chef-compliance.yml

---
AWSTemplateFormatVersion: '2010-09-09'
Description: Lab Chef Compliance Webapp Server by Levon Becker v20160502-0830
Parameters:
  Ec2KeyPair:
    Description: Select Keypair to Assign to Chef Compliance EC2 Instance.
    Type: AWS::EC2::KeyPair::KeyName
  Owner:
    Description: Enter Team or Individual Name Responsible for the Stack.
    Type: String
    Default: FirstName LastName
  Project:
    Description: Enter Project Name.
    Type: String
    Default: Chef Compliance Webapp Server
  DeleteAfter:
    Description: Enter Date It's Ok to Delete the Stack or 'Never' if meant to be
      persistent.
    Type: String
    Default: 00/00/201x
  VPC:
    Description: Select VPC.
    Type: AWS::EC2::VPC::Id
  PublicSubnet:
    Description: Public Subnet to Deploy Chef Compliance Instance.
    Type: AWS::EC2::Subnet::Id
  InternalAccessSecurityGroup:
    Description: Security Group That Allows Chef Compliance Host Access to Instances.
    Type: AWS::EC2::SecurityGroup::Id
  RemoteSecurityGroup:
    Description: Remote Network or IP that can Access the instances of VPN or Direct
      Connect.
    Type: AWS::EC2::SecurityGroup::Id
Mappings:
  RegionMap:
    us-west-2:
      ChefComplianceVersion: 0.15.13-1
      AMIChefCompliance: ami-9ebb55fe
      InstanceTypeChefCompliance: t2.medium
    us-east-1:
      ChefComplianceVersion: 0.15.13-1
      AMIChefCompliance: ami-a83b3fc2
      InstanceTypeChefCompliance: t2.medium
  bootstrap:
    rhel:
      warmebs: 'echo ''ACTION: Performing EBS Warming'' && dd if=/dev/xvda of=/dev/xvda
        conv=notrunc bs=1M status=progress'
      installpackages: yum install -y curl wget mlocate ca-certificates openssl vim
      updatechefcompliance: 'echo ''ACTION: Upgrading Chef Marketplace to the Latest''
        && chef-marketplace-ctl upgrade -y && chef-compliance-ctl restart'
Resources:
  IamRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - ec2.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: "/"
  IamPolicies:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName:
        Fn::Join:
        - ''
        - - Ref: AWS::StackName
          - "-instance-policy"
      PolicyDocument:
        Statement:
        - Effect: Allow
          Action:
          - s3:*
          - ec2:Describe*
          - elasticloadbalancing:Describe*
          - autoscaling:Describe*
          - cloudwatch:*
          - logs:*
          - sns:*
          Resource: "*"
      Roles:
      - Ref: IamRole
  IamInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: "/"
      Roles:
      - Ref: IamRole
  InternetToChefComplianceServerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Internet to Chef Compliance Server Access
      VpcId:
        Ref: VPC
      Tags:
      - Key: Name
        Value:
          Fn::Join:
          - ''
          - - Ref: AWS::StackName
            - "-internet-to-chefcompliance"
      - Key: Owner
        Value:
          Ref: Owner
      - Key: Project
        Value:
          Ref: Project
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: '80'
        ToPort: '80'
        CidrIp: 0.0.0.0/0
      - IpProtocol: tcp
        FromPort: '443'
        ToPort: '443'
        CidrIp: 0.0.0.0/0
      - IpProtocol: tcp
        FromPort: '8443'
        ToPort: '8443'
        CidrIp: 0.0.0.0/0
      SecurityGroupEgress:
      - IpProtocol: "-1"
        CidrIp: 0.0.0.0/0
  EIP:
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
  EIPAssociation:
    Type: AWS::EC2::EIPAssociation
    DependsOn:
    - EC2Instance
    - EIP
    Properties:
      InstanceId:
        Ref: EC2Instance
      AllocationId:
        Fn::GetAtt:
        - EIP
        - AllocationId
  EC2Instance:
    DependsOn:
    - InternetToChefComplianceServerSecurityGroup
    - IamInstanceProfile
    Type: AWS::EC2::Instance
    Properties:
      InstanceType:
        Fn::FindInMap:
        - RegionMap
        - Ref: AWS::Region
        - InstanceTypeChefCompliance
      IamInstanceProfile:
        Ref: IamInstanceProfile
      ImageId:
        Fn::FindInMap:
        - RegionMap
        - Ref: AWS::Region
        - AMIChefCompliance
      SecurityGroupIds:
      - Ref: InternetToChefComplianceServerSecurityGroup
      - Ref: InternalAccessSecurityGroup
      - Ref: RemoteSecurityGroup
      SubnetId:
        Ref: PublicSubnet
      KeyName:
        Ref: Ec2KeyPair
      BlockDeviceMappings:
      - DeviceName: "/dev/sda1"
        Ebs:
          DeleteOnTermination: 'true'
          VolumeType: gp2
      UserData:
        Fn::Base64:
          Fn::Join:
          - ''
          - - |
              #!/bin/bash
            - Fn::FindInMap:
              - bootstrap
              - rhel
              - warmebs
            - |2+

