templates/lab_template-old.yml [144:704]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Mappings:
  RegionalSettings:
    us-east-1:
      ideType: m5.large
      supersetType: m5.large
      nodeType: db.r6g.large
      name: N. Virginia
      az1: us-east-1a
      az2: us-east-1b
      az3: us-east-1c
    us-east-2:
      ideType: m5.large
      supersetType: m5.large
      nodeType: db.r6g.large
      name: Ohio
      az1: us-east-2c
      az2: us-east-2a
      az3: us-east-2b
    us-west-2:
      ideType: m5.large
      supersetType: m5.large
      nodeType: db.r6g.large
      name: Oregon
      az1: us-west-2b
      az2: us-west-2c
      az3: us-west-2d
    ca-central-1:
      ideType: m5.large
      supersetType: m5.large
      nodeType: db.r6g.large
      name: Montreal
      az1: ca-central-1c
      az2: ca-central-1a
      az3: ca-central-1b
    eu-central-1:
      ideType: m5.large
      supersetType: m5.large
      nodeType: db.r6g.large
      name: Frankfurt
      az1: eu-central-1b
      az2: eu-central-1a
      az3: eu-central-1c
    eu-west-1:
      ideType: m5.large
      supersetType: m5.large
      nodeType: db.r6g.large
      name: Ireland
      az1: eu-west-1a
      az2: eu-west-1b
      az3: eu-west-1c
    eu-west-2:
      ideType: m5.large
      supersetType: m5.large
      nodeType: db.r6g.large
      name: London
      az1: eu-west-2b
      az2: eu-west-2a
      az3: eu-west-2c
    ap-southeast-1:
      ideType: m5.large
      supersetType: m5.large
      nodeType: db.r6g.large
      name: Singapore
      az1: ap-southeast-1c
      az2: ap-southeast-1b
      az3: ap-southeast-1a
    ap-southeast-2:
      ideType: m5.large
      supersetType: m5.large
      nodeType: db.r6g.large
      name: Sydney
      az1: ap-southeast-2a
      az2: ap-southeast-2b
      az3: ap-southeast-2c
    ap-south-1:
      ideType: m5.large
      supersetType: m5.large
      nodeType: db.r6g.large
      name: Mumbai
      az1: ap-south-1a
      az2: ap-south-1b
      az3: ap-south-1c
    ap-northeast-1:
      ideType: m5.large
      supersetType: m5.large
      nodeType: db.r6g.large
      name: Tokyo
      az1: ap-northeast-1d
      az2: ap-northeast-1a
      az3: ap-northeast-1c
    ap-northeast-2:
      ideType: m5.large
      supersetType: m5.large
      nodeType: db.r6g.large
      name: Seoul
      az1: ap-northeast-2a
      az2: ap-northeast-2b
      az3: ap-northeast-2c
  NetworkSettings:
    primary:
      vpcCidr: 172.30.0.0/16
      subPub1Cidr: 172.30.0.0/24
      subPub2Cidr: 172.30.1.0/24
      subPub3Cidr: 172.30.2.0/24
      subPrv1Cidr: 172.30.10.0/24
      subPrv2Cidr: 172.30.11.0/24
      subPrv3Cidr: 172.30.12.0/24
    secondary:
      vpcCidr: 172.31.0.0/16
      subPub1Cidr: 172.31.0.0/24
      subPub2Cidr: 172.31.1.0/24
      subPub3Cidr: 172.31.2.0/24
      subPrv1Cidr: 172.31.10.0/24
      subPrv2Cidr: 172.31.11.0/24
      subPrv3Cidr: 172.31.12.0/24
  ClusterSettings:
    global:
      dbSchema: mylab
      dbDriver: mysql
      dbVersion: 5.7.mysql_aurora.2.10.0
      dbEngine: aurora-mysql
      dbFamily: aurora-mysql5.7
    scaling:
      maxCapacity: 2
      minCapacity: 1
      cpuLoadTarget: 30
    sysbench:
      dbSchema: sbtpcc
      runTime: '600'
      numThreads: '4'
      numTables: '8'
      numWarehouses: '2'
  MLSettings:
    global:
      notebookType: ml.m4.xlarge
  GDBSettings:
    superset:
      username: "admin"
      password: "AuroraTest123!"


