templates/mssqlfsx-mad.template.yaml [1081:1332]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        - name: "PrepareFCI"
          action: "aws:runCommand"
          onFailure: "step:signalfailure"
          inputs:
            DocumentName: "AWS-RunRemoteScript"
            InstanceIds: '{{GetAllClusterNodes.InstanceIds}}'
            CloudWatchOutputConfig:
              CloudWatchOutputEnabled: "true"
              CloudWatchLogGroupName: !Ref 'QuickStartLogs'
            Parameters:
              sourceType: "S3"
              sourceInfo:
                !Sub
                  - '{"path": "https://${S3Bucket}.s3.${S3Region}.{{URLSuffix}}/{{QSS3KeyPrefix}}scripts/prepare-fci.ps1"}'
                  - S3Bucket: !If 
                      - UsingDefaultBucket
                      - !Sub '${QSS3BucketName}-${AWS::Region}'
                      - !Ref QSS3BucketName
                    S3Region: !If 
                      - UsingDefaultBucket
                      - !Ref AWS::Region
                      - !Ref QSS3BucketRegion
              commandLine: "./prepare-fci.ps1 -AdminSecret '{{AdminSecrets}}' -DomainNetBIOSName {{DomainNetBIOSName}} -SqlUserSecret {{AdminSecrets}} -MSSQLMediaBucket '{{MSSQLMediaBucketName}}' -MSSQLMediaKey '{{MSSQLMediaPathKey}}'"
        - name: "CompleteFCI"
          action: "aws:runCommand"
          onFailure: "step:signalfailure"
          inputs:
            DocumentName: "AWS-RunRemoteScript"
            InstanceIds: '{{GetClusterNode1.InstanceIds}}'
            CloudWatchOutputConfig:
              CloudWatchOutputEnabled: "true"
              CloudWatchLogGroupName: !Ref 'QuickStartLogs'
            Parameters:
              sourceType: "S3"
              sourceInfo:
                !Sub
                  - '{"path": "https://${S3Bucket}.s3.${S3Region}.{{URLSuffix}}/{{QSS3KeyPrefix}}scripts/complete-fci.ps1"}'
                  - S3Bucket: !If 
                      - UsingDefaultBucket
                      - !Sub '${QSS3BucketName}-${AWS::Region}'
                      - !Ref QSS3BucketName
                    S3Region: !If 
                      - UsingDefaultBucket
                      - !Ref AWS::Region
                      - !Ref QSS3BucketRegion
              commandLine: "./complete-fci.ps1 -AdminSecret '{{AdminSecrets}}' -DomainNetBIOSName {{DomainNetBIOSName}} -FileServerPath '{{FindFSxVolDnsAddress.FSxDnsAddress}}'.split(';')[0] -Node1FciIp '{{FindSecondaryIpAddresses.SecondaryPrivateIpAddresses}}'.split(';')[1] -Node1SubnetMask '{{FindSecondaryIpAddresses.SecondaryPrivateIpAddresses}}'.split(';')[4] -Node2FciIp '{{FindSecondaryIpAddresses.SecondaryPrivateIpAddresses}}'.split(';')[3] -Node2SubnetMask '{{FindSecondaryIpAddresses.SecondaryPrivateIpAddresses}}'.split(';')[5] -FCIName {{SqlFSxFCIName}} -SQLAdminAccounts '{{SQLAdminAccounts}}'"           
        #End of deployment workflow
        
        
        # Determines if CFN Needs to be Signaled or if Workflow should just end
        - name: CFNSignalEnd
          action: aws:branch
          inputs:
            Choices:
            - NextStep: signalsuccess
              Not: 
                Variable: "{{StackName}}"
                StringEquals: ""
            - NextStep: sleepend
              Variable: "{{StackName}}"
              StringEquals: ""
        # If all steps complete successfully signals CFN of Success
        - name: "signalsuccess"
          action: "aws:executeAwsApi"
          isEnd: True
          inputs:
            Service: cloudformation
            Api: SignalResource
            LogicalResourceId: "SSMWaitCondition"
            StackName: "{{StackName}}"
