1_RotatePublicRDS.yaml

# Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Permission is hereby granted, free of charge, to any person obtaining a copy of this
# software and associated documentation files (the "Software"), to deal in the Software
# without restriction, including without limitation the rights to use, copy, modify,
# merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
# permit persons to whom the Software is furnished to do so.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
# INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
# PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
# HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
# OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
# SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

---
AWSTemplateFormatVersion: '2010-09-09'

Description: Demo environment for AWS Secrets Manager with public RDS rotation.


# SecretsManagerDemoPublicRDS.yaml
#
# This CloudFormation template creates infrastructure for demonstrating
# AWS Secrets Manager using a public RDS database.
#
# The template builds the following:
#
# - An Internet gateway
# - Two public subnets (PubSubnet01 and 02)
# - A public route Table (PubRouteTable) with a default route pointing to
#   the Internet gateway
# - An EC2 instance running the Amazon Linux 2 operating system (Bastion)
#   which is installed on PubSubnet01
# - A security group for the EC2 instance (BastionSG)
# - Two bash scripts on the bastion instance
#     mysql.oldway.sh - connect to the database with hard-coded passwords
#     mysql.newway.sh - connect to the database with secrets manager
# - A public RDS database
#
# SECURITY NOTE:
#
# The purpose of this template is to give a simple demonstration of AWS
# Secrets Manager.  To simplify the demo, the EC2 bastion host and the RDS
# database are on public subnets and OPEN TO THE INTERNET.  You should
# delete this CloudFormation stack after you have completed the demo.
# Please consult the Secrets Manager user guide for information on how to
# use Secrets Manager in a more secure manner.

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      -
        Label:
          default: 'SECURITY NOTE: Please delete this stack after you complete this demo!'
        Parameters:
          - AZName01
          - AZName02
          - BastionKeyPair
          - DBName
          - DBPort
          - NamePrefix
          - ProjectTag
      -
        Label:
          default: 'SECURITY NOTE: Please delete this stack after you complete this demo!'
    ParameterLabels: 
      AZName01: 
        default: 'Choose an Avaiability Zone:'
      AZName02: 
        default: 'Choose a second Avaiability Zone:'
      BastionKeyPair:
        default: 'Choose a key pair:'
      DBName:
        default: 'Enter the name of the database:'
      DBPort:
        default: 'Enter the TCP port for the database endpoint:'
      NamePrefix:
        default: 'Enter a prefix for the Name tag:'
      ProjectTag:
        default: 'Enter the value for the Project tag:'

Parameters:

# NamePrefix - A prefix to apply to the Name tag of taggable resources.
# The Name tag will be set to the NamePrefix, a dash ("-"), and a suffix
# that varies based on the resource.  You would typically accept the default.

  NamePrefix:
    Type: String
    Default: 'smdemo'
    MinLength: 2
    MaxLength: 15
    AllowedPattern: '[a-zA-Z][a-zA-Z0-9]*'

# ProjectTag - A value to apply to the Project tag of taggable resources. You
# would typically accept the default.

  ProjectTag:
    Type: String
    Default: 'smproj'
    MinLength: 2
    MaxLength: 15
    AllowedPattern: '[a-zA-Z][a-zA-Z0-9]*'

# AZName01 and AZName02 - The two Availability Zones to use for building subnets.
# Two are needed because a DB subnet group requires two different AZs.

  AZName01:
    Type: AWS::EC2::AvailabilityZone::Name

  AZName02:
    Type: AWS::EC2::AvailabilityZone::Name

# BastionKeyPair - The EC2 keypair for the bastion host.

  BastionKeyPair:
    Type: AWS::EC2::KeyPair::KeyName

# DBName - The RDS database instance name for the MySQL database.
# You would typically accept the default.

  DBName:
    Default: 'smdemo'
    Type: String
    MinLength: 1
    MaxLength: 64
    AllowedPattern: '[a-zA-Z][a-zA-Z0-9]*'
    ConstraintDescription: 'Up to 64 alphanumerics beginning with a letter'

# DBPort - The TCP port for the MySQL RDS database.  You should typically
# accept the default.

  DBPort:
    Default: 3306
    Type: Number
    MinValue: 1024
    MaxValue: 65535
    ConstraintDescription: 'Must be between 1024 and 65535'