## Resources
Resources:

## The VPC
  vpc:
    Type: "AWS::EC2::VPC"
    Properties:
      EnableDnsSupport: true
      EnableDnsHostnames: true
      InstanceTenancy: default
      CidrBlock: !If [ condIsSecondary, !FindInMap [ NetworkSettings, secondary, vpcCidr ], !FindInMap [ NetworkSettings, primary, vpcCidr ] ]
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-vpc", !Sub "${AWS::StackName}-vpc" ]

## Create an IGW & attach it to the VPC
  vpcIgw:
    Type: "AWS::EC2::InternetGateway"
    Properties:
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-igw", !Sub "${AWS::StackName}-igw" ]
  attachIgwVpc:
    Type: "AWS::EC2::VPCGatewayAttachment"
    Properties:
      VpcId: !Ref vpc
      InternetGatewayId: !Ref vpcIgw

## Create a public subnet in each AZ
  sub1Public:
    Type: "AWS::EC2::Subnet"
    Properties:
      VpcId: !Ref vpc
      CidrBlock: !If [ condIsSecondary, !FindInMap [ NetworkSettings, secondary, subPub1Cidr ], !FindInMap [ NetworkSettings, primary, subPub1Cidr ] ]
      AvailabilityZone: !FindInMap [ RegionalSettings, !Ref "AWS::Region", az1 ]
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-pub-sub-1", !Sub "${AWS::StackName}-pub-sub-1" ]
  sub2Public:
    Type: "AWS::EC2::Subnet"
    Properties:
      VpcId: !Ref vpc
      CidrBlock: !If [ condIsSecondary, !FindInMap [ NetworkSettings, secondary, subPub2Cidr ], !FindInMap [ NetworkSettings, primary, subPub2Cidr ] ]
      AvailabilityZone: !FindInMap [ RegionalSettings, !Ref "AWS::Region", az2 ]
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-pub-sub-2", !Sub "${AWS::StackName}-pub-sub-2" ]
  sub3Public:
    Type: "AWS::EC2::Subnet"
    Properties:
      VpcId: !Ref vpc
      CidrBlock: !If [ condIsSecondary, !FindInMap [ NetworkSettings, secondary, subPub3Cidr ], !FindInMap [ NetworkSettings, primary, subPub3Cidr ] ]
      AvailabilityZone: !FindInMap [ RegionalSettings, !Ref "AWS::Region", az3 ]
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-pub-sub-3", !Sub "${AWS::StackName}-pub-sub-3" ]

## Associate the public subnets with a public route table
  rtbPublic:
    Type: "AWS::EC2::RouteTable"
    Properties:
      VpcId: !Ref vpc
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-public-rtb", !Sub "${AWS::StackName}-public-rtb" ]
  rteToIgw:
    Type: "AWS::EC2::Route"
    DependsOn: attachIgwVpc
    Properties:
      RouteTableId: !Ref rtbPublic
      DestinationCidrBlock: "0.0.0.0/0"
      GatewayId: !Ref vpcIgw
  srta1Public:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Properties:
      SubnetId: !Ref sub1Public
      RouteTableId: !Ref rtbPublic
  srta2Public:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Properties:
      SubnetId: !Ref sub2Public
      RouteTableId: !Ref rtbPublic
  srta3Public:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Properties:
      SubnetId: !Ref sub3Public
      RouteTableId: !Ref rtbPublic

## Create a private subnet in each AZ
  sub1Private:
    Type: "AWS::EC2::Subnet"
    Properties:
      VpcId: !Ref vpc
      CidrBlock: !If [ condIsSecondary, !FindInMap [ NetworkSettings, secondary, subPrv1Cidr ], !FindInMap [ NetworkSettings, primary, subPrv1Cidr ] ]
      AvailabilityZone: !FindInMap [ RegionalSettings, !Ref "AWS::Region", az1 ]
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-prv-sub-1", !Sub "${AWS::StackName}-prv-sub-1" ]
  sub2Private:
    Type: "AWS::EC2::Subnet"
    Properties:
      VpcId: !Ref vpc
      CidrBlock: !If [ condIsSecondary, !FindInMap [ NetworkSettings, secondary, subPrv2Cidr ], !FindInMap [ NetworkSettings, primary, subPrv2Cidr ] ]
      AvailabilityZone: !FindInMap [ RegionalSettings, !Ref "AWS::Region", az2 ]
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-prv-sub-2", !Sub "${AWS::StackName}-prv-sub-2" ]
  sub3Private:
    Type: "AWS::EC2::Subnet"
    Properties:
      VpcId: !Ref vpc
      CidrBlock: !If [ condIsSecondary, !FindInMap [ NetworkSettings, secondary, subPrv3Cidr ], !FindInMap [ NetworkSettings, primary, subPrv3Cidr ] ]
      AvailabilityZone: !FindInMap [ RegionalSettings, !Ref "AWS::Region", az3 ]
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-prv-sub-3", !Sub "${AWS::StackName}-prv-sub-3" ]

## Create a NAT Gateway & EIP
  natEip:
    Type: "AWS::EC2::EIP"
    Properties:
      Domain: vpc
  vpcNgw:
    Type: "AWS::EC2::NatGateway"
    DependsOn: attachIgwVpc
    Properties:
      AllocationId: !GetAtt natEip.AllocationId
      SubnetId: !Ref sub2Public