            Status: SUCCESS
            UniqueId: "{{SqlFSxInstanceId}}"
        # If CFN Signl Not Needed this sleep ends work flow
        - name: "sleepend"
          action: "aws:sleep"
          isEnd: True
          inputs:
            Duration: PT1S
        # If any steps fails signals CFN of Failure
        - name: "signalfailure"
          action: "aws:executeAwsApi"
          inputs:
            Service: cloudformation
            Api: SignalResource
            LogicalResourceId: "SSMWaitCondition"
            StackName: "{{StackName}}"
            Status: FAILURE
            UniqueId: "{{SqlFSxInstanceId}}"
  SqlFSxSSMPassRolePolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: SqlFsx-SSM-PassRole
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - iam:PassRole
            Resource: !Sub 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${AWSQuickstartSqlFSxRole}'
      Roles:
        - !Ref 'AWSQuickstartSqlFSxRole'
  SqlFSxInstance1: 
    Type: AWS::EC2::Instance
    DependsOn: FSxWindowsFileSystem
    Properties:
      ImageId:
        Fn::GetAtt:
        - WindowsBaseAMIInfo
        - Id
      IamInstanceProfile:
        Ref: SqlFSxProfile
      InstanceType:
        Ref: WorkloadInstanceType
      NetworkInterfaces:
      - DeleteOnTermination: true
        DeviceIndex: '0'
        SubnetId:
          Ref: PrivateSubnet1ID
        SecondaryPrivateIpAddressCount: 2
        GroupSet:
          - Ref: DomainMemberSGID
          - Ref: WorkloadSecurityGroup
      Tags:
      - Key: Name
        Value:
          Ref: SqlFSxServerNetBIOSName1
      - Key: FCIName
        Value:
          Ref: SqlFSxFCIName
      - Key: FCIRole
        Value: Primary
      - Key: ResourceGroup
        Value: !Ref ResourceGroupName
      BlockDeviceMappings:
      - DeviceName: "/dev/sda1"
        Ebs:
          VolumeSize: 100
          VolumeType: gp2
      KeyName:
        Ref: KeyPairName
      UserData: !Base64
        Fn::Join:
          - ''
          - - "<powershell>\n"
            - "New-Item -Path C:\\ -Name log -ItemType Directory \n"
            - "$transcriptPath = 'C:\\log\\user-data-transcript.txt' \n"
            - "Start-Transcript $transcriptPath \n"
            - !Sub 'Set-Content -Value "${SqlFSxServerNetBIOSName1}" -Path C:\log\hostname.txt'
            - "\n"
            - !Sub 'Rename-Computer -NewName "${SqlFSxServerNetBIOSName1}"'
            - "\n"
            - "$instanceId = (New-Object System.Net.WebClient).DownloadString('http://169.254.169.254/latest/meta-data/instance-id')\n"
            - 'Start-SSMAutomationExecution -DocumentName '
            - !Sub '"${SqlFSxAutomation}"'
            - ' -Parameter @{'
            - '"SqlFSxInstanceId"='
            - "$instanceId"
            - ';"URLSuffix"='
            - !Sub '"${AWS::URLSuffix}"'
            - ';"QSS3BucketName"='
            - !Sub '"${QSS3BucketName}"'
            - ';"QSS3KeyPrefix"='
            - !Sub '"${QSS3KeyPrefix}"'
            - ';"AutomationAssumeRole"='
            - !Sub '"arn:aws:iam::${AWS::AccountId}:role/${AWSQuickstartSqlFSxRole}"'
            - '}'
            - "\n"
            - "</powershell>\n"
  SqlFSxInstance2:
    Type: AWS::EC2::Instance
    Properties:
      ImageId:
        Fn::GetAtt:
        - WindowsBaseAMIInfo
        - Id
      IamInstanceProfile:
        Ref: SqlFSxProfile
      InstanceType:
        Ref: WorkloadInstanceType
      NetworkInterfaces:
      - DeleteOnTermination: true
        DeviceIndex: '0'
        SubnetId:
          Ref: PrivateSubnet2ID
        SecondaryPrivateIpAddressCount: 2           
        GroupSet:
          - Ref: DomainMemberSGID
