waf.yaml

AWSTemplateFormatVersion: "2010-09-09"

Description: Use WAF to block malicious traffic from the bastion host in VPC2

Metadata:

  Authors:
    Description: Mark Richman (mark@linuxacademy.com)
  License:
    Description: Copyright 2019 Linux Academy. All Rights Reserved.

Parameters:
  LatestAmiId:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Description: Latest Amazon Linux 2 AMI ID
    Default: /aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2
  KeyName:
    Type: String
    Description: Optional key pair of the ec2-user to establish a SSH connection to the EC2 instances
    Default: ''
  EC2UserPassword:
    Type: String
    Description: Password for ec2-user on the VPC2 bastion host
    NoEcho: true
    MinLength: 8
    MaxLength: 41
    AllowedPattern: ^[a-zA-Z0-9]*$

Conditions:
  HasKeyName: !Not [!Equals [!Ref KeyName, '']]

Resources:
  VPC:
    Type: "AWS::EC2::VPC"
    Properties:
      CidrBlock: "10.99.0.0/16"
      EnableDnsHostnames: true
      EnableDnsSupport: true
      Tags:
       - Key: Name
         Value: SysOpsVPC

  InternetGateway:
    Type: "AWS::EC2::InternetGateway"
    Properties:
      Tags:
      - Key: Name
        Value: InternetGateway

  VPCGatewayAttachment:
    Type: "AWS::EC2::VPCGatewayAttachment"
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  DMZ1public:
    Type: "AWS::EC2::Subnet"
    Properties:
      AvailabilityZone: !Select
        - 0
        - !GetAZs
      CidrBlock: "10.99.1.0/24"
      VpcId: !Ref VPC
      Tags:
      - Key: Name
        Value: DMZ1public

  DMZ2public:
    Type: "AWS::EC2::Subnet"
    Properties:
      AvailabilityZone: !Select
        - 1
        - !GetAZs
      CidrBlock: "10.99.2.0/24"
      VpcId: !Ref VPC
      Tags:
      - Key: Name
        Value: DMZ2public

  AppLayer1private:
    Type: "AWS::EC2::Subnet"
    Properties:
      AvailabilityZone: !Select
        - 0
        - !GetAZs
      CidrBlock: "10.99.11.0/24"
      VpcId: !Ref VPC
      Tags:
      - Key: Name
        Value: AppLayer1private

  AppLayer2private:
    Type: "AWS::EC2::Subnet"
    Properties:
      AvailabilityZone: !Select
        - 1
        - !GetAZs
      CidrBlock: "10.99.12.0/24"
      VpcId: !Ref VPC
      Tags:
      - Key: Name
        Value: AppLayer2private

  PublicRT:
    Type: "AWS::EC2::RouteTable"
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: PublicRT

  RouteTableAssociationA:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Properties:
      SubnetId: !Ref DMZ1public
      RouteTableId: !Ref PublicRT

  RouteTableAssociationB:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Properties:
      SubnetId: !Ref DMZ2public
      RouteTableId: !Ref PublicRT

  RoutePublicNATToInternet:
    Type: "AWS::EC2::Route"
    Properties:
      RouteTableId: !Ref PublicRT
      DestinationCidrBlock: "0.0.0.0/0"
      GatewayId: !Ref InternetGateway
    DependsOn: VPCGatewayAttachment

  NATElasticIP:
    Type: "AWS::EC2::EIP"
    Properties:
      Domain: "vpc"
    DependsOn: "VPCGatewayAttachment"

  NATGateway:
    Type: "AWS::EC2::NatGateway"
    Properties:
      AllocationId:
        Fn::GetAtt:
          - NATElasticIP
          - AllocationId
      SubnetId: !Ref DMZ2public
      Tags:
      - Key: Name
        Value: NATGateway

  NATGatewayRoute:
    Type: "AWS::EC2::Route"
    Properties:
      RouteTableId: !Ref PrivateRT
      DestinationCidrBlock: "0.0.0.0/0"
      NatGatewayId: !Ref NATGateway

  PrivateRT:
    Type: "AWS::EC2::RouteTable"
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: PrivateRT

  RouteTableAssociationC:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Properties:
      SubnetId: !Ref AppLayer1private
      RouteTableId: !Ref PrivateRT

  RouteTableAssociationD:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Properties:
      SubnetId: !Ref AppLayer2private
      RouteTableId: !Ref PrivateRT

  DMZNACL:
    Type: "AWS::EC2::NetworkAcl"
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: DMZNACL

