ScalableVpc.yml

---
AWSTemplateFormatVersion: '2010-09-09'
Description: This template creates a VPC up to 3 AZs x 3 layers, based on parameters.
Metadata:
 "AWS::CloudFormation::Interface":
  ParameterGroups:
   -
    Label:
      default: "Network Configuration"
    Parameters:
     - VpcCidr
     - NamePubSubAz1
     - PubSubAz1Cidr
     - NamePubSubAz2
     - PubSubAz2Cidr
     - NamePubSubAz3
     - PubSubAz3Cidr
     - NamePrivSubTier1Az1
     - PrivSubTier1Az1Cidr
     - NamePrivSubTier1Az2
     - PrivSubTier1Az2Cidr
     - NamePrivSubTier1Az3
     - PrivSubTier1Az3Cidr
     - NamePrivSubTier2Az1
     - PrivSubTier2Az1Cidr
     - NamePrivSubTier2Az2
     - PrivSubTier2Az2Cidr
     - NamePrivSubTier2Az3
     - PrivSubTier2Az3Cidr
Parameters:
  VpcCidr:
    Description: CIDR block for the VPC
    Type: String
    Default: 10.0.0.0/16
  PubSubAz1Cidr:
    Description: CIDR block for the public subnet in AZ1. Required.
    Type: String
    MinLength: 9
    MaxLength: 18
    Default: 10.0.32.0/20
    AllowedPattern: "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
    ConstraintDescription: Must be a valid IPv4 CIDR formatted as x.x.x.x/x.
  PubSubAz2Cidr:
    Description: "(optional) CIDR block for the public subnet in AZ2. This parameter
      determines whether AZ2 is used."
    Type: String
    MinLength: 0
    MaxLength: 18
    Default: 10.0.96.0/20
    AllowedPattern: "^(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})|$"
    ConstraintDescription: Must be a valid IPv4 CIDR formatted as x.x.x.x/x.
  PubSubAz3Cidr:
    Description: "(optional) CIDR block for the public subnet in AZ3. This parameter
      determines whether AZ3 is used."
    Type: String
    MinLength: 0
    MaxLength: 18
    Default: 10.0.160.0/20
    AllowedPattern: "^(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})|$"
    ConstraintDescription: Must be a valid IPv4 CIDR formatted as x.x.x.x/x.
  PrivSubTier1Az1Cidr:
    Description: "(optional) CIDR block for the first tier private subnet in AZ1."
    Type: String
    MinLength: 0
    MaxLength: 18
    Default: 10.0.0.0/19
    AllowedPattern: "^(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})|$"
    ConstraintDescription: Must be a valid IPv4 CIDR formatted as x.x.x.x/x.
  PrivSubTier1Az2Cidr:
    Description: "(optional) CIDR block for the first tier private subnet in AZ2.
      Used only if you specified a CIDR for the Public Subnet in AZ2."
    Type: String
    MinLength: 0
    MaxLength: 18
    Default: 10.0.64.0/19
    AllowedPattern: "^(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})|$"
    ConstraintDescription: Must be a valid IPv4 CIDR formatted as x.x.x.x/x.
  PrivSubTier1Az3Cidr:
    Description: "(optional) CIDR block for the first tier private subnet in AZ3.
      Used only if you specified a CIDR for the Public Subnet in AZ3."
    Type: String
    MinLength: 0
    MaxLength: 18
    Default: 10.0.128.0/19
    AllowedPattern: "^(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})|$"
    ConstraintDescription: Must be a valid IPv4 CIDR formatted as x.x.x.x/x.
  PrivSubTier2Az1Cidr:
    Description: "(optional) CIDR block for the second tier private subnet in AZ1."
    Type: String
    MinLength: 0
    MaxLength: 18
    Default: 10.0.48.0/21
    AllowedPattern: "^(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})|$"
    ConstraintDescription: Must be a valid IPv4 CIDR formatted as x.x.x.x/x.
  PrivSubTier2Az2Cidr:
    Description: "(optional) CIDR block for the second tier private subnet in AZ2.
      Used only if you created a public subnet in AZ2."
    Type: String
    MinLength: 0
    MaxLength: 18
    Default: 10.0.112.0/21
    AllowedPattern: "^(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})|$"
    ConstraintDescription: Must be a valid IPv4 CIDR formatted as x.x.x.x/x.
  PrivSubTier2Az3Cidr:
    Description: "(optional) CIDR block for the second tier private subnet in AZ3.
      Used only if you created a public subnet in AZ3."
