showcase.yaml

---
AWSTemplateFormatVersion: '2010-09-09'
Description: 'AWS EC2 SSH access with IAM showcase'
Parameters:
  VPC:
    Type: 'AWS::EC2::VPC::Id'
    Description: 'The VPC the EC2 instance is launched into.'
  Subnet:
    Type: 'AWS::EC2::Subnet::Id'
    Description: 'The subnet the EC2 instance is launched into.'
  AssumeRole:
    Type: 'String'
    Description: 'Optional IAM role ARN to assume to get the IAM users from another account'
    Default: ''
  KeyName:
    Description: 'Optional key pair of the ec2-user to establish a SSH connection to the EC2 instance when things go wrong.'
    Type: String
    Default: ''
  OS:
    Description: 'Operating system'
    Type: String
    Default: 'AmazonLinux'
    AllowedValues:
    - AmazonLinux
    - Ubuntu
Mappings:
  OSMap:
    AmazonLinux:
      RegionMap: RegionMapAmazonLinux
    Ubuntu:
      RegionMap: RegionMapUbuntu
  RegionMapAmazonLinux:
    'ap-south-1':
      AMI: 'ami-d7abd1b8'
    'eu-west-2':
      AMI: 'ami-489f8e2c'
    'eu-west-1':
      AMI: 'ami-ebd02392'
    'ap-northeast-2':
      AMI: 'ami-8663bae8'
    'ap-northeast-1':
      AMI: 'ami-4af5022c'
    'sa-east-1':
      AMI: 'ami-d27203be'
    'ca-central-1':
      AMI: 'ami-5ac17f3e'
    'ap-southeast-1':
      AMI: 'ami-fdb8229e'
    'ap-southeast-2':
      AMI: 'ami-30041c53'
    'eu-central-1':
      AMI: 'ami-657bd20a'
    'us-east-1':
      AMI: 'ami-4fffc834'
    'us-east-2':
      AMI: 'ami-ea87a78f'
    'us-west-1':
      AMI: 'ami-3a674d5a'
    'us-west-2':
      AMI: 'ami-aa5ebdd2'
  RegionMapUbuntu:
    'ap-south-1':
      AMI: 'ami-099fe766'
    'eu-west-2':
      AMI: 'ami-996372fd'
    'eu-west-1':
      AMI: 'ami-785db401'
    'ap-northeast-2':
      AMI: 'ami-d28a53bc'
    'ap-northeast-1':
      AMI: 'ami-ea4eae8c'
    'sa-east-1':
      AMI: 'ami-10186f7c'
    'ca-central-1':
      AMI: 'ami-9818a7fc'
    'ap-southeast-1':
      AMI: 'ami-6f198a0c'
    'ap-southeast-2':
      AMI: 'ami-e2021d81'
    'eu-central-1':
      AMI: 'ami-1e339e71'
    'us-east-1':
      AMI: 'ami-cd0f5cb6'
    'us-east-2':
      AMI: 'ami-10547475'
    'us-west-1':
      AMI: 'ami-09d2fb69'
    'us-west-2':
      AMI: 'ami-6e1a0117'
Conditions:
  UseCrossAccountIAM: !Not [!Equals [!Ref AssumeRole, '']]
  UseLocalIAM: !Equals [!Ref AssumeRole, '']
  UseUbuntu: !Equals [!Ref OS, 'Ubuntu']
  HasKeyName: !Not [!Equals [!Ref KeyName, '']]
Resources:
  SecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: ssh
      VpcId: !Ref VPC
      SecurityGroupIngress:
      - CidrIp: '0.0.0.0/0'
        IpProtocol: tcp
        FromPort: 22
        ToPort: 22
  InstanceProfile:
    Type: 'AWS::IAM::InstanceProfile'
    Properties:
      Roles:
      - !Ref Role
  Role:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: 'ec2.amazonaws.com'
          Action: 'sts:AssumeRole'
      Path: /
  CrossAccountRolePolicy:
    Type: 'AWS::IAM::Policy'
    Condition: UseCrossAccountIAM
    Properties:
      PolicyName: crossaccountiam
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: 'sts:AssumeRole'
            Resource: !Ref AssumeRole
      Roles:
        - !Ref Role
  LocalRolePolicy:
    Type: 'AWS::IAM::Policy'
    Condition: UseLocalIAM
    Properties:
      PolicyName: iam
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Action: 
          - 'iam:ListUsers'
          - 'iam:GetGroup'
          Resource: '*'
        - Effect: Allow
          Action:
          - 'iam:ListSSHPublicKeys'
          - 'iam:GetSSHPublicKey'
          Resource: !Sub 'arn:aws:iam::${AWS::AccountId}:user/*'
        - Effect: Allow
          Action: 'ec2:DescribeTags'
          Resource: '*'
      Roles:
        - !Ref Role
  Instance:
    Type: AWS::EC2::Instance
    Metadata:
      'AWS::CloudFormation::Init':
        config:
          packages: !If
          - UseUbuntu
          - apt:
              git: []
              awscli: []
          - yum:
              git: []
          files:
            '/opt/install.sh':
              source: 'https://raw.githubusercontent.com/widdix/aws-ec2-ssh/master/install.sh'
              mode: '000755'
              owner: root
              group: root
          commands:
            a_install:
              command: !Sub './install.sh -a "${AssumeRole}"'
              cwd: '/opt'
    Properties:
      ImageId: !FindInMap [!FindInMap [OSMap, !Ref OS, RegionMap], !Ref 'AWS::Region', AMI]
      IamInstanceProfile: !Ref InstanceProfile
      InstanceType: 't2.micro'
      KeyName: !If [HasKeyName, !Ref KeyName, !Ref 'AWS::NoValue']
      UserData: !If
      - UseUbuntu
      - 'Fn::Base64': !Sub |
          #!/bin/bash -x
          bash -ex << "TRY"
            apt-get update
            apt-get -y install python-setuptools
            mkdir aws-cfn-bootstrap-latest
            curl -s -m 60 https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-latest.tar.gz | tar xz -C aws-cfn-bootstrap-latest --strip-components 1
            easy_install aws-cfn-bootstrap-latest
            /usr/local/bin/cfn-init --verbose --stack=${AWS::StackName} --region=${AWS::Region} --resource=Instance
          TRY
          /usr/local/bin/cfn-signal --exit-code $? --stack=${AWS::StackName} --region=${AWS::Region} --resource=Instance
      - 'Fn::Base64': !Sub |
          #!/bin/bash -x
          /opt/aws/bin/cfn-init --verbose --stack=${AWS::StackName} --region=${AWS::Region} --resource=Instance
          /opt/aws/bin/cfn-signal --exit-code $? --stack=${AWS::StackName} --region=${AWS::Region} --resource=Instance
      NetworkInterfaces:
      - AssociatePublicIpAddress: true
        DeleteOnTermination: true
        SubnetId: !Ref Subnet
        DeviceIndex: 0
        GroupSet:
        - !Ref SecurityGroup
      Tags:
      - Key: Name
        Value: 'AWS EC2 SSH access with IAM showcase'
    CreationPolicy:
      ResourceSignal:
        Count: 1
        Timeout: PT15M
Outputs:
  PublicName:
    Description: 'The public name of the EC2 instance.'
    Value: !GetAtt 'Instance.PublicDnsName'