assignment10.yml

AWSTemplateFormatVersion: "2010-09-09"
Description: "Cloudformation Stack Template"
Parameters:
  VpcCidrBlock:
    Description: "CIDR Block for VPC"
    Type: String
    Default: "10.0.0.0/16"
  VpcSubnetCidrBlocks: 
    Description: "List of CIDR blocks"
    Type: CommaDelimitedList
    Default: "10.0.10.0/24, 10.0.11.0/24, 10.0.12.0/24, 10.0.13.0/24, 10.0.14.0/24, 10.0.15.0/24"
  VpcSubnetAvailabilityZones: 
    Description: "List of Availability Zones"
    Type: CommaDelimitedList
    Default: "us-east-1a, us-east-1b, us-east-1c"
  PublicRouteDestinationCidrBlock:
    Description: "CIDR Block for Public Route"
    Type: String
    Default: "0.0.0.0/0"
  PublicSubnetNames:
    Description: "Name Tags for Subnets"
    Type: CommaDelimitedList
    Default: "PublicSubnet1, PublicSubnet2, PublicSubnet3"
  PrivateSubnetNames:
    Description: "Name Tags for Subnets"
    Type: CommaDelimitedList
    Default: "PrivateSubnet1, PrivateSubnet2, PrivateSubnet3"
  PublicRouteTableName:
    Description: "Name Tag for Public Route Table"
    Type: String
    Default: "PublicRouteTable"
  PrivateRouteTableName:
    Description: "Name Tag for Private Route Table"
    Type: String
    Default: "PrivateRouteTable"
  InternetGatewayName:
    Description: "Name Tag for Internet Gateway"
    Type: String
    Default: "InternetGateway"
  AppSecurityGroup:
    Description: "Name Tag for Application Security Group"
    Type: String
    Default: "application"
  DBSecurityGroupName:
    Description: "Name Tag for DB Security Group"
    Type: String
    Default: "database"
  AmiID:
    Description: "AMI ID for Instance"
    Type: String
  EC2InstanceName:
    Description: "Instance Name"
    Type: String
    Default: "NodeApp"
  InstanceType:
    Description: EC2 instance Type
    Type: String
    Default: t2.micro
  S3BucketName:
    Description: "S3 Bucket Name"
    Type: String
    Default: dev
  Ipv4Cidr:
    Description: "AMI ID for Instance"
    Type: String
    Default: "0.0.0.0/0"
  Ipv6Cidr:
    Description: "AMI ID for Instance"
    Type: String
    Default: "::/0"
  ProfileName:
    Default: demo
    Type: String
    Description: Dev/Demo(Prod)
  myLaunchTemplateVersionNumber:
    Type: String
    Default: "1.0"
  KeyName:
    Type: String
    Default: "key"
  DNSName:
    Type: String
    Default: "demo.pramithijagdish.me."
  emailaddress:
    Description: email address
    Type: String
    Default: "jagdish.p@northeastern.edu"
Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCidrBlock
      EnableDnsSupport: 'true'
      EnableDnsHostnames: 'true'
      InstanceTenancy: 'default'
      Tags: 
      - Key: Name
        Value: !Ref AWS::StackName
  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
      - Key: Name
        Value: !Ref InternetGatewayName
  InternetGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref VPC
  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId:
        Ref: VPC
      CidrBlock: !Select [0, !Ref VpcSubnetCidrBlocks]
      AvailabilityZone: !Select 
        - 0
        - !GetAZs 
          Ref: 'AWS::Region'
      MapPublicIpOnLaunch: true
      Tags: 
      - Key: Name
        Value: !Select [0, !Ref PublicSubnetNames]
      - Key: VPC Name
        Value: !Ref AWS::StackName
  PublicSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId:
        Ref: VPC
      CidrBlock: !Select [1, !Ref VpcSubnetCidrBlocks]
      AvailabilityZone: !Select 
        - 1
        - !GetAZs 
          Ref: 'AWS::Region'
      MapPublicIpOnLaunch: true
      Tags: 
      - Key: Name
        Value: !Select [1, !Ref PublicSubnetNames]
      - Key: VPC Name
        Value: !Ref AWS::StackName
  PublicSubnet3:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId:
        Ref: VPC
      CidrBlock: !Select [2, !Ref VpcSubnetCidrBlocks]
      AvailabilityZone: !Select 
        - 2
        - !GetAZs 
          Ref: 'AWS::Region'
      MapPublicIpOnLaunch: true
      Tags: 
      - Key: Name
        Value: !Select [2, !Ref PublicSubnetNames]
      - Key: VPC Name
        Value: !Ref AWS::StackName
  PrivateSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId:
        Ref: VPC
      CidrBlock: !Select [3, !Ref VpcSubnetCidrBlocks]
      AvailabilityZone: !Select 
        - 0
        - !GetAZs 
          Ref: 'AWS::Region'
      MapPublicIpOnLaunch: false
      Tags: 
      - Key: Name
        Value: !Select [0, !Ref PrivateSubnetNames]
      - Key: VPC Name
        Value: !Ref AWS::StackName
  PrivateSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId:
        Ref: VPC
      CidrBlock: !Select [4, !Ref VpcSubnetCidrBlocks]
      AvailabilityZone: !Select 
        - 1
        - !GetAZs 
          Ref: 'AWS::Region'
      MapPublicIpOnLaunch: false
      Tags: 
      - Key: Name
        Value: !Select [1, !Ref PrivateSubnetNames]
      - Key: VPC Name
        Value: !Ref AWS::StackName
  PrivateSubnet3:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId:
        Ref: VPC
      CidrBlock: !Select [5, !Ref VpcSubnetCidrBlocks]
      AvailabilityZone: !Select 
        - 2
        - !GetAZs 
          Ref: 'AWS::Region'
      MapPublicIpOnLaunch: false
      Tags: 
      - Key: Name
        Value: !Select [2, !Ref PrivateSubnetNames]
      - Key: VPC Name
        Value: !Ref AWS::StackName
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId:  
        Ref: VPC
      Tags:
      - Key: Name
        Value: !Ref PublicRouteTableName
      - Key: VPC Name
        Value: !Ref AWS::StackName
  PrivateRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId:  
        Ref: VPC
      Tags:
      - Key: Name
        Value: !Ref PrivateRouteTableName
      - Key: VPC Name
        Value: !Ref AWS::StackName
  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: InternetGatewayAttachment
    Properties:
      RouteTableId:
        Ref: PublicRouteTable
      DestinationCidrBlock: !Ref PublicRouteDestinationCidrBlock
      GatewayId:
        Ref: InternetGateway
  PublicSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId:
        Ref: PublicSubnet1
      RouteTableId:
        Ref: PublicRouteTable
  PublicSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId:
        Ref: PublicSubnet2
      RouteTableId:
        Ref: PublicRouteTable
  PublicSubnet3RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId:
        Ref: PublicSubnet3
      RouteTableId:
        Ref: PublicRouteTable
  PrivateSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId:
        Ref: PrivateSubnet1
      RouteTableId:
        Ref: PrivateRouteTable
  PrivateSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId:
        Ref: PrivateSubnet2
      RouteTableId:
        Ref: PrivateRouteTable
  PrivateSubnet3RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId:
        Ref: PrivateSubnet3
      RouteTableId:
        Ref: PrivateRouteTable
  ApplicationSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
        GroupDescription: application security group
        GroupName: application
        VpcId:
          Ref: VPC
        SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 3000
          ToPort: 3000
          SourceSecurityGroupId: !GetAtt LoadBalancerSecurityGroup.GroupId
        - IpProtocol: tcp
          FromPort: 3000
          ToPort: 3000
          SourceSecurityGroupId: !GetAtt LoadBalancerSecurityGroup.GroupId
        - IpProtocol: tcp
          Description: SSH
          FromPort: 22
          ToPort: 22
          CidrIp: 
            Ref: Ipv4Cidr
        - IpProtocol: tcp
          Description: SSH
          FromPort: 22
          ToPort: 22
          CidrIpv6:
            Ref: Ipv6Cidr
        Tags:
        - Key: Name
          Value: !Ref AppSecurityGroup
  LoadBalancerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
        GroupDescription: load balancer security group
        GroupName: load balancer
        VpcId:
          Ref: VPC
        SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp:
            Ref: Ipv4Cidr
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIpv6:
            Ref: Ipv6Cidr
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp:
            Ref: Ipv4Cidr
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIpv6:
            Ref: Ipv6Cidr
  DBSecurityGroup:
    DependsOn:
      - PrivateSubnet1
      - PrivateSubnet2
      - PrivateSubnet3
    Type: AWS::EC2::SecurityGroup
    Properties:
        GroupDescription: database
        GroupName: database
        VpcId:
          Ref: VPC
        SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 3306
          ToPort: 3306
          SourceSecurityGroupId: !GetAtt ApplicationSecurityGroup.GroupId 
        Tags:
        - Key: Name
          Value: !Ref DBSecurityGroupName
  S3Bucket:
    Type: 'AWS::S3::Bucket'
    DeletionPolicy: Delete
    Properties:
      BucketEncryption: 
        ServerSideEncryptionConfiguration: 
        - ServerSideEncryptionByDefault:
            SSEAlgorithm: AES256
      BucketName: !Join
        - "."
