InfrastructuraAWS.yaml

#AWSTemplateFormatVersion: 2010-09-09

Description:  Este template crea una stack de un servidor web con autoscaling y un balanceador de carga. Tambien incluye la infraestructura de redes necesaria para ello, como una VPC NAT gateways, entre otros.

Parameters:
  NombreStack:
    Description: El nombre asignado a los recursos para identificarlos facilmente. 
    Type: String
    Default: 'Misaby'

  VpcCIDR:
    Description: Rango de IPs (CIDR) para la VPC
    Type: String
    Default: 150.10.0.0/16

  RedPublica1CIDR:
    Description: Rango de IPs (CIDR) para la subred publica en la primer AZ.
    Type: String
    Default: 150.10.0.0/28

  RedPublica2CIDR:
    Description: Rango de IPs (CIDR) para la subred publica en la segunda AZ.
    Type: String
    Default: 150.10.0.16/28

  RedWeb1CIDR:
    Description: Rango de IPs (CIDR) para la subred WEB en la primer AZ.
    Type: String
    Default: 150.10.0.32/28

  RedWeb2CIDR:
    Description: Rango de IPs (CIDR) para la subred WEB en la segunda AZ.
    Type: String
    Default: 150.10.0.48/28

  RedBD1CIDR:
    Description: Rango de IPs (CIDR) para la subred privada de BDs en la primer AZ.
    Type: String
    Default: 150.10.0.64/28

  RedBD2CIDR:
    Description: Rango de IPs (CIDR) para la subred privada de BDs en la segunda AZ.
    Type: String
    Default: 150.10.0.80/28

  InstanceTier:
    Type: String
    Default: t2.medium
    AllowedValues:
      - t2.micro
      - t2.medium
    Description: El tier de las máquinas, pueden ser t2.micro o t2.medium. Por defecto se elige t2.micro.

  SSHKeyWeb:
    Type: String
    Description: La llave SSH a utilizar para los servidores Web.
    Default: WebServers

  IdAMI:
    Type: String
    Description: Id de AMI a utilizar para las instancias. Por defecto crea un server Apache (ami-00773c07a04ff93f0)
    Default: ami-00773c07a04ff93f0

Resources:
# Networking
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCIDR
      EnableDnsSupport: 'true'
      EnableDnsHostnames: 'true'
      Tags:
      - Key: Name
        Value: !Sub ${NombreStack} VPC

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: !Sub ${NombreStack} InternetGW

  InternetGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref VPC
 
  RedPublica1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC                                       # Required
      AvailabilityZone: !Select [ 0, !GetAZs '' ]           # Obtiene la primer AZ de la cuenta
      CidrBlock: !Ref RedPublica1CIDR                       # Required
      MapPublicIpOnLaunch: true                             # Red publica
      Tags:
        - Key: Name
          Value: !Sub ${NombreStack} Red Publica (AZ1)

  RedPublica2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC                                       # Required
      AvailabilityZone: !Select [ 1, !GetAZs '' ]           # Obtiene la segunda AZ de la cuenta
      CidrBlock: !Ref RedPublica2CIDR                       # Required
      MapPublicIpOnLaunch: true                             # Red publica
      Tags:
        - Key: Name
          Value: !Sub ${NombreStack} Red Publica (AZ2)

  RedWeb1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 0, !GetAZs  '' ]          # Obtiene la primer AZ de la cuenta
      CidrBlock: !Ref RedWeb1CIDR                           # Required
      MapPublicIpOnLaunch: true                             # Red Publica
      Tags:
        - Key: Name
          Value: !Sub ${NombreStack} Red Web (AZ1)

  RedWeb2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 1, !GetAZs  '' ]          # Obtiene la segunda AZ de la cuenta
      CidrBlock: !Ref RedWeb2CIDR                           # Required
      MapPublicIpOnLaunch: true                             # Red Publica
      Tags:
        - Key: Name
          Value: !Sub ${NombreStack} Red Web (AZ2)