## Associate the private subnets with a NATed route table
  rtbNat:
    Type: "AWS::EC2::RouteTable"
    Properties:
      VpcId: !Ref vpc
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-nat-rtb", !Sub "${AWS::StackName}-nat-rtb" ]
  rteToNgw:
    Type: "AWS::EC2::Route"
    Properties:
      RouteTableId: !Ref rtbNat
      DestinationCidrBlock: "0.0.0.0/0"
      NatGatewayId: !Ref vpcNgw
  srta1Ngw:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref sub1Private
      RouteTableId: !Ref rtbNat
  srta2Ngw:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref sub2Private
      RouteTableId: !Ref rtbNat
  srta3Ngw:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref sub3Private
      RouteTableId: !Ref rtbNat

## Create VPC S3 endpoint
  s3Enpoint:
    Type: "AWS::EC2::VPCEndpoint"
    Properties:
      VpcId: !Ref vpc
      ServiceName: !Sub "com.amazonaws.${AWS::Region}.s3"
      RouteTableIds:
        - !Ref rtbPublic
        - !Ref rtbNat
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Principal: "*"
            Effect: Allow
            Action: "s3:*"
            Resource:
              - "arn:aws:s3:::*"
              - "arn:aws:s3:::*/*"

## Create S3 bucket that will host lab resources (incl ML training data), if the ML lab condition allows it.
  bucketLabData:
    Type: "AWS::S3::Bucket"
    Properties:
      BucketName: !Join
        - "-"
        - - !If [ condEventEngine, "auroralab", !Ref "AWS::StackName" ]
          - data
          - !Select
            - 0
            - !Split
              - "-"
              - !Select
                - 2
                - !Split
                  - "/"
                  - !Ref 'AWS::StackId'
      PublicAccessBlockConfiguration:
        BlockPublicAcls: TRUE
        BlockPublicPolicy: TRUE
        IgnorePublicAcls: TRUE
        RestrictPublicBuckets: TRUE
      Tags:
        - Key: Name
          Value: !Join
            - "-"
            - - !If [ condEventEngine, "auroralab", !Ref "AWS::StackName" ]
              - data
              - !Select
                - 0
                - !Split
                  - "-"
                  - !Select
                    - 2
                    - !Split
                      - "/"
                      - !Ref 'AWS::StackId'

## Create DB subnet group
  dbSubnets:
    Type: "AWS::RDS::DBSubnetGroup"
    Properties:
      DBSubnetGroupName: !If [ condEventEngine, "auroralab-db-subnet-group", !Sub "${AWS::StackName}-db-subnet-group" ]
      DBSubnetGroupDescription: "Aurora Lab subnets allowed for deploying DB instances"
      SubnetIds: [ !Ref sub1Private, !Ref sub2Private, !Ref sub3Private ]
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-db-subnet-group", !Sub "${AWS::StackName}-db-subnet-group" ]

## Create client security group
  clientSecGroup:
    Type: "AWS::EC2::SecurityGroup"
    Properties:
      VpcId: !Ref vpc
      GroupName: !If [ condEventEngine, "auroralab-workstation-sg", !Sub "${AWS::StackName}-workstation-sg" ]
      GroupDescription: "Aurora lab workstation security group (firewall)"
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-workstation-sg", !Sub "${AWS::StackName}-workstation-sg" ]

## Create Apache Superset security group
  supersetSecGroup:
    Type: "AWS::EC2::SecurityGroup"
    Condition: condDeployGDBResources
    Properties:
      VpcId: !Ref vpc
      GroupName: !If [ condEventEngine, "auroralab-superset-sg", !Sub "${AWS::StackName}-superset-sg" ]
      GroupDescription: "Aurora Lab Apache Superset security group (firewall)"
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-superset-sg", !Sub "${AWS::StackName}-superset-sg" ]
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
          Description: Allows Default Webport (80) access      

## Create DB security group
  dbClusterSecGroup:
    Type: "AWS::EC2::SecurityGroup"
    Properties:
      VpcId: !Ref vpc
      GroupName: !If [ condEventEngine, "auroralab-database-sg", !Sub "${AWS::StackName}-database-sg" ]
      GroupDescription: "Aurora lab database security group (firewall)"
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-database-sg", !Sub "${AWS::StackName}-database-sg" ]
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 3306
          ToPort: 3306
          SourceSecurityGroupId: !Ref clientSecGroup
          Description: "Allows MySQL access from the workstation security group"
  ruleDbClusterSecGroupIngressSelf:
    Type: "AWS::EC2::SecurityGroupIngress"
    Properties:
      GroupId: !Ref dbClusterSecGroup
      IpProtocol: -1
      Description: "Allows all inbound access from sources with the same security group"
      SourceSecurityGroupId: !Ref dbClusterSecGroup
  ruledbClusterSecGroupIngressSuperset:
    Type: "AWS::EC2::SecurityGroupIngress"
    Condition: condDeployGDBResources
    Properties:
      GroupId: !Ref dbClusterSecGroup
      IpProtocol: tcp
      FromPort: 3306
      ToPort: 3306
      Description: "Allows MySQL access from Superset Instance"
      SourceSecurityGroupId: !Ref supersetSecGroup