  SubnetNetworkAclAssociationA:
    Type: "AWS::EC2::SubnetNetworkAclAssociation"
    Properties:
      SubnetId: !Ref DMZ1public
      NetworkAclId: !Ref DMZNACL

  SubnetNetworkAclAssociationB:
    Type: "AWS::EC2::SubnetNetworkAclAssociation"
    Properties:
      SubnetId: !Ref DMZ2public
      NetworkAclId: !Ref DMZNACL

  DMZNACLEntryIngress100:
    Type: "AWS::EC2::NetworkAclEntry"
    Properties:
      NetworkAclId: !Ref DMZNACL
      RuleNumber: 100
      Protocol: 6
      PortRange:
        From: 22
        To: 22
      RuleAction: allow
      Egress: false
      CidrBlock: "0.0.0.0/0"

  DMZNACLEntryIngress110:
    Type: "AWS::EC2::NetworkAclEntry"
    Properties:
      NetworkAclId: !Ref DMZNACL
      RuleNumber: 110
      Protocol: 6
      PortRange:
        From: 80
        To: 80
      RuleAction: "allow"
      Egress: false
      CidrBlock: "0.0.0.0/0"

  DMZNACLEntryIngress120:
    Type: "AWS::EC2::NetworkAclEntry"
    Properties:
      NetworkAclId: !Ref DMZNACL
      RuleNumber: 120
      Protocol: 6
      PortRange:
        From: 443
        To: 443
      RuleAction: "allow"
      Egress: false
      CidrBlock: "0.0.0.0/0"

  DMZNACLEntryIngress130:
    Type: "AWS::EC2::NetworkAclEntry"
    Properties:
      NetworkAclId: !Ref DMZNACL
      RuleNumber: 130
      Protocol: 6
      PortRange:
        From: 1024
        To: 65535
      RuleAction: "allow"
      Egress: false
      CidrBlock: "0.0.0.0/0"

  DMZNACLEntryEgress100:
    Type: "AWS::EC2::NetworkAclEntry"
    Properties:
      NetworkAclId: !Ref DMZNACL
      RuleNumber: 100
      Protocol: 6
      PortRange:
        From: 22
        To: 22
      RuleAction: "allow"
      Egress: true
      CidrBlock: "0.0.0.0/0"

  DMZNACLEntryEgress110:
    Type: "AWS::EC2::NetworkAclEntry"
    Properties:
      NetworkAclId: !Ref DMZNACL
      RuleNumber: 110
      Protocol: 6
      PortRange:
        From: 80
        To: 80
      RuleAction: "allow"
      Egress: true
      CidrBlock: "0.0.0.0/0"

  DMZNACLEntryEgress120:
    Type: "AWS::EC2::NetworkAclEntry"
    Properties:
      NetworkAclId: !Ref DMZNACL
      RuleNumber: 120
      Protocol: 6
      PortRange:
        From: 443
        To: 443
      RuleAction: "allow"
      Egress: true
      CidrBlock: "0.0.0.0/0"

  DMZNACLEntryEgress130:
    Type: "AWS::EC2::NetworkAclEntry"
    Properties:
      NetworkAclId: !Ref DMZNACL
      RuleNumber: 130
      Protocol: 6
      PortRange:
        From: 1024
        To: 65535
      RuleAction: "allow"
      Egress: true
      CidrBlock: "0.0.0.0/0"

  AppNACL:
    Type: "AWS::EC2::NetworkAcl"
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: AppNACL

  SubnetNetworkAclAssociationC:
    Type: "AWS::EC2::SubnetNetworkAclAssociation"
    Properties:
      SubnetId: !Ref AppLayer1private
      NetworkAclId: !Ref AppNACL

  SubnetNetworkAclAssociationD:
    Type: "AWS::EC2::SubnetNetworkAclAssociation"
    Properties:
      SubnetId: !Ref AppLayer2private
      NetworkAclId: !Ref AppNACL

  AppNACLEntryIngress100:
    Type: "AWS::EC2::NetworkAclEntry"
    Properties:
      NetworkAclId: !Ref AppNACL
      RuleNumber: 100
      Protocol: 6
      PortRange:
        From: 22
        To: 22
      RuleAction: "allow"
      Egress: false
      CidrBlock: "10.99.0.0/16"

  AppNACLEntryIngress110:
    Type: "AWS::EC2::NetworkAclEntry"
    Properties:
      NetworkAclId: !Ref AppNACL
      RuleNumber: 110
      Protocol: 6
      PortRange:
        From: 80
        To: 80
      RuleAction: "allow"
      Egress: false
      CidrBlock: "10.99.0.0/16"

