vpc-private.yaml

AWSTemplateFormatVersion: 2010-09-09
Resources:
  privateVPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 172.31.0.0/16
      Tags:
        - Key: Name
          Value: !Ref AWS::StackName
  privateSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref privateVPC
      AvailabilityZone:
        Fn::Select:
         - 0
         - Fn::GetAZs: ""
      CidrBlock: 172.31.3.0/24
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Join ["-", [!Ref "AWS::StackName","subnet-a"]]
  privateSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref privateVPC
      AvailabilityZone:
        Fn::Select:
         - 1
         - Fn::GetAZs: ""
      CidrBlock: 172.31.2.0/24
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Join ["-", [!Ref "AWS::StackName","subnet-b"]]
  privateRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref privateVPC
  privateSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref privateSubnet1
      RouteTableId: !Ref privateRouteTable
  privateSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref privateSubnet2
      RouteTableId: !Ref privateRouteTable
  s3Endpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal: "*"
          Action:
            - "s3:*"
          Resource:
            - "*"
      RouteTableIds:
        - !Ref privateRouteTable
      ServiceName: !Sub com.amazonaws.${AWS::Region}.s3
      VpcId: !Ref privateVPC
  dynamoDBEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal: "*"
          Action:
            - "dynamodb:*"
          Resource:
            - "*"
      RouteTableIds:
        - !Ref privateRouteTable
      ServiceName: !Sub com.amazonaws.${AWS::Region}.dynamodb
      VpcId: !Ref privateVPC
Outputs:
  privateVPCID:
    Description: VPC ID
    Value: !Ref privateVPC
    Export:
      Name: !Join ["-", [!Ref "AWS::StackName","vpc"]]
  privateSubnet1ID:
    Description: Private Subnet A ID
    Value: !Ref privateSubnet1
    Export:
      Name: !Join ["-", [!Ref "AWS::StackName","subnet-a"]]
  privateSubnet2ID:
    Description: Private Subnet B ID
    Value: !Ref privateSubnet2
    Export:
      Name: !Join ["-", [!Ref "AWS::StackName","subnet-b"]]
  privateVPCSecurityGroup:
    Description: Default security for Lambda VPC
    Value: !GetAtt privateVPC.DefaultSecurityGroup
    Export:
      Name: !Join ["-", [!Ref "AWS::StackName","vpc-sg"]]