cloudformation-template.yaml

Description: Launch OpenVPN backed up by ActiveDirectory SimpleAD stack within its own VPC or an existing VPC

Parameters:

  #OpenVPN
  CookbookUrl:
    Type: String
    Default: https://github.com/netbears/opsworks-openvpn/releases/download/v1.1.0/cookbooks-v1.1.0.tar.gz

  Version:
    Type: String
    Default: '2.7.5-932a08a3-Ubuntu18'

  InstanceType:
    Type: String
    Default: 'c5.large'
    AllowedValues:
    - c5.large
    - c5.xlarge
    - c5.2xlarge
    - c5.4xlarge

  InstanceRootVolumeSize:
    Type: String
    Default: '50'
    Description: Size in GB of the root volume

  SslLoadBalancer:
    Type: String
    Description: SSL ARN from Certificate Manager

  OpenVPNDnsRecord:
    Type: String

  GenerateOpenVPNDnsRecord:
    Type: String
    Default: 'true'
    AllowedValues:
      - 'true'
      - 'false'

  OpenVPNDnsZone:
    Type: AWS::Route53::HostedZone::Id
    Description: Route53 hosted zone in which to place dns record

  EnableMfa:
    Type: String
    Default: 'true'
    AllowedValues:
      - 'true'
      - 'false'

  #LDAP
  LdapBindDn:
    Type: String
    Description: User will have to be created in AD after stack creation

  LdapBindPassword:
    Type: String
    NoEcho: true

  LdapUsersBaseDn:
    Type: String
    Description: Make sure the path exists in AD after stack creation

  LdapGroupVPNRequirement:
    Type: String
    Description: Make sure the group exists in AD after stack creation

  LdapAdminUsername:
    Type: String
    Description: Make sure the user exists in AD after stack creation

  #Network
  ClientNetmask:
    Type: String
    Default: '20'

  ClientNetwork:
    Type: String
    Default: '172.20.112.0'

  PrivateNetworkAccess1:
    Type: String
    Description: Set the VPC CIDR that you want to provide access to. Leave empty if none
    Default: "172.20.0.0/16"

  PrivateNetworkAccess2:
    Type: String
    Description: Set the VPC CIDR that you want to provide access to. Leave empty if none
    Default: "172.17.0.0/16"

  PrivateNetworkAccess3:
    Type: String
    Description: Set the VPC CIDR that you want to provide access to. Leave empty if none
    Default: "172.23.0.0/16"

  WebPort:
    Type: String
    Default: '443'

  ClientsTalkEachOther:
    Type: String
    Default: 'false'
    AllowedValues:
      - 'true'
      - 'false'

  RouteInternetTraffic:
    Type: String
    Default: 'false'
    AllowedValues:
      - 'true'
      - 'false'
    Description: Whether to route Internet traffic through OpenVPN or not

  DaemonListenPort:
    Type: String
    Default: '80'

  DaemonListenProtocol:
    Type: String
    Default: 'tcp'
    AllowedValues:
      - 'tcp'
      - 'udp'

  #ActiveDirectory
  Edition:
    Type: String
    Default: 'Standard'
    AllowedValues:
      - 'Standard'
      - 'Enterprise'
    Description: Standard is about 100 USD/month

  EnableSso:
    Type: String
    Default: 'false'
    AllowedValues:
      - 'false'
      - 'true'
    Description: Single sign-on allows users in your directory to access certain AWS services from a computer joined to the directory without having to enter their credentials separately

  Name:
    Type: String
    Description: The fully qualified domain name for the AWS Managed Microsoft AD directory, such as corp.example.com. This name will resolve inside your VPC only. It does not need to be publicly resolvable.

  ShortName:
    Type: String
    Description: The NetBIOS name for your domain, such as CORP. For example, CORP for the directory DNS corp.example.com.