## Create NACL to simulate regional failure
  naclDenyAllAccess:
    Type: "AWS::EC2::NetworkAcl"
    Condition: condDeployGDBResources
    Properties: 
      VpcId: !Ref vpc
      Tags: 
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-denyall-nacl", !Sub "${AWS::StackName}-denyall-nacl" ]
  naclEntryDenyAllEgress:
    Type: "AWS::EC2::NetworkAclEntry"
    Condition: condDeployGDBResources
    Properties: 
      CidrBlock: 0.0.0.0/0
      Egress: true
      NetworkAclId: !Ref naclDenyAllAccess
      Protocol: -1
      RuleAction: deny
      RuleNumber: 100
  naclEntryDenyAllIngress:
    Type: "AWS::EC2::NetworkAclEntry"
    Condition: condDeployGDBResources
    Properties: 
      CidrBlock: 0.0.0.0/0
      Egress: false
      NetworkAclId: !Ref naclDenyAllAccess
      Protocol: -1
      RuleAction: deny
      RuleNumber: 100 

## Create a random generated password and store it as a secret for the DB cluster
  secretClusterAdminUser:
    Type: "AWS::SecretsManager::Secret"
    Condition: condDeployDBCluster
    Properties:
      Description: !If [ condEventEngine, "Administrator user credentials for DB cluster 'auroralab-mysql-cluster'", !Sub "Administrator user credentials for DB cluster '${AWS::StackName}-mysql-cluster'" ]
      GenerateSecretString:
        SecretStringTemplate: '{"username": "administrator"}'
        GenerateStringKey: 'password'
        PasswordLength: 10
        ExcludeCharacters: '="@/\$`&:{}()[]'
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-cluster-secret", !Sub "${AWS::StackName}-cluster-secret" ]

## Create enhanced monitoring role
  roleEnhancedMonitoring:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: !If [ condEventEngine, !Sub "auroralab-monitor-${AWS::Region}", !Sub "${AWS::StackName}-monitor-${AWS::Region}" ]
      Description: "Allows your Aurora DB cluster to deliver Enhanced Monitoring metrics."
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - "sts:AssumeRole"
            Principal:
              Service:
                - "monitoring.rds.amazonaws.com"
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole"
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, !Sub "auroralab-monitor-${AWS::Region}", !Sub "${AWS::StackName}-monitor-${AWS::Region}" ]

## Create external integration role
  roleServiceIntegration:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: !If [ condEventEngine, !Sub "auroralab-integrate-${AWS::Region}", !Sub "${AWS::StackName}-integrate-${AWS::Region}" ]
      Description: "Allows your Aurora DB cluster to integrate with other AWS services, such as Amazon S3 for import/export."
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - "sts:AssumeRole"
            Principal:
              Service:
                - "rds.amazonaws.com"
      Policies:
        - PolicyName: inline-policy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - "s3:ListBucket"
                  - "s3:GetObject"
                  - "s3:GetObjectVersion"
                  - "s3:AbortMultipartUpload"
                  - "s3:DeleteObject"
                  - "s3:ListMultipartUploadParts"
                  - "s3:PutObject"
                Resource:
                  - "arn:aws:s3:::*/*"
                  - "arn:aws:s3:::*"
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, !Sub "auroralab-integrate-${AWS::Region}", !Sub "${AWS::StackName}-integrate-${AWS::Region}" ]

## Create role for client IDE
  roleClientIDE:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: !If [ condEventEngine, !Sub "auroralab-ide-${AWS::Region}", !Sub "${AWS::StackName}-ide-${AWS::Region}" ]
      Description: "Permits user interaction with AWS APIs from the Cloud9 IDE."
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - "sts:AssumeRole"
            Principal:
              Service:
                - "ec2.amazonaws.com"
                - "ssm.amazonaws.com"
                - "cloud9.amazonaws.com"
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
        - "arn:aws:iam::aws:policy/AmazonSageMakerFullAccess"
        - "arn:aws:iam::aws:policy/AWSGlueConsoleSageMakerNotebookFullAccess"
        - "arn:aws:iam::aws:policy/AWSCloud9SSMInstanceProfile"
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