Resources:

# VpcName - Our VPC

  VpcName:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.200.0.0/16
      EnableDnsSupport: 'true'
      EnableDnsHostnames: 'true'
      Tags:
      - Key: Name
        Value: !Join [ '', [ Ref: NamePrefix, '-vpc' ]]
      - Key: Project
        Value: !Ref ProjectTag

# PubSubnet01 and PubSubnet02 - Public subnets.  Note that the EC2 and
# RDS instances only go into PubSubnet01.  We need, however, another
# subnet for the DB subnet group regardless.

  PubSubnet01:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Ref AZName01
      CidrBlock: 10.200.11.0/24
      MapPublicIpOnLaunch: 'true'
      Tags:
      - Key: Name
        Value: !Join [ '', [ Ref: NamePrefix, '-pubsn01' ]]
      - Key: Project
        Value: !Ref ProjectTag
      VpcId: !Ref VpcName

  PubSubnet02:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Ref AZName02
      CidrBlock: 10.200.12.0/24
      MapPublicIpOnLaunch: 'true'
      Tags:
      - Key: Name
        Value: !Join [ '', [ Ref: NamePrefix, '-pubsn02' ]]
      - Key: Project
        Value: !Ref ProjectTag
      VpcId: !Ref VpcName

# VpcIgw and VpcIgwAttachment - Set up the Internet gateway
# and the attachment.

  VpcIgw:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
      - Key: Name
        Value: !Join [ '', [ Ref: NamePrefix, '-igw' ]]
      - Key: Project
        Value: !Ref ProjectTag

  VpcIgwAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref VpcIgw
      VpcId: !Ref VpcName

# PubRouteTable - The public routing table.

  PubRouteTable:
    Type: AWS::EC2::RouteTable
    DependsOn: VpcIgwAttachment
    Properties:
      VpcId: !Ref VpcName
      Tags:
      - Key: Name
        Value: !Join [ '', [ Ref: NamePrefix, '-pubrtb' ]]
      - Key: Project
        Value: !Ref ProjectTag

# DefaultPubRoute - The default route to the public internet.

  DefaultPubRoute:
    Type: AWS::EC2::Route
    DependsOn: VpcIgwAttachment
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref VpcIgw
      RouteTableId: !Ref PubRouteTable

# PubSubnet01PubRtb and PubSubnet02PubRtb - Associate subnets
# with the routng table.

  PubSubnet01PubRtb:
    Type: AWS::EC2::SubnetRouteTableAssociation
    DependsOn: VpcIgwAttachment
    Properties:
      RouteTableId: !Ref PubRouteTable
      SubnetId: !Ref PubSubnet01

  PubSubnet02PubRtb:
    Type: AWS::EC2::SubnetRouteTableAssociation
    DependsOn: VpcIgwAttachment
    Properties:
      RouteTableId: !Ref PubRouteTable
      SubnetId: !Ref PubSubnet02

# BastionSG - The security group for ssh on the bastion host.,  This
# is open to the Internet.

  BastionSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Enable SSH access via port 22
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: '22'
        ToPort: '22'
        CidrIp: 0.0.0.0/0
      Tags:
      - Key: Name
        Value: !Join [ '', [ Ref: NamePrefix, '-sg01' ]]
      - Key: Project
        Value: !Ref ProjectTag
      VpcId: !Ref VpcName

# BastionRole - The instance role for the bastion host.  We only need
# permissions for Secrets Manager and KMS for this demo.

  BastionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - ec2.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: '/'
      Policies:
      - PolicyName: !Join [ '', [ Ref: NamePrefix, '-CloudWatch' ]]
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - cloudwatch:PutMetricData
            Resource: '*'
      - PolicyName: !Join [ '', [ Ref: NamePrefix, '-CloudWatchLogs' ]]
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            - logs:DescribeLogStreams
            Resource: arn:aws:logs:*:*:*
      - PolicyName: !Join [ '', [ Ref: NamePrefix, '-SecretsManager' ]]
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - secretsmanager:*
            Resource: '*'
      - PolicyName: !Join [ '', [ Ref: NamePrefix, '-KMS' ]]
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - kms:*
            Resource: '*'

# BastionProfile - The instance profile for the bastion host which just
# contains the corresponding IAM role.

  BastionProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: '/'
      Roles:
      - !Ref BastionRole

# Bastion - Our bastion host.  Note that we launch this with the BastionProfile
# instance profile so we get access to some AWS services.  We also create the
# take advantage of CloudFormation::Init to do some initialization create files,
# install packages, and run commands.
#
# FIles created:
#
# mysql.oldway.sh - shows the old way of connecting to the datbases with
# hardcoded credentials
#
# mysql.newway.sh - shows the new way of connecting to the database with
# AWS Secrets Manager
#
# Packages installed:
#
# jq - for parsing the strings from Secrets Manager
# python3 - for building the newest AWS CLI which has the most updated commands
#
# Additionally:
#
# (1) Install the LAMP (Linux-Apache-MariaDB-PHP) stack using
# amazon-linux-extras.   We just need the mysql client and this is an easy
# way of getting it.
#
# (2) Build the latest AWS CLI which has the latest commands
#
# (3) Apply updates - twice for good measure!


  Bastion:
    Type: AWS::EC2::Instance
    DependsOn:
      - VpcIgwAttachment
      - DBInstance

    Metadata:
      AWS::CloudFormation::Init:
        configSets:
          default:
          - BastionSetup

        BastionSetup:
          packages:
            yum: 
              jq: []
              python3: []
          files:
            /home/ec2-user/mysql.oldway.sh:
              content: !Sub |
                #/bin/bash
                
                # mysql.oldway.sh
                
                # This is the old way of accessing a database, with hard-coded passwords.
                # This script will only work right after the CloudFormation script runs.
                # After you store and rotate the secret, you will need to use the
                # mysql.newway.sh script.
                
                mysql \
                -p${DBMasterPassword.RandomString} \
                -u ${DBMasterUser.RandomString} \
                -P ${DBPort} \
                -h ${DBInstance.Endpoint.Address} 
              mode: '755'
              owner: ec2-user
              group: ec2-user
            /home/ec2-user/mysql.newway.sh:
              content: !Sub |
                #/bin/bash
                
                # This is the new way of accessing a database, with AWS Secrets Manager.
                
                if [ $# -ne 1 ]
                then
                  echo usage: $0 SecretName
                  exit 1
                fi
                
                secret=$(aws secretsmanager get-secret-value --secret-id $1 --region ${AWS::Region} | jq .SecretString | jq fromjson)
                user=$(echo $secret | jq -r .username)
                password=$(echo $secret | jq -r .password)
                endpoint=$(echo $secret | jq -r .host)
                port=$(echo $secret | jq -r .port)
                
                mysql \
                -p$password \
                -u $user \
                -P $port \
                -h $endpoint
              mode: '755'
              owner: ec2-user
              group: ec2-user
            /tmp/awscli-bundle.zip:
              source: https://s3.amazonaws.com/aws-cli/awscli-bundle.zip
              mode: '755'
          commands:
            cmd10mariadb: 
              command: 'amazon-linux-extras install lamp-mariadb10.2-php7.2'
            cmd20unzipcli: 
              command: 'unzip awscli-bundle.zip'
              cwd: '/tmp'
            cmd30installcli:
              command: './awscli-bundle/install -i /usr/local/aws -b /usr/local/bin/aws'
              cwd: '/tmp'

    CreationPolicy:
      ResourceSignal:
        Timeout: PT15M

    Properties:
      AvailabilityZone: !Ref AZName01
      IamInstanceProfile: !Ref BastionProfile
      ImageId: !GetAtt AMIInfo.Id
      InstanceInitiatedShutdownBehavior: stop
      InstanceType: t2.micro
      KeyName: !Ref BastionKeyPair
      Monitoring: true
      NetworkInterfaces:
      - AssociatePublicIpAddress: true
        DeviceIndex: '0'
        GroupSet:
        - !Ref BastionSG
        SubnetId: !Ref PubSubnet01
      Tags:
      - Key: Name
        Value: !Join [ '', [ Ref: NamePrefix, '-host' ]]
      - Key: Project
        Value: !Ref ProjectTag
      Tenancy: default
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash -xe
          /opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource Bastion --region ${AWS::Region}

