"Ref": "Project"}
          },
          {
            "Key": "DeleteAfter",
            "Value": {"Ref": "DeleteAfter"}
          },
          {
            "Key": "ChefComplianceVersion",
            "Value": {
              "Fn::FindInMap": [
                "RegionMap",
                {"Ref": "AWS::Region"},
                "ChefComplianceVersion"
              ]
            }
          }
        ]
      }
    }
  },
  "Outputs": {
    "Owner": {
      "Description": "Team or Individual that Owns this Formation.",
      "Value": {"Ref": "Owner"}
    },
    "Project": {
      "Description": "The project name",
      "Value": {"Ref": "Project"}
    },
    "DeleteAfter": {
      "Description": "It is ok to delete the Formation after this date",
      "Value": {"Ref": "DeleteAfter"}
    },
    "PublicDNS": {
      "Description": "Chef Compliance Server Public DNS Name",
      "Value": {"Fn::GetAtt": ["EC2Instance", "PublicDnsName"]}
    },
    "EIP": {
      "Description": "External IP Address for Chef Compliance Webapp Server",
      "Value": {"Ref": "EIP"}
    },
    "KeyPairLoaded": {
      "Description": "Key Pair used.",
      "Value": {"Ref": "Ec2KeyPair"}
    },
    "VPC": {
      "Description": "VPC Used",
      "Value": {"Ref": "VPC"}
    },
    "IAMRole": {
      "Description": "IAM Instance Profile Role Created.",
      "Value": {"Ref": "IamRole"}
    },
    "DeployedToSubnet": {
      "Description": "Public Subnet the Bastion Host was Deployed on.",
      "Value": {"Ref": "PublicSubnet"}
    },
    "InternetToChefComplianceServerSecurityGroup": {
      "Description": "Internet to Chef Compliance Server Security Group",
      "Value": {"Ref": "InternetToChefComplianceServerSecurityGroup"}
    }
  },
  "Metadata" : {
    "AWS::CloudFormation::Interface" : {
      "ParameterGroups" : [
        {
          "Label" : { "default" : "Ownership" },
          "Parameters" : [ "Owner", "Project", "DeleteAfter" ]
        },
        {
          "Label" : { "default" : "Instance Settings" },
          "Parameters" : [
            "VPC",
            "Ec2KeyPair",
            "PublicSubnet",
            "InternalAccessSecurityGroup",
            "RemoteSecurityGroup"
          ]
        }
      ],
      "ParameterLabels" : {
        "Owner" : { "default" : "Team or Individual Owner" },
        "DeleteAfter" : { "default" : "Delete After Date" },
        "PublicSubnet" : { "default" : "Public Subnet" },
        "InternalAccessSecurityGroup" : { "default" : "Instance Access SG" },
        "Ec2KeyPair" : { "default" : "EC2 Access Keypair" }
      }
    }
  }
}