        - - !Select
            - 0
            - !Split
              - "-"
              - !Select
                - 2
                - !Split
                  - "/"
                  - !Ref "AWS::StackId"
          - Ref: "ProfileName"
          - "pramithijagdish.me"
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      LifecycleConfiguration:
        Rules:
          - Id: Move to Standard IA
            Prefix: profile
            Status: Enabled
            Transitions:
              - TransitionInDays: 30
                StorageClass: STANDARD_IA
      Tags:
        - Key: Name
          Value: !Ref S3BucketName
  DBSubnetGroup:
    Type: 'AWS::RDS::DBSubnetGroup' 
    Properties: 
      DBSubnetGroupDescription: Private Subnet Group for MySql Database
      DBSubnetGroupName: RDS Subnet Group
      SubnetIds: 
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2
        - !Ref PrivateSubnet3
  RDSDBParameterGroup:
    Type: 'AWS::RDS::DBParameterGroup'
    Properties:
      Description: MySQL8
      Family: mysql8.0
  RDS:
    Type: 'AWS::RDS::DBInstance'
    DeletionPolicy: Delete
    Properties:
      MultiAZ: false
      DBInstanceIdentifier: csye6225
      DBName: csye6225
      Port: 3306
      DBInstanceClass: db.t3.micro
      AllocatedStorage: 20
      Engine: MySQL
      EngineVersion: 8.0.27
      MasterUsername: csye6225
      MasterUserPassword: csye6225Spring2022
      PubliclyAccessible: false
      VPCSecurityGroups:
        - !Ref DBSecurityGroup
      DBSubnetGroupName:
        Ref: DBSubnetGroup
      DBParameterGroupName:
        Ref: RDSDBParameterGroup
      StorageEncrypted: true
      KmsKeyId: !GetAtt RdsKmsKey.Arn

  WebAppS3Policy:
    Type: 'AWS::IAM::Policy'
    Properties:
        PolicyName: WebAppS3
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
          - Effect: Allow
            Action:
              - 's3:GetObject'
              - 's3:PutObject'
              - 's3:DeleteObject'
            Resource: 
              -  !Sub arn:aws:s3:::${S3Bucket}
              -  !Sub arn:aws:s3:::${S3Bucket}/*
        Roles: 
          - !Ref IAMRole
  IAMRole:
    Type: 'AWS::IAM::Role' 
    Properties:
      RoleName: EC2-CSYE6225
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /
  IAMInstanceProfile: 
    Type: 'AWS::IAM::InstanceProfile'
    Properties: 
      Path: /
      Roles: 
        - Ref: IAMRole
  
  LaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    Properties:
      LaunchTemplateName: LaunchTemplate
      LaunchTemplateData:
        IamInstanceProfile:
          Arn: !GetAtt
            - IAMInstanceProfile
            - Arn
        ImageId: !Ref AmiID
        InstanceType: !Ref InstanceType
        KeyName: !Ref KeyName
        SecurityGroupIds:
          - !Ref ApplicationSecurityGroup
        BlockDeviceMappings:
          - DeviceName: "/dev/sdm"
            Ebs:
              VolumeSize: 20
              VolumeType: "gp2"
              DeleteOnTermination: true
              Encrypted: true
              KmsKeyId: !GetAtt EBSKmsKey.Arn
        UserData: 
          Fn::Base64: 
            !Sub |
              #!/bin/bash
              echo export DB_HOST="${RDS.Endpoint.Address}" >> /etc/environment
              echo export DB_USER="csye6225" >> /etc/environment
              echo export DB_PASSWORD="csye6225Spring2022" >> /etc/environment
              echo export DB_NAME="csye6225" >> /etc/environment