    Type: String
    MinLength: 0
    MaxLength: 18
    Default: 10.0.176.0/21
    AllowedPattern: "^(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})|$"
    ConstraintDescription: Must be a valid IPv4 CIDR formatted as x.x.x.x/x.
  S3buckets:
    Description: "Buckets and objects allowed to be accessed by systems in this VPC, e.g. `arn:aws:s3:::my_secure_bucket, arn:aws:s3:::my_secure_bucket/*`"
    Type: CommaDelimitedList
    Default: "*"
  UseGuardrailNacl:
    Description: "Deploy Guardrail NACL"
    Type: String
    Default: yes
    AllowedValues:
     - yes
     - no
  NamePubSubAz1:
    Description: "Name of PubSubAz1"
    Type: String
    Default: Public Subnet AZ1
    ConstraintDescription: Subnet Name
  NamePubSubAz2:
    Description: "Name of PubSubAz2"
    Type: String
    Default: Public Subnet AZ2
    ConstraintDescription: Subnet Name
  NamePubSubAz3:
    Description: "Name of PubSubAz3"
    Type: String
    Default: Public Subnet AZ3
    ConstraintDescription: Subnet Name
  NamePrivSubTier1Az1:
    Description: "Name of PrivSubTier1Az1"
    Type: String
    Default: Private Subnet Tier 1 AZ1
    ConstraintDescription: Subnet Name
  NamePrivSubTier1Az2:
    Description: "Name of PrivSubTier1Az2"
    Type: String
    Default: Private Subnet Tier 1 AZ2
    ConstraintDescription: Subnet Name
  NamePrivSubTier1Az3:
    Description: "Name of PrivSubTier1Az3"
    Type: String
    Default: Private Subnet Tier 1 AZ3
    ConstraintDescription: Subnet Name
  NamePrivSubTier2Az1:
    Description: "Name of PrivSubTier2Az1"
    Type: String
    Default: Private Subnet Tier 2 AZ1
    ConstraintDescription: Subnet Name
  NamePrivSubTier2Az2:
    Description: "Name of PrivSubTier2Az2"
    Type: String
    Default: Private Subnet Tier 2 AZ2
    ConstraintDescription: Subnet Name
  NamePrivSubTier2Az3:
    Description: "Name of PrivSubTier2Az3"
    Type: String
    Default: Private Subnet Tier 2 AZ3
    ConstraintDescription: Subnet Name
Conditions:
  CreatePubSubAz1:
    Fn::Not:
    - Fn::Equals:
      - Ref: PubSubAz1Cidr
      - ''
  CreatePubSubAz2:
    Fn::And:
    - Condition: CreatePubSubAz1
    - Fn::Not:
      - Fn::Equals:
        - Ref: PubSubAz2Cidr
        - ''
  CreatePubSubAz3:
    Fn::And:
    - Condition: CreatePubSubAz2
    - Fn::Not:
      - Fn::Equals:
        - Ref: PubSubAz3Cidr
        - ''
  CreatePrivSubTier1Az1:
    Fn::Not:
      - Fn::Equals:
        - Ref: PrivSubTier1Az1Cidr
        - ''
  CreatePrivSubTier1Az2:
    Fn::And:
    - Condition: CreatePrivSubTier1Az1
    - Condition: CreatePubSubAz2
    - Fn::Not:
      - Fn::Equals:
        - Ref: PrivSubTier1Az2Cidr
        - ''
  CreatePrivSubTier1Az3:
    Fn::And:
    - Condition: CreatePubSubAz3
    - Condition: CreatePrivSubTier1Az2
    - Fn::Not:
      - Fn::Equals:
        - Ref: PrivSubTier1Az3Cidr
        - ''
  CreatePrivSubTier2Az1:
    Fn::And:
    - Condition: CreatePrivSubTier1Az1
    - Fn::Not:
      - Fn::Equals:
        - Ref: PrivSubTier2Az1Cidr
        - ''
  CreatePrivSubTier2Az2:
    Fn::And:
    - Condition: CreatePrivSubTier2Az1
    - Condition: CreatePrivSubTier1Az2
    - Fn::Not:
      - Fn::Equals:
        - Ref: PrivSubTier2Az2Cidr
        - ''
  CreatePrivSubTier2Az3:
    Fn::And:
    - Condition: CreatePrivSubTier2Az2
    - Condition: CreatePrivSubTier1Az3
    - Fn::Not:
      - Fn::Equals:
        - Ref: PrivSubTier2Az3Cidr
        - ''
  CreateGuardrailNACL:
    Fn::Equals:
    - Ref: UseGuardrailNacl
    - yes
  CreateSubGuardrailNaclAssocPubSubAZ1:
    Condition: CreateGuardrailNACL
  CreateSubGuardrailNaclAssocPubSubAZ2:
    Fn::And:
    - Condition: CreatePubSubAz2
    - Condition: CreateGuardrailNACL
  CreateSubGuardrailNaclAssocPubSubAZ3:
    Fn::And:
    - Condition: CreatePubSubAz3
    - Condition: CreateGuardrailNACL
  CreateSubGuardrailNaclAssocPrivSubT1AZ1:
    Fn::And:
    - Condition: CreatePrivSubTier1Az1
    - Condition: CreateGuardrailNACL
  CreateSubGuardrailNaclAssocPrivSubT1AZ2:
    Fn::And:
    - Condition: CreatePrivSubTier1Az2
    - Condition: CreateGuardrailNACL