            - Fn::FindInMap:
              - bootstrap
              - rhel
              - installpackages
            - |2+

            - Fn::FindInMap:
              - bootstrap
              - rhel
              - updatechefcompliance
            - |2+

            - echo sleeping and then running Chef Compliance Update again because
              it can error if upgrading the Chef Client and simply needs to be ran
              again.
            - sleep 20s
            - |2+

            - Fn::FindInMap:
              - bootstrap
              - rhel
              - updatechefcompliance
            - |2+

      Tags:
      - Key: Name
        Value:
          Ref: AWS::StackName
      - Key: Owner
        Value:
          Ref: Owner
      - Key: Project
        Value:
          Ref: Project
      - Key: DeleteAfter
        Value:
          Ref: DeleteAfter
      - Key: ChefComplianceVersion
        Value:
          Fn::FindInMap:
          - RegionMap
          - Ref: AWS::Region
          - ChefComplianceVersion
Outputs:
  Owner:
    Description: Team or Individual that Owns this Formation.
    Value:
      Ref: Owner
  Project:
    Description: The project name
    Value:
      Ref: Project
  DeleteAfter:
    Description: It is ok to delete the Formation after this date
    Value:
      Ref: DeleteAfter
  PublicDNS:
    Description: Chef Compliance Server Public DNS Name
    Value:
      Fn::GetAtt:
      - EC2Instance
      - PublicDnsName
  EIP:
    Description: External IP Address for Chef Compliance Webapp Server
    Value:
      Ref: EIP
  KeyPairLoaded:
    Description: Key Pair used.
    Value:
      Ref: Ec2KeyPair
  VPC:
    Description: VPC Used
    Value:
      Ref: VPC
  IAMRole:
    Description: IAM Instance Profile Role Created.
    Value:
      Ref: IamRole
  DeployedToSubnet:
    Description: Public Subnet the Bastion Host was Deployed on.
    Value:
      Ref: PublicSubnet
  InternetToChefComplianceServerSecurityGroup:
    Description: Internet to Chef Compliance Server Security Group
    Value:
      Ref: InternetToChefComplianceServerSecurityGroup
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
    - Label:
        default: Ownership
      Parameters:
      - Owner
      - Project
      - DeleteAfter
    - Label:
        default: Instance Settings
      Parameters:
      - VPC
      - Ec2KeyPair
      - PublicSubnet
      - InternalAccessSecurityGroup
      - RemoteSecurityGroup
    ParameterLabels:
      Owner:
        default: Team or Individual Owner
      DeleteAfter:
        default: Delete After Date
      PublicSubnet:
        default: Public Subnet
      InternalAccessSecurityGroup:
        default: Instance Access SG
      Ec2KeyPair:
        default: EC2 Access Keypair