source/repositories/compliant-framework-management-services-core/templates/management-services-directory-vpc.yml [52:297]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  pTransitGatewayId:
    Type: String

  # Log Destination Info
  pLoggingBucketArn:
    Type: String

Resources:
  #
  # VPC
  #
  rVpc:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref pVpcCidr
      EnableDnsHostnames: True
      EnableDnsSupport: True
      InstanceTenancy: !Ref pInstanceTenancy
      Tags:
        - Key: Name
          Value: !Sub ${pName}-vpc
  rVpcFlowLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      RetentionInDays: 365
  rVpcFlowLogCloudWatchRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - vpc-flow-logs.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Resource: !GetAtt rVpcFlowLogGroup.Arn
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:DescribeLogGroups
                  - logs:DescribeLogStreams
                  - logs:PutLogEvents
  rVpcFlowLogCloudWatch:
    Type: AWS::EC2::FlowLog
    Properties:
      DeliverLogsPermissionArn: !GetAtt rVpcFlowLogCloudWatchRole.Arn
      LogDestination: !GetAtt rVpcFlowLogGroup.Arn
      ResourceId: !Ref rVpc
      ResourceType: VPC
      TrafficType: ALL
  rVpcFlowLogS3:
    Type: AWS::EC2::FlowLog
    Properties:
      LogDestinationType: s3
      LogDestination: !Ref pLoggingBucketArn
      ResourceId: !Ref rVpc
      ResourceType: VPC
      TrafficType: ALL

  #
  # SUBNETS
  #
  rApplicationSubnetA:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref rVpc
      CidrBlock: !Ref pApplicationSubnetACidr
      AvailabilityZone: !Select
        - 0
        - Fn::GetAZs: !Ref AWS::Region
      Tags:
        - Key: Name
          Value: !Sub ${pName}-app-subnet-a
  rApplicationSubnetB:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref rVpc
      CidrBlock: !Ref pApplicationSubnetBCidr
      AvailabilityZone: !Select
        - 1
        - Fn::GetAZs: !Ref AWS::Region
      Tags:
        - Key: Name
          Value: !Sub ${pName}-app-subnet-b
  rDataSubnetA:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref rVpc
      CidrBlock: !Ref pDataSubnetACidr
      AvailabilityZone: !Select
        - 0
        - Fn::GetAZs: !Ref AWS::Region
      Tags:
        - Key: Name
          Value: !Sub ${pName}-data-subnet-a
  rDataSubnetB:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref rVpc
      CidrBlock: !Ref pDataSubnetBCidr
      AvailabilityZone: !Select
        - 1
        - Fn::GetAZs: !Ref AWS::Region
      Tags:
        - Key: Name
          Value: !Sub ${pName}-data-subnet-b
  rTransitGatewayAttachmentSubnetA:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref rVpc
      CidrBlock: !Ref pTransitGatewayAttachmentSubnetACidr
      AvailabilityZone: !Select
        - 0
        - Fn::GetAZs: !Ref AWS::Region
      Tags:
        - Key: Name
          Value: !Sub ${pName}-tgw-attach-subnet-a
  rTransitGatewayAttachmentSubnetB:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref rVpc
      CidrBlock: !Ref pTransitGatewayAttachmentSubnetBCidr
      AvailabilityZone: !Select
        - 1
        - Fn::GetAZs: !Ref AWS::Region
      Tags:
        - Key: Name
          Value: !Sub ${pName}-tgw-attach-subnet-b

  #
  # ROUTE TABLES
  #
  rApplicationRtA:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref rVpc
      Tags:
        - Key: Name
          Value: !Sub ${pName}-app-subnet-rt-a
  rApplicationSubnetRtAssociationA:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref rApplicationSubnetA
      RouteTableId: !Ref rApplicationRtA
  rApplicationRtB:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref rVpc
      Tags:
        - Key: Name
          Value: !Sub ${pName}-app-subnet-rt-b
  rApplicationSubnetRtAssociationB:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref rApplicationSubnetB
      RouteTableId: !Ref rApplicationRtB
  rDataRtA:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref rVpc
      Tags:
        - Key: Name
          Value: !Sub ${pName}-data-subnet-rt-a
  rDataSubnetRtAssociationA:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref rDataSubnetA
      RouteTableId: !Ref rDataRtA

  rDataRtB:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref rVpc
      Tags:
        - Key: Name
          Value: !Sub ${pName}-data-subnet-rt-b
  rDataSubnetRtAssociationB:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref rDataSubnetB
      RouteTableId: !Ref rDataRtB

  rTransitGatewayAttachmentRt:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref rVpc
      Tags:
        - Key: Name
          Value: !Sub ${pName}-tgw-attach-subnet-rt
  rTransitGatewayAttachmentSubnetRtAssociationA:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref rTransitGatewayAttachmentSubnetA
      RouteTableId: !Ref rTransitGatewayAttachmentRt
  rTransitGatewayAttachmentSubnetRtAssociationB:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref rTransitGatewayAttachmentSubnetB
      RouteTableId: !Ref rTransitGatewayAttachmentRt