          - Ref: WorkloadSecurityGroup
      Tags:
      - Key: Name
        Value:
          Ref: SqlFSxServerNetBIOSName2
      - Key: FCIName
        Value:
          Ref: SqlFSxFCIName
      - Key: FCIRole
        Value: Secondary
      - Key: ResourceGroup
        Value: !Ref ResourceGroupName
      BlockDeviceMappings:
      - DeviceName: "/dev/sda1"
        Ebs:
          VolumeSize: 100
          VolumeType: gp2
      KeyName:
        Ref: KeyPairName
      UserData: !Base64
        Fn::Join:
          - ''
          - - "<powershell>\n"
            - "New-Item -Path C:\\ -Name log -ItemType Directory \n"          
            - !Sub 'Set-Content -Value "${SqlFSxServerNetBIOSName2}" -Path C:\log\hostname.txt'
            - "\n"          
            - !Sub 'Rename-Computer -NewName "${SqlFSxServerNetBIOSName2}"'
            - "\n"
            - "</powershell>\n"            
  SqlFSxRole:
    Type: AWS::IAM::Role
    Properties:
      Policies:
      - PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Action:
            - s3:GetObject
            Resource:
            - !Sub ['arn:${AWS::Partition}:s3:::${S3Bucket}/${QSS3KeyPrefix}*', S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]]
            Effect: Allow
          - Action:
            - s3:*
            Resource: "*"
            Effect: Allow
        PolicyName: aws-quick-start-s3-policy
      - PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - secretsmanager:GetSecretValue
                - secretsmanager:DescribeSecret
              Resource: 
                - !Ref 'ADAdminSecrets'
            - Effect: Allow
              Action:
                - ssm:StartAutomationExecution
              Resource: '*'
        PolicyName: QS-SqlFSx-SSM
      - PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



templates/mssqlfsx.template.yaml [1076:1327]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        - name: "PrepareFCI"
          action: "aws:runCommand"
          onFailure: "step:signalfailure"
          inputs:
            DocumentName: "AWS-RunRemoteScript"
            InstanceIds: '{{GetAllClusterNodes.InstanceIds}}'
            CloudWatchOutputConfig:
              CloudWatchOutputEnabled: "true"
              CloudWatchLogGroupName: !Ref 'QuickStartLogs'
            Parameters:
              sourceType: "S3"
              sourceInfo:
                !Sub
                  - '{"path": "https://${S3Bucket}.s3.${S3Region}.{{URLSuffix}}/{{QSS3KeyPrefix}}scripts/prepare-fci.ps1"}'
                  - S3Bucket: !If 
                      - UsingDefaultBucket
                      - !Sub '${QSS3BucketName}-${AWS::Region}'
                      - !Ref QSS3BucketName
                    S3Region: !If 
                      - UsingDefaultBucket
                      - !Ref AWS::Region
                      - !Ref QSS3BucketRegion
              commandLine: "./prepare-fci.ps1 -AdminSecret '{{AdminSecrets}}' -DomainNetBIOSName {{DomainNetBIOSName}} -SqlUserSecret {{AdminSecrets}} -MSSQLMediaBucket '{{MSSQLMediaBucketName}}' -MSSQLMediaKey '{{MSSQLMediaPathKey}}'"
        - name: "CompleteFCI"
          action: "aws:runCommand"
          onFailure: "step:signalfailure"
          inputs:
            DocumentName: "AWS-RunRemoteScript"
            InstanceIds: '{{GetClusterNode1.InstanceIds}}'
            CloudWatchOutputConfig:
              CloudWatchOutputEnabled: "true"
              CloudWatchLogGroupName: !Ref 'QuickStartLogs'
            Parameters:
              sourceType: "S3"
              sourceInfo:
                !Sub
                  - '{"path": "https://${S3Bucket}.s3.${S3Region}.{{URLSuffix}}/{{QSS3KeyPrefix}}scripts/complete-fci.ps1"}'