  AppNACLEntryIngress120:
    Type: "AWS::EC2::NetworkAclEntry"
    Properties:
      NetworkAclId: !Ref AppNACL
      RuleNumber: 120
      Protocol: 6
      PortRange:
        From: 443
        To: 443
      RuleAction: "allow"
      Egress: false
      CidrBlock: "10.99.0.0/16"

  AppNACLEntryIngress130:
    Type: "AWS::EC2::NetworkAclEntry"
    Properties:
      NetworkAclId: !Ref AppNACL
      RuleNumber: 130
      Protocol: 6
      PortRange:
        From: 1024
        To: 65535
      RuleAction: "allow"
      Egress: false
      CidrBlock: "0.0.0.0/0"

  AppNACLEntryEgress110:
    Type: "AWS::EC2::NetworkAclEntry"
    Properties:
      NetworkAclId: !Ref AppNACL
      RuleNumber: 110
      Protocol: 6
      PortRange:
        From: 80
        To: 80
      RuleAction: "allow"
      Egress: true
      CidrBlock: "0.0.0.0/0"

  AppNACLEntryEgress120:
    Type: "AWS::EC2::NetworkAclEntry"
    Properties:
      NetworkAclId: !Ref AppNACL
      RuleNumber: 120
      Protocol: 6
      PortRange:
        From: 443
        To: 443
      RuleAction: "allow"
      Egress: true
      CidrBlock: "0.0.0.0/0"

  AppNACLEntryEgress130:
    Type: "AWS::EC2::NetworkAclEntry"
    Properties:
      NetworkAclId: !Ref AppNACL
      RuleNumber: 130
      Protocol: 6
      PortRange:
        From: 1024
        To: 65535
      RuleAction: "allow"
      Egress: true
      CidrBlock: "10.99.0.0/16"

  BastionSecurityGroup:
    Type: "AWS::EC2::SecurityGroup"
    Properties:
      GroupDescription: "bastion"
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: BastionSG
      SecurityGroupIngress:
        - CidrIp: "0.0.0.0/0"
          FromPort: 22
          IpProtocol: "tcp"
          ToPort: 22

  LoadBalancerSecurityGroup:
    Type: "AWS::EC2::SecurityGroup"
    Properties:
      GroupDescription: "apache-elb"
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: LoadBalancerSG
      SecurityGroupIngress:
        - CidrIp: "0.0.0.0/0"
          FromPort: 80
          IpProtocol: "tcp"
          ToPort: 80

        - CidrIp: "0.0.0.0/0"
          FromPort: 443
          IpProtocol: "tcp"
          ToPort: 443

  WebServerSecurityGroup:
    Type: "AWS::EC2::SecurityGroup"
    Properties:
      GroupDescription: "apache-ec2"
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: WebServerSG
      SecurityGroupIngress:
        - FromPort: 22
          IpProtocol: "tcp"
          SourceSecurityGroupId: !Ref BastionSecurityGroup
          ToPort: 22

        - FromPort: 80
          IpProtocol: "tcp"
          SourceSecurityGroupId: !Ref LoadBalancerSecurityGroup
          ToPort: 80

  LoadBalancer:
    Type: "AWS::ElasticLoadBalancingV2::LoadBalancer"
    Properties:
      Subnets:
        - !Ref DMZ1public
        - !Ref DMZ2public
      Name: "load-balancer"
      Type: "application"
      Scheme: "internet-facing"
      SecurityGroups:
        - !Ref LoadBalancerSecurityGroup
      IpAddressType: ipv4

  Listener:
    Type: "AWS::ElasticLoadBalancingV2::Listener"
    Properties:
      DefaultActions:
        - Type: "forward"
          TargetGroupArn: !Ref TargetGroup
      LoadBalancerArn: !Ref LoadBalancer
      Port: 80
      Protocol: "HTTP"

  TargetGroup:
    Type: "AWS::ElasticLoadBalancingV2::TargetGroup"
    Properties:
      HealthCheckIntervalSeconds: 10
      HealthCheckPath: /phpinfo.php
      HealthCheckPort: "80"
      HealthCheckProtocol: "HTTP"
      HealthyThresholdCount: 2
      Name: "TG1"
      Port: 80
      Protocol: "HTTP"
      UnhealthyThresholdCount: 2
      VpcId: !Ref VPC

  WebInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
      - !Ref WebInstanceRole

  WebInstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM
        - arn:aws:iam::aws:policy/AmazonSSMFullAccess
      Path: /
      Policies:
        - PolicyName: logs
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:*
                Resource:
                  - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:*

