templates/mf-es-redhat-template.yaml [372:478]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  HaveEMailNotificationTopic: !Not
    - !Equals
      - !Ref EMailNotificationTopic
      - ''
Resources:
  ESInstanceRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - 'sts:AssumeRole'
            Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
      Path: /
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM'
        - 'arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy'
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - 's3:GetObject'
                Effect: Allow
                Resource:
                  - !Sub
                    - arn:${AWS::Partition}:s3:::${S3Bucket}
                    - S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
                  - !Sub
                    - arn:${AWS::Partition}:s3:::${S3Bucket}/${QSS3KeyPrefix}*
                    - S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
            Version: 2012-10-17
          PolicyName: aws-quick-start-s3-policy
        - PolicyDocument:
            Statement:
              - Action:
                  - 's3:*'
                Effect: Allow
                Resource:
                  - !Sub 'arn:${AWS::Partition}:s3:::${ESS3BucketName}'
                  - !Sub 'arn:${AWS::Partition}:s3:::${ESS3BucketName}/*'
              - Action:
                  - 'ds:Describe*'
                Effect: Allow
                Resource: '*'
          PolicyName: ESInstancePolicy
  ESInstanceRoleProfile:
    Type: 'AWS::IAM::InstanceProfile'
    Properties:
      Path: /
      Roles:
        - !Ref ESInstanceRole
  LambdaExecutionRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
  CalcPrimaryDataVolumeStorageSizeFunction:
    Type: 'AWS::Lambda::Function'
    Properties:
      Handler: index.handler
      Role: !GetAtt LambdaExecutionRole.Arn
      Code:
        ZipFile: |
          var response = require('cfn-response');
          exports.handler = function(event, context) {
            var props = event.ResourceProperties;
            var result = (parseInt(props.RegionsPerInstance) * parseInt(props.RegionStorageOverheadInGiB)) + parseInt(props.AdditionalESStorageinGiB);
            response.send(event, context, response.SUCCESS, {Value: result});
          };
      Runtime: nodejs12.x
  ESPrimaryDataVolumeStorageSize:
    Type: 'Custom::CalcPrimaryDataVolumeStorageSizeFunction'
    Properties:
      ServiceToken: !GetAtt CalcPrimaryDataVolumeStorageSizeFunction.Arn
      RegionsPerInstance: !Ref RegionsPerInstance
      RegionStorageOverheadInGiB: 50
      AdditionalESStorageinGiB: !Ref AdditionalESStorageinGiB
      Value: 0
  ESPrimaryDataVolume:
    Type: 'AWS::EC2::Volume'
    Properties:
      VolumeType: gp2
      Size: !GetAtt ESPrimaryDataVolumeStorageSize.Value
      AvailabilityZone: !Select
        - 0
        - !Ref AvailabilityZones
      Tags:
        - Key: Name
          Value: !Sub '${AWS::StackName}-${ESInstanceName} Data Volume'
  ESInstance:
    Type: 'AWS::EC2::Instance'
    CreationPolicy:
      ResourceSignal:
        Count: 1
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



templates/mf-es-template.yaml [405:511]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  HaveEMailNotificationTopic: !Not
    - !Equals
      - !Ref EMailNotificationTopic
      - ''
Resources:
  ESInstanceRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - 'sts:AssumeRole'
            Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
      Path: /
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM'
        - 'arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy'
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - 's3:GetObject'
                Effect: Allow
                Resource:
                  - !Sub
                    - arn:${AWS::Partition}:s3:::${S3Bucket}
                    - S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
                  - !Sub
                    - arn:${AWS::Partition}:s3:::${S3Bucket}/${QSS3KeyPrefix}*
                    - S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
            Version: 2012-10-17
          PolicyName: aws-quick-start-s3-policy
        - PolicyDocument:
            Statement:
              - Action:
                  - 's3:*'
                Effect: Allow
                Resource:
                  - !Sub 'arn:${AWS::Partition}:s3:::${ESS3BucketName}'
                  - !Sub 'arn:${AWS::Partition}:s3:::${ESS3BucketName}/*'
              - Action:
                  - 'ds:Describe*'
                Effect: Allow
                Resource: '*'
          PolicyName: ESInstancePolicy
  ESInstanceRoleProfile:
    Type: 'AWS::IAM::InstanceProfile'
    Properties:
      Path: /
      Roles:
        - !Ref ESInstanceRole
  LambdaExecutionRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
  CalcPrimaryDataVolumeStorageSizeFunction:
    Type: 'AWS::Lambda::Function'
    Properties:
      Handler: index.handler
      Role: !GetAtt LambdaExecutionRole.Arn
      Code:
        ZipFile: |
          var response = require('cfn-response');
          exports.handler = function(event, context) {
            var props = event.ResourceProperties;
            var result = (parseInt(props.RegionsPerInstance) * parseInt(props.RegionStorageOverheadInGiB)) + parseInt(props.AdditionalESStorageinGiB);
            response.send(event, context, response.SUCCESS, {Value: result});
          };
      Runtime: nodejs12.x
  ESPrimaryDataVolumeStorageSize:
    Type: 'Custom::CalcPrimaryDataVolumeStorageSizeFunction'
    Properties:
      ServiceToken: !GetAtt CalcPrimaryDataVolumeStorageSizeFunction.Arn
      RegionsPerInstance: !Ref RegionsPerInstance
      RegionStorageOverheadInGiB: 50
      AdditionalESStorageinGiB: !Ref AdditionalESStorageinGiB
      Value: 0
  ESPrimaryDataVolume:
    Type: 'AWS::EC2::Volume'
    Properties:
      VolumeType: gp2
      Size: !GetAtt ESPrimaryDataVolumeStorageSize.Value
      AvailabilityZone: !Select
        - 0
        - !Ref AvailabilityZones
      Tags:
        - Key: Name
          Value: !Sub '${AWS::StackName}-${ESInstanceName} Data Volume'
  ESInstance:
    Type: 'AWS::EC2::Instance'
    CreationPolicy:
      ResourceSignal:
        Count: 1
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



