VyOSを利用したVPN環境構築(静的ルーティング編)

---
AWSTemplateFormatVersion: "2010-09-09"
Description: "VPN TEST: Base environment (VPC and EC2)"

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "General Information"
        Parameters:
          - SystemName
          - Environment
      - Label:
          default: "Network Configuration"
        Parameters:
          - CidrBlockVPC
          - CidrBlockSubnetPublic1
          - CidrBlockSubnetPrivate1
          - CidrBlockRemoteNetwork
      - Label:
          default: "EC2 Instance Configuration"
        Parameters:
          - EC2ImageID
          - EC2InstanceType
          - EC2KeyName
          - EC2VolumeType
          - EC2VolumeSize

Parameters:
  SystemName:
    Type: String
    AllowedValues:
      - tokyo
      - singapore

  Environment:
    Type: String
    Default: dev
    AllowedValues:
      - dev
      - str
      - prd

  CidrBlockVPC:
    Type: String
    AllowedValues:
      -  10.0.0.0/16
      -  192.168.0.0/16

  CidrBlockSubnetPublic1:
    Type: String
    AllowedValues:
      -  10.0.0.0/24
      -  192.168.0.0/24

  CidrBlockSubnetPrivate1:
    Type: String
    AllowedValues:
      -  10.0.128.0/24
      -  192.168.128.0/24

  CidrBlockRemoteNetwork:
    Type: String
    AllowedValues:
      -  192.168.128.0/24
      -  10.0.128.0/24

  EC2ImageID:
    Type: AWS::SSM::Parameter::Value<String>
    Default: /aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2

  EC2InstanceType:
    Type: String
    Default: t3.micro

  EC2KeyName:
    Type: AWS::EC2::KeyPair::KeyName

  EC2VolumeType:
    Type: String
    Default: gp2

  EC2VolumeSize:
    Type: String
    Default: 8

Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref CidrBlockVPC
      EnableDnsSupport: true
      EnableDnsHostnames: true
      InstanceTenancy: default
      Tags:
        - Key: Name
          Value: !Sub "${SystemName}-${Environment}-vpc"
        - Key: System
          Value: !Ref SystemName
        - Key: Environment
          Value: !Ref Environment

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: !Sub "${SystemName}-${Environment}-igw"
        - Key: System
          Value: !Ref SystemName
        - Key: Environment
          Value: !Ref Environment

  VPCGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref VPC

  SubnetPublic1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select
        - 0
        - Fn::GetAZs: !Ref AWS::Region
      CidrBlock: !Ref CidrBlockSubnetPublic1
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub "${SystemName}-${Environment}-public1-subnet"
        - Key: System
          Value: !Ref SystemName
        - Key: Environment
          Value: !Ref Environment

  SubnetPrivate1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select
        - 0
        - Fn::GetAZs: !Ref AWS::Region
      CidrBlock: !Ref CidrBlockSubnetPrivate1
      Tags:
        - Key: Name
          Value: !Sub "${SystemName}-${Environment}-private1-subnet"
        - Key: System
          Value: !Ref SystemName
        - Key: Environment
          Value: !Ref Environment

  EIPNatGateway:
    DependsOn:
      - VPCGatewayAttachment
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc

  NatGateway:
    DependsOn:
      - EIPNatGateway
      - SubnetPublic1
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt EIPNatGateway.AllocationId
      SubnetId: !Ref SubnetPublic1
      Tags:
        - Key: Name
          Value: !Sub "${SystemName}-${Environment}-natgateway"
        - Key: System
          Value: !Ref SystemName
        - Key: Environment
          Value: !Ref Environment

  RouteTablePublic:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub "${SystemName}-${Environment}-public-rtb"
        - Key: System
          Value: !Ref SystemName
        - Key: Environment
          Value: !Ref Environment

  RouteTablePrivate:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub "${SystemName}-${Environment}-private-rtb"
        - Key: System
          Value: !Ref SystemName
        - Key: Environment
          Value: !Ref Environment