  RedBD1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 0, !GetAZs  '' ]          # Obtiene la primer AZ de la cuenta
      CidrBlock: !Ref RedBD1CIDR                            # Required
      MapPublicIpOnLaunch: false                            # Red Privada
      Tags:
        - Key: Name
          Value: !Sub ${NombreStack} Red BD (AZ1)

  RedBD2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 1, !GetAZs  '' ]          # Obtiene la segunda AZ de la cuenta
      CidrBlock: !Ref RedBD2CIDR                            # Required
      MapPublicIpOnLaunch: false                            # Red Privada
      Tags:
        - Key: Name
          Value: !Sub ${NombreStack} Red BD (AZ2)

  NatGateway1EIP:
    Type: AWS::EC2::EIP
    DependsOn: InternetGatewayAttachment
    Properties:
      Domain: vpc

  NatGateway2EIP:
    Type: AWS::EC2::EIP
    DependsOn: InternetGatewayAttachment
    Properties:
      Domain: vpc

  NatGateway1:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt NatGateway1EIP.AllocationId
      SubnetId: !Ref RedPublica1

  NatGateway2:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt NatGateway2EIP.AllocationId
      SubnetId: !Ref RedPublica2

  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub ${NombreStack} Rutas Publicas

  DefaultPublicRoute:
    Type: AWS::EC2::Route
    DependsOn: InternetGatewayAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  PublicSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref RedPublica1

  PublicSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref RedPublica2

  Web1Subnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref RedWeb1

  Web2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref RedWeb2

  PrivateRouteTable1:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub ${NombreStack} Rutas Privadas (AZ1)

  DefaultPrivateRoute1:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateRouteTable1
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway1

  PrivateSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateRouteTable1
      SubnetId: !Ref RedBD1

  PrivateRouteTable2:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub ${NombreStack} Rutas Privadas (AZ2)

  DefaultPrivateRoute2:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateRouteTable2
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway2

  PrivateSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateRouteTable2
      SubnetId: !Ref RedBD2
# Security Groups
  NoIngressSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: "no-ingress-sg"
      GroupDescription: "Security group para el load balancer"
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
      Tags:
        - Key: Name
          Value: !Sub ${NombreStack} LoadBalancerSecurityGroup
  
  WebServerSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Permite http de todos lados y SQL desde las bases de datos.
      VpcId: !Ref VPC
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 80
        ToPort: 80
        CidrIp: 0.0.0.0/0
      - IpProtocol: tcp
        FromPort: 3306
        ToPort: 3306
        CidrIp: !Ref RedWeb1CIDR
      SecurityGroupEgress:
      - IpProtocol: tcp
        FromPort: 80
        ToPort: 80
        CidrIp: 0.0.0.0/0
      - IpProtocol: tcp
        FromPort: 3306
        ToPort: 3306
        CidrIp: !Ref RedWeb2CIDR
      Tags:
        - Key: Name
          Value: !Sub ${NombreStack} WebSecurityGroup

  DBServerSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Permite SQL desde servidores WEB y trafico desde la NAT.
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 3306
          ToPort: 3306
          CidrIp: !Ref RedPublica1CIDR
        - IpProtocol: tcp
          FromPort: 3306
          ToPort: 3306
          CidrIp: !Ref RedPublica2CIDR
        - IpProtocol: tcp    
          FromPort: 80
          ToPort: 80
          CidrIp: !Ref RedPublica1CIDR
        - IpProtocol: tcp    
          FromPort: 80
          ToPort: 80
          CidrIp: !Ref RedPublica2CIDR 
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 3306
          ToPort: 3306
          CidrIp: !Ref RedPublica1CIDR
        - IpProtocol: tcp
          FromPort: 3306
          ToPort: 3306
          CidrIp: !Ref RedPublica2CIDR
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: !Ref RedPublica1CIDR
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: !Ref RedPublica2CIDR 
      Tags:
        - Key: Name
          Value: !Sub ${NombreStack} BDSecurityGroup
# AutoScaling 
  LaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    Properties:
      LaunchTemplateName: !Sub ${NombreStack}-Launch-Template
      LaunchTemplateData:
        DisableApiTermination: true
        ImageId: !Ref IdAMI
        InstanceType: !Ref InstanceTier
        KeyName: !Ref SSHKeyWeb
        SecurityGroupIds:
          - !Ref WebServerSG

  AutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      AutoScalingGroupName: !Sub ${NombreStack}-AutoScalingGroup
      VPCZoneIdentifier:
        - !Ref RedWeb1
        - !Ref RedWeb2
      LaunchTemplate:
        LaunchTemplateId: !Ref LaunchTemplate
        Version: !GetAtt LaunchTemplate.LatestVersionNumber
      MinSize: 1
      MaxSize: 3
      DesiredCapacity: 2
      HealthCheckGracePeriod: 300
      MaxInstanceLifetime: 2592000
      TargetGroupARNs:
        - !Ref TargetGroup1
      Tags:
        - Key: Name
          Value: !Sub ${NombreStack} Instance
          PropagateAtLaunch: true
# LoadBalancer
  TargetGroup1:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckEnabled: true
      HealthCheckIntervalSeconds: 30
      HealthCheckPath: '/var/www/html'
      HealthCheckPort: 80
      HealthCheckProtocol: HTTP
      HealthCheckTimeoutSeconds: 4
      HealthyThresholdCount: 2
      UnhealthyThresholdCount: 2
      Port: 80
      Protocol: HTTP
      VpcId: !Ref VPC
      TargetType: instance
      Tags:
        - Key: Name
          Value: !Sub ${NombreStack} TargetGroup

  ListenerRule1:
    Type: 'AWS::ElasticLoadBalancingV2::ListenerRule'
    Properties:
      Actions:
        - Type: forward
          TargetGroupArn: !Ref TargetGroup1
      Conditions:
        - Field: http-request-method
          HttpRequestMethodConfig:
            Values:
              - GET_OR_HEAD
      ListenerArn: !Ref HTTPListener
      Priority: 1

  HTTPListener:
    Type: "AWS::ElasticLoadBalancingV2::Listener"
    Properties:
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref TargetGroup1
      LoadBalancerArn: !Ref LoadBalancer
      Port: 80
      Protocol: HTTP

  LoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      SecurityGroups:
        - !Ref NoIngressSecurityGroup
      Subnets:
        - !Ref RedWeb1
        - !Ref RedWeb2
      Type: application
      Tags: 
        - Key: Name
          Value: !Sub ${NombreStack} Load Balancer

Outputs:
  VPC:
    Description: Referencia de la VPC creada
    Value: !Ref VPC

  PublicSubnets:
    Description: Lista de redes publicas
    Value: !Join [ ",", [ !Ref RedPublica1, !Ref RedPublica2 ]]
  
  WebSubnets:
    Description: Lista de redes publicas para web
    Value: !Join [ ",", [ !Ref RedWeb1, !Ref RedWeb2 ]]

  PrivateSubnets:
    Description: Lista de redes privadas
    Value: !Join [ ",", [ !Ref RedBD1, !Ref RedBD2 ]]

  PublicSubnet1:
    Description: Referencia de la subred publica en la primer AZ
    Value: !Ref RedPublica1

  PublicSubnet2:
    Description: Referencia de la subred publica en la segunda AZ
    Value: !Ref RedPublica2

  PrivateSubnet1:
    Description: Referencia de la subred privada en la primer AZ
    Value: !Ref RedBD1

  PrivateSubnet2:
    Description: Referencia de la subred privada en la segunda AZ
    Value: !Ref RedBD2

  NoIngressSecurityGroup:
    Description: Security group para el load balancer
    Value: !Ref NoIngressSecurityGroup

  WebSecurityGroup:
    Description: Security group para servidor web
    Value: !Ref WebServerSG

  DBSecurityGroup:
    Description: Security group para bases de datos
    Value: !Ref DBServerSG

  LaunchTemplate:
    Description: Referencia del Launch Template
    Value: !Ref LaunchTemplate

  AutoScalingGroup:
    Description: Referencia del AutoScalingGroup
    Value: !Ref AutoScalingGroup

  LoadBalancer:
    Description: Referencia del LoadBalancer
    Value: !Ref LoadBalancer