          mysql -p${DBMasterPassword.RandomString} -u ${DBMasterUser.RandomString} -P ${DBPort} -h ${DBInstance.Endpoint.Address} <<EOF
          USE ${DBName}
          CREATE TABLE bookinfo (BookId int, BookTitle varchar(255), BookAuthor varchar(255));
          INSERT INTO bookinfo (BookId, BookTitle, BookAuthor) VALUES (1, "A Tale of Two Cities", "Charles Dickens");
          EOF

          /opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource Bastion --region ${AWS::Region}

# Create a Lambda excution role for the AMI lookup Lambda function

  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: '/'
      Policies:
      - PolicyName: root
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            Resource: arn:aws:logs:*:*:*
          - Effect: Allow
            Action:
            - ec2:DescribeImages
            Resource: '*'

# AMIInfoFunction - Look up an AMI based on a NameFilter
# This AWS Lambda function is used to look up an Amazon EC2 AMI based
# on a name filter. An example of a name filter would be:
#
# amzn2-ami-hvm\*ebs
#
# After looking up the names of all images that satify the filter,
# they are sorted in reverse by date/time stamp and the first AMI
# ID (which corresponds to the newest AMI) is returned.
#
# Using a Lambda function makes it possible to look up the AMI
# dynamically.  THe alternative would be to create a static map.
#
# Some enhancements could be made here, for example filtering out
# beta releases.

  AMIInfoFunction:
    Type: AWS::Lambda::Function
    Properties: 
      Description: 'Look up an AMI based on a filter'
      Handler: index.handler
      MemorySize: 128
      Role: !GetAtt LambdaExecutionRole.Arn
      Runtime: 'python3.6'
      Timeout: 30
      Tags: 
      - Key: Name
        Value: !Join [ '', [ Ref: NamePrefix, '-amilambda' ]]
      - Key: Project
        Value: !Ref ProjectTag
      Code:
        ZipFile: |
          import json
          import boto3
          import cfnresponse
          def handler(event, context):
            if event['RequestType'] == 'Delete':
              responseData = {}      
              cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData)
              return
            
            ec2=boto3.client('ec2')
            imageDescriptions=ec2.describe_images(
              Owners=['amazon'],
              Filters=[
                {'Name': 'name', 'Values': [event['ResourceProperties']['NameFilter']]}
              ],
            )
            
            if len(imageDescriptions) == 0:
              responseData = {}
              cfnresponse.send(event, context, cfnresponse.FAILED)
            else:
              amiNames = sorted(imageDescriptions['Images'],
                key=lambda x: x['CreationDate'],
                reverse=True)
              responseData = {}
              responseData['Id'] = amiNames[0]['ImageId']
              cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData)
            
            return

# AMIInfo - The AWS Lambda-backed resource for looking up an Amazon EC2 AMI
#
# Parameters
#
# ServiceToken - a pointer to the AWS Lambda function
# NameFilter - the name filter to pass to the describe_images API

  AMIInfo:
    Type: Custom::AMIInfo
    Properties:
      ServiceToken: !GetAtt AMIInfoFunction.Arn
      NameFilter: 'amzn2-ami-hvm*gp2'

# RandomStrFunction - Generate a string of random characters
#
# This AWS Lambda function is used to generate a random string
# of letters. We'll use the Python string module to do this.
# You can change the composition of the string by changing the
# methods that are used.

  RandomStrFunction:
    Type: AWS::Lambda::Function
    Properties: 
      Description: 'Generate a random string of characters'
      Handler: index.handler
      MemorySize: 128
      Role: !GetAtt LambdaExecutionRole.Arn
      Runtime: 'python3.6'
      Timeout: 30
      Tags: 
      - Key: Name
        Value: !Join [ '', [ Ref: NamePrefix, 'rndstrlambda' ]]
      - Key: Project
        Value: !Ref ProjectTag
      Code:
        ZipFile: |
          import json
          import boto3
          import cfnresponse
          import string
          import random
          def handler(event, context):
            if event['RequestType'] == 'Delete':
              responseData = {}      
              cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData)
              return
            