  RouteIGW:
    DependsOn:
      - VPCGatewayAttachment
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref RouteTablePublic
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  RouteNatGateway:
    DependsOn:
      - NatGateway
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref RouteTablePrivate
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway

  RouteTableAssociationPublic1:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref SubnetPublic1
      RouteTableId: !Ref RouteTablePublic

  RouteTableAssociationPrivate1:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref SubnetPrivate1
      RouteTableId: !Ref RouteTablePrivate

  IAMRoleSSM:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${SystemName}-${Environment}-ssm-role"
      AssumeRolePolicyDocument: |
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": "ec2.amazonaws.com"
              },
              "Action": "sts:AssumeRole"
            }
          ]
        }
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
      Path: /

  IAMInstanceProfileSSM:
    Type: AWS::IAM::InstanceProfile
    Properties:
      InstanceProfileName: !Sub "${SystemName}-${Environment}-ssm-role"
      Roles: 
        - !Ref IAMRoleSSM
      Path: /

  SecurityGroupServer:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Sub "${SystemName}-${Environment}-server-sg"
      GroupDescription: "Security group for servers"
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: !Ref CidrBlockRemoteNetwork
          Description: "HTTP access from remote network"
        - IpProtocol: icmp
          FromPort: -1
          ToPort: -1
          CidrIp: !Ref CidrBlockRemoteNetwork
          Description: "ICMP access from remote network"
      Tags:
        - Key: Name
          Value: !Sub "${SystemName}-${Environment}-server-sg"
        - Key: System
          Value: !Ref SystemName
        - Key: Environment
          Value: !Ref Environment

  EC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Ref EC2ImageID
      InstanceType: !Ref EC2InstanceType
      KeyName: !Ref EC2KeyName
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            VolumeType: !Ref EC2VolumeType
            VolumeSize: !Ref EC2VolumeSize
      NetworkInterfaces:
        - DeviceIndex: 0
          SubnetId: !Ref SubnetPrivate1
          GroupSet:
            - !Ref SecurityGroupServer
      IamInstanceProfile: !Ref IAMInstanceProfileSSM
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash -xe
          amazon-linux-extras install -y nginx1
          systemctl enable nginx
          systemctl start nginx
          SYSTEM_NAME=${SystemName}
          echo Hello! I\'m ${!SYSTEM_NAME^^} Web Server! > /usr/share/nginx/html/index.html
      Tags:
        - Key: Name
          Value: !Sub "${SystemName}-${Environment}-server"
        - Key: System
          Value: !Ref SystemName
        - Key: Environment
          Value: !Ref Environment

Outputs:
  VPC:
    Value: !Ref VPC
    Export:
      Name: !Sub "${AWS::StackName}::VPC"

  SubnetPublic1:
    Value: !Ref SubnetPublic1
    Export:
      Name: !Sub "${AWS::StackName}::SubnetPublic1"

  SubnetPrivate1:
    Value: !Ref SubnetPrivate1
    Export:
      Name: !Sub "${AWS::StackName}::SubnetPrivate1"

  RouteTablePublic:
    Value: !Ref RouteTablePublic
    Export:
      Name: !Sub "${AWS::StackName}::RouteTablePublic"

  RouteTablePrivate:
    Value: !Ref RouteTablePrivate
    Export:
      Name: !Sub "${AWS::StackName}::RouteTablePrivate"

  IAMRoleSSM:
    Value: !Ref IAMRoleSSM
    Export:
      Name: !Sub "${AWS::StackName}::IAMRoleSSM"

  IAMInstanceProfileSSM:
    Value: !Ref IAMInstanceProfileSSM
    Export:
      Name: !Sub "${AWS::StackName}::IAMInstanceProfileSSM"

  SecurityGroupServer:
    Value: !Ref SecurityGroupServer
    Export:
      Name: !Sub "${AWS::StackName}::SecurityGroupServer"

  EC2Instance:
    Value: !Ref EC2Instance
    Export:
      Name: !Sub "${AWS::StackName}::EC2Instance"

---
AWSTemplateFormatVersion: "2010-09-09"
Description: "VPN TEST: VyOS EC2 Instance (site-to-site VPN router)"

