aws-cloudformation/vpc_routing_enhancement_architectures/templates/EgressVpcNatGw.yaml [189:472]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    AllowedValues: ["Yes", "No"]
    Type: String
    ConstraintDescription: Value must be either Yes or No

Conditions:
  BastionHostCreate: !Equals [!Ref CreateBastionHost, "Yes"]

Resources:
# Egress VPC:
  Vpc:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCidr
      EnableDnsSupport: true
      EnableDnsHostnames: true
      InstanceTenancy: default
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-vpc"

# IGW associated with Ingress VPC:
  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-igw"
  
  AttachInternetGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref Vpc
      InternetGatewayId: !Ref InternetGateway

# Subnets:
  # AZ 1:
  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Ref AvailabilityZone1
      CidrBlock: !Ref PublicSubnet1Cidr
      VpcId: !Ref Vpc
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-public-subnet-1"

  GwlbeSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Ref AvailabilityZone1
      CidrBlock: !Ref GwlbeSubnet1Cidr
      VpcId: !Ref Vpc
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-gwlbe-subnet-1"
          
  ApplicationSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Ref AvailabilityZone1
      CidrBlock: !Ref ApplicationSubnet1Cidr
      VpcId: !Ref Vpc
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-app-subnet-1"

  # AZ 2:
  PublicSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Ref AvailabilityZone2
      CidrBlock: !Ref PublicSubnet2Cidr
      VpcId: !Ref Vpc
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-public-subnet-2"

  GwlbeSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Ref AvailabilityZone2
      CidrBlock: !Ref GwlbeSubnet2Cidr
      VpcId: !Ref Vpc
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-gwlbe-subnet-2"

  ApplicationSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Ref AvailabilityZone2
      CidrBlock: !Ref ApplicationSubnet2Cidr
      VpcId: !Ref Vpc
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-app-subnet-2"

# Elastic IP and NAT GW:
  # AZ 1:
  NATGW1EIP:
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc

  NATGW1:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt NATGW1EIP.AllocationId
      SubnetId: !Ref PublicSubnet1
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-natgw-1"

  # AZ 2:
  NATGW2EIP:
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc

  NATGW2:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt NATGW2EIP.AllocationId
      SubnetId: !Ref PublicSubnet2
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-natgw-2"

# Gateway Load Balancer endpoints:
  GwlbVpcEndpoint1:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref Vpc
      ServiceName: !Ref ServiceName
      VpcEndpointType: GatewayLoadBalancer
      SubnetIds:
        - !Ref GwlbeSubnet1

  GwlbVpcEndpoint2:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref Vpc
      ServiceName: !Ref ServiceName
      VpcEndpointType: GatewayLoadBalancer
      SubnetIds:
        - !Ref GwlbeSubnet2

# Route Table and subnet association:
  # AZ 1:
  PublicRouteTable1:
    Type: AWS::EC2::RouteTable
    DependsOn: GwlbVpcEndpoint1
    Properties:
      VpcId: !Ref Vpc
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-public-rtb-1"
  
  PublicSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet1
      RouteTableId: !Ref PublicRouteTable1

  GwlbeRouteTable1:
    Type: AWS::EC2::RouteTable
    DependsOn: NATGW1
    Properties:
      VpcId: !Ref Vpc
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-gwlbe-rtb-1"
    
  GwlbeSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref GwlbeSubnet1
      RouteTableId: !Ref GwlbeRouteTable1

  ApplicationRouteTable1:
    Type: AWS::EC2::RouteTable
    DependsOn: ['GwlbVpcEndpoint1', 'GwlbVpcEndpoint2']
    Properties:
      VpcId: !Ref Vpc
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-app-rtb-1"
  
  ApplicationSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref ApplicationSubnet1
      RouteTableId: !Ref ApplicationRouteTable1
  
  # AZ 2:
  PublicRouteTable2:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref Vpc
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-public-rtb-2"
  
  PublicSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet2
      RouteTableId: !Ref PublicRouteTable2