  Password:
    Type: String
    NoEcho: true
    Description: The password for the default administrative user named Admin. If you need to change the password for the administrator account, see the ResetUserPassword API call in the AWS Directory Service API Reference.
    AllowedPattern: (?=^.{8,64}$)((?=.*\d)(?=.*[A-Z])(?=.*[a-z])|(?=.*\d)(?=.*[^A-Za-z0-9\s])(?=.*[a-z])|(?=.*[^A-Za-z0-9\s])(?=.*[A-Z])(?=.*[a-z])|(?=.*\d)(?=.*[A-Z])(?=.*[^A-Za-z0-9\s]))^.*

  VpcId:
    Type: AWS::EC2::VPC::Id
    Description: Setting takes effect only if NewVpc is set to "existing"

  SubnetIdsPrivate:
    Type: List<AWS::EC2::Subnet::Id>
    Description: Setting takes effect only if CreateVpc is set to "existing" (specify AT LEAST 2 PRIVATE subnets)

  SubnetIdsPublic:
    Type: List<AWS::EC2::Subnet::Id>
    Description: Setting takes effect only if CreateVpc is set to "existing" (specify AT LEAST 2 PUBLIC subnets)

  LdapDnsZone:
    Type: AWS::Route53::HostedZone::Id
    Description: Route53 hosted zone in which to place dns record

  LdapDnsRecord:
    Type: String

  #Jumpbox
  Jumpbox:
    Type: String
    Default: 'true'
    AllowedValues:
      - 'true'
      - 'false'
    Description: Whether to deploy a Windows Server Jumpbox attached to the domain

  JumpboxAmi:
    Type: AWS::EC2::Image::Id
    Description: Windows 2016 or 2019 Base AMI available in your region (default value is current Windows 2019 Base AMI in us-east-1 at time of writing)
    Default: ami-04ca2d0801450d495

  JumpboxKeyPair:
    Type: AWS::EC2::KeyPair::KeyName
    Description: KeyPair for EC2 Instance

  JumpboxType:
    Type: String
    Default: 'public-ip'
    AllowedValues:
      - public-ip
      - private-ip
    Description: Whether to deploy the jumpbox with public ip or not

  JumpboxInstanceType:
    Type: String
    Default: t2.medium
    AllowedValues:
    - t2.micro
    - t2.small
    - t2.medium
    - c4.large
    - c4.xlarge
    ConstraintDescription: Must be a valid EC2 instance type.

  # Logging
  ElasticsearchPort:
    Type: String
    Default: '9200'

  ElasticsearchHost:
    Type: String

  KibanaPort:
    Type: String
    Default: '5601'

  KibanaHost:
    Type: String

  LoggingToElasticsearchEnabled:
    Type: String
    Default: 'false'
    AllowedValues:
      - 'true'
      - 'false'
    Description: Whether to deploy Filebeat and connect it to ElasticSearch

  MonitoringToElasticsearchEnabled:
    Type: String
    Default: 'false'
    AllowedValues:
      - 'true'
      - 'false'
    Description: Whether to deploy Metricbeat and connect it to ElasticSearch

Conditions:
  DeployJumpbox:
    Fn::Equals:
      - Ref: Jumpbox
      - 'true'

  PublicJumpbox:
    Fn::Equals:
      - Ref: JumpboxType
      - public-ip

  IsTcpDaemon:
    Fn::Equals:
      - Ref: DaemonListenProtocol
      - tcp

  DeployOpenVPNRecord:
    Fn::Equals:
      - Ref: GenerateOpenVPNDnsRecord
      - 'true'

Resources:
  AWSMicrosoftDirectory:
    Type: AWS::DirectoryService::MicrosoftAD
    Properties:
      Edition:
        Ref: Edition
      EnableSso:
        Ref: EnableSso
      Name:
        Ref: Name
      Password: 
        Ref: Password
      ShortName: 
        Ref: ShortName
      VpcSettings:
        SubnetIds:
          - Fn::Select:
              - 0
              - Ref: SubnetIdsPrivate
          - Fn::Select:
              - 1
              - Ref: SubnetIdsPrivate
        VpcId:
          Ref: VpcId