templates/lab_template.yml [146:706]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Mappings:
  RegionalSettings:
    us-east-1:
      ideType: m5.large
      supersetType: m5.large
      nodeType: db.r6g.large
      name: N. Virginia
      az1: us-east-1a
      az2: us-east-1b
      az3: us-east-1c
    us-east-2:
      ideType: m5.large
      supersetType: m5.large
      nodeType: db.r6g.large
      name: Ohio
      az1: us-east-2c
      az2: us-east-2a
      az3: us-east-2b
    us-west-2:
      ideType: m5.large
      supersetType: m5.large
      nodeType: db.r6g.large
      name: Oregon
      az1: us-west-2b
      az2: us-west-2c
      az3: us-west-2d
    ca-central-1:
      ideType: m5.large
      supersetType: m5.large
      nodeType: db.r6g.large
      name: Montreal
      az1: ca-central-1c
      az2: ca-central-1a
      az3: ca-central-1b
    eu-central-1:
      ideType: m5.large
      supersetType: m5.large
      nodeType: db.r6g.large
      name: Frankfurt
      az1: eu-central-1b
      az2: eu-central-1a
      az3: eu-central-1c
    eu-west-1:
      ideType: m5.large
      supersetType: m5.large
      nodeType: db.r6g.large
      name: Ireland
      az1: eu-west-1a
      az2: eu-west-1b
      az3: eu-west-1c
    eu-west-2:
      ideType: m5.large
      supersetType: m5.large
      nodeType: db.r6g.large
      name: London
      az1: eu-west-2b
      az2: eu-west-2a
      az3: eu-west-2c
    ap-southeast-1:
      ideType: m5.large
      supersetType: m5.large
      nodeType: db.r6g.large
      name: Singapore
      az1: ap-southeast-1c
      az2: ap-southeast-1b
      az3: ap-southeast-1a
    ap-southeast-2:
      ideType: m5.large
      supersetType: m5.large
      nodeType: db.r6g.large
      name: Sydney
      az1: ap-southeast-2a
      az2: ap-southeast-2b
      az3: ap-southeast-2c
    ap-south-1:
      ideType: m5.large
      supersetType: m5.large
      nodeType: db.r6g.large
      name: Mumbai
      az1: ap-south-1a
      az2: ap-south-1b
      az3: ap-south-1c
    ap-northeast-1:
      ideType: m5.large
      supersetType: m5.large
      nodeType: db.r6g.large
      name: Tokyo
      az1: ap-northeast-1d
      az2: ap-northeast-1a
      az3: ap-northeast-1c
    ap-northeast-2:
      ideType: m5.large
      supersetType: m5.large
      nodeType: db.r6g.large
      name: Seoul
      az1: ap-northeast-2a
      az2: ap-northeast-2b
      az3: ap-northeast-2c
  NetworkSettings:
    primary:
      vpcCidr: 172.30.0.0/16
      subPub1Cidr: 172.30.0.0/24
      subPub2Cidr: 172.30.1.0/24
      subPub3Cidr: 172.30.2.0/24
      subPrv1Cidr: 172.30.10.0/24
      subPrv2Cidr: 172.30.11.0/24
      subPrv3Cidr: 172.30.12.0/24
    secondary:
      vpcCidr: 172.31.0.0/16
      subPub1Cidr: 172.31.0.0/24
      subPub2Cidr: 172.31.1.0/24
      subPub3Cidr: 172.31.2.0/24
      subPrv1Cidr: 172.31.10.0/24
      subPrv2Cidr: 172.31.11.0/24
      subPrv3Cidr: 172.31.12.0/24
  ClusterSettings:
    global:
      dbSchema: mylab
      dbDriver: mysql
      dbVersion: 5.7.mysql_aurora.2.10.0
      dbEngine: aurora-mysql
      dbFamily: aurora-mysql5.7
    scaling:
      maxCapacity: 2
      minCapacity: 1
      cpuLoadTarget: 30
    sysbench:
      dbSchema: sbtpcc
      runTime: '600'
      numThreads: '4'
      numTables: '8'
      numWarehouses: '2'
  MLSettings:
    global:
      notebookType: ml.m4.xlarge
  GDBSettings:
    superset:
      username: "admin"
      password: "AuroraTest123!"