            StringLength=int(event['ResourceProperties']['StringLength'])
            
            if StringLength <= 0:
              responseData = {}
              cfnresponse.send(event, context, cfnresponse.FAILED)
            else:
              responseData = {}
              chars=string.ascii_letters # change this to use other kinds of characters
              
              responseData['RandomString'] = ''.join(random.choice(chars) for _ in range(StringLength))
              cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData)
            
            return

# DBMasterUser - The AWS Lambda-backed resource for generating a random username
#
# Parameters
#
# ServiceToken - a pointer to the AWS Lambda function
# StringLength - the length of the random string to generate

  DBMasterUser:
    Type: Custom::DBMasterUser
    Properties:
      ServiceToken: !GetAtt RandomStrFunction.Arn
      StringLength: '16'

# DBMasterPassword - The AWS Lambda-backed resource for generating a random password
#
# Parameters
#
# ServiceToken - a pointer to the AWS Lambda function
# StringLength - the length of the random string to generate

  DBMasterPassword:
    Type: Custom::DBMasterPassword
    Properties:
      ServiceToken: !GetAtt RandomStrFunction.Arn
      StringLength: '32'

# DBSG - The security group for the RDS database

  DBSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Enable SSH access via port 22
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: !Ref DBPort
        ToPort: !Ref DBPort
        CidrIp: 0.0.0.0/0
      Tags:
      - Key: Name
        Value: !Join [ '', [ Ref: NamePrefix, '-dbsg' ]]
      - Key: Project
        Value: !Ref ProjectTag
      VpcId: !Ref VpcName

# DBSubnetGroup - Database subnet group
#
# We need this even for single AZ databases.

  DBSubnetGroup:
    Type: AWS::RDS::DBSubnetGroup
    Properties: 
      DBSubnetGroupDescription: Subnet group for RDS database
      SubnetIds:
        - !Ref PubSubnet01
        - !Ref PubSubnet02
      Tags:
      - Key: Name
        Value: !Join [ '', [ Ref: NamePrefix, '-dbsubg' ]]
      - Key: Project
        Value: !Ref ProjectTag

# DBInstance - Our test database.
#
# Note that this is a public database which makes this tutorial more
# straightforward.  Ordinarily, we'd use a private database.  We'll keep
# it simple in this demo.  To have some randomness with the initial
# password, we'll use the resource ID for the database security group
# as the initial password.  The password will change after the first
# rotation.

  DBInstance:
    Type: AWS::RDS::DBInstance
    DependsOn: VpcIgwAttachment
    DeletionPolicy: Delete
    Properties:
      AllocatedStorage: 5
      AllowMajorVersionUpgrade: false
      AutoMinorVersionUpgrade: true
      AvailabilityZone: !Ref AZName01
      BackupRetentionPeriod: 0
      DBInstanceClass: db.t2.micro
      DBName: !Ref DBName
      DBSubnetGroupName: !Ref DBSubnetGroup
      Engine: 'mysql'
      EngineVersion: '5.7'
      MasterUsername: !GetAtt DBMasterUser.RandomString
      MasterUserPassword: !GetAtt DBMasterPassword.RandomString
      MultiAZ: false
      Port: !Ref DBPort
      PubliclyAccessible: true
      StorageType: gp2
      Tags:
      - Key: Name
        Value: !Join [ '', [ Ref: NamePrefix, '-db' ]]
      - Key: Project
        Value: !Ref ProjectTag
      VPCSecurityGroups:
        - !Ref DBSG

Outputs:
  SecurityNotification:
    Description: SecurityNotification
    Value: 'SECURITY NOTE: Please delete this stack after you complete this demo!'

  BastionIP:
    Description: Bastion IP Address
    Value: !GetAtt Bastion.PublicIp

  DBUser:
    Description: RDS MySQL master user
    Value: !GetAtt DBMasterUser.RandomString

  DBPassword:
    Description: RDS MySQL master user initial password
    Value: !GetAtt DBMasterPassword.RandomString 

  DBEndpoint:
    Description: RDS MySQL endpoint
    Value: !GetAtt DBInstance.Endpoint.Address