s3_security.json

{
   "AWSTemplateFormatVersion":"2010-09-09",
   "Transform":{
      "Name":"AWS::Include",
      "Parameters":{
         "Location":"s3://storage-specialists-cf-templates/regional_ami_mapping.json"
      }
   },
   "Resources":{
      "myVPC":{
         "Type":"AWS::EC2::VPC",
         "Properties":{
            "CidrBlock":"10.11.12.0/24",
            "EnableDnsSupport":"true",
            "EnableDnsHostnames":"true",
            "InstanceTenancy":"default",
            "Tags":[
               {
                  "Key":"Name",
                  "Value":"S3SecurityWorkshopVPC"
               }
            ]
         }
      },
      "PublicSubnet1":{
         "Type":"AWS::EC2::Subnet",
         "Properties":{
            "VpcId":{
               "Ref":"myVPC"
            },
            "CidrBlock":"10.11.12.0/24",
            "MapPublicIpOnLaunch":"True",
            "Tags":[
               {
                  "Key":"Name",
                  "Value":"S3SecurityWorkshopSubnet"
               }
            ]
         }
      },
      "myInternetGateway":{
         "Type":"AWS::EC2::InternetGateway",
         "Properties":{
            "Tags":[
               {
                  "Key":"Name",
                  "Value":"S3SecurityWorkshopVPC"
               }
            ]
         }
      },
      "AttachGateway":{
         "Type":"AWS::EC2::VPCGatewayAttachment",
         "Properties":{
            "VpcId":{
               "Ref":"myVPC"
            },
            "InternetGatewayId":{
               "Ref":"myInternetGateway"
            }
         }
      },
      "myRouteTable":{
         "Type":"AWS::EC2::RouteTable",
         "Properties":{
            "VpcId":{
               "Ref":"myVPC"
            },
            "Tags":[
               {
                  "Key":"Name",
                  "Value":"S3SecurityWorkshopVPC"
               }
            ]
         }
      },
      "PublicSubnet1RouteAssociaton":{
         "Type":"AWS::EC2::SubnetRouteTableAssociation",
         "Properties":{
            "SubnetId":{
               "Ref":"PublicSubnet1"
            },
            "RouteTableId":{
               "Ref":"myRouteTable"
            }
         }
      },
      "RoutetoInternet":{
         "Type":"AWS::EC2::Route",
         "DependsOn":"myInternetGateway",
         "Properties":{
            "RouteTableId":{
               "Ref":"myRouteTable"
            },
            "DestinationCidrBlock":"0.0.0.0/0",
            "GatewayId":{
               "Ref":"myInternetGateway"
            }
         }
      },
      "SSHAccessSG":{
         "Type":"AWS::EC2::SecurityGroup",
         "Properties":{
            "GroupDescription":"SSH Access",
            "VpcId":{
               "Ref":"myVPC"
            },
            "SecurityGroupIngress":{
               "IpProtocol":"tcp",
               "FromPort":"22",
               "ToPort":"22",
               "CidrIp":"0.0.0.0/0"
            }
         }
      },
      "AdminRole":{
         "Type":"AWS::IAM::Role",
         "Properties":{
            "AssumeRolePolicyDocument":{
               "Version":"2012-10-17",
               "Statement":[
                  {
                     "Effect":"Allow",
                     "Principal":{
                        "Service":[
                           "ec2.amazonaws.com"
                        ]
                     },
                     "Action":[
                        "sts:AssumeRole"
                     ]
                  }
               ]
            },
            "Path":"/"
         }
      },
      "RolePolicies":{
         "Type":"AWS::IAM::Policy",
         "Properties":{
            "PolicyName":"admin",
            "PolicyDocument":{
               "Version":"2012-10-17",
               "Statement":[
                  {
                     "Effect":"Allow",
                     "Action":[
                        "ec2:TerminateInstances",
                        "s3:*"
                     ],
                     "Resource":"*"
                  }
               ]
            },
            "Roles":[
               {
                  "Ref":"AdminRole"
               }
            ]
         }
      },
      "AdminInstanceProfile":{
         "Type":"AWS::IAM::InstanceProfile",
         "Properties":{
            "Path":"/",
            "Roles":[
               {
                  "Ref":"AdminRole"
               }
            ]
         }
      },
      "bucket01":{
         "Type":"AWS::S3::Bucket",
         "Properties":{
            "BucketEncryption":{
               "ServerSideEncryptionConfiguration":[
                  {
                     "ServerSideEncryptionByDefault":{
                        "SSEAlgorithm":"AES256"
                     }
                  }
               ]
            }
         }
      },
      "S3Group":{
         "Type":"AWS::IAM::Group",
         "Properties":{

         }
      },
      "addUserToS3Group":{
         "Type":"AWS::IAM::UserToGroupAddition",
         "Properties":{
            "GroupName":{
               "Ref":"S3Group"
            },
            "Users":[
               {
                  "Ref":"user1"
               },
               {
                  "Ref":"user2"
               }
            ]
         }
      },
      "S3Policy":{
         "Type":"AWS::IAM::Policy",
         "Properties":{
            "PolicyName":"S3Access",
            "PolicyDocument":{
               "Version":"2012-10-17",
               "Statement":[
                  {
                     "Effect":"Allow",
                     "Action":[
                        "s3:*"
                     ],
                     "Resource":"*"