  #
  # TRANSIT GATEWAY ATTACHMENT / ROUTING
  #
  rTransitGatewayAttachment:
    Type: AWS::EC2::TransitGatewayAttachment
    Properties:
      SubnetIds:
        - !Ref rTransitGatewayAttachmentSubnetA
        - !Ref rTransitGatewayAttachmentSubnetB
      Tags:
        - Key: Name
          Value: !Sub ${pName}-tgw-attachment
      TransitGatewayId: !Ref pTransitGatewayId
      VpcId: !Ref rVpc

  # Send All Traffic to TGW [App A]
  rVpcApplicationRtATgwRouteRfc1918Route1:
    DependsOn: rTransitGatewayAttachment
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref rApplicationRtA
      DestinationCidrBlock: 0.0.0.0/0
      TransitGatewayId: !Ref pTransitGatewayId

  # Send All Traffic to TGW [App B]
  rVpcApplicationRtBTgwRouteRfc1918Route1:
    DependsOn: rTransitGatewayAttachment
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref rApplicationRtB
      DestinationCidrBlock: 0.0.0.0/0
      TransitGatewayId: !Ref pTransitGatewayId

  # VPC Endpoints
  rVpcEndpointSg:
    Metadata:
      cfn_nag:
        rules_to_suppress:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



source/repositories/compliant-framework-management-services-core/templates/management-services-vpc.yml [52:313]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  pTransitGatewayId:
    Type: String

  # Log Destination Info
  pLoggingBucketArn:
    Type: String

Resources:
  #
  # VPC
  #
  rVpc:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref pVpcCidr
      EnableDnsHostnames: True
      EnableDnsSupport: True
      InstanceTenancy: !Ref pInstanceTenancy
      Tags:
        - Key: Name
          Value: !Sub ${pName}-vpc
  rVpcFlowLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      RetentionInDays: 365
  rVpcFlowLogCloudWatchRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - vpc-flow-logs.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Resource: !GetAtt rVpcFlowLogGroup.Arn
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:DescribeLogGroups
                  - logs:DescribeLogStreams
                  - logs:PutLogEvents
  rVpcFlowLogCloudWatch:
    Type: AWS::EC2::FlowLog
    Properties:
      DeliverLogsPermissionArn: !GetAtt rVpcFlowLogCloudWatchRole.Arn
      LogDestination: !GetAtt rVpcFlowLogGroup.Arn
      ResourceId: !Ref rVpc
      ResourceType: VPC
      TrafficType: ALL
  rVpcFlowLogS3:
    Type: AWS::EC2::FlowLog
    Properties:
      LogDestinationType: s3
      LogDestination: !Ref pLoggingBucketArn
      ResourceId: !Ref rVpc
      ResourceType: VPC
      TrafficType: ALL

  #
  # SUBNETS
  #
  rApplicationSubnetA:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref rVpc
      CidrBlock: !Ref pApplicationSubnetACidr
      AvailabilityZone: !Select
        - 0
        - Fn::GetAZs: !Ref AWS::Region
      Tags:
        - Key: Name
          Value: !Sub ${pName}-app-subnet-a
  rApplicationSubnetB:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref rVpc
      CidrBlock: !Ref pApplicationSubnetBCidr
      AvailabilityZone: !Select
        - 1
        - Fn::GetAZs: !Ref AWS::Region
      Tags:
        - Key: Name
          Value: !Sub ${pName}-app-subnet-b
  rDataSubnetA:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref rVpc
      CidrBlock: !Ref pDataSubnetACidr
      AvailabilityZone: !Select
        - 0
        - Fn::GetAZs: !Ref AWS::Region
      Tags:
        - Key: Name
          Value: !Sub ${pName}-data-subnet-a
  rDataSubnetB:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref rVpc
      CidrBlock: !Ref pDataSubnetBCidr
      AvailabilityZone: !Select
        - 1
        - Fn::GetAZs: !Ref AWS::Region
      Tags:
        - Key: Name
          Value: !Sub ${pName}-data-subnet-b
  rTransitGatewayAttachmentSubnetA:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref rVpc
      CidrBlock: !Ref pTransitGatewayAttachmentSubnetACidr
      AvailabilityZone: !Select
        - 0
        - Fn::GetAZs: !Ref AWS::Region
      Tags:
        - Key: Name
          Value: !Sub ${pName}-tgw-attach-subnet-a
  rTransitGatewayAttachmentSubnetB:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref rVpc
      CidrBlock: !Ref pTransitGatewayAttachmentSubnetBCidr
      AvailabilityZone: !Select
        - 1
        - Fn::GetAZs: !Ref AWS::Region
      Tags:
        - Key: Name
          Value: !Sub ${pName}-tgw-attach-subnet-b

