cfn.yaml

# This creates a VPC with a public subnet and associated routing. # Usage from command line:
#   aws cloudformation --region <<YOUR-REGION>> create-stack --stack-name vpc --template-body file://vpc-setup.yaml

Parameters:
  LatestAmiId:
    Type: 'AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>'
    Default: '/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-6.1-x86_64'
        
Resources:
  ## VPC
  PublicVPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16

  ## SUBNETS     
  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref PublicVPC
      CidrBlock: 10.0.1.0/24
      MapPublicIpOnLaunch: true
  
  
  ## INTERNET GATEWAY
  InternetGateway:
    Type: AWS::EC2::InternetGateway
  
  GatewayToInternet:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref PublicVPC
      InternetGatewayId: !Ref InternetGateway
  
  ## PUBLIC ROUTING
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref PublicVPC
  
  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: GatewayToInternet
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway
  
  PublicSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet
      RouteTableId: !Ref PublicRouteTable


  EC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Ref LatestAmiId  
      InstanceType: t3a.small
      Tags:
      - Key: Name
        Value: webServer
      IamInstanceProfile: !Ref InstanceProfile
      SecurityGroupIds: 
        - !GetAtt InstanceSecurityGroup.GroupId
      SubnetId: !Ref PublicSubnet
      UserData: !Base64 
        'Fn::Join':
          - ''
          - - |
              #!/bin/bash -xe
            - |
              yum install -y aws-cfn-bootstrap
            - |
              # Install the files and packages from the metadata
            - '/opt/aws/bin/cfn-init -v '
            - '         --stack '
            - !Ref 'AWS::StackName'
            - '         --resource EC2Instance '
            - '         --region '
            - !Ref 'AWS::Region'
            - |+
    Metadata:
      AWS::CloudFormation::Init:
        install:
          packages:
            yum:
              nginx: []
          files:
            /root/sshlog.sh:
              content: |
                #!/bin/bash
                journalctl -u sshd.service -fqn0 | grep --line-buffered "Connection closed" | while read line
                do
                  description=$(echo $line | jq -Rsa .)
                  curl -X POST -H 'Content-type: application/json' {{resolve:ssm:jiraurl}} -d'{"summary":"SSH attempt","description":'"${description}"',"priority":2}'  
                done
              mode: "000755"
            /root/ssher.sh:
              content: |
                #!/bin/bash
                MYIP=$(curl ifconfig.me)
                ssh -oStrictHostKeyChecking=no blah@${MYIP} || true
              mode: "000755"              
            /usr/lib/systemd/system/sshlog.service:
              content: |
                [Unit]
                Description=Alerts us to ssh login attempts
                [Service]
                Type=exec
                ExecStart=/root/sshlog.sh
                [Install]
                WantedBy=multi-user.target
              mode: "000644"      
            /usr/lib/systemd/system/ssher.service:
              content: |
                [Unit]
                Description=Makes ssh attempts
                [Service]
                Type=oneshot
                ExecStart=/root/ssher.sh
              mode: "000644"
            /usr/lib/systemd/system/ssher.timer:
              content: |
                [Unit]
                Description=Makes ssh attempts
                [Timer]
                OnCalendar=*-*-* *:00/10:00
                RandomizedDelaySec=600
                [Install]
                WantedBy=timers.target
              mode: "000644"              
            /root/kill.sh:
              content: |
                #!/bin/bash
                systemctl stop nginx
                rm /etc/nginx/default.d/killer.conf' 
              mode: "000755"
            /root/webfail.sh:
              content: |
                #!/bin/bash
                curl -X POST -H 'Content-type: application/json' {{resolve:ssm:jiraurl}} -d'{"summary":"WEBSITE DOWN!","description":"The website is down","priority":1}'  
              mode: "000755"              
            /usr/lib/systemd/system/killer.service:
              content: |
                [Unit]
                Description=Stops nginx
                [Service]
                ExecStart=/root/kill.sh
                [Install]
                Also=killer.socket
              mode: "000644"
            /usr/lib/systemd/system/killer.socket: 
              content: |
                [Unit]
                Description=killer Socket
                [Socket]
                ListenStream=/run/killer.sock
                [Install]
                WantedBy=sockets.target
              mode: "000644"

          commands:
            updateNginxStart:
              command: sed -i '/\[Service\]/a ExecStopPost=/root/webfail.sh' /usr/lib/systemd/system/nginx.service
        start:              
          files:
            /etc/nginx/default.d/killer.conf:
              content: |
                location /page2.html {
                    gzip off;
                    root /usr/share/nginx/;
                    autoindex on;
                    fastcgi_pass unix:/run/killer.sock;
                    include /etc/nginx/fastcgi_params;
                }
              owner: "nginx"
              group: "nginx"
            /usr/share/nginx/html/index.html:
              content: |
                echo '<!DOCTYPE html>
                <html><head><title>Welcome to nginx!</title></head>
                <body>
                <h1>Welcome to the website!</h1>
                <p>If you see this page, the site is partially working</p>
                <a href="./page2.html">Click here for more tests</a>
                </body></html>
              mode: "000666"  
            /usr/share/nginx/html/page2.html:
              content: |  
                <!DOCTYPE html>
                <html><head><title>Page2</title></head>
                <body>
                <h1>Welcome to the website!</h1>
                <p>If you see this page, the site is fully working.</p>
                </body></html>
              mode: "000666"
          services:
            systemd:
              nginx:
                enabled: "true"
                ensureRunning: "true" 
              killer.socket:
                enabled: "true"
                ensureRunning: "true" 
              sshlog.service:  
                enabled: "true"
                ensureRunning: "true"   
              ssher.timer:
                enabled: "true"
                ensureRunning: "true"                                   
        configSets:
          default:
            - install
            - start
  InstanceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Enable HTTP access
      VpcId: !Ref PublicVPC
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 80
        ToPort: 80
        CidrIp: '0.0.0.0/0'
      - IpProtocol: tcp
        FromPort: 22
        ToPort: 22
        CidrIp: '0.0.0.0/0'       

  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles: [ !Ref InstanceRole ]
  InstanceRole:
    Type: AWS::IAM::Role
    Properties:
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: [ ec2.amazonaws.com ]
            Action:
              - sts:AssumeRole
      Path: /