## Resources
Resources:

## The VPC
  vpc:
    Type: "AWS::EC2::VPC"
    Properties:
      EnableDnsSupport: true
      EnableDnsHostnames: true
      InstanceTenancy: default
      CidrBlock: !If [ condIsSecondary, !FindInMap [ NetworkSettings, secondary, vpcCidr ], !FindInMap [ NetworkSettings, primary, vpcCidr ] ]
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-vpc", !Sub "${AWS::StackName}-vpc" ]

## Create an IGW & attach it to the VPC
  vpcIgw:
    Type: "AWS::EC2::InternetGateway"
    Properties:
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-igw", !Sub "${AWS::StackName}-igw" ]
  attachIgwVpc:
    Type: "AWS::EC2::VPCGatewayAttachment"
    Properties:
      VpcId: !Ref vpc
      InternetGatewayId: !Ref vpcIgw

## Create a public subnet in each AZ
  sub1Public:
    Type: "AWS::EC2::Subnet"
    Properties:
      VpcId: !Ref vpc
      CidrBlock: !If [ condIsSecondary, !FindInMap [ NetworkSettings, secondary, subPub1Cidr ], !FindInMap [ NetworkSettings, primary, subPub1Cidr ] ]
      AvailabilityZone: !FindInMap [ RegionalSettings, !Ref "AWS::Region", az1 ]
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-pub-sub-1", !Sub "${AWS::StackName}-pub-sub-1" ]
  sub2Public:
    Type: "AWS::EC2::Subnet"
    Properties:
      VpcId: !Ref vpc
      CidrBlock: !If [ condIsSecondary, !FindInMap [ NetworkSettings, secondary, subPub2Cidr ], !FindInMap [ NetworkSettings, primary, subPub2Cidr ] ]
      AvailabilityZone: !FindInMap [ RegionalSettings, !Ref "AWS::Region", az2 ]
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-pub-sub-2", !Sub "${AWS::StackName}-pub-sub-2" ]
  sub3Public:
    Type: "AWS::EC2::Subnet"
    Properties:
      VpcId: !Ref vpc
      CidrBlock: !If [ condIsSecondary, !FindInMap [ NetworkSettings, secondary, subPub3Cidr ], !FindInMap [ NetworkSettings, primary, subPub3Cidr ] ]
      AvailabilityZone: !FindInMap [ RegionalSettings, !Ref "AWS::Region", az3 ]
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-pub-sub-3", !Sub "${AWS::StackName}-pub-sub-3" ]

## Associate the public subnets with a public route table
  rtbPublic:
    Type: "AWS::EC2::RouteTable"
    Properties:
      VpcId: !Ref vpc
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-public-rtb", !Sub "${AWS::StackName}-public-rtb" ]
  rteToIgw:
    Type: "AWS::EC2::Route"
    DependsOn: attachIgwVpc
    Properties:
      RouteTableId: !Ref rtbPublic
      DestinationCidrBlock: "0.0.0.0/0"
      GatewayId: !Ref vpcIgw
  srta1Public:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Properties:
      SubnetId: !Ref sub1Public
      RouteTableId: !Ref rtbPublic
  srta2Public:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Properties:
      SubnetId: !Ref sub2Public
      RouteTableId: !Ref rtbPublic
  srta3Public:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Properties:
      SubnetId: !Ref sub3Public
      RouteTableId: !Ref rtbPublic

## Create a private subnet in each AZ
  sub1Private:
    Type: "AWS::EC2::Subnet"
    Properties:
      VpcId: !Ref vpc
      CidrBlock: !If [ condIsSecondary, !FindInMap [ NetworkSettings, secondary, subPrv1Cidr ], !FindInMap [ NetworkSettings, primary, subPrv1Cidr ] ]
      AvailabilityZone: !FindInMap [ RegionalSettings, !Ref "AWS::Region", az1 ]
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-prv-sub-1", !Sub "${AWS::StackName}-prv-sub-1" ]
  sub2Private:
    Type: "AWS::EC2::Subnet"
    Properties:
      VpcId: !Ref vpc
      CidrBlock: !If [ condIsSecondary, !FindInMap [ NetworkSettings, secondary, subPrv2Cidr ], !FindInMap [ NetworkSettings, primary, subPrv2Cidr ] ]
      AvailabilityZone: !FindInMap [ RegionalSettings, !Ref "AWS::Region", az2 ]
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-prv-sub-2", !Sub "${AWS::StackName}-prv-sub-2" ]
  sub3Private:
    Type: "AWS::EC2::Subnet"
    Properties:
      VpcId: !Ref vpc
      CidrBlock: !If [ condIsSecondary, !FindInMap [ NetworkSettings, secondary, subPrv3Cidr ], !FindInMap [ NetworkSettings, primary, subPrv3Cidr ] ]
      AvailabilityZone: !FindInMap [ RegionalSettings, !Ref "AWS::Region", az3 ]
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-prv-sub-3", !Sub "${AWS::StackName}-prv-sub-3" ]

## Create a NAT Gateway & EIP
  natEip:
    Type: "AWS::EC2::EIP"
    Properties:
      Domain: vpc
  vpcNgw:
    Type: "AWS::EC2::NatGateway"
    DependsOn: attachIgwVpc
    Properties:
      AllocationId: !GetAtt natEip.AllocationId
      SubnetId: !Ref sub2Public