  Route53RecordLdap:
    Type: AWS::Route53::RecordSetGroup
    Properties:
      HostedZoneId:
        Ref: LdapDnsZone
      Comment: 
        Fn::Sub: Route53-record-for-LDAP
      RecordSets:
      - Name:
          Ref: LdapDnsRecord
        Type: A
        TTL: 300
        ResourceRecords:
          Fn::GetAtt: AWSMicrosoftDirectory.DnsIpAddresses

  SsmDocument:
    DependsOn: AWSMicrosoftDirectory
    Type: AWS::SSM::Document
    Properties:
      Content:
        schemaVersion: '1.2'
        description: Join instances to an AWS Directory Service domain.
        parameters:
          directoryId:
            type: String
            description: "(Required) The ID of the AWS Directory Service directory."
          directoryName:
            type: String
            description: "(Required) The name of the directory; for example, test.example.com"
          dnsIpAddresses:
            type: StringList
            default: []
            description: "(Optional) The IP addresses of the DNS servers in the directory.
              Required when DHCP is not configured. Learn more at http://docs.aws.amazon.com/directoryservice/latest/simple-ad/join_get_dns_addresses.html"
            allowedPattern: "((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)"
        runtimeConfig:
          aws:domainJoin:
            properties:
              directoryId: "{{ directoryId }}"
              directoryName: "{{ directoryName }}"
              dnsIpAddresses: "{{ dnsIpAddresses }}"

  LaunchTemplate:
    Condition: DeployJumpbox
    Type: AWS::EC2::LaunchTemplate
    Properties:
      LaunchTemplateData:
        SecurityGroupIds:
        - Fn::GetAtt: InstanceSecurityGroup.GroupId
        BlockDeviceMappings:
          - DeviceName: /dev/sda1
            Ebs:
              VolumeSize: 50
              VolumeType: gp2
              DeleteOnTermination: true
        DisableApiTermination: false
        EbsOptimized: false
        IamInstanceProfile:
          Arn:
            Fn::GetAtt:
              - InstanceProfileJumpbox
              - Arn
        ImageId:
          Ref: JumpboxAmi
        InstanceInitiatedShutdownBehavior: terminate
        InstanceType:
          Ref: JumpboxInstanceType
        KeyName:
          Ref: JumpboxKeyPair
        Monitoring:
          Enabled: false
        TagSpecifications:
        - ResourceType: instance
          Tags:
            - Key: Name
              Value:
                Fn::Sub: "${AWS::StackName}-Jumpbox"
        UserData:
          Fn::Base64:
            Fn::Join:
              - ''
              - - <powershell>
                - Install-WindowsFeature -Name GPMC,RSAT-AD-PowerShell,RSAT-AD-AdminCenter,RSAT-ADDS-Tools,RSAT-DNS-Server,ADFS-Federation; Install-PackageProvider -Name NuGet -Force; Install-Module MSOnline -Force
                - </powershell>

  SpotFleetIAMRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - spotfleet.amazonaws.com
          Action:
          - sts:AssumeRole
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AmazonEC2SpotFleetAutoscaleRole
      - arn:aws:iam::aws:policy/service-role/AmazonEC2SpotFleetTaggingRole
      Policies:
      - PolicyName:
          Fn::Sub: ${AWS::StackName}-GetInstanceProfile
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - iam:GetInstanceProfile
            Resource: "*"

  SpotFleetIAMAutoScaleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - application-autoscaling.amazonaws.com
            - eks.amazonaws.com
            - ec2.amazonaws.com
          Action:
          - sts:AssumeRole
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AmazonEC2SpotFleetAutoscaleRole
      - arn:aws:iam::aws:policy/service-role/AmazonEC2SpotFleetTaggingRole