              echo export AWS_BUCKET_NAME="${S3Bucket}" >> /etc/environment
              echo export AWS_REGION="us-east-1" >> /etc/environment
              echo export DB="csye6225" >> /etc/environment
              sleep 20
              source /etc/environment
              rm -rf node_modules
              sudo npm i
              sudo pm2 restart all --update-env  
  AutoscalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      MinSize: '1'
      MaxSize: '3'
      DesiredCapacity: '1'
      LaunchTemplate:
        LaunchTemplateId: !Ref LaunchTemplate
        Version: !GetAtt LaunchTemplate.LatestVersionNumber
      VPCZoneIdentifier:
      - !Ref PublicSubnet1
      - !Ref PublicSubnet2
      - !Ref PublicSubnet3
      TargetGroupARNs:
      - !Ref TargetGroup
      Cooldown: 60
      Tags:
        - Key: Name
          Value: NodeAppASG
          PropagateAtLaunch: "true"
  LoadBalancer:
    DependsOn: InternetGatewayAttachment
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      IpAddressType: ipv4
      Name: AppLoadBalancer
      Scheme: internet-facing
      Type: application
      Subnets:
      - !Ref PublicSubnet1
      - !Ref PublicSubnet2
      - !Ref PublicSubnet3
      SecurityGroups: 
      - !Ref LoadBalancerSecurityGroup
  CPUAlarmHigh:
    Type: AWS::CloudWatch::Alarm
    Properties:
      EvaluationPeriods: '1'
      Statistic: Average
      Threshold: '4'
      AlarmDescription: Alarm if CPU utilization more than 4%
      Period: '300'
      AlarmActions:
      - !Ref ScaleOutPolicy
      Namespace: AWS/EC2
      Dimensions:
      - Name: AutoScalingGroupName
        Value: !Ref AutoscalingGroup
      ComparisonOperator: GreaterThanThreshold
      MetricName: CPUUtilization
  CPUAlarmLow:
    Type: AWS::CloudWatch::Alarm
    Properties:
      EvaluationPeriods: '1'
      Statistic: Average
      Threshold: '2'
      AlarmDescription: Alarm if CPU utilization is less than 2%
      Period: '300'
      AlarmActions:
      - !Ref ScaleInPolicy
      Namespace: AWS/EC2
      Dimensions:
      - Name: AutoScalingGroupName
        Value: !Ref AutoscalingGroup
      ComparisonOperator: LessThanThreshold
      MetricName: CPUUtilization
  ScaleOutPolicy:
    Type: AWS::AutoScaling::ScalingPolicy
    Properties:
      AdjustmentType: ChangeInCapacity
      AutoScalingGroupName: !Ref AutoscalingGroup
      Cooldown: 60
      ScalingAdjustment: 1
  ScaleInPolicy:
    Type: AWS::AutoScaling::ScalingPolicy
    Properties:
      AdjustmentType: ChangeInCapacity
      AutoScalingGroupName: !Ref AutoscalingGroup
      Cooldown: 60
      ScalingAdjustment: -1
  TargetGroup:
    DependsOn: LoadBalancer
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckIntervalSeconds: 30
      HealthCheckPath: /healthz
      HealthyThresholdCount: 3
      UnhealthyThresholdCount: 5
      HealthCheckPort: 3000
      HealthCheckProtocol: HTTP
      Name: AppLBTargetGroup
      Port: 3000
      Protocol: HTTP
      TargetType: instance
      VpcId: !Ref VPC
  LoadBalancerListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref TargetGroup
      LoadBalancerArn: !Ref LoadBalancer
      Port: 443
      Protocol: HTTPS
      Certificates:
        - CertificateArn:  arn:aws:acm:us-east-1:485384960986:certificate/7f85a476-51fa-431d-960a-25e31bdc8c6d
  DNSRecord:  
    Type: AWS::Route53::RecordSetGroup
    Properties:
      HostedZoneName: !Ref DNSName
      Comment: Zone apex alias targeted to LoadBalancer.
