2.DOCTANK_CGW.yml

AWSTemplateFormatVersion: "2010-09-09"
Description: "CGW Config for Cisco CSR"

Metadata:
  "AWS::CloudFormation::Interface":
    ParameterGroups:
      - Label:
          default: "VPC Parameters"
        Parameters:
          - AvailabilityZoneA
          - AvailabilityZoneB

Parameters:
#  ParentStack:
#    Description: "Name of the CFN Stack for VPCs"
#    : String
#    Default: "OCTANK"

  KeyPair:
    Description: "Keypair to access the CSR"
    Type: "AWS::EC2::KeyPair::KeyName"
    Default: "whchoi02"
 
  RouterChoice: 
    Description: Virtual Routers for the Virtual DC CGW
    Default: Cisco
    : String
    AllowedValues: 
      - Cisco

Conditions: 
  CreateCiscoCSR: !Equals [ !Ref RouterChoice, Cisco ]

Mappings:
  # AMI for Cisco CSR1kv 
  RegionMap:
    'ap-northeast-2': 
      CSRAMI: "ami-0bfd6b68306c37acd"
    'ap-northeast-1': 
      CSRAMI: "ami-0a32b4f1b6dbf76e2"
    'us-east-1': 
      CSRAMI: "ami-0fc7a3d5400f4619d"
    'us-east-2': 
      CSRAMI: "ami-0fda690c9c2f5cbf9"


Resources:
# Customer Gateway for TGW to DOCTANK Connectivity

  CiscoCustomerGateway:
    Condition: CreateCiscoCSR
    : AWS::EC2::CustomerGateway
    DependsOn: CSRIP
    Properties:
      BgpAsn: 65001
      IpAddress: !Ref CSRIP
      Tags:
        - Key: Name
          Value: DOCTANK-CGW
      : ipsec.1

# CSRVPN Router in the Datacenter

  CSRIP:
    Condition: CreateCiscoCSR
    : "AWS::EC2::EIP"
    Properties:
      Domain: vpc

  ServerRole:
    : AWS::IAM::Role
    Properties:
      RoleName: !Join ["-", [DOCTANK, Ref: "AWS::StackName", "SSMRole"]]
      Path: "/"
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole

  InstanceProfile:
    : AWS::IAM::InstanceProfile
    Properties:
      Path: "/"
      Roles:
        - !Ref ServerRole

  CSRSecGroup:
    Condition: CreateCiscoCSR
    : AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Open-up ports for local VPC and SSH
      GroupName: CSR-SG
      VpcId:
        Fn::ImportValue: !Sub "DOCTANK-VPC"
      SecurityGroupIngress:
        - IpProtocol: -1
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: "22"
          ToPort: "22"
          CidrIp: 0.0.0.0/0

  CSRENI:
    Condition: CreateCiscoCSR
    : AWS::EC2::NetworkInterface
    Properties:
      SubnetId:
        Fn::ImportValue: !Sub "DOCTANK-PublicSubnetA"
      Description: Interface for controlling traffic such as SSH
      GroupSet:
        - Ref: CSRSecGroup
      SourceDestCheck: false
      Tags:
        - Key: Name
          Value: CSR

  CSRInstance:
    Condition: CreateCiscoCSR
    : AWS::EC2::Instance
    Properties:
      NetworkInterfaces:
        - NetworkInterfaceId: !Ref CSRENI
          DeviceIndex: 0
      ImageId: !FindInMap [RegionMap, !Ref "AWS::Region", CSRAMI]
      Instance: c5.large
      KeyName: !Ref KeyPair
      IamInstanceProfile:
        Ref: InstanceProfile
      Tags:
        - Key: Name
          Value: DOCTANK-CSR

  AssociateCSREIP:
    Condition: CreateCiscoCSR
    Type: AWS::EC2::EIPAssociation
    Properties:
      AllocationId: !GetAtt CSRIP.AllocationId
      NetworkInterfaceId: !Ref CSRENI

  PrivateDefaultRoute:
    Condition: CreateCiscoCSR
    Type: AWS::EC2::Route
    DependsOn: CSRENI
    Properties:
      RouteTableId:
        Fn::ImportValue: !Sub "DOCTANK-Private-Route-Table"
      DestinationCidrBlock: 10.0.0.0/8
      NetworkInterfaceId:
        Ref: CSRENI

# Create NAT Gateway for BindServer To Get out to Internet

  DOCTANKNATEIP:
    : "AWS::EC2::EIP"
    Properties:
      Domain: vpc

  DOCTANKNATGateway:
    : "AWS::EC2::NatGateway"
    Properties:
      AllocationId:
        Fn::GetAtt:
          - DOCTANKNATEIP
          - AllocationId
      SubnetId:
        Fn::ImportValue: !Sub "DOCTANK-PublicSubnetA"
      Tags:
        - Key: Name
          Value: DOCTANK-NATGW

  PrivateDefaultRoute:
    : AWS::EC2::Route
    DependsOn: DOCTANKNATGateway
    Properties:
      RouteTableId:
        Fn::ImportValue: DOCTANK-Private-Route-Table
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId:
        Ref: DOCTANKNATGateway

  PrivateAWSRoute:
    Condition: CreateCiscoCSR
    : AWS::EC2::Route
    DependsOn: CSRENI
    Properties:
      RouteTableId:
        Fn::ImportValue: DOCTANK-Private-Route-Table
      DestinationCidrBlock: 10.0.0.0/8
      NetworkInterfaceId:
        Ref: CSRENI
  
  PublicAWSRoute:
    Condition: CreateCiscoCSR
    : AWS::EC2::Route
    DependsOn: CSRENI
    Properties:
      RouteTableId:
        Fn::ImportValue: DOCTANK-Public-Route-Table
      DestinationCidrBlock: 10.0.0.0/8
      NetworkInterfaceId:
        Ref: CSRENI


Outputs:
  # Datacenter 1 Outputs
  CSRSSH:
    Condition: CreateCiscoCSR
    Description: "ssh command to CSR"
    Value:
      !Join [
        "",
        ["ssh -i ~/.ssh/", Ref: "KeyPair", ".pem ec2-user@", !GetAtt "CSRENI.PrimaryPrivateIpAddress"],
      ]
    Export:
      Name: !Sub "DOCTANK-CSRssh"