  SpotFleet:
    Condition: DeployJumpbox
    Type: AWS::EC2::SpotFleet
    Properties:
      SpotFleetRequestConfigData:
        AllocationStrategy: diversified
        ExcessCapacityTerminationPolicy: default
        IamFleetRole:
          Fn::GetAtt:
            - SpotFleetIAMRole
            - Arn
        InstanceInterruptionBehavior: terminate
        ReplaceUnhealthyInstances: true
        SpotPrice: '5'
        TargetCapacity: '1'
        TerminateInstancesWithExpiration: true
        LaunchTemplateConfigs:
          - LaunchTemplateSpecification:
              LaunchTemplateId:
                Ref: LaunchTemplate
              Version:
                Fn::GetAtt:
                  - LaunchTemplate
                  - LatestVersionNumber
            Overrides:
            - InstanceType:
                Ref: JumpboxInstanceType
              WeightedCapacity: '1'
              SubnetId:
                Fn::If:
                  - PublicJumpbox
                  - Fn::Select: [ 0, Ref: SubnetIdsPublic ]
                  - Fn::Select: [ 0, Ref: SubnetIdsPrivate ]

  SsmAssociationSpotFleet:
    Type: AWS::SSM::Association
    Condition: DeployJumpbox
    Properties: 
      Name:
        Ref: SsmDocument
      Parameters: 
        directoryId :
          - Ref: AWSMicrosoftDirectory
        directoryName :
          - Ref: Name
        dnsIpAddresses :
          - Fn::Select:
              - 0
              - Fn::GetAtt: ["AWSMicrosoftDirectory","DnsIpAddresses"]
          - Fn::Select:
              - 1
              - Fn::GetAtt: ["AWSMicrosoftDirectory","DnsIpAddresses"]
      Targets:
        - Key: "tag:Name"
          Values:
            - Fn::Sub: "${AWS::StackName}-Jumpbox"

  InstanceRoleJumpbox:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: 
                - 'ec2.amazonaws.com'
            Action:
              - 'sts:AssumeRole'
      Path: /
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM
      Policies:
        - PolicyName:
            Fn::Sub: ${AWS::StackName}-ssm-create-association
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - 'ssm:CreateAssociation'
                Resource:
                  - '*'

  InstanceProfileJumpbox:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - Ref: InstanceRoleJumpbox

  InstanceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow http to client host
      VpcId:
        Ref: VpcId
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: '3389'
        ToPort: '3389'
        CidrIp: 0.0.0.0/0

  KmsEncryptRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal: {Service: [lambda.amazonaws.com]}
          Action: ['sts:AssumeRole']
      Policies:
      - PolicyName:
          Fn::Sub: ${AWS::StackName}-KMS
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - kms:Encrypt*
            - kms:Get*
            - kms:List*
            - kms:Describe*
            Resource: '*'
      - PolicyName:
          Fn::Sub: ${AWS::StackName}-CloudWatch
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - logs:*
            - cloudwatch:*
            Resource: '*'

  KmsEncryptFunction:
    Type: AWS::Lambda::Function
    Properties:
      Handler: index.lambda_handler
      Runtime: python3.7
      Role:
        Fn::GetAtt: KmsEncryptRole.Arn
      Code:
        ZipFile:
          Fn::Sub: |
            import boto3
            import cfnresponse
            import base64
            def lambda_handler(event, context):
              responseValue={}
              kms = boto3.client('kms',region_name="${AWS::Region}")
              secret = kms.encrypt(KeyId=event['ResourceProperties']['LdapPasswordKeyArn'],Plaintext=event['ResourceProperties']['LdapBindPassword'])
              blob = secret["CiphertextBlob"]
              responseValue["Value"] = str(base64.b64encode(blob))[2:-1]
              cfnresponse.send(event, context, cfnresponse.SUCCESS, responseValue)
              return True

  KmsEncryptResult:
    Type: Custom::KmsEncryptLdapBindPassword
    Properties:
      ServiceToken:
        Fn::GetAtt: KmsEncryptFunction.Arn
      LdapBindPassword:
        Ref: LdapBindPassword
      LdapPasswordKeyArn:
        Fn::GetAtt: LdapPasswordKey.Arn

  LdapPasswordKey:
    Type: AWS::KMS::Key
    Properties:
      KeyPolicy:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action: kms:*
            Resource: "*"
            Principal:
              AWS:
                - Fn::Sub: arn:aws:iam::${AWS::AccountId}:root
          - Effect: Allow
            Action: kms:Encrypt
            Resource: "*"
            Principal:
              AWS:
                - Fn::GetAtt: KmsEncryptRole.Arn
          - Effect: Allow
            Action: kms:Decrypt
            Resource: "*"
            Principal:
              AWS:
                - Fn::GetAtt: InstanceRoleOpenVPN.Arn

  LdapPasswordAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: alias/OpenVPN
      TargetKeyId:
        Ref: LdapPasswordKey

  ServiceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - 'opsworks.amazonaws.com'
            Action:
              - 'sts:AssumeRole'
      Path: /
      Policies:
        - PolicyName:
            Fn::Sub: ${AWS::StackName}-OpsWorksDefaultPolicy
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - 'ec2:*'
                  - 'iam:PassRole'
                  - 'cloudwatch:GetMetricStatistics'
                  - 'cloudwatch:DescribeAlarms'
                  - 'elasticloadbalancing:*'
                  - 'ecs:*'
                  - 'rds:*'
                Resource: '*'

  InstanceRoleOpenVPN:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: 
                - 'ec2.amazonaws.com'
            Action:
              - 'sts:AssumeRole'
      Path: /
      Policies:
        - PolicyName:
            Fn::Sub: ${AWS::StackName}-ec2
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - 'ec2:Get*'
                  - 'ec2:List*'
                  - 'ec2:Describe*'
                Resource:
                  - '*'
        - PolicyName:
            Fn::Sub: ${AWS::StackName}-s3
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - 's3:*'
                Resource:
                  - '*'
        - PolicyName:
            Fn::Sub: ${AWS::StackName}-CloudWatchLogs
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - 'cloudwatch:*'
                  - 'logs:*'
                Resource:
                  - '*'

  InstanceProfileOpenVPN:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - Ref: InstanceRoleOpenVPN

  Ec2SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription:
        Fn::Sub: ${AWS::StackName}-Sg
      VpcId:
        Ref: VpcId
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 0
          ToPort: 65535
          CidrIp: 0.0.0.0/0
        - IpProtocol: udp
          FromPort: 0
          ToPort: 65535
          CidrIp: 0.0.0.0/0

  AlbSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription:
        Fn::Sub: ${AWS::StackName}-Sg
      VpcId:
        Ref: VpcId
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort:
            Ref: WebPort
          ToPort:
            Ref: WebPort
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort:
            Ref: DaemonListenPort
          ToPort:
            Ref: DaemonListenPort
          CidrIp: 0.0.0.0/0
        - IpProtocol: udp
          FromPort:
            Ref: DaemonListenPort
          ToPort:
            Ref: DaemonListenPort
          CidrIp: 0.0.0.0/0