      RecordSets:
      - Name: !Ref DNSName
        Type: A
        AliasTarget:
          HostedZoneId: !GetAtt 'LoadBalancer.CanonicalHostedZoneID'
          DNSName: !GetAtt 'LoadBalancer.DNSName'
  CodeDeployEC2S3:
    Type: 'AWS::IAM::Policy'
    Properties:
      PolicyName: CodeDeploy-EC2-S3
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Effect: Allow
          Action:

            - 's3:PutObject'
            - 's3:Get*'
            - 's3:GetObjectVersion'
            - 's3:DeleteObject'
            - 's3:List*'
          Resource:
              - arn:aws:s3:::assignment7.demo
              - arn:aws:s3:::assignment7.demo/*
      Roles:
        - !Ref IAMRole
  GHUploadToS3:
    Type: 'AWS::IAM::Policy'
    Properties:
      PolicyName: GH-Upload-To-S3
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Effect: Allow
          Action:
            - 's3:PutObject'
            - 's3:Put*'
            - 's3:Get*' 
            - 's3:List*'
            - 's3:Delete*'
            - 's3:GetObjectVersion'
          Resource:
              - arn:aws:s3:::assignment7.demo
              - arn:aws:s3:::assignment7.demo/*
      Users: 
        - ghactions-app
  GHCodeDeploy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: GHCodeDeploy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - 'codedeploy:RegisterApplicationRevision'
              - 'codedeploy:GetApplicationRevision'
            Resource: 
              - arn:aws:codedeploy:us-east-1:485384960986:application:csye6225webapp
          - Effect: Allow
            Action:
              - 'codedeploy:CreateDeployment'
              - 'codedeploy:GetDeployment'
            Resource:
              - '*'
          - Effect: Allow
            Action:
              - 'codedeploy:GetDeploymentConfig'
            Resource:
              - arn:aws:codedeploy:us-east-1:485384960986:deploymentconfig:CodeDeployDefault.OneAtATime
              - arn:aws:codedeploy:us-east-1:485384960986:deploymentconfig:CodeDeployDefault.HalfAtATime
              - arn:aws:codedeploy:us-east-1:485384960986:deploymentconfig:CodeDeployDefault.AllAtOnce
      Users:
        - ghactions-app
  GHEC2AMI:
    Type: 'AWS::IAM::Policy'
    Properties:
      PolicyName: gh-ec2-ami
      PolicyDocument:
          Version: "2012-10-17"
          Statement:
          - Effect: Allow
            Action:
              - ec2:AttachVolume
              - ec2:AuthorizeSecurityGroupIngress
              - ec2:CopyImage
              - ec2:CreateImage
              - ec2:CreateKeypair
              - ec2:CreateSecurityGroup
              - ec2:CreateSnapshot
              - ec2:CreateTags
              - ec2:CreateVolume
              - ec2:DeleteKeyPair
              - ec2:DeleteSecurityGroup
              - ec2:DeleteSnapshot
              - ec2:DeleteVolume
              - ec2:DeregisterImage
              - ec2:DescribeImageAttribute
              - ec2:DescribeImages
              - ec2:DescribeInstances
              - ec2:DescribeInstanceStatus
              - ec2:DescribeRegions
              - ec2:DescribeSecurityGroups
              - ec2:DescribeSnapshots
              - ec2:DescribeSubnets
              - ec2:DescribeTags
              - ec2:DescribeVolumes
              - ec2:DetachVolume
              - ec2:GetPasswordData
              - ec2:ModifyImageAttribute
              - ec2:ModifyInstanceAttribute
              - ec2:ModifySnapshotAttribute
              - ec2:RegisterImage
              - ec2:RunInstances
              - ec2:StopInstances
              - ec2:TerminateInstances
            Resource:
              - '*'      
      Users:
          - ghactions-app
  CodeDeployServiceRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: CodeDeployServiceRole
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - codedeploy.amazonaws.com
            Action: 
              - 'sts:AssumeRole'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSCodeDeployRole
      Path: "/"
  CodeDeployApplication:
    Type: AWS::CodeDeploy::Application
    Properties:
      ComputePlatform: Server
      ApplicationName: csye6225webapp
  CodeDeployDeploymentGroup:
    Type: AWS::CodeDeploy::DeploymentGroup
    DependsOn: CodeDeployApplication 
    Properties:
      DeploymentGroupName: csye6225-webapp-deployment
      ApplicationName: !Ref CodeDeployApplication
      ServiceRoleArn: !GetAtt CodeDeployServiceRole.Arn
      DeploymentStyle:
        DeploymentType: IN_PLACE
        DeploymentOption: WITHOUT_TRAFFIC_CONTROL
      DeploymentConfigName: CodeDeployDefault.AllAtOnce
      AutoRollbackConfiguration:
        Enabled: 'true'
        Events: 