  GwlbeRouteTable2:
    Type: AWS::EC2::RouteTable
    DependsOn: NATGW2
    Properties:
      VpcId: !Ref Vpc
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-gwlbe-rtb-2"
  
  GwlbeSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref GwlbeSubnet2
      RouteTableId: !Ref GwlbeRouteTable2

  ApplicationRouteTable2:
    Type: AWS::EC2::RouteTable
    DependsOn: ['GwlbVpcEndpoint1', 'GwlbVpcEndpoint2']
    Properties:
      VpcId: !Ref Vpc
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-app-rtb-2"
  
  ApplicationSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref ApplicationSubnet2
      RouteTableId: !Ref ApplicationRouteTable2

# Security Group:
  BastionSg:
    Type: AWS::EC2::SecurityGroup
    Condition: BastionHostCreate
    Properties:
      VpcId: !Ref Vpc
      GroupName: !Sub "${AWS::StackName}-bastion-sg"
      GroupDescription: >-
        Access to bastion instance: allow SSH and ICMP access from appropriate location.
        Allow all traffic from VPC CIDR
      SecurityGroupIngress:
        - CidrIp: !Ref AccessLocation
          IpProtocol: tcp
          FromPort: 22
          ToPort: 22
        - CidrIp: !Ref AccessLocation
          IpProtocol: tcp
          FromPort: 80
          ToPort: 80
        - CidrIp: !Ref AccessLocation
          IpProtocol: tcp
          FromPort: 443
          ToPort: 443                  
        - CidrIp: !Ref AccessLocation
          IpProtocol: ICMP
          FromPort: -1
          ToPort: -1
        - CidrIp: !Ref VpcCidr
          IpProtocol: "-1"
          FromPort: -1
          ToPort: -1          
      SecurityGroupEgress:
        - CidrIp: 0.0.0.0/0
          IpProtocol: "-1"
          FromPort: -1
          ToPort: -1
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-bastion-sg"
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



aws-cloudformation/vpc_routing_enhancement_architectures/templates/IngressVpcElb.yaml [245:528]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    AllowedValues: ["Yes", "No"]
    Type: String
    ConstraintDescription: Value must be either Yes or No

Conditions:
  BastionHostCreate: !Equals [!Ref CreateBastionHost, "Yes"]    

Resources:
# Ingress VPC:
  Vpc:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCidr
      EnableDnsSupport: true
      EnableDnsHostnames: true
      InstanceTenancy: default
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-vpc"

# IGW associated with Ingress VPC:
  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-igw"
  
  AttachInternetGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref Vpc
      InternetGatewayId: !Ref InternetGateway

# Subnets:
  # AZ 1:
  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Ref AvailabilityZone1
      CidrBlock: !Ref PublicSubnet1Cidr
      VpcId: !Ref Vpc
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-public-subnet-1"

  GwlbeSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Ref AvailabilityZone1
      CidrBlock: !Ref GwlbeSubnet1Cidr
      VpcId: !Ref Vpc
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-gwlbe-subnet-1"
          
  ApplicationSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Ref AvailabilityZone1
      CidrBlock: !Ref ApplicationSubnet1Cidr
      VpcId: !Ref Vpc
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-app-subnet-1"

  # AZ 2:
  PublicSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Ref AvailabilityZone2
      CidrBlock: !Ref PublicSubnet2Cidr
      VpcId: !Ref Vpc
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-public-subnet-2"

  GwlbeSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Ref AvailabilityZone2
      CidrBlock: !Ref GwlbeSubnet2Cidr
      VpcId: !Ref Vpc
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-gwlbe-subnet-2"

  ApplicationSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Ref AvailabilityZone2
      CidrBlock: !Ref ApplicationSubnet2Cidr
      VpcId: !Ref Vpc
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-app-subnet-2"

# Elastic IP and NAT GW:
  # AZ 1:
  NATGW1EIP:
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc

  NATGW1:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt NATGW1EIP.AllocationId
      SubnetId: !Ref PublicSubnet1
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-natgw-1"