## Associate the private subnets with a NATed route table
  rtbNat:
    Type: "AWS::EC2::RouteTable"
    Properties:
      VpcId: !Ref vpc
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-nat-rtb", !Sub "${AWS::StackName}-nat-rtb" ]
  rteToNgw:
    Type: "AWS::EC2::Route"
    Properties:
      RouteTableId: !Ref rtbNat
      DestinationCidrBlock: "0.0.0.0/0"
      NatGatewayId: !Ref vpcNgw
  srta1Ngw:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref sub1Private
      RouteTableId: !Ref rtbNat
  srta2Ngw:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref sub2Private
      RouteTableId: !Ref rtbNat
  srta3Ngw:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref sub3Private
      RouteTableId: !Ref rtbNat

## Create VPC S3 endpoint
  s3Enpoint:
    Type: "AWS::EC2::VPCEndpoint"
    Properties:
      VpcId: !Ref vpc
      ServiceName: !Sub "com.amazonaws.${AWS::Region}.s3"
      RouteTableIds:
        - !Ref rtbPublic
        - !Ref rtbNat
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Principal: "*"
            Effect: Allow
            Action: "s3:*"
            Resource:
              - "arn:aws:s3:::*"
              - "arn:aws:s3:::*/*"

## Create S3 bucket that will host lab resources (incl ML training data), if the ML lab condition allows it.
  bucketLabData:
    Type: "AWS::S3::Bucket"
    Properties:
      BucketName: !Join
        - "-"
        - - !If [ condEventEngine, "auroralab", !Ref "AWS::StackName" ]
          - data
          - !Select
            - 0
            - !Split
              - "-"
              - !Select
                - 2
                - !Split
                  - "/"
                  - !Ref 'AWS::StackId'
      PublicAccessBlockConfiguration:
        BlockPublicAcls: TRUE
        BlockPublicPolicy: TRUE
        IgnorePublicAcls: TRUE
        RestrictPublicBuckets: TRUE
      Tags:
        - Key: Name
          Value: !Join
            - "-"
            - - !If [ condEventEngine, "auroralab", !Ref "AWS::StackName" ]
              - data
              - !Select
                - 0
                - !Split
                  - "-"
                  - !Select
                    - 2
                    - !Split
                      - "/"
                      - !Ref 'AWS::StackId'

## Create DB subnet group
  dbSubnets:
    Type: "AWS::RDS::DBSubnetGroup"
    Properties:
      DBSubnetGroupName: !If [ condEventEngine, "auroralab-db-subnet-group", !Sub "${AWS::StackName}-db-subnet-group" ]
      DBSubnetGroupDescription: "Aurora Lab subnets allowed for deploying DB instances"
      SubnetIds: [ !Ref sub1Private, !Ref sub2Private, !Ref sub3Private ]
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-db-subnet-group", !Sub "${AWS::StackName}-db-subnet-group" ]

## Create client security group
  clientSecGroup:
    Type: "AWS::EC2::SecurityGroup"
    Properties:
      VpcId: !Ref vpc
      GroupName: !If [ condEventEngine, "auroralab-workstation-sg", !Sub "${AWS::StackName}-workstation-sg" ]
      GroupDescription: "Aurora lab workstation security group (firewall)"
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-workstation-sg", !Sub "${AWS::StackName}-workstation-sg" ]

## Create Apache Superset security group
  supersetSecGroup:
    Type: "AWS::EC2::SecurityGroup"
    Condition: condDeployGDBResources
    Properties:
      VpcId: !Ref vpc
      GroupName: !If [ condEventEngine, "auroralab-superset-sg", !Sub "${AWS::StackName}-superset-sg" ]
      GroupDescription: "Aurora Lab Apache Superset security group (firewall)"
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-superset-sg", !Sub "${AWS::StackName}-superset-sg" ]
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
          Description: Allows Default Webport (80) access      

## Create DB security group
  dbClusterSecGroup:
    Type: "AWS::EC2::SecurityGroup"
    Properties:
      VpcId: !Ref vpc
      GroupName: !If [ condEventEngine, "auroralab-database-sg", !Sub "${AWS::StackName}-database-sg" ]
      GroupDescription: "Aurora lab database security group (firewall)"
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-database-sg", !Sub "${AWS::StackName}-database-sg" ]
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 3306
          ToPort: 3306
          SourceSecurityGroupId: !Ref clientSecGroup
          Description: "Allows MySQL access from the workstation security group"
  ruleDbClusterSecGroupIngressSelf:
    Type: "AWS::EC2::SecurityGroupIngress"
    Properties:
      GroupId: !Ref dbClusterSecGroup
      IpProtocol: -1
      Description: "Allows all inbound access from sources with the same security group"
      SourceSecurityGroupId: !Ref dbClusterSecGroup
  ruledbClusterSecGroupIngressSuperset:
    Type: "AWS::EC2::SecurityGroupIngress"
    Condition: condDeployGDBResources
    Properties:
      GroupId: !Ref dbClusterSecGroup
      IpProtocol: tcp
      FromPort: 3306
      ToPort: 3306
      Description: "Allows MySQL access from Superset Instance"
      SourceSecurityGroupId: !Ref supersetSecGroup