          - DEPLOYMENT_FAILURE
      Ec2TagFilters:
        - Key: Name
          Value: NodeAppASG
          Type: KEY_AND_VALUE
  CloudWatchAgentPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: "EC2CloudWatchPolicy"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - 'cloudwatch:PutMetricData'
              - 'ec2:DescribeTags'
              - 'ec2:DescribeVolumes'
              - 'logs:PutLogEvents'
              - 'logs:DescribeLogStreams'
              - 'logs:DescribeLogGroups'
              - 'logs:CreateLogStream'
              - 'logs:CreateLogGroup'
            Resource: "*"
          - Effect: Allow
            Action:
              - 'ssm:GetParameter'
              - 'ssm:PutParameter'
            Resource: 
              - "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*"
              - "arn:aws:iam::aws:policy/CloudWatchAgent*"
      Roles:
        - Ref: IAMRole
  SNSservice:
    Type: AWS::SNS::Topic
    Properties:
      DisplayName: verify_email
      Subscription:
      - Endpoint: !GetAtt LambdaFunction.Arn
        Protocol: lambda
      TopicName: verify_email
  SNStopicpolicy:
    Type: AWS::SNS::TopicPolicy
    Properties:
      PolicyDocument:
        Version: '2008-10-17'
        Id: __default_policy_ID
        Statement:
        - Sid: __default_statement_ID
          Effect: Allow
          Principal:
            AWS: "*"
          Action:
          - SNS:Publish
          - SNS:DeleteTopic
          - SNS:ListSubscriptionsByTopic
          - SNS:GetTopicAttributes
          - SNS:Receive
          - SNS:AddPermission
          - SNS:Subscribe
          Resource:
            Ref: SNSservice
          Condition:
            StringEquals:
              AWS:SourceOwner: !Ref AWS::AccountId
        - Sid: __console_pub_0
          Effect: Allow
          Principal:
            AWS: "*"
          Action: SNS:Publish
          Resource:
            Ref: SNSservice
        - Sid: __console_sub_0
          Effect: Allow
          Principal:
            AWS: "*"
          Action:
          - SNS:Subscribe
          - SNS:Receive
          Resource:
            Ref: SNSservice
      Topics:
      - Ref: SNSservice
  LambdaInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref LambdaFunction
      Action: lambda:InvokeFunction
      Principal: sns.amazonaws.com
      SourceArn:
        Ref: SNSservice
  LambdaFunction:
    Type: AWS::Lambda::Function
    Description: Store token in dynamodb and send email to SNS
    Properties:
      FunctionName: emailVerify
      Role:
        Fn::Join:
        - ''
        - - 'arn:aws:iam::'
          - !Ref AWS::AccountId
          - ":role/"
          - !Ref LambdaRole
      Runtime: nodejs12.x
      Handler: index.handler
      Code:
        ZipFile: |
          console.log('In Lambda function');
          exports.handler=function(event,context,callback){
            console.log('Message from SNS');
            var message = event.Records[0].Sns.Message;
            callback(null,"Success");
          };
  DynamodbTable:
    Type: AWS::DynamoDB::Table
    Properties:
      AttributeDefinitions:
        - 
          AttributeName: "Email"
          AttributeType: "S"
        - 
          AttributeName: "TokenName"
          AttributeType: "S"
      KeySchema:
        - 
          AttributeName: "Email"
          KeyType: "HASH"
        - 
          AttributeName: "TokenName"
          KeyType: "RANGE"
      ProvisionedThroughput: 
        ReadCapacityUnits: 10
        WriteCapacityUnits: 5
      TableName: csye6225
      TimeToLiveSpecification:
        AttributeName: TimeToLive
        Enabled: true
      Tags:
        - Key: key
          Value: value
  LambdaRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: "LambdaFunctionRole"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
                - 'sts:AssumeRole'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSESFullAccess
        - arn:aws:iam::aws:policy/CloudWatchLogsFullAccess
        - arn:aws:iam::aws:policy/AmazonS3FullAccess 
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
  DynamoDBPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: DynamoPolicy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - 'dynamodb:List*'
              - 'dynamodb:DescribeReservedCapacity*'
              - 'dynamodb:DescribeLimits'
              - 'dynamodb:DescribeTimeToLive'
            Resource: 
              - '*'
          - Effect: Allow
            Action:
              - 'dynamodb:PutItem'
              - 'dynamodb:DescribeTable'
              - 'dynamodb:Get*'
              - 'dynamodb:Query'
              - 'dynamodb:Scan'
              - 'dynamodb:Delete*'
