aws-cloudformation/vpc_routing_enhancement_architectures/templates/EgressVpcNatGw.yaml [474:524]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  ApplicationSg:
    Type: AWS::EC2::SecurityGroup
    Properties:
      VpcId: !Ref Vpc
      GroupName: !Sub "${AWS::StackName}-app-sg"
      GroupDescription: >-
        Access to application instance: Allow access from only ALB.
      SecurityGroupIngress:
        - CidrIp: !Ref VpcCidr
          IpProtocol: "-1"
          FromPort: -1
          ToPort: -1             
      SecurityGroupEgress:
        - CidrIp: 0.0.0.0/0
          IpProtocol: "-1"
          FromPort: -1
          ToPort: -1
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-app-sg"

# IAM Instance Role and Profile:
  InstanceSSMRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${AWS::StackName}-instance-ssm-role"
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"    
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /

  InstanceSSMProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - !Ref InstanceSSMRole

# EC2 Instances (servers and bastion host):
  Server1:
    DependsOn: 
      - PublicRtb1EditLocalRoute
      - GwlbeRtb1Route1
      - AppRtb1Route1
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



aws-cloudformation/vpc_routing_enhancement_architectures/templates/IngressVpcElb.yaml [564:614]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  ApplicationSg:
    Type: AWS::EC2::SecurityGroup
    Properties:
      VpcId: !Ref Vpc
      GroupName: !Sub "${AWS::StackName}-app-sg"
      GroupDescription: >-
        Access to application instance: Allow access from only ALB.
      SecurityGroupIngress:
        - CidrIp: !Ref VpcCidr
          IpProtocol: "-1"
          FromPort: -1
          ToPort: -1             
      SecurityGroupEgress:
        - CidrIp: 0.0.0.0/0
          IpProtocol: "-1"
          FromPort: -1
          ToPort: -1
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-app-sg"

# IAM Instance Role and Profile:
  InstanceSSMRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${AWS::StackName}-instance-ssm-role"
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"    
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /

  InstanceSSMProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - !Ref InstanceSSMRole

# EC2 Instances (servers and bastion host):
  Server1:
    DependsOn: 
      - PublicRtb1EditLocalRoute
      - GwlbeRtb1Route1
      - AppRtb1Route1
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