  OpsWorksStack: 
    Type: AWS::OpsWorks::Stack
    Properties: 
      AgentVersion: LATEST
      Name: 
        Ref: AWS::StackName
      ServiceRoleArn: 
        Fn::GetAtt:
          - ServiceRole
          - Arn
      DefaultInstanceProfileArn: 
        Fn::GetAtt:
          - InstanceProfileOpenVPN
          - Arn
      ConfigurationManager:
        Name: Chef
        Version: '12'
      UseCustomCookbooks: true
      CustomCookbooksSource:
        Type: archive
        Url:
          Ref: CookbookUrl
      DefaultSubnetId:
        Fn::Select: [ 0, Ref: SubnetIdsPrivate ]
      VpcId:
        Ref: VpcId
      UseOpsworksSecurityGroups: true
      DefaultOs: Ubuntu 18.04 LTS
      DefaultRootDeviceType: ebs
      CustomJson:
        Fn::Sub: |
          {
            "openvpnas": {
              "version": "${Version}",
              "ubuntu_version": "Ubuntu18",
              "admin_username": "${LdapAdminUsername}",
              "admin_ui.https.port": "${WebPort}",
              "auth.ldap.0.add_req": "${LdapGroupVPNRequirement}",
              "auth.ldap.0.bind_dn": "${LdapBindDn}",
              "auth.ldap.0.bind_pw_encrypted": "${KmsEncryptResult.Value}",
              "auth.ldap.0.server.0.host": "${LdapDnsRecord}",
              "auth.ldap.0.users_base_dn": "${LdapUsersBaseDn}",
              "cs.https.port": "${WebPort}",
              "host.name": "${OpenVPNDnsRecord}",
              "vpn.client.routing.inter_client": "${ClientsTalkEachOther}",
              "vpn.client.routing.reroute_gw": "${RouteInternetTraffic}",
              "vpn.daemon.0.client.netmask_bits": "${ClientNetmask}",
              "vpn.daemon.0.client.network": "${ClientNetwork}",
              "vpn.daemon.0.listen.port": "${DaemonListenPort}",
              "vpn.daemon.0.listen.protocol": "${DaemonListenProtocol}",
              "vpn.server.routing.private_network.0": "${PrivateNetworkAccess1}",
              "vpn.server.routing.private_network.1": "${PrivateNetworkAccess2}",
              "vpn.server.routing.private_network.2": "${PrivateNetworkAccess3}",
              "enable_mfa": "${EnableMfa}"
            },
            "elasticsearch": {
              "http_port": "${ElasticsearchPort}",
              "http_ip": "${ElasticsearchHost}"
            },
            "kibana": {
              "http_port": "${KibanaPort}",
              "http_ip": "${KibanaHost}"
            },
            "filebeat": {
              "enabled": "${LoggingToElasticsearchEnabled}"
            },
            "metricbeat": {
              "enabled": "${MonitoringToElasticsearchEnabled}"
            }
          }
      Tags:
        - Key: Application
          Value: OpenVPN
        - Key: MaintainerName
          Value: Marius Mitrofan
        - Key: MaintainerTeam
          Value: NETBEARS
        - Key: MaintainerEmail
          Value: support@netbears.com

  Elb:
    Type: AWS::ElasticLoadBalancing::LoadBalancer
    DependsOn: Layer
    Properties:
      HealthCheck:
        Interval: 30
        Target: TCP:22
        Timeout: 5
        UnhealthyThreshold: 5
        HealthyThreshold: 5
      Listeners:
        - Fn::If:
          - IsTcpDaemon
          - InstancePort:
              Ref: DaemonListenPort
            LoadBalancerPort:
              Ref: DaemonListenPort
            Protocol: TCP
            InstanceProtocol: TCP
            SSLCertificateId:
              Ref: SslLoadBalancer
          - Ref: AWS::NoValue
        - InstancePort:
            Ref: WebPort
          LoadBalancerPort:
            Ref: WebPort
          Protocol: HTTPS
          InstanceProtocol: HTTPS
          PolicyNames:
            - Fn::Sub: ${AWS::StackName}
          SSLCertificateId:
            Ref: SslLoadBalancer
      Scheme: internet-facing
      SecurityGroups:
        - Ref: AlbSecurityGroup
      Subnets:
        Ref: SubnetIdsPublic
      ConnectionDrainingPolicy:
        Enabled: 'true'
        Timeout: '300'
      LBCookieStickinessPolicy:
        - CookieExpirationPeriod: 600
          PolicyName:
            Ref: AWS::StackName

  Layer:
    Type: AWS::OpsWorks::Layer
    Properties:
      Name: OpenVPN
      Shortname: openvpn-
      Type: custom
      EnableAutoHealing: 'false'
      AutoAssignElasticIps: 'false'
      AutoAssignPublicIps: 'false'
      StackId:
        Ref: OpsWorksStack
      CustomRecipes:
        Setup:
          - 'openvpn_stack::setup'
      UseEbsOptimizedInstances: True
      CustomSecurityGroupIds:
        - Fn::GetAtt: Ec2SecurityGroup.GroupId

  ElbLayer:
    DependsOn: Elb
    Type: AWS::OpsWorks::ElasticLoadBalancerAttachment
    Properties: 
      ElasticLoadBalancerName: 
        Ref: Elb
      LayerId: 
        Ref: Layer