  CreateSubGuardrailNaclAssocPrivSubT1AZ3:
    Fn::And:
    - Condition: CreatePrivSubTier1Az3
    - Condition: CreateGuardrailNACL
  CreateSubGuardrailNaclAssocPrivSubT2AZ1:
    Fn::And:
    - Condition: CreatePrivSubTier2Az1
    - Condition: CreateGuardrailNACL
  CreateSubGuardrailNaclAssocPrivSubT2AZ2:
    Fn::And:
    - Condition: CreatePrivSubTier2Az2
    - Condition: CreateGuardrailNACL
  CreateSubGuardrailNaclAssocPrivSubT2AZ3:
    Fn::And:
    - Condition: CreatePrivSubTier2Az3
    - Condition: CreateGuardrailNACL
Resources:
  Vpc:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock:
        Ref: VpcCidr
      EnableDnsSupport: 'true'
      EnableDnsHostnames: 'true'
      Tags:
      - Key: Name
        Value:
          Ref: AWS::StackName
      - Key: Application
        Value:
          Ref: AWS::StackName
  PubSubAz1:
    Type: AWS::EC2::Subnet
    Properties:
      MapPublicIpOnLaunch: true
      VpcId:
        Ref: Vpc
      CidrBlock:
        Ref: PubSubAz1Cidr
      AvailabilityZone:
        Fn::Select:
        - '0'
        - Fn::GetAZs:
            Ref: AWS::Region
      Tags:
      - Key: Application
        Value:
          Ref: AWS::StackName
      - Key: Network
        Value: Public
      - Key: Name
        Value:
          Ref: NamePubSubAz1
  PubSubAz2:
    Condition: CreatePubSubAz2
    Type: AWS::EC2::Subnet
    Properties:
      MapPublicIpOnLaunch: true
      VpcId:
        Ref: Vpc
      CidrBlock:
        Ref: PubSubAz2Cidr
      AvailabilityZone:
        Fn::Select:
        - '1'
        - Fn::GetAZs:
            Ref: AWS::Region
      Tags:
      - Key: Application
        Value:
          Ref: AWS::StackName
      - Key: Network
        Value: Public
      - Key: Name
        Value:
          Ref: NamePubSubAz2
  PubSubAz3:
    Condition: CreatePubSubAz3
    Type: AWS::EC2::Subnet
    Properties:
      MapPublicIpOnLaunch: true
      VpcId:
        Ref: Vpc
      CidrBlock:
        Ref: PubSubAz3Cidr
      AvailabilityZone:
        Fn::Select:
        - '2'
        - Fn::GetAZs:
            Ref: AWS::Region
      Tags:
      - Key: Application
        Value:
          Ref: AWS::StackName
      - Key: Network
        Value: Public
      - Key: Name
        Value:
          Ref: NamePubSubAz3
  PrivSubTier1Az1:
    Condition: CreatePrivSubTier1Az1
    Type: AWS::EC2::Subnet
    Properties:
      VpcId:
        Ref: Vpc
      CidrBlock:
        Ref: PrivSubTier1Az1Cidr
      AvailabilityZone:
        Fn::Select:
        - '0'
        - Fn::GetAZs:
            Ref: AWS::Region
      Tags:
      - Key: Application
        Value:
          Ref: AWS::StackName
      - Key: Network
        Value: Private
      - Key: Name
        Value:
          Ref: NamePrivSubTier1Az1
  PrivSubTier1Az2:
     Condition: CreatePrivSubTier1Az2
     Type: AWS::EC2::Subnet
     Properties:
       VpcId:
         Ref: Vpc
       CidrBlock:
         Ref: PrivSubTier1Az2Cidr
       AvailabilityZone:
         Fn::Select:
         - '1'
         - Fn::GetAZs:
             Ref: AWS::Region
       Tags:
       - Key: Application
         Value:
           Ref: AWS::StackName
       - Key: Network
         Value: Private
       - Key: Name
         Value:
          Ref: NamePrivSubTier1Az2
  PrivSubTier1Az3:
     Condition: CreatePrivSubTier1Az3
     Type: AWS::EC2::Subnet
     Properties:
       VpcId:
         Ref: Vpc
       CidrBlock:
         Ref: PrivSubTier1Az3Cidr
       AvailabilityZone:
         Fn::Select:
         - '2'
         - Fn::GetAZs:
             Ref: AWS::Region
       Tags:
       - Key: Application
         Value:
           Ref: AWS::StackName
       - Key: Network
         Value: Private
       - Key: Name
         Value:
          Ref: NamePrivSubTier1Az3
  PrivSubTier2Az1:
     Condition: CreatePrivSubTier2Az1
     Type: AWS::EC2::Subnet
     Properties:
       VpcId:
         Ref: Vpc
       CidrBlock:
         Ref: PrivSubTier2Az1Cidr
       AvailabilityZone:
         Fn::Select:
         - '0'
         - Fn::GetAZs:
             Ref: AWS::Region