  LaunchConfiguration:
    Type: "AWS::AutoScaling::LaunchConfiguration"
    Metadata:
      AWS::CloudFormation::Init:
        configSets:
          default:
            - install_packages
        install_packages:
          packages:
            yum:
              httpd: []
    Properties:
      ImageId: !Ref LatestAmiId
      InstanceType: t3.micro
      KeyName: !If [HasKeyName, !Ref KeyName, !Ref 'AWS::NoValue']
      IamInstanceProfile: !Ref WebInstanceProfile
      SecurityGroups:
        - !Ref WebServerSecurityGroup
      AssociatePublicIpAddress: false
      InstanceMonitoring: true
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash -xe
          yum update -y
          /opt/aws/bin/cfn-init -v --region ${AWS::Region} --stack ${AWS::StackName} --resource LaunchConfiguration
          amazon-linux-extras install -y lamp-mariadb10.2-php7.2 php7.2
          # Add your website content here
          echo "<?php phpinfo(); ?>" > /var/www/html/phpinfo.php
          systemctl start httpd
          systemctl enable httpd
          /opt/aws/bin/cfn-signal -e $? --region ${AWS::Region} --stack ${AWS::StackName} --resource LaunchConfiguration

  AutoScalingGroup:
    Type: "AWS::AutoScaling::AutoScalingGroup"
    Properties:
      TargetGroupARNs:
        - !Ref TargetGroup
      LaunchConfigurationName: !Ref LaunchConfiguration
      MinSize: '2'
      MaxSize: '2'
      DesiredCapacity: '2'
      Cooldown: '300'
      HealthCheckGracePeriod: 300
      HealthCheckType: "ELB"
      VPCZoneIdentifier:
        - !Ref AppLayer1private
        - !Ref AppLayer2private
      Tags:
        - PropagateAtLaunch: true
          Value: Web Server
          Key: Name

  BastionInstance:
    Type: 'AWS::EC2::Instance'
    Properties:
      ImageId: !Ref LatestAmiId
      InstanceType: t3.micro
      KeyName: !If [HasKeyName, !Ref KeyName, !Ref 'AWS::NoValue']
      IamInstanceProfile: !Ref WebInstanceProfile
      UserData:
        Fn::Base64: |
          #!/bin/bash
          yum update -y
          mkdir /home/cloud_user/.aws
          echo -e '[default]\nregion = us-east-1' > /home/cloud_user/.aws/config
      NetworkInterfaces:
        - GroupSet:
            - !Ref BastionSecurityGroup
          AssociatePublicIpAddress: true
          DeviceIndex: '0'
          DeleteOnTermination: true
          SubnetId: !Ref DMZ1public
      Tags:
        - Value: Bastion Host
          Key: Name

  VPC2:
    Type: "AWS::EC2::VPC"
    Properties:
      CidrBlock: "10.111.0.0/16"
      EnableDnsHostnames: true
      EnableDnsSupport: true
      Tags:
       - Key: Name
         Value: SysOpsVPC2

  InternetGateway2:
    Type: "AWS::EC2::InternetGateway"
    Properties:
      Tags:
      - Key: Name
        Value: InternetGateway2

  VPCGatewayAttachment2:
    Type: "AWS::EC2::VPCGatewayAttachment"
    Properties:
      VpcId: !Ref VPC2
      InternetGatewayId: !Ref InternetGateway2

  DMZ1public2:
    Type: "AWS::EC2::Subnet"
    Properties:
      AvailabilityZone: !Select
        - 0
        - !GetAZs
      CidrBlock: "10.111.1.0/24"
      VpcId: !Ref VPC2
      Tags:
      - Key: Name
        Value: DMZ1public2

  PublicRT2:
    Type: "AWS::EC2::RouteTable"
    Properties:
      VpcId: !Ref VPC2
      Tags:
        - Key: Name
          Value: PublicRT2

  RouteTableAssociation2A:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Properties:
      SubnetId: !Ref DMZ1public2
      RouteTableId: !Ref PublicRT2

  RoutePublicNATToInternet2:
    Type: "AWS::EC2::Route"
    Properties:
      RouteTableId: !Ref PublicRT2
      DestinationCidrBlock: "0.0.0.0/0"
      GatewayId: !Ref InternetGateway2
    DependsOn: VPCGatewayAttachment

  DMZNACL2:
    Type: "AWS::EC2::NetworkAcl"
    Properties:
      VpcId: !Ref VPC2
      Tags:
        - Key: Name
          Value: DMZNACL2

  SubnetNetworkAclAssociation2A:
    Type: "AWS::EC2::SubnetNetworkAclAssociation"
    Properties:
      SubnetId: !Ref DMZ1public2
      NetworkAclId: !Ref DMZNACL2