  #
  # ROUTE TABLES
  #
  rApplicationRtA:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref rVpc
      Tags:
        - Key: Name
          Value: !Sub ${pName}-app-subnet-rt-a
  rApplicationSubnetRtAssociationA:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref rApplicationSubnetA
      RouteTableId: !Ref rApplicationRtA
  rApplicationRtB:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref rVpc
      Tags:
        - Key: Name
          Value: !Sub ${pName}-app-subnet-rt-b
  rApplicationSubnetRtAssociationB:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref rApplicationSubnetB
      RouteTableId: !Ref rApplicationRtB
  rDataRtA:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref rVpc
      Tags:
        - Key: Name
          Value: !Sub ${pName}-data-subnet-rt-a
  rDataSubnetRtAssociationA:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref rDataSubnetA
      RouteTableId: !Ref rDataRtA
  rDataRtB:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref rVpc
      Tags:
        - Key: Name
          Value: !Sub ${pName}-data-subnet-rt-b
  rDataSubnetRtAssociationB:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref rDataSubnetB
      RouteTableId: !Ref rDataRtB
  rTransitGatewayAttachmentRt:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref rVpc
      Tags:
        - Key: Name
          Value: !Sub ${pName}-tgw-attach-subnet-rt
  rTransitGatewayAttachmentSubnetRtAssociationA:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref rTransitGatewayAttachmentSubnetA
      RouteTableId: !Ref rTransitGatewayAttachmentRt
  rTransitGatewayAttachmentSubnetRtAssociationB:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref rTransitGatewayAttachmentSubnetB
      RouteTableId: !Ref rTransitGatewayAttachmentRt

  #
  # TRANSIT GATEWAY ATTACHMENT / ROUTING
  #
  rTransitGatewayAttachment:
    Type: AWS::EC2::TransitGatewayAttachment
    Properties:
      SubnetIds:
        - !Ref rTransitGatewayAttachmentSubnetA
        - !Ref rTransitGatewayAttachmentSubnetB
      Tags:
        - Key: Name
          Value: !Sub ${pName}-tgw-attachment
      TransitGatewayId: !Ref pTransitGatewayId
      VpcId: !Ref rVpc

  # Send All Traffic to TGW [App A]
  rVpcApplicationRtATgwRouteRfc1918Route1:
    DependsOn: rTransitGatewayAttachment
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref rApplicationRtA
      DestinationCidrBlock: 0.0.0.0/0
      TransitGatewayId: !Ref pTransitGatewayId

  # Send All Traffic to TGW [App B]
  rVpcApplicationRtBTgwRouteRfc1918Route1:
    DependsOn: rTransitGatewayAttachment
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref rApplicationRtB
      DestinationCidrBlock: 0.0.0.0/0
      TransitGatewayId: !Ref pTransitGatewayId

  # # Send All Traffic to TGW [Data A]
  # rVpcDataRtATgwRouteRfc1918Route1:
  #   DependsOn: rTransitGatewayAttachment
  #   Type: AWS::EC2::Route
  #   Properties:
  #     RouteTableId: !Ref rDataRtA
  #     DestinationCidrBlock: 10.0.0.0/8
  #     TransitGatewayId: !Ref pTransitGatewayId

  # # Send All Traffic to TGW [Data B]
  # rVpcDataRtBTgwRouteRfc1918Route1:
  #   DependsOn: rTransitGatewayAttachment
  #   Type: AWS::EC2::Route
  #   Properties:
  #     RouteTableId: !Ref rDataRtB
  #     DestinationCidrBlock: 10.0.0.0/8
  #     TransitGatewayId: !Ref pTransitGatewayId

  # VPC Endpoints
  rVpcEndpointSg:
    Metadata:
      cfn_nag:
        rules_to_suppress:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