       Tags:
       - Key: Application
         Value:
           Ref: AWS::StackName
       - Key: Network
         Value: Private
       - Key: Name
         Value:
          Ref: NamePrivSubTier2Az1
  PrivSubTier2Az2:
     Condition: CreatePrivSubTier2Az2
     Type: AWS::EC2::Subnet
     Properties:
       VpcId:
         Ref: Vpc
       CidrBlock:
         Ref: PrivSubTier2Az2Cidr
       AvailabilityZone:
         Fn::Select:
         - '1'
         - Fn::GetAZs:
             Ref: AWS::Region
       Tags:
       - Key: Application
         Value:
           Ref: AWS::StackName
       - Key: Network
         Value: Private
       - Key: Name
         Value:
          Ref: NamePrivSubTier2Az2
  PrivSubTier2Az3:
     Condition: CreatePrivSubTier2Az3
     Type: AWS::EC2::Subnet
     Properties:
       VpcId:
         Ref: Vpc
       CidrBlock:
         Ref: PrivSubTier2Az3Cidr
       AvailabilityZone:
         Fn::Select:
         - '2'
         - Fn::GetAZs:
             Ref: AWS::Region
       Tags:
       - Key: Application
         Value:
           Ref: AWS::StackName
       - Key: Network
         Value: Private
       - Key: Name
         Value:
          Ref: NamePrivSubTier2Az3
  PrivateRouteTableAz1:
    Condition: CreatePrivSubTier1Az1
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId:
        Ref: Vpc
      Tags:
      - Key: Application
        Value:
          Ref: AWS::StackName
      - Key: Network
        Value: Private
      - Key: Name
        Value: Private AZ1
  PrivateRouteTableAz2:
    Condition: CreatePrivSubTier1Az2
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId:
        Ref: Vpc
      Tags:
      - Key: Application
        Value:
          Ref: AWS::StackName
      - Key: Network
        Value: Private
      - Key: Name
        Value: Private AZ2
  PrivateRouteTableAz3:
    Condition: CreatePrivSubTier1Az3
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId:
        Ref: Vpc
      Tags:
      - Key: Application
        Value:
          Ref: AWS::StackName
      - Key: Network
        Value: Private
      - Key: Name
        Value: Private AZ3
  PublicSubnetAz1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId:
        Ref: PubSubAz1
      RouteTableId:
        Ref: PublicRouteTable
  PublicSubnetAz2RouteTableAssociation:
    Condition: CreatePubSubAz2
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId:
        Ref: PubSubAz2
      RouteTableId:
        Ref: PublicRouteTable
  PublicSubnetAz3RouteTableAssociation:
    Condition: CreatePubSubAz3
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId:
        Ref: PubSubAz3
      RouteTableId:
        Ref: PublicRouteTable
  PrivateSubnetTier1Az1RouteTableAssociation:
    Condition: CreatePrivSubTier1Az1
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId:
        Ref: PrivSubTier1Az1
      RouteTableId:
        Ref: PrivateRouteTableAz1
  PrivateSubnetTier1Az2RouteTableAssociation:
    Condition: CreatePrivSubTier1Az2
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId:
        Ref: PrivSubTier1Az2
      RouteTableId:
        Ref: PrivateRouteTableAz2
  PrivateSubnetTier1Az3RouteTableAssociation:
    Condition: CreatePrivSubTier1Az3
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId:
        Ref: PrivSubTier1Az3
      RouteTableId:
        Ref: PrivateRouteTableAz3
  PrivateSubnetTier2Az1RouteTableAssociation:
    Condition: CreatePrivSubTier2Az1
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId:
        Ref: PrivSubTier2Az1
      RouteTableId:
        Ref: PrivateRouteTableAz1
  PrivateSubnetTier2Az2RouteTableAssociation:
    Condition: CreatePrivSubTier2Az2
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId:
        Ref: PrivSubTier2Az2
      RouteTableId:
        Ref: PrivateRouteTableAz2
  PrivateSubnetTier2Az3RouteTableAssociation:
    Condition: CreatePrivSubTier2Az3
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId:
        Ref: PrivSubTier2Az3
      RouteTableId:
        Ref: PrivateRouteTableAz3
  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
