cf-template.yml

---
Description: Splits an input AMI into a new AMI spread across multiple EBS snapshots
Parameters:
  AppSourceAMI:
    Description: Source AMI
    Type: String
    Default: ami-0625f87c
  RootDevPartition:
    Description: Root Filesystem Partition on the AMI's root disk
    Type: Number
    Default: 2
    AllowedValues:
      - 1
      - 2
      - 3
      - 4
  AppFilesystemParameters:
    Description: "space-separated filesystem designations of the form [PATH]:[SIZE]:[MOUNT_OPTIONS]"
    # Default disk partitions for Center for Internet Security recommendations
    Default: "/tmp:20:nodev,nosuid,noexec /var/tmp:7:nodev,nosuid,noexec /var:10:defaults /home:10:defaults,nodev /var/log/audit:5:defaults /var/log:15:defaults"
    Type: String
  LogRetention:
    Description: Number of days to retain the log
    Type: Number
    Default: 1
  SoftwareRepoURL:
    Description: The git checkout URL for the repo that contains splitAMI.rb
    Type: String
    Default: https://github.com/benton/splitami.git
  SoftwareVersion:
    Description: Which branch / Git reference of splitAMI.rb to run
    Type: String
    Default: root-dev-partition
  InstanceType:
    Description: Worker EC2 instance type (m3.medium, etc).
    Type: String
    ConstraintDescription: must be a valid EC2 instance type.
    Default: t2.micro
  InstanceBootKey:
    Description: EC2 Boot Key, installed for user 'ec2-user'
    Type: AWS::EC2::KeyPair::KeyName
    Default: medistrano
  Shutdown:
    Description: Whether or not to delete this CloudFormation Stack on completion
    Type: String
    Default: true
    AllowedValues:
      - true
      - false
  PublicImage:
    Description: Whether or not to make the resulting AMI Public
    Type: String
    Default: false
    AllowedValues:
      - true
      - false
Resources:
  AMIInstance:
    Type: "AWS::EC2::Instance"
    DependsOn: LogStream
    Metadata:
      AWS::CloudFormation::Init:
        AppInstall:
          package_upgrade: true
          packages:
            yum:
              git: []
              gcc: []
              ruby-devel: []
          files:
            "/scripts/app-install":
              content:
                !Sub |
                  echo Installing splitAMI...
                  gem install io-console bundler
                  git clone ${SoftwareRepoURL} /app
                  cd /app && git checkout ${SoftwareVersion}
                  bundle install --jobs=4
        AppRun:
          files:
            "/scripts/app-run":
              content:
                !Sub |
                  echo Running splitAMI...
                  ./splitAMI.rb ${AppSourceAMI} ${AppFilesystemParameters}
        SetupLogging:
          files:
            "/scripts/setup-logging":
              content: !Sub |
                curl -O \
                https://s3.amazonaws.com/aws-cloudwatch/downloads/latest/awslogs-agent-setup.py
                chmod +x ./awslogs-agent-setup.py
                ./awslogs-agent-setup.py -n -r ${AWS::Region} -c /etc/awslogs.conf
            "/etc/awslogs.conf":
              content:
                Fn::Join:
                  - ''
                  - - !Sub |
                      [general]
                      state_file = /var/awslogs/state/agent-state

                      [/var/log/cloud-init-output.log]
                      file = /var/log/cloud-init-output.log
                      log_group_name = ${LogGroup}
                      log_stream_name = ${LogStream}
                      datetime_format = %b %d %H:%M:%S
        configSets:
          All:
          - SetupLogging
          - AppInstall
          - AppRun
    Properties:
      UserData:
        Fn::Base64:
          !Sub |
            #!/bin/bash
            set -ex pipefail
            export PATH="/usr/local/sbin:/usr/local/bin:$PATH:/opt/aws/bin"
            export PUBLICIMAGE="${PublicImage}"
            export ROOT_DEV_PARTITION=${RootDevPartition}
            aws configure set default.region ${AWS::Region}
            cfn-init --region ${AWS::Region} -s ${AWS::StackName} \
              -r AMIInstance --configsets All
            bash -ex /scripts/setup-logging
            bash -ex /scripts/app-install
            cd /app
            bash -ex /scripts/app-run
            if ${Shutdown} ; then
              echo Deleting Stack ${AWS::StackName}...
