Example of CloudFormation Template

Subscribe Send me a message

#aws #CloudFormation

In this post, we present a sample CloudFormation template. The template will set up the following components

VPC
Subnet inside the VPC.
Internet gateway. The internet gateway allows the subnet to connect to the public internet.
Route table. This route table is associated with the subnet.
Security Group
EC2 instance

A bottom-up explanation of different components is as follows:

An EC2 instance needs to be in a subnet and the host-level security control is done through the security group.
A subnet needs to know where to send traffic. Therefore, it needs a route table. The association between a subnet and a route table is represented by AWS::EC2::SubnetRouteTableAssociation.
A route table contains routes, which is represented by AWS::EC2::Route.
To open the traffic to public, we could use the internet gateway whose usage is referenced in a AWS::EC2::Route instance.

The configuration can be confusing. Part of the reason is that there are different ways to represent the association between two components. For example, we could use !Ref or create an association type that has references to the associated components.

Here is a sample CloudFormation template.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131

AWSTemplateFormatVersion: "2010-09-09"
Resources:

  # VPC Sectoin
  MyVpc:
      Type: AWS::EC2::VPC
      Properties:
        CidrBlock: 10.66.123.0/24
        EnableDnsHostnames: false
        EnableDnsSupport: false
        Tags:
            - Key: Name
              Value: my-vpc

  # Subnet Section
  MySubnet:
      Type: AWS::EC2::Subnet
      Properties:
        VpcId: !Ref MyVpc
        CidrBlock: 10.66.123.192/26
        AvailabilityZone: "us-east-1a"
        Tags:
            - Key: Name
              Value: my-subnet

  # Internet Gateway Section
  #   - This allows us to make the subnet public.
  MyInternetGateway:
      Type: AWS::EC2::InternetGateway
      Properties:
          Tags:
            - Key: Name
              Value: my-internet-gateway

  MyInternetGatewayAttachment:
      Type: AWS::EC2::VPCGatewayAttachment
      Properties:
        InternetGatewayId: !Ref MyInternetGateway
        VpcId: !Ref MyVpc

  # Route Table Section
  MyRouteTable:
      Type: AWS::EC2::RouteTable
      Properties:
          VpcId: !Ref MyVpc
          Tags:
              - Key: Name
                Value: my-route-table

  # Set up a public route. Note that this is associated with the route table.
  MyPublicRoute:
      Type: AWS::EC2::Route
      DependsOn: MyInternetGateway
      Properties:
          RouteTableId: !Ref MyRouteTable
          DestinationCidrBlock: 0.0.0.0/0
          GatewayId: !Ref MyInternetGateway

  # Associate the route table with the VPC.
  SubnetRouteTableAssociation:
      Type: AWS::EC2::SubnetRouteTableAssociation
      Properties:
          RouteTableId: !Ref MyRouteTable
          SubnetId: !Ref MySubnet

  # Security Group Section
  MyEC2SecurityGroup:
      Type: AWS::EC2::SecurityGroup
      Properties:
          VpcId: !Ref MyVpc
          GroupDescription: EC2 Security Group
          GroupName: MyEC2SecurityGroup
          SecurityGroupIngress:
              - IpProtocol: tcp
                FromPort: 22
                ToPort: 22
                CidrIp: <some-value>
              - IpProtocol: tcp
                FromPort: 22
                ToPort: 22
                SourcePrefixListId: <some-value>
              - IpProtocol: icmp
                FromPort: -1
                ToPort: -1
                CidrIp: <some-value>
              - IpProtocol: icmp
                FromPort: -1
                ToPort: -1
                SourcePrefixListId: <some-value>

  # EC2 Instance Section
  Node1:
        Type: AWS::EC2::Instance
        Properties:
            Tags:
                - Key: Name
                  Value: my-node-1

            Instancetype: t2.micro
            ImageId: ami-0aeeebd8d2ab47354
            # PrivateIpAddress: <some-value>

            NetworkInterfaces:
                - AssociatePublicIpAddress: "true"
                  DeviceIndex: "0"
                  GroupSet:
                      - !Ref MyEC2SecurityGroup
                  SubnetId: !Ref MySubnet


# Output Section
Outputs:
    MyVpc:
      Value: !Ref MyVpc
    MySubnet:
      Value: !Ref MySubnect
    MyInternetGateway:
      Value: !Ref MyInternetGateway
    MyInternetGatewayAttachment:
      Value: !Ref MyInternetGatewayAttachment
    MyRouteTable:
      Value: !Ref MyRouteTable
    MyPublicRoute:
      Value: !Ref MyPublicRoute
    SubnetRouteTableAssociation:
      Value: !Ref SubnetRouteTableAssociation
    MyEC2SecurityGroup:
      Value: !Ref MyEC2SecurityGroup
    Node1:
      Value: !Ref Node1

----- END -----

If you have questions about this post, you could find me on Discord.

Send me a message Subscribe to blog updates

Want some fun stuff?