      - Key: Application
        Value:
          Ref: AWS::StackName
      - Key: Network
        Value: Public
      - Key: Name
        Value:
          Ref: AWS::StackName
  GatewayToInternet:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId:
        Ref: Vpc
      InternetGatewayId:
        Ref: InternetGateway
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId:
        Ref: Vpc
      Tags:
      - Key: Application
        Value:
          Ref: AWS::StackName
      - Key: Network
        Value: Public
      - Key: Name
        Value: Public
  PublicRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId:
        Ref: PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId:
        Ref: InternetGateway
  DefaultRouteAz1:
    Condition: CreatePrivSubTier1Az1
    Type: AWS::EC2::Route
    Properties:
      RouteTableId:
        Ref: PrivateRouteTableAz1
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId:
        Ref: NatGw1
  DefaultRouteAz2:
    Condition: CreatePrivSubTier1Az2
    Type: AWS::EC2::Route
    Properties:
      RouteTableId:
        Ref: PrivateRouteTableAz2
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId:
        Ref: NatGw2
  DefaultRouteAz3:
    Condition: CreatePrivSubTier1Az3
    Type: AWS::EC2::Route
    Properties:
      RouteTableId:
        Ref: PrivateRouteTableAz3
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId:
        Ref: NatGw3
  Eip1:
    Condition: CreatePrivSubTier1Az1
    DependsOn: GatewayToInternet
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
  NatGw1:
    Condition: CreatePrivSubTier1Az1
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId:
        Fn::GetAtt:
        - Eip1
        - AllocationId
      SubnetId:
        Ref: PubSubAz1
  Eip2:
    Condition: CreatePrivSubTier1Az2
    DependsOn: GatewayToInternet
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
  NatGw2:
    Condition: CreatePrivSubTier1Az2
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId:
        Fn::GetAtt:
        - Eip2
        - AllocationId
      SubnetId:
        Ref: PubSubAz2
  Eip3:
    Condition: CreatePrivSubTier1Az3
    DependsOn: GatewayToInternet
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
  NatGw3:
    Condition: CreatePrivSubTier1Az3
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId:
        Fn::GetAtt:
        - Eip3
        - AllocationId
      SubnetId:
        Ref: PubSubAz3
  RoleFlowLogs:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Principal:
              Service:
                - "vpc-flow-logs.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"
      Policies:
      -
        PolicyName: "VPCFlowLogsPolicy"
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            -
              Action:
                - logs:CreateLogGroup
                - logs:CreateLogStream
                - logs:PutLogEvents
                - logs:DescribeLogGroups
                - logs:DescribeLogStreams
              Effect: "Allow"
              Resource : "*"
  FlowLogsGroup:
      Type: "AWS::Logs::LogGroup"
  FlowLogs:
    Type: AWS::EC2::FlowLog
    Properties:
      DeliverLogsPermissionArn:
        Fn::GetAtt: [RoleFlowLogs,Arn]
      LogGroupName:
        Ref: FlowLogsGroup
      ResourceId:
        Ref: Vpc
      ResourceType: VPC
      TrafficType: "ALL"
  S3Endpoint:
    Type: "AWS::EC2::VPCEndpoint"
    Properties:
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Principal: "*"
            Action: "*"
            Resource:
              Ref: S3buckets
      RouteTableIds:
        - Ref: PublicRouteTable
        - "Fn::If":
          -  CreatePrivSubTier1Az1
          -  Ref: PrivateRouteTableAz1
          -  Ref: "AWS::NoValue"
        - "Fn::If":
          -  CreatePrivSubTier1Az2
          -  Ref: PrivateRouteTableAz2
          -  Ref: "AWS::NoValue"
        - "Fn::If":
          -  CreatePrivSubTier1Az3
          -  Ref: PrivateRouteTableAz3
          -  Ref: "AWS::NoValue"
      ServiceName:
        Fn::Join:
          - ''
          - - com.amazonaws.