                  - S3Bucket: !If 
                      - UsingDefaultBucket
                      - !Sub '${QSS3BucketName}-${AWS::Region}'
                      - !Ref QSS3BucketName
                    S3Region: !If 
                      - UsingDefaultBucket
                      - !Ref AWS::Region
                      - !Ref QSS3BucketRegion
              commandLine: "./complete-fci.ps1 -AdminSecret '{{AdminSecrets}}' -DomainNetBIOSName {{DomainNetBIOSName}} -FileServerPath '{{FindFSxVolDnsAddress.FSxDnsAddress}}'.split(';')[0] -Node1FciIp '{{FindSecondaryIpAddresses.SecondaryPrivateIpAddresses}}'.split(';')[1] -Node1SubnetMask '{{FindSecondaryIpAddresses.SecondaryPrivateIpAddresses}}'.split(';')[4] -Node2FciIp '{{FindSecondaryIpAddresses.SecondaryPrivateIpAddresses}}'.split(';')[3] -Node2SubnetMask '{{FindSecondaryIpAddresses.SecondaryPrivateIpAddresses}}'.split(';')[5] -FCIName {{SqlFSxFCIName}} -SQLAdminAccounts '{{SQLAdminAccounts}}'"              
        #End of deployment workflow
        
        
        # Determines if CFN Needs to be Signaled or if Workflow should just end
        - name: CFNSignalEnd
          action: aws:branch
          inputs:
            Choices:
            - NextStep: signalsuccess
              Not: 
                Variable: "{{StackName}}"
                StringEquals: ""
            - NextStep: sleepend
              Variable: "{{StackName}}"
              StringEquals: ""
        # If all steps complete successfully signals CFN of Success
        - name: "signalsuccess"
          action: "aws:executeAwsApi"
          isEnd: True
          inputs:
            Service: cloudformation
            Api: SignalResource
            LogicalResourceId: "SSMWaitCondition"
            StackName: "{{StackName}}"
            Status: SUCCESS
            UniqueId: "{{SqlFSxInstanceId}}"
        # If CFN Signl Not Needed this sleep ends work flow
        - name: "sleepend"
          action: "aws:sleep"
          isEnd: True
          inputs:
            Duration: PT1S
        # If any steps fails signals CFN of Failure
        - name: "signalfailure"
          action: "aws:executeAwsApi"
          inputs:
            Service: cloudformation
            Api: SignalResource
            LogicalResourceId: "SSMWaitCondition"
            StackName: "{{StackName}}"
            Status: FAILURE
            UniqueId: "{{SqlFSxInstanceId}}"
  SqlFSxSSMPassRolePolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: SqlFsx-SSM-PassRole
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - iam:PassRole
            Resource: !Sub 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${AWSQuickstartSqlFSxRole}'
      Roles:
        - !Ref 'AWSQuickstartSqlFSxRole'
  SqlFSxInstance1: 
    Type: AWS::EC2::Instance
    DependsOn: FSxWindowsFileSystem
    Properties:
      ImageId:
        Fn::GetAtt:
        - WindowsBaseAMIInfo
        - Id
      IamInstanceProfile:
        Ref: SqlFSxProfile
      InstanceType:
        Ref: WorkloadInstanceType
      NetworkInterfaces:
      - DeleteOnTermination: true
        DeviceIndex: '0'
        SubnetId:
          Ref: PrivateSubnet1ID
        SecondaryPrivateIpAddressCount: 2
        GroupSet:
          - Ref: DomainMemberSGID
          - Ref: WorkloadSecurityGroup
      Tags:
      - Key: Name
        Value:
          Ref: SqlFSxServerNetBIOSName1
      - Key: FCIName
        Value:
          Ref: SqlFSxFCIName
      - Key: FCIRole
        Value: Primary
      - Key: ResourceGroup
        Value: !Ref ResourceGroupName
      BlockDeviceMappings:
      - DeviceName: "/dev/sda1"
