eks_vpc_stack.yml

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Network Stack: Deploy VPC with 3 public subnet'

Resources:
  VPC:
    Type: 'AWS::EC2::VPC'
    Properties:
      CidrBlock: '10.11.0.0/16'
      EnableDnsSupport: true
      EnableDnsHostnames: true
      InstanceTenancy: default

  InternetGateway:
    Type: 'AWS::EC2::InternetGateway'

  VPCGatewayAttachment:
    Type: 'AWS::EC2::VPCGatewayAttachment'
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  PublicSubnet1:
    Type: 'AWS::EC2::Subnet'
    Properties:
      AvailabilityZone: !Select [0, !GetAZs '']
      CidrBlock: '10.11.1.0/24'
      MapPublicIpOnLaunch: true
      VpcId: !Ref VPC

  PublicSubnet2:
    Type: 'AWS::EC2::Subnet'
    Properties:
      AvailabilityZone: !Select [1, !GetAZs '']
      CidrBlock: '10.11.2.0/24'
      MapPublicIpOnLaunch: true
      VpcId: !Ref VPC

  PublicSubnet3:
    Type: 'AWS::EC2::Subnet'
    Properties:
      AvailabilityZone: !Select [2, !GetAZs '']
      CidrBlock: '10.11.3.0/24'
      MapPublicIpOnLaunch: true
      VpcId: !Ref VPC

  PrivateSubnet1:
    Type: 'AWS::EC2::Subnet'
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [0, !GetAZs '']
      CidrBlock: '10.11.4.0/24'
      MapPublicIpOnLaunch: false

  PrivateSubnet2:
    Type: 'AWS::EC2::Subnet'
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [1, !GetAZs '']
      CidrBlock: '10.11.5.0/24'
      MapPublicIpOnLaunch: false

  RouteTablePublicSubnet1:
    Type: 'AWS::EC2::RouteTable'
    Properties:
      VpcId: !Ref VPC

  RouteTablePublicSubnet2:
    Type: 'AWS::EC2::RouteTable'
    Properties:
      VpcId: !Ref VPC

  RouteTablePublicSubnet3:
    Type: 'AWS::EC2::RouteTable'
    Properties:
      VpcId: !Ref VPC

  RouteTableAssociationPublicSubnet1:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      SubnetId: !Ref PublicSubnet1
      RouteTableId: !Ref RouteTablePublicSubnet1

  RouteTableAssociationPublicSubnet2:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      SubnetId: !Ref PublicSubnet2
      RouteTableId: !Ref RouteTablePublicSubnet2

  RouteTableAssociationPublicSubnet3:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      SubnetId: !Ref PublicSubnet3
      RouteTableId: !Ref RouteTablePublicSubnet3

  RouteTablePublicSubnet1InternetRoute:
    Type: 'AWS::EC2::Route'
    DependsOn: VPCGatewayAttachment
    Properties:
      RouteTableId: !Ref RouteTablePublicSubnet1
      DestinationCidrBlock: '0.0.0.0/0'
      GatewayId: !Ref InternetGateway

  RouteTablePublicSubnet2InternetRoute:
    Type: 'AWS::EC2::Route'
    DependsOn: VPCGatewayAttachment
    Properties:
      RouteTableId: !Ref RouteTablePublicSubnet2
      DestinationCidrBlock: '0.0.0.0/0'
      GatewayId: !Ref InternetGateway

  RouteTablePublicSubnet3InternetRoute:
    Type: 'AWS::EC2::Route'
    DependsOn: VPCGatewayAttachment
    Properties:
      RouteTableId: !Ref RouteTablePublicSubnet3
      DestinationCidrBlock: '0.0.0.0/0'
      GatewayId: !Ref InternetGateway

  NetworkAclPublic:
    Type: 'AWS::EC2::NetworkAcl'
    Properties:
      VpcId: !Ref VPC

  SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    DependsOn: VPC
    Properties:
      GroupName: security-group
      GroupDescription: EMR on EKS Workshop VPC Security Group
      VpcId: !Ref VPC

  # Self Reference Rule
  SelfReferenceRule:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      IpProtocol: "-1" #-1 used for all traffic
      SourceSecurityGroupId: !Ref SecurityGroup
      GroupId: !Ref SecurityGroup

  SubnetNetworkAclAssociationPublicSubnet1:
    Type: 'AWS::EC2::SubnetNetworkAclAssociation'
    Properties:
      SubnetId: !Ref PublicSubnet1
      NetworkAclId: !Ref NetworkAclPublic

  SubnetNetworkAclAssociationPublicSubnet2:
    Type: 'AWS::EC2::SubnetNetworkAclAssociation'
    Properties:
      SubnetId: !Ref PublicSubnet2
      NetworkAclId: !Ref NetworkAclPublic

  SubnetNetworkAclAssociationPublicSubnet3:
    Type: 'AWS::EC2::SubnetNetworkAclAssociation'
    Properties:
      SubnetId: !Ref PublicSubnet3
      NetworkAclId: !Ref NetworkAclPublic

  NetworkAclEntryInPublicAllowAll:
    Type: 'AWS::EC2::NetworkAclEntry'
    Properties:
      NetworkAclId: !Ref NetworkAclPublic
      RuleNumber: 99
      Protocol: -1
      RuleAction: allow
      Egress: false
      CidrBlock: '0.0.0.0/0'

  NetworkAclEntryOutPublicAllowAll:
    Type: 'AWS::EC2::NetworkAclEntry'
    Properties:
      NetworkAclId: !Ref NetworkAclPublic
      RuleNumber: 99
      Protocol: -1
      RuleAction: allow
      Egress: true
      CidrBlock: '0.0.0.0/0'

  NatGateway:
    Type: "AWS::EC2::NatGateway"
    DependsOn: NatPublicIP
    Properties:
      AllocationId: !GetAtt NatPublicIP.AllocationId
      SubnetId: !Ref PublicSubnet1

  NatPublicIP:
    Type: "AWS::EC2::EIP"
    DependsOn: VPC
    Properties:
      Domain: vpc

  PrivateRouteTable:
    Type: 'AWS::EC2::RouteTable'
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Network
          Value: Private

  PrivateRoute:
    Type: 'AWS::EC2::Route'
    Properties:
      RouteTableId: !Ref PrivateRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway

  PrivateSubnet1RouteTableAssociation:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      SubnetId: !Ref PrivateSubnet1
      RouteTableId: !Ref PrivateRouteTable

  PrivateSubnet2RouteTableAssociation:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      SubnetId: !Ref PrivateSubnet2
      RouteTableId: !Ref PrivateRouteTable

Outputs:

  VpcId:
    Description: 'VPC Id'
    Value: !Ref VPC

  PublicSubnet1Id:
    Description: 'Public Subnet 1'
    Value: !Ref PublicSubnet1

  PublicSubnet2Id:
    Description: 'Public Subnet 2'
    Value: !Ref PublicSubnet2

  PublicSubnet3Id:
    Description: 'Public Subnet 3'
    Value: !Ref PublicSubnet3

  PrivateSubnet1Id:
    Description: 'Private Subnet 1'
    Value: !Ref PrivateSubnet1

  PrivateSubnet2Id:
    Description: 'Private Subnet 2'
    Value: !Ref PrivateSubnet2

  SecurityGroup:
    Description: 'VPC Security Group'
    Value: !Ref SecurityGroup