            - Ref: AWS::Region
            - .s3
      VpcId:
        Ref: Vpc
  SubGuardrailNaclAssocPubSubAZ1:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    Condition: CreateSubGuardrailNaclAssocPubSubAZ1
    Properties:
      SubnetId:
        Ref: PubSubAz1
      NetworkAclId:
        Ref: GuardrailNacl
  SubGuardrailNaclAssocPubSubAZ2:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    Condition: CreateSubGuardrailNaclAssocPubSubAZ2
    Properties:
      SubnetId:
        Ref: PubSubAz2
      NetworkAclId:
        Ref: GuardrailNacl
  SubGuardrailNaclAssocPubSubAZ3:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    Condition: CreateSubGuardrailNaclAssocPubSubAZ3
    Properties:
      SubnetId:
        Ref: PubSubAz3
      NetworkAclId:
        Ref: GuardrailNacl
  SubGuardrailNaclAssocPrivSubT1AZ1:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    Condition: CreateSubGuardrailNaclAssocPrivSubT1AZ1
    Properties:
      SubnetId:
        Ref: PrivSubTier1Az1
      NetworkAclId:
        Ref: GuardrailNacl
  SubGuardrailNaclAssocPrivSubT1AZ2:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    Condition: CreateSubGuardrailNaclAssocPrivSubT1AZ2
    Properties:
      SubnetId:
        Ref: PrivSubTier1Az2
      NetworkAclId:
        Ref: GuardrailNacl
  SubGuardrailNaclAssocPrivSubT1AZ3:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    Condition: CreateSubGuardrailNaclAssocPrivSubT1AZ3
    Properties:
      SubnetId:
        Ref: PrivSubTier1Az3
      NetworkAclId:
        Ref: GuardrailNacl
  SubGuardrailNaclAssocPrivSubT2AZ1:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    Condition: CreateSubGuardrailNaclAssocPrivSubT2AZ1
    Properties:
      SubnetId:
        Ref: PrivSubTier2Az1
      NetworkAclId:
        Ref: GuardrailNacl
  SubGuardrailNaclAssocPrivSubT2AZ2:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    Condition: CreateSubGuardrailNaclAssocPrivSubT2AZ2
    Properties:
      SubnetId:
        Ref: PrivSubTier2Az2
      NetworkAclId:
        Ref: GuardrailNacl
  SubGuardrailNaclAssocPrivSubT2AZ3:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    Condition: CreateSubGuardrailNaclAssocPrivSubT2AZ3
    Properties:
      SubnetId:
        Ref: PrivSubTier2Az3
      NetworkAclId:
        Ref: GuardrailNacl
  GuardrailNacl:
    Condition: CreateGuardrailNACL
    Type: "AWS::EC2::NetworkAcl"
    Properties:
      Tags:
      -
       Key: Name
       Value: "Guardrail NACL"
      VpcId:
        Ref: Vpc
  NoFtpIngress:
   Condition: CreateGuardrailNACL
   Type: "AWS::EC2::NetworkAclEntry"
   Properties:
    CidrBlock: "0.0.0.0/0"
    Egress: false
    NetworkAclId:
     Ref: GuardrailNacl
    PortRange:
     From: 20
     To: 21
    Protocol: 6
    RuleAction: Deny
    RuleNumber: 100
  NoFtpEgress:
   Condition: CreateGuardrailNACL
   Type: "AWS::EC2::NetworkAclEntry"
   Properties:
    CidrBlock: "0.0.0.0/0"
    Egress: true
    NetworkAclId:
     Ref: GuardrailNacl
    PortRange:
     From: 20
     To: 21
    Protocol: 6
    RuleAction: Deny
    RuleNumber: 100
  NoTelnetIngress:
   Condition: CreateGuardrailNACL
   Type: "AWS::EC2::NetworkAclEntry"
   Properties:
    CidrBlock: "0.0.0.0/0"
    Egress: false
    NetworkAclId:
     Ref: GuardrailNacl
    PortRange:
     From: 23
     To: 23
    Protocol: 6
    RuleAction: Deny