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "General Information"
        Parameters:
          - SystemName
          - Environment
      - Label:
          default: "Network Configuration"
        Parameters:
          - CidrBlockAllowAccessRouter
          - IPAddressAllowSSH
      - Label:
          default: "EC2 Instance Configuration"
        Parameters:
          - EC2ImageID
          - EC2InstanceType
          - EC2KeyName
          - EC2VolumeType
          - EC2VolumeSize
      - Label:
          default: "CloudFormation Stack Reference"
        Parameters:
          - StackVPC

Parameters:
  SystemName:
    Type: String
    Default: singapore

  Environment:
    Type: String
    Default: dev
    AllowedValues:
      - dev
      - str
      - prd

  CidrBlockAllowAccessRouter:
    Type: String
    Default: 192.168.128.0/24

  IPAddressAllowSSH:
    Type: String

  EC2ImageID:
    Type: AWS::EC2::Image::Id
    Default: ami-070a39a224bab5d4f    # VyOS (HVM) 1.2.4-9c9395f4-e891-4577-82e9-a6d5bccfb3c9-ami-00c8302b5b62b168a.4 @ ap-southeast-1

  EC2InstanceType:
    Type: String
    Default: t3.large

  EC2KeyName:
    Type: AWS::EC2::KeyPair::KeyName

  EC2VolumeType:
    Type: String
    Default: gp2

  EC2VolumeSize:
    Type: String
    Default: 10

  StackVPC:
    Type: String

Resources:
  SecurityGroupVyOS:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Sub "${SystemName}-${Environment}-router-sg"
      GroupDescription: "Security group for servers"
      VpcId: {"Fn::ImportValue": !Sub "${StackVPC}::VPC"}
      SecurityGroupIngress:
        - IpProtocol: -1
          FromPort: -1
          ToPort: -1
          CidrIp: !Ref CidrBlockAllowAccessRouter
          Description: "Access by all protocols from allowed network"
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: !Ref IPAddressAllowSSH
          Description: "SSH access from my IP address"
      Tags:
        - Key: Name
          Value: !Sub "${SystemName}-${Environment}-router-sg"
        - Key: System
          Value: !Ref SystemName
        - Key: Environment
          Value: !Ref Environment

  EC2InstanceVyOS:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Ref EC2ImageID
      InstanceType: !Ref EC2InstanceType
      KeyName: !Ref EC2KeyName
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            VolumeType: !Ref EC2VolumeType
            VolumeSize: !Ref EC2VolumeSize
      NetworkInterfaces:
        - DeviceIndex: 0
          SubnetId: {"Fn::ImportValue": !Sub "${StackVPC}::SubnetPublic1"}
          GroupSet:
            - !Ref SecurityGroupVyOS
      SourceDestCheck: false
      Tags:
        - Key: Name
          Value: !Sub "${SystemName}-${Environment}-router"
        - Key: System
          Value: !Ref SystemName
        - Key: Environment
          Value: !Ref Environment

  EIPVyOS:
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc

  EIPAssociationVyOS:
    Type: AWS::EC2::EIPAssociation
    Properties:
      AllocationId: !GetAtt EIPVyOS.AllocationId
      InstanceId: !Ref EC2InstanceVyOS

Outputs:
  SecurityGroupVyOS:
    Value: !Ref SecurityGroupVyOS
    Export:
      Name: !Sub "${AWS::StackName}::SecurityGroupVyOS"

  EC2InstanceVyOS:
    Value: !Ref EC2InstanceVyOS
    Export:
      Name: !Sub "${AWS::StackName}::EC2InstanceVyOS"

  EC2InstanceVyOSPublicIP:
    Value: !GetAtt EC2InstanceVyOS.PublicIp
    Export:
      Name: !Sub "${AWS::StackName}::EC2InstanceVyOSPublicIP"

  EC2InstanceVyOSPrivateIP:
    Value: !GetAtt EC2InstanceVyOS.PrivateIp
    Export:
      Name: !Sub "${AWS::StackName}::EC2InstanceVyOSPrivateIP"