  # AZ 2:
  NATGW2EIP:
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc

  NATGW2:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt NATGW2EIP.AllocationId
      SubnetId: !Ref PublicSubnet2
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-natgw-2"

# Gateway Load Balancer endpoints:
  GwlbVpcEndpoint1:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref Vpc
      ServiceName: !Ref ServiceName
      VpcEndpointType: GatewayLoadBalancer
      SubnetIds:
        - !Ref GwlbeSubnet1

  GwlbVpcEndpoint2:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref Vpc
      ServiceName: !Ref ServiceName
      VpcEndpointType: GatewayLoadBalancer
      SubnetIds:
        - !Ref GwlbeSubnet2

# Route Table and subnet association:
  # AZ 1:
  PublicRouteTable1:
    Type: AWS::EC2::RouteTable
    DependsOn: GwlbVpcEndpoint1
    Properties:
      VpcId: !Ref Vpc
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-public-rtb-1"
  
  PublicSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet1
      RouteTableId: !Ref PublicRouteTable1

  GwlbeRouteTable1:
    Type: AWS::EC2::RouteTable
    DependsOn: NATGW1
    Properties:
      VpcId: !Ref Vpc
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-gwlbe-rtb-1"
    
  GwlbeSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref GwlbeSubnet1
      RouteTableId: !Ref GwlbeRouteTable1

  ApplicationRouteTable1:
    Type: AWS::EC2::RouteTable
    DependsOn: ['GwlbVpcEndpoint1', 'GwlbVpcEndpoint2']
    Properties:
      VpcId: !Ref Vpc
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-app-rtb-1"
  
  ApplicationSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref ApplicationSubnet1
      RouteTableId: !Ref ApplicationRouteTable1
  
  # AZ 2:
  PublicRouteTable2:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref Vpc
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-public-rtb-2"
  
  PublicSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet2
      RouteTableId: !Ref PublicRouteTable2

  GwlbeRouteTable2:
    Type: AWS::EC2::RouteTable
    DependsOn: NATGW2
    Properties:
      VpcId: !Ref Vpc
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-gwlbe-rtb-2"
  
  GwlbeSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref GwlbeSubnet2
      RouteTableId: !Ref GwlbeRouteTable2

  ApplicationRouteTable2:
    Type: AWS::EC2::RouteTable
    DependsOn: ['GwlbVpcEndpoint1', 'GwlbVpcEndpoint2']
    Properties:
      VpcId: !Ref Vpc
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-app-rtb-2"
  
  ApplicationSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref ApplicationSubnet2
      RouteTableId: !Ref ApplicationRouteTable2

# Security Group:
  BastionSg:
    Type: AWS::EC2::SecurityGroup
    Condition: BastionHostCreate
    Properties:
      VpcId: !Ref Vpc
      GroupName: !Sub "${AWS::StackName}-bastion-sg"
      GroupDescription: >-
        Access to bastion instance: allow SSH and ICMP access from appropriate location.
        Allow all traffic from VPC CIDR
      SecurityGroupIngress:
        - CidrIp: !Ref AccessLocation
          IpProtocol: tcp
          FromPort: 22
          ToPort: 22
        - CidrIp: !Ref AccessLocation
          IpProtocol: tcp
          FromPort: 80
          ToPort: 80
        - CidrIp: !Ref AccessLocation
          IpProtocol: tcp
          FromPort: 443
          ToPort: 443                  
        - CidrIp: !Ref AccessLocation
          IpProtocol: ICMP
          FromPort: -1
          ToPort: -1
        - CidrIp: !Ref VpcCidr
          IpProtocol: "-1"
          FromPort: -1
          ToPort: -1          
      SecurityGroupEgress:
        - CidrIp: 0.0.0.0/0
          IpProtocol: "-1"
          FromPort: -1
          ToPort: -1
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-bastion-sg"
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