        Ebs:
          VolumeSize: 100
          VolumeType: gp2
      KeyName:
        Ref: KeyPairName
      UserData: !Base64
        Fn::Join:
          - ''
          - - "<powershell>\n"
            - "New-Item -Path C:\\ -Name log -ItemType Directory \n"
            - "$transcriptPath = 'C:\\log\\user-data-transcript.txt' \n"
            - "Start-Transcript $transcriptPath \n"
            - !Sub 'Set-Content -Value "${SqlFSxServerNetBIOSName1}" -Path C:\log\hostname.txt'
            - "\n"
            - !Sub 'Rename-Computer -NewName "${SqlFSxServerNetBIOSName1}"'
            - "\n"
            - "$instanceId = (New-Object System.Net.WebClient).DownloadString('http://169.254.169.254/latest/meta-data/instance-id')\n"
            - 'Start-SSMAutomationExecution -DocumentName '
            - !Sub '"${SqlFSxAutomation}"'
            - ' -Parameter @{'
            - '"SqlFSxInstanceId"='
            - "$instanceId"
            - ';"URLSuffix"='
            - !Sub '"${AWS::URLSuffix}"'
            - ';"QSS3BucketName"='
            - !Sub '"${QSS3BucketName}"'
            - ';"QSS3KeyPrefix"='
            - !Sub '"${QSS3KeyPrefix}"'
            - ';"AutomationAssumeRole"='
            - !Sub '"arn:aws:iam::${AWS::AccountId}:role/${AWSQuickstartSqlFSxRole}"'
            - '}'
            - "\n"
            - "</powershell>\n"
  SqlFSxInstance2:
    Type: AWS::EC2::Instance
    Properties:
      ImageId:
        Fn::GetAtt:
        - WindowsBaseAMIInfo
        - Id
      IamInstanceProfile:
        Ref: SqlFSxProfile
      InstanceType:
        Ref: WorkloadInstanceType
      NetworkInterfaces:
      - DeleteOnTermination: true
        DeviceIndex: '0'
        SubnetId:
          Ref: PrivateSubnet2ID
        SecondaryPrivateIpAddressCount: 2           
        GroupSet:
          - Ref: DomainMemberSGID
          - Ref: WorkloadSecurityGroup
      Tags:
      - Key: Name
        Value:
          Ref: SqlFSxServerNetBIOSName2
      - Key: FCIName
        Value:
          Ref: SqlFSxFCIName
      - Key: FCIRole
        Value: Secondary
      - Key: ResourceGroup
        Value: !Ref ResourceGroupName
      BlockDeviceMappings:
      - DeviceName: "/dev/sda1"
        Ebs:
          VolumeSize: 100
          VolumeType: gp2
      KeyName:
        Ref: KeyPairName
      UserData: !Base64
        Fn::Join:
          - ''
          - - "<powershell>\n"
            - "New-Item -Path C:\\ -Name log -ItemType Directory \n"          
            - !Sub 'Set-Content -Value "${SqlFSxServerNetBIOSName2}" -Path C:\log\hostname.txt'
            - "\n"          
            - !Sub 'Rename-Computer -NewName "${SqlFSxServerNetBIOSName2}"'
            - "\n"
            - "</powershell>\n"            
  SqlFSxRole:
    Type: AWS::IAM::Role
    Properties:
      Policies:
      - PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Action:
            - s3:GetObject
            Resource:
            - !Sub ['arn:${AWS::Partition}:s3:::${S3Bucket}/${QSS3KeyPrefix}*', S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]]
            Effect: Allow
          - Action:
            - s3:*
            Resource: "*"
            Effect: Allow
        PolicyName: aws-quick-start-s3-policy
      - PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - secretsmanager:GetSecretValue
                - secretsmanager:DescribeSecret
              Resource: 
                - !Ref 'ADAdminSecrets'
            - Effect: Allow
              Action:
                - ssm:StartAutomationExecution
              Resource: '*'
        PolicyName: QS-SqlFSx-SSM
      - PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



