#
# Exercise 3 Solution
# Carlos Rivas / February 2021
#
Parameters:
  myVPC:
      Description: VPC used to deploy our resources below
      Type: AWS::EC2::VPC::Id
  SubnetForServer:
      Description: Subnet to be used for our Web Server
      Type: AWS::EC2::Subnet::Id
  AMItoUse:
      Description: AMI to use for our base image
      Type: String
Resources:
# IAM Role to allow EC2 Session Manager to access our server
  RoleForSSMAccess: 
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
# Instance Profile
  ServerInstanceProfile: 
    Type: "AWS::IAM::InstanceProfile"
    Properties: 
      Roles: 
        - !Ref RoleForSSMAccess
# Security Group
  WebAccessSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
        GroupDescription: Allow http to our test host
        VpcId:
          Ref: myVPC
        SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
        SecurityGroupEgress:
        - IpProtocol: -1
          FromPort: -1
          ToPort: -1
          CidrIp: 0.0.0.0/0
# Server EC2 Instance
  ServerInstance: 
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: t3.micro
      ImageId: !Ref AMItoUse
      IamInstanceProfile: !Ref ServerInstanceProfile
      NetworkInterfaces: 
        - AssociatePublicIpAddress: "true"
          DeviceIndex: "0"
          GroupSet: 
            - Ref: "WebAccessSecurityGroup"
          SubnetId: 
            Ref: "SubnetForServer"