  DMZNACL2EntryIngress100:
    Type: "AWS::EC2::NetworkAclEntry"
    Properties:
      NetworkAclId: !Ref DMZNACL2
      RuleNumber: 100
      Protocol: 6
      PortRange:
        From: 22
        To: 22
      RuleAction: allow
      Egress: false
      CidrBlock: "0.0.0.0/0"

  DMZNACL2EntryIngress110:
    Type: "AWS::EC2::NetworkAclEntry"
    Properties:
      NetworkAclId: !Ref DMZNACL2
      RuleNumber: 110
      Protocol: 6
      PortRange:
        From: 80
        To: 80
      RuleAction: "allow"
      Egress: false
      CidrBlock: "0.0.0.0/0"

  DMZNACL2EntryIngress120:
    Type: "AWS::EC2::NetworkAclEntry"
    Properties:
      NetworkAclId: !Ref DMZNACL2
      RuleNumber: 120
      Protocol: 6
      PortRange:
        From: 443
        To: 443
      RuleAction: "allow"
      Egress: false
      CidrBlock: "0.0.0.0/0"

  DMZNACL2EntryIngress130:
    Type: "AWS::EC2::NetworkAclEntry"
    Properties:
      NetworkAclId: !Ref DMZNACL2
      RuleNumber: 130
      Protocol: 6
      PortRange:
        From: 1024
        To: 65535
      RuleAction: "allow"
      Egress: false
      CidrBlock: "0.0.0.0/0"

  DMZNACL2EntryEgress100:
    Type: "AWS::EC2::NetworkAclEntry"
    Properties:
      NetworkAclId: !Ref DMZNACL2
      RuleNumber: 100
      Protocol: 6
      PortRange:
        From: 22
        To: 22
      RuleAction: "allow"
      Egress: true
      CidrBlock: "0.0.0.0/0"

  DMZNACL2EntryEgress110:
    Type: "AWS::EC2::NetworkAclEntry"
    Properties:
      NetworkAclId: !Ref DMZNACL2
      RuleNumber: 110
      Protocol: 6
      PortRange:
        From: 80
        To: 80
      RuleAction: "allow"
      Egress: true
      CidrBlock: "0.0.0.0/0"

  DMZNACL2EntryEgress120:
    Type: "AWS::EC2::NetworkAclEntry"
    Properties:
      NetworkAclId: !Ref DMZNACL2
      RuleNumber: 120
      Protocol: 6
      PortRange:
        From: 443
        To: 443
      RuleAction: "allow"
      Egress: true
      CidrBlock: "0.0.0.0/0"

  DMZNACL2EntryEgress130:
    Type: "AWS::EC2::NetworkAclEntry"
    Properties:
      NetworkAclId: !Ref DMZNACL2
      RuleNumber: 130
      Protocol: 6
      PortRange:
        From: 1024
        To: 65535
      RuleAction: "allow"
      Egress: true
      CidrBlock: "0.0.0.0/0"

  BastionSecurityGroup2:
    Type: "AWS::EC2::SecurityGroup"
    Properties:
      GroupDescription: "bastion"
      VpcId: !Ref VPC2
      Tags:
        - Key: Name
          Value: BastionSG-VPC2
      SecurityGroupIngress:
        - CidrIp: "0.0.0.0/0"
          FromPort: 22
          IpProtocol: "tcp"
          ToPort: 22

  BastionInstance2:
    Type: 'AWS::EC2::Instance'
    Properties:
      ImageId: !Ref LatestAmiId
      InstanceType: t3.micro
      KeyName: !If [HasKeyName, !Ref KeyName, !Ref 'AWS::NoValue']
      IamInstanceProfile: !Ref WebInstanceProfile
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash
          yum update -y
          passwd ec2-user << EOF
          ${EC2UserPassword}
          ${EC2UserPassword}
          EOF
          echo "PasswordAuthentication yes" > /etc/ssh/sshd_config
          service sshd restart
      NetworkInterfaces:
        - GroupSet:
            - !Ref BastionSecurityGroup2
          AssociatePublicIpAddress: true
          DeviceIndex: '0'
          DeleteOnTermination: true
          SubnetId: !Ref DMZ1public2
      Tags:
        - Value: Malicious Host
          Key: Name


Outputs:
  pubIpAddress1:
    Description: Public IP address of Bastion in VPC2
    Value: !GetAtt BastionInstance2.PublicIp
  loadbalancer:
    Description: Load Balancer DNS Name
    Value: !GetAtt LoadBalancer.DNSName