                  }
               ]
            },
            "Groups":[
               {
                  "Ref":"S3Group"
               }
            ]
         }
      },
      "user1":{
         "Type":"AWS::IAM::User",
         "Properties":{
            "UserName":"s3_security_lab_user1"
         }
      },
      "user2":{
         "Type":"AWS::IAM::User",
         "Properties":{
            "UserName":"s3_security_lab_user2"
         }
      },
      "EC2Admin":{
         "Type":"AWS::EC2::Instance",
         "DependsOn":"bucket01",
         "Properties":{
            "ImageId":{
               "Fn::FindInMap":[
                  "RegionalAmiMap",
                  {
                     "Ref":"AWS::Region"
                  },
                  "AmazonLinux2"
               ]
            },
            "InstanceType":"m5.large",
            "SubnetId":{
               "Ref":"PublicSubnet1"
            },
            "Tags":[
               {
                  "Key":"Name",
                  "Value":"Admin"
               }
            ],
            "SecurityGroupIds":[
               {
                  "Ref":"SSHAccessSG"
               }
            ],
            "IamInstanceProfile":{
               "Ref":"AdminInstanceProfile"
            },
            "BlockDeviceMappings":[
               {
                  "DeviceName":"/dev/xvda",
                  "Ebs":{
                     "VolumeType":"gp2",
                     "DeleteOnTermination":"true",
                     "VolumeSize":"10"
                  }
               }
            ],
            "UserData":{
               "Fn::Base64":{
                  "Fn::Join":[
                     "",
                     [
                        "#!/bin/bash -xe\n",
                        "sudo yum update -y\n",
                        "AZ=`curl -s http://169.254.169.254/latest/meta-data/placement/availability-zone`\n",
                        "REGION=${AZ::-1}\n",
                        "BUCKET01=",
                        {
                           "Ref":"bucket01"
                        },
                        "\n",
                        "echo 'AdminInstance' | sudo tee -a  /proc/sys/kernel/hostname\n",
                        "dd if=/dev/zero of=/tmp/output  bs=1M  count=1\n",
                        "aws s3api put-object --bucket $BUCKET01 --key app1/file1 --body /tmp/output\n",
                        "aws s3api put-object --bucket $BUCKET01 --key app1/file2 --body /tmp/output\n",
                        "aws s3api put-object --bucket $BUCKET01 --key app1/file3 --body /tmp/output\n",
                        "aws s3api put-object --bucket $BUCKET01 --key app1/file4 --body /tmp/output\n",
                        "aws s3api put-object --bucket $BUCKET01 --key app1/file5 --body /tmp/output\n",
                        "aws s3api put-object --bucket $BUCKET01 --key app2/file1 --body /tmp/output\n",
                        "aws s3api put-object --bucket $BUCKET01 --key app2/file2 --body /tmp/output\n",
                        "aws s3api put-object --bucket $BUCKET01 --key app2/file3 --body /tmp/output\n",
                        "aws s3api put-object --bucket $BUCKET01 --key app2/file4 --body /tmp/output\n",
                        "aws s3api put-object --bucket $BUCKET01 --key app2/file5 --body /tmp/output\n",
                        "sleep 2\n",
                        "aws ec2 terminate-instances --instance-ids $(curl -s http://169.254.169.254/latest/meta-data/instance-id) --region $REGION\n"
                     ]
                  ]
               }
            }
         }
      },
      "Instance01":{
         "Type":"AWS::EC2::Instance",
         "Properties":{
            "ImageId":{
               "Fn::FindInMap":[
                  "RegionalAmiMap",
                  {
                     "Ref":"AWS::Region"
                  },
                  "AmazonLinux2"
               ]
            },
            "InstanceType":"m5.large",
            "SubnetId":{
               "Ref":"PublicSubnet1"
            },
            "Tags":[
               {
                  "Key":"Name",
                  "Value":"S3_Workshop_Instance01"
               }
            ],
            "SecurityGroupIds":[
               {
                  "Ref":"SSHAccessSG"
               }
            ],
            "BlockDeviceMappings":[
               {
                  "DeviceName":"/dev/xvda",
                  "Ebs":{
                     "VolumeType":"gp2",
                     "DeleteOnTermination":"true",
                     "VolumeSize":"10"
                  }
               }
            ],
            "UserData":{
               "Fn::Base64":{
                  "Fn::Join":[
                     "",
                     [
                        "#!/bin/bash -xe\n",
                        "sudo yum update -y\n",
                        "echo 'storage-workshop' | sudo tee -a  /proc/sys/kernel/hostname\n",
                        "echo '#!/bin/bash' > /etc/profile.d/script.sh\n",
                        {
                           "Fn::Join":[
                              "",
                              [
                                 "echo export bucket=",
                                 {
                                    "Ref":"bucket01"
                                 },
                                 " >> /etc/profile.d/script.sh\n"
                              ]
                           ]
                        }
                     ]
                  ]
               }
            }
         }
      }
   },
   "Outputs":{
      "Bucket01":{
         "Value":{
            "Ref":"bucket01"
         }
      }
   }
}