## Create NACL to simulate regional failure
  naclDenyAllAccess:
    Type: "AWS::EC2::NetworkAcl"
    Condition: condDeployGDBResources
    Properties: 
      VpcId: !Ref vpc
      Tags: 
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-denyall-nacl", !Sub "${AWS::StackName}-denyall-nacl" ]
  naclEntryDenyAllEgress:
    Type: "AWS::EC2::NetworkAclEntry"
    Condition: condDeployGDBResources
    Properties: 
      CidrBlock: 0.0.0.0/0
      Egress: true
      NetworkAclId: !Ref naclDenyAllAccess
      Protocol: -1
      RuleAction: deny
      RuleNumber: 100
  naclEntryDenyAllIngress:
    Type: "AWS::EC2::NetworkAclEntry"
    Condition: condDeployGDBResources
    Properties: 
      CidrBlock: 0.0.0.0/0
      Egress: false
      NetworkAclId: !Ref naclDenyAllAccess
      Protocol: -1
      RuleAction: deny
      RuleNumber: 100 

## Create a random generated password and store it as a secret for the DB cluster
  secretClusterAdminUser:
    Type: "AWS::SecretsManager::Secret"
    Condition: condDeployDBCluster
    Properties:
      Description: !If [ condEventEngine, "Administrator user credentials for DB cluster 'auroralab-mysql-cluster'", !Sub "Administrator user credentials for DB cluster '${AWS::StackName}-mysql-cluster'" ]
      GenerateSecretString:
        SecretStringTemplate: '{"username": "administrator"}'
        GenerateStringKey: 'password'
        PasswordLength: 10
        ExcludeCharacters: '="@/\$`&:{}()[]'
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-cluster-secret", !Sub "${AWS::StackName}-cluster-secret" ]

## Create enhanced monitoring role
  roleEnhancedMonitoring:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: !If [ condEventEngine, !Sub "auroralab-monitor-${AWS::Region}", !Sub "${AWS::StackName}-monitor-${AWS::Region}" ]
      Description: "Allows your Aurora DB cluster to deliver Enhanced Monitoring metrics."
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - "sts:AssumeRole"
            Principal:
              Service:
                - "monitoring.rds.amazonaws.com"
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole"
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, !Sub "auroralab-monitor-${AWS::Region}", !Sub "${AWS::StackName}-monitor-${AWS::Region}" ]

## Create external integration role
  roleServiceIntegration:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: !If [ condEventEngine, !Sub "auroralab-integrate-${AWS::Region}", !Sub "${AWS::StackName}-integrate-${AWS::Region}" ]
      Description: "Allows your Aurora DB cluster to integrate with other AWS services, such as Amazon S3 for import/export."
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - "sts:AssumeRole"
            Principal:
              Service:
                - "rds.amazonaws.com"
      Policies:
        - PolicyName: inline-policy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - "s3:ListBucket"
                  - "s3:GetObject"
                  - "s3:GetObjectVersion"
                  - "s3:AbortMultipartUpload"
                  - "s3:DeleteObject"
                  - "s3:ListMultipartUploadParts"
                  - "s3:PutObject"
                Resource:
                  - "arn:aws:s3:::*/*"
                  - "arn:aws:s3:::*"
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, !Sub "auroralab-integrate-${AWS::Region}", !Sub "${AWS::StackName}-integrate-${AWS::Region}" ]

## Create role for client IDE
  roleClientIDE:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: !If [ condEventEngine, !Sub "auroralab-ide-${AWS::Region}", !Sub "${AWS::StackName}-ide-${AWS::Region}" ]
      Description: "Permits user interaction with AWS APIs from the Cloud9 IDE."
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - "sts:AssumeRole"
            Principal:
              Service:
                - "ec2.amazonaws.com"
                - "ssm.amazonaws.com"
                - "cloud9.amazonaws.com"
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
        - "arn:aws:iam::aws:policy/AmazonSageMakerFullAccess"
        - "arn:aws:iam::aws:policy/AWSGlueConsoleSageMakerNotebookFullAccess"
        - "arn:aws:iam::aws:policy/AWSCloud9SSMInstanceProfile"
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