              - 'dynamodb:CreateTable'
              - 'dynamodb:Update*'
              - 'dynamodb:BatchWrite*'
              - 'dynamodb:DescribeStream'
              - 'dynamodb:BatchGet*'
            Resource:
              - !GetAtt DynamodbTable.Arn
      Roles:
        - !Ref IAMRole
  EBSKmsKey:
    Type: AWS::KMS::Key
    Properties:
      Description: 'KMS Key for EBS'
      KeyPolicy:
        Id: "kms-key-for-ebs"
        Version: '2012-10-17'
        Statement:
          - Sid: Enable IAM User Permissions
            Effect: Allow
            Principal:
              AWS: 
                - !Join ["",["arn:aws:iam::",!Ref "AWS::AccountId",":root"],]
                - !Join ["",["arn:aws:iam::",!Ref "AWS::AccountId",":role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling",],]
            Action: kms:*
            Resource: '*'
          - Sid: Allow access for Key Administrators
            Effect: Allow
            Principal:
              AWS: 
                - !Join ["",["arn:aws:iam::",!Ref "AWS::AccountId",":role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling",],]
            Action:
              - kms:Create*
              - kms:Describe*
              - kms:Enable*
              - kms:List*
              - kms:Put*
              - kms:Update*
              - kms:Revoke*
              - kms:Disable*
              - kms:Get*
              - kms:Delete*
              - kms:TagResource
              - kms:UntagResource
              - kms:ScheduleKeyDeletion
              - kms:CancelKeyDeletion
            Resource: '*'
          - Sid: Allow use of the key
            Effect: Allow
            Principal:
              AWS: 
                - !Join ["",["arn:aws:iam::",!Ref "AWS::AccountId",":role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling",],]
            Action:
              - kms:Encrypt
              - kms:Decrypt
              - kms:ReEncrypt*
              - kms:GenerateDataKey*
              - kms:DescribeKey
            Resource: '*'
          - Sid: Allow attachment of persistent resources
            Effect: Allow
            Principal:
              AWS: 
                - !Join ["",["arn:aws:iam::",!Ref "AWS::AccountId",":role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling",],]
            Action:
              - kms:CreateGrant
              - kms:ListGrants
              - kms:RevokeGrant
            Resource: '*'
            
  RdsKmsKey:
    Type: AWS::KMS::Key
    Properties:
      Description: 'KMS Key for RDS'
      KeyPolicy:
        Id: "kms-key-for-rds"
        Version: '2012-10-17'
        Statement:
          - Sid: Enable IAM User Permissions
            Effect: Allow
            Principal:
              AWS: !Join
                - ''
                - - 'arn:aws:iam::'
                  - !Ref 'AWS::AccountId'
                  - ':root'
            Action: kms:*
            Resource: '*'
          - Sid: Allow access for Key Administrators
            Effect: Allow
            Principal:
              AWS: !Join
                - ''
                - - 'arn:aws:iam::'
                  - !Ref 'AWS::AccountId'
                  - ':role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS'
            Action:
              - kms:Create*
              - kms:Describe*
              - kms:Enable*
              - kms:List*
              - kms:Put*
              - kms:Update*
              - kms:Revoke*
              - kms:Disable*
              - kms:Get*
              - kms:Delete*
              - kms:TagResource
              - kms:UntagResource
              - kms:ScheduleKeyDeletion
              - kms:CancelKeyDeletion
            Resource: '*'
          - Sid: Allow use of the key
            Effect: Allow
            Principal:
              AWS: !Join
                - ''
                - - 'arn:aws:iam::'
                  - !Ref 'AWS::AccountId'
                  - ':role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS'
            Action:
              - kms:Encrypt
              - kms:Decrypt
              - kms:ReEncrypt*
              - kms:GenerateDataKey*
              - kms:DescribeKey
            Resource: '*'
          - Sid: Allow attachment of persistent resources
            Effect: Allow
            Principal:
              AWS: !Join
                - ''
                - - 'arn:aws:iam::'
                  - !Ref 'AWS::AccountId'
                  - ':role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS'
            Action:
              - kms:CreateGrant
              - kms:ListGrants
              - kms:RevokeGrant
            Resource: '*'