vpc-privatepublic.yaml

AWSTemplateFormatVersion: 2010-09-09
Resources:
  pubPrivateVPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 172.31.0.0/16
      Tags:
        - Key: Name
          Value: !Ref AWS::StackName
  publicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref pubPrivateVPC
      AvailabilityZone:
        Fn::Select:
         - 0
         - Fn::GetAZs: ""
      CidrBlock: 172.31.0.0/24
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Join ["-", [!Ref "AWS::StackName","public-subnet"]]
  privateSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref pubPrivateVPC
      AvailabilityZone:
        Fn::Select:
         - 0
         - Fn::GetAZs: ""
      CidrBlock: 172.31.3.0/24
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Join ["-", [!Ref "AWS::StackName","private-subnet-a"]]
  privateSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref pubPrivateVPC
      AvailabilityZone:
        Fn::Select:
         - 1
         - Fn::GetAZs: ""
      CidrBlock: 172.31.2.0/24
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Join ["-", [!Ref "AWS::StackName","private-subnet-b"]]
  internetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: !Join ["-", [!Ref "AWS::StackName","gateway"]]
  gatewayToInternet:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref pubPrivateVPC
      InternetGatewayId: !Ref internetGateway
  publicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref pubPrivateVPC
  publicRoute:
    Type: AWS::EC2::Route
    DependsOn: gatewayToInternet
    Properties:
      RouteTableId: !Ref publicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref internetGateway
  publicSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref publicSubnet1
      RouteTableId: !Ref publicRouteTable
  natGateway:
    Type: AWS::EC2::NatGateway
    DependsOn: natPublicIP
    Properties:
      AllocationId: !GetAtt natPublicIP.AllocationId
      SubnetId: !Ref publicSubnet1
  natPublicIP:
    Type: AWS::EC2::EIP
    DependsOn: pubPrivateVPC
    Properties:
      Domain: vpc
  privateRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref pubPrivateVPC
  privateRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref privateRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref natGateway
  privateSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref privateSubnet1
      RouteTableId: !Ref privateRouteTable
  privateSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref privateSubnet2
      RouteTableId: !Ref privateRouteTable
  s3Endpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal: "*"
          Action:
            - "s3:*"
          Resource:
            - "*"
      RouteTableIds:
        - !Ref privateRouteTable
      ServiceName: !Sub com.amazonaws.${AWS::Region}.s3
      VpcId: !Ref pubPrivateVPC
  dynamoDBEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal: "*"
          Action:
            - "dynamodb:*"
          Resource:
            - "*"
      RouteTableIds:
        - !Ref privateRouteTable
      ServiceName: !Sub com.amazonaws.${AWS::Region}.dynamodb
      VpcId: !Ref pubPrivateVPC
Outputs:
  pubPrivateVPCID:
    Description: VPC ID
    Value: !Ref pubPrivateVPC
    Export:
      Name: !Join ["-", [!Ref "AWS::StackName","vpc"]]
  publicSubnet1ID:
    Description: Public Subnet A ID
    Value: !Ref publicSubnet1
    Export:
      Name: !Join ["-", [!Ref "AWS::StackName","public-subnet-a"]]
  privateSubnet1ID:
    Description: Private Subnet A ID
    Value: !Ref privateSubnet1
    Export:
      Name: !Join ["-", [!Ref "AWS::StackName","private-subnet-a"]]
  privateSubnet2ID:
    Description: Private Subnet B ID
    Value: !Ref privateSubnet2
    Export:
      Name: !Join ["-", [!Ref "AWS::StackName","private-subnet-b"]]
  privateVPCSecurityGroup:
    Description: Default security for Lambda VPC
    Value: !GetAtt pubPrivateVPC.DefaultSecurityGroup
    Export:
      Name: !Join ["-", [!Ref "AWS::StackName","vpc-sg"]]