    RuleNumber: 110
  NoTelnetEgress:
   Condition: CreateGuardrailNACL
   Type: "AWS::EC2::NetworkAclEntry"
   Properties:
    CidrBlock: "0.0.0.0/0"
    Egress: true
    NetworkAclId:
     Ref: GuardrailNacl
    PortRange:
     From: 23
     To: 23
    Protocol: 6
    RuleAction: Deny
    RuleNumber: 110
  NoPop3Ingress:
   Condition: CreateGuardrailNACL
   Type: "AWS::EC2::NetworkAclEntry"
   Properties:
    CidrBlock: "0.0.0.0/0"
    Egress: false
    NetworkAclId:
     Ref: GuardrailNacl
    PortRange:
     From: 110
     To: 110
    Protocol: 6
    RuleAction: Deny
    RuleNumber: 120
  NoPop3Egress:
   Condition: CreateGuardrailNACL
   Type: "AWS::EC2::NetworkAclEntry"
   Properties:
    CidrBlock: "0.0.0.0/0"
    Egress: true
    NetworkAclId:
     Ref: GuardrailNacl
    PortRange:
     From: 110
     To: 110
    Protocol: 6
    RuleAction: Deny
    RuleNumber: 120
  NoImapIngress:
   Condition: CreateGuardrailNACL
   Type: "AWS::EC2::NetworkAclEntry"
   Properties:
    CidrBlock: "0.0.0.0/0"
    Egress: false
    NetworkAclId:
     Ref: GuardrailNacl
    PortRange:
     From: 143
     To: 143
    Protocol: 6
    RuleAction: Deny
    RuleNumber: 130
  NoImapEgress:
   Condition: CreateGuardrailNACL
   Type: "AWS::EC2::NetworkAclEntry"
   Properties:
    CidrBlock: "0.0.0.0/0"
    Egress: true
    NetworkAclId:
     Ref: GuardrailNacl
    PortRange:
     From: 143
     To: 143
    Protocol: 6
    RuleAction: Deny
    RuleNumber: 130
  NoInsecureSnmpIngress:
   Condition: CreateGuardrailNACL
   Type: "AWS::EC2::NetworkAclEntry"
   Metadata:
    Notes: "SNMPv3 with TLS uses 10161/10162 per https://tools.ietf.org/html/rfc6353"
   Properties:
    CidrBlock: "0.0.0.0/0"
    Egress: false
    NetworkAclId:
     Ref: GuardrailNacl
    PortRange:
     From: 161
     To: 162
    Protocol: 17
    RuleAction: Deny
    RuleNumber: 140
  NoInsecureSnmpEgress:
   Condition: CreateGuardrailNACL
   Type: "AWS::EC2::NetworkAclEntry"
   Metadata:
    Notes: "SNMPv3 with TLS uses 10161/10162 per https://tools.ietf.org/html/rfc6353"
   Properties:
    CidrBlock: "0.0.0.0/0"
    Egress: true
    NetworkAclId:
     Ref: GuardrailNacl
    PortRange:
     From: 161
     To: 162
    Protocol: 17
    RuleAction: Deny
    RuleNumber: 140
  DefaultAllowIngress:
   Condition: CreateGuardrailNACL
   Type: "AWS::EC2::NetworkAclEntry"
   Properties:
    CidrBlock: "0.0.0.0/0"
    Egress: false
    NetworkAclId:
     Ref: GuardrailNacl
    Protocol: -1
    RuleAction: Allow
    RuleNumber: 32766
  DefaultAllowEgress:
   Condition: CreateGuardrailNACL
   Type: "AWS::EC2::NetworkAclEntry"
   Properties:
    CidrBlock: "0.0.0.0/0"
    Egress: true
    NetworkAclId:
     Ref: GuardrailNacl
    Protocol: -1
    RuleAction: Allow
    RuleNumber: 32766
Outputs:
  VpcId:
    Description: ID of the VPC
    Value:
      Ref: Vpc
    Export:
      Name:
        Fn::Sub: "${AWS::StackName}-Vpc"
  FlowLogsGroupId:
    Description: ID of the Flow Logs Group
    Value:
      Ref: FlowLogsGroup
    Export:
      Name:
        Fn::Sub: "${AWS::StackName}-FlowLogsGroup"
  S3EndpointId:
    Description: ID of the S3 Endpoint
    Value:
      Ref: S3Endpoint
    Export:
      Name:
        Fn::Sub: "${AWS::StackName}-S3Endpoint"
  PublicRouteId:
    Description: ID of the Public Route
    Value:
      Ref: PublicRoute
    Export:
      Name:
        Fn::Sub: "${AWS::StackName}-PublicRoute"
  PublicRouteTableId:
    Description: ID of the Public Route Table
    Value:
      Ref: PublicRouteTable
    Export:
      Name:
        Fn::Sub: "${AWS::StackName}-PublicRouteTable"
  PublicSubnetAz1RouteTableAssociationId:
    Description: ID of the Public Route Table
    Value:
      Ref: PublicSubnetAz1RouteTableAssociation
    Export:
      Name:
        Fn::Sub: "${AWS::StackName}-PublicSubnetAz1RouteTableAssociation"
  PublicSubnetAz2RouteTableAssociationId:
    Description: ID of the Public Route Table
    Condition: CreatePubSubAz2
    Value:
      Ref: PublicSubnetAz2RouteTableAssociation
    Export:
      Name:
        Fn::Sub: "${AWS::StackName}-PublicSubnetAz2RouteTableAssociation"
  PublicSubnetAz3RouteTableAssociationId:
    Condition: CreatePubSubAz3
    Description: ID of the Public Route Table
    Value:
      Ref: PublicSubnetAz3RouteTableAssociation
    Export:
      Name:
        Fn::Sub: "${AWS::StackName}-PublicSubnetAz3RouteTableAssociation"
  PubSubAz1Id:
    Description: ID of the Public Subnet in AZ1
    Value:
      Ref: PubSubAz1
    Export:
      Name:
        Fn::Sub: "${AWS::StackName}-PubSubAz1"
  PubSubAz2Id:
    Condition: CreatePubSubAz2
    Description: ID of the Public Subnet in AZ2
    Value:
      Ref: PubSubAz2
    Export:
      Name:
        Fn::Sub: "${AWS::StackName}-PubSubAz2"
  PubSubAz3Id:
    Condition: CreatePubSubAz3
    Description: ID of the Public Subnet in AZ3
    Value:
      Ref: PubSubAz3
    Export:
      Name:
        Fn::Sub: "${AWS::StackName}-PubSubAz3"
  PrivSubTier1Az1Id:
    Condition: CreatePrivSubTier1Az1
    Description: ID of the Private Tier1 Subnet in AZ1
    Value:
      Ref: PrivSubTier1Az1
    Export:
      Name:
        Fn::Sub: "${AWS::StackName}-PrivSubTier1Az1"
  PrivSubTier1Az2Id:
    Condition: CreatePrivSubTier1Az2
    Description: ID of the Private Tier1 Subnet in AZ2
    Value:
      Ref: PrivSubTier1Az2
    Export:
      Name:
        Fn::Sub: "${AWS::StackName}-PrivSubTier1Az2"
  PrivSubTier1Az3Id:
    Condition: CreatePrivSubTier1Az3
    Description: ID of the Private Tier1 Subnet in AZ3
    Value:
      Ref: PrivSubTier1Az3
    Export:
      Name:
        Fn::Sub: "${AWS::StackName}-PrivSubTier1Az3"
  PrivSubTier2Az1Id:
    Condition: CreatePrivSubTier2Az1
    Description: ID of the Private Tier2 Subnet in AZ1
    Value:
      Ref: PrivSubTier2Az1
    Export:
      Name:
        Fn::Sub: "${AWS::StackName}-PrivSubTier2Az1"
  PrivSubTier2Az2Id:
    Condition: CreatePrivSubTier2Az2
    Description: ID of the Private Tier2 Subnet in AZ2
    Value:
      Ref: PrivSubTier2Az2
    Export:
      Name:
        Fn::Sub: "${AWS::StackName}-PrivSubTier2Az2"
  PrivSubTier2Az3Id:
    Condition: CreatePrivSubTier2Az3
    Description: ID of the Private Tier2 Subnet in AZ3
    Value:
      Ref: PrivSubTier2Az3
    Export:
      Name:
        Fn::Sub: "${AWS::StackName}-PrivSubTier2Az3"
  NatGw1Eip:
    Condition: CreatePrivSubTier1Az1
    Description: Public Elastic IP of NAT Gateway in AZ1
    Value:
      Ref: Eip1
  NatGw2Eip:
    Condition: CreatePrivSubTier1Az2
    Description: Public Elastic IP of NAT Gateway in AZ2
    Value:
      Ref: Eip2
  NatGw3Eip:
    Condition: CreatePrivSubTier1Az3
    Description: Public IP Elastic of NAT Gateway in AZ3
    Value:
      Ref: Eip3