              sleep 30 # wait for CloudwatchLogs Agent to finish sending data
              aws cloudformation delete-stack --stack-name ${AWS::StackName}
            fi
      ImageId:
        Fn::FindInMap:
        - RegionAMIMap
        - Ref: AWS::Region
        - AMI
      InstanceType: !Ref InstanceType
      KeyName: !Ref InstanceBootKey
      SecurityGroupIds:
      - !GetAtt EC2SecurityGroup.GroupId
      SubnetId: !Ref PublicSubnet
      IamInstanceProfile: !Ref IAMInstanceProfile
      Tags:
      - Key: Application
        Value: !Ref AWS::StackName
      - Key: Name
        Value: AMI Splitter
      - Key: Project
        Value: splitami
      - Key: Environment
        Value: sandbox
      - Key: Type
        Value: app
      - Key: 'mdsol:splitami:sandbox:app'
        Value: ""
  IAMRole:
    Type: AWS::IAM::Role
    Properties:
      Path: "/"
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - ec2.amazonaws.com
          Action:
          - sts:AssumeRole
      Policies:
      - PolicyName: CloudWatchLogs-LogEvents
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:DescribeLogGroups
            - logs:DescribeLogStreams
            - logs:PutLogEvents
            Resource: "*"
      - PolicyName: Split-EBS-AMIs
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - ec2:AttachVolume
            - ec2:CreateVolume
            - ec2:DeleteVolume
            - ec2:CreateImage
            - ec2:DescribeVolumes
            - ec2:DetachVolume
            - ec2:DescribeInstances
            - ec2:CreateSnapshot
            - ec2:DescribeSnapshots
            - ec2:DescribeImages
            - ec2:RegisterImage
            - ec2:CreateTags
            - ec2:ModifyImageAttribute
            - ec2:ModifySnapshotAttribute
            Resource: "*"
      - PolicyName: Delete-My-Own-CF-stack
        PolicyDocument:
          Statement:
          - Action:
            - cloudformation:DeleteStack
            Effect: Allow
            Resource: !Sub arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${AWS::StackName}/*
          - Action:
            - ec2:TerminateInstances
            - ec2:DeleteSecurityGroup
            Condition:
              StringEquals:
                ec2:ResourceTag/aws:cloudformation:stack-id:
                  Ref: AWS::StackId
            Effect: Allow
            Resource: "*"
          - Action:
            - ec2:DescribeInstances
            - ec2:DeleteVpc
            - ec2:DeleteSubnet
            - ec2:DeleteInternetGateway
            - ec2:DeleteNetworkAcl
            - ec2:DetachInternetGateway
            - ec2:DeleteRouteTable
            - ec2:DeleteNetworkAclEntry
            - ec2:DisassociateRouteTable
            - ec2:DescribeRouteTables
            - ec2:DeleteRoute
            - ec2:DescribeNetworkAcls
            - ec2:DescribeInternetGatewaysResult
            - ec2:DescribeSubnets
            - ec2:ReplaceNetworkAclAssociation
            - ec2:DescribeInternetGateways
            - ec2:DescribeVpcs
            Effect: Allow
            Resource: "*"
          - Action:
            - iam:DeleteInstanceProfile
            - iam:RemoveRoleFromInstanceProfile
            Effect: Allow
            Resource: !Sub >-
              arn:aws:iam::${AWS::AccountId}:instance-
              profile/${AWS::StackName}-IAMInstanceProfile-*
            Resource:
              Fn::Join:
              - ':'
              - - 'arn:aws:iam:'
                - Ref: AWS::AccountId
                - !Sub instance-profile/${AWS::StackName}-IAMInstanceProfile-*
          - Action:
            - iam:DeleteRole
            - iam:DeleteRolePolicy
            Effect: Allow
            Resource: !Sub >-
              arn:aws:iam::${AWS::AccountId}:role/${AWS::StackName}-IAMRole-*
  IAMInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: "/"
      Roles:
      - Ref: IAMRole
  VPC:
    Type: AWS::EC2::VPC
    DependsOn: IAMInstanceProfile
    Properties:
      EnableDnsSupport: true
      EnableDnsHostnames: true
      CidrBlock:
        Fn::FindInMap:
        - SubnetConfig
        - VPC
        - CIDR
      Tags:
      - Key: Application
        Value: !Ref AWS::StackName
      - Key: Network
        Value: Public
  InternetGateway:
    Type: AWS::EC2::InternetGateway
    DependsOn: IAMInstanceProfile
    Properties:
      Tags:
      - Key: Application
        Value: !Ref AWS::StackName
      - Key: Network
        Value: Public
  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      MapPublicIpOnLaunch: true
      CidrBlock:
        Fn::FindInMap:
        - SubnetConfig
        - Public
        - CIDR
      Tags:
      - Key: Application
        Value: !Ref AWS::StackName
      - Key: Network
        Value: Public
  GatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId:
        Ref: VPC
      InternetGatewayId:
        Ref: InternetGateway
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId:
        Ref: VPC
      Tags:
      - Key: Application
        Value: !Ref AWS::StackName
      - Key: Network
        Value: Public
  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: GatewayAttachment
    Properties:
      RouteTableId:
        Ref: PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId:
        Ref: InternetGateway
  PublicSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId:
        Ref: PublicSubnet
      RouteTableId:
        Ref: PublicRouteTable
  PublicNetworkAcl:
    Type: AWS::EC2::NetworkAcl
    Properties:
      VpcId:
        Ref: VPC
      Tags:
      - Key: Application
        Value: !Ref AWS::StackName
      - Key: Network
        Value: Public
  InboundPublicNetworkAclEntry:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId:
        Ref: PublicNetworkAcl
      RuleNumber: '100'
      Protocol: '6'
      RuleAction: allow
      Egress: false
      CidrBlock: 0.0.0.0/0
      PortRange:
        From: '0'
        To: '65535'
  OutboundPublicNetworkAclEntry:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId:
        Ref: PublicNetworkAcl
      RuleNumber: '100'
      Protocol: '6'
      RuleAction: allow
      Egress: true
      CidrBlock: 0.0.0.0/0
      PortRange:
        From: '0'
        To: '65535'
  PublicSubnetNetworkAclAssociation:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    Properties:
      SubnetId:
        Ref: PublicSubnet
      NetworkAclId:
        Ref: PublicNetworkAcl
  EC2SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow ssh to host
      VpcId:
        Ref: VPC
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: '22'
        ToPort: '22'
        CidrIp: 0.0.0.0/0
  LogGroup:
    DependsOn: GatewayAttachment
    Type: "AWS::Logs::LogGroup"
    DeletionPolicy: Retain
    Properties:
      RetentionInDays: !Ref LogRetention
  LogStream:
    Type: "AWS::Logs::LogStream"
    DeletionPolicy: Retain
    Properties:
      LogGroupName: !Ref LogGroup
Outputs:
  LogURL:
    Description: The AWS Console URL for the log output
    Value:
      Fn::Join:
        - ''
        - - https://console.aws.amazon.com/cloudwatch/home?region=
          - !Sub ${AWS::Region}#logEventViewer:group=${LogGroup};
          - !Sub stream=${LogStream}
  LogGroup:
    Description: The CloudwatchLogs LogGroup
    Value: !Ref LogGroup
  LogStream:
    Description: The CloudwatchLogs LogStream
    Value: !Ref LogStream
  DebugCommand:
    Description: Run this command if something goes wrong
    Value: !Sub |-
      ssh -i ~/.ssh/${InstanceBootKey} ec2-user@${AMIInstance.PublicDnsName}
       cat /var/log/cloud-init-output.log
Mappings:
  # AMI Name = amzn-ami-hvm-2017.03.0.20170417-x86_64-gp2
  RegionAMIMap:
    ap-northeast-1: # Tokyo, Japan
      AMI: ami-923d12f5
    ap-northeast-2: # Seoul, South Korea
      AMI: ami-9d15c7f3
    ap-south-1: # Mumbai, India
      AMI: ami-52c7b43d
    sa-east-1: # Sao Paolo, Brazil
      AMI: ami-37cfad5b
    ap-southeast-2: # Sydney, Australia
      AMI: ami-162c2575
    ap-southeast-1: # Singapore
      AMI: ami-fc5ae39f
    eu-central-1: # Frankfurt, Germany
      AMI: ami-b968bad6
    eu-west-1: # Dublin, Ireland
      AMI: ami-01ccc867
    eu-west-2: # London, England
      AMI: ami-b6daced2
    us-east-1: # Virginia, USA
      AMI: ami-c58c1dd3
    us-east-2: # Ohio, USA
      AMI: ami-4191b524
    us-west-1: # California, USA
      AMI: ami-7a85a01a
    us-west-2: # Oregon, USA
      AMI: ami-4836a428
  SubnetConfig:
    VPC:
      CIDR: 10.0.0.0/16
    Public:
      CIDR: 10.0.0.0/24