  InstanceOpsWorks: 
    DependsOn: AWSMicrosoftDirectory
    Type: AWS::OpsWorks::Instance
    DependsOn: Elb
    Properties: 
      StackId: 
        Ref: OpsWorksStack
      LayerIds: 
        - Ref: Layer
      InstanceType:
        Ref: InstanceType
      RootDeviceType: ebs
      SubnetId:
        Fn::Select: [ 0, Ref: SubnetIdsPrivate ]
      Hostname:
        Fn::Sub: openvpn-host-main
      BlockDeviceMappings:
        - DeviceName: ROOT_DEVICE
          Ebs:
            VolumeType: gp2
            VolumeSize:
              Ref: InstanceRootVolumeSize

  Route53RecordOpenVPN:
    Type: AWS::Route53::RecordSetGroup
    Condition: DeployOpenVPNRecord
    Properties:
      HostedZoneId:
        Ref: OpenVPNDnsZone
      Comment: 
        Fn::Sub: Route53-record-for-OpenVPN
      RecordSets:
      - Name:
          Ref: OpenVPNDnsRecord
        Type: A
        AliasTarget:
          HostedZoneId: 
            Fn::GetAtt:
              - Elb
              - CanonicalHostedZoneNameID
          DNSName: 
            Fn::GetAtt:
              - Elb
              - DNSName

Outputs:
  AdminUrlOpenVPN:
    Export:
      Name:
        Fn::Sub: "${AWS::StackName}-AdminUrlOpenVPN"
    Value:
      Fn::Sub: "https://${OpenVPNDnsRecord}:${WebPort}/admin"

  ClientUrlOpenVPN:
    Export:
      Name:
        Fn::Sub: "${AWS::StackName}-ClientUrlOpenVPN"
    Value:
      Fn::Sub: "https://${OpenVPNDnsRecord}:${WebPort}"

  OpsWorksStackId:
    Export:
      Name:
        Fn::Sub: "${AWS::StackName}-OpsWorksStack"
    Value:
      Ref: OpsWorksStack

  LayerId:
    Export:
      Name:
        Fn::Sub: "${AWS::StackName}-Layer"
    Value:
      Ref: Layer

  DnsIpAddresses:
    Export:
      Name:
        Fn::Sub: ${AWS::StackName}-DnsIpAddresses
    Value:
      Fn::Join:
        - ", "
        - Fn::GetAtt: AWSMicrosoftDirectory.DnsIpAddresses

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
    - Label:
        default: ActiveDirectory
      Parameters:
      - Edition
      - EnableSso
      - Name
      - ShortName
      - Password
      - NewVpc
      - VpcId
      - SubnetIdsPrivate
      - SubnetIdsPublic
      - LdapDnsZone
      - LdapDnsRecord
    - Label:
        default: Jumpbox
      Parameters:
      - Jumpbox
      - JumpboxAmi
      - JumpboxKeyPair
      - JumpboxType
      - JumpboxInstanceType
    - Label:
        default: OpenVPN
      Parameters:
      - CookbookUrl
      - Version
      - InstanceType
      - InstanceRootVolumeSize
      - SslLoadBalancer
      - AdminPassword
      - OpenVPNDnsRecord
      - OpenVPNDnsZone
      - GenerateOpenVPNDnsRecord
      - EnableMfa
    - Label:
        default: LDAP
      Parameters:
      - LdapBindDn
      - LdapBindPassword
      - LdapUsersBaseDn
      - LdapGroupVPNRequirement
      - LdapAdminUsername
    - Label:
        default: Network
      Parameters:
      - ClientNetmask
      - ClientNetwork
      - PrivateNetworkAccess
      - RouteInternetTraffic
      - ClientsTalkEachOther
      - DaemonListenProtocol
      - DaemonListenPort
      - PrivateNetworkAccess1
      - PrivateNetworkAccess2
      - PrivateNetworkAccess3
      - WebPort
    - Label:
        default: Logging
      Parameters:
      - ElasticsearchHost
      - ElasticsearchPort
      - KibanaHost
      - KibanaPort
      - LoggingToElasticsearchEnabled
      - MonitoringToElasticsearchEnabled