template.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: Deploy a UIUC Bastion Host with automation.

Parameters:
  SourceURL:
    Type: String
    Description: HTTPS URL to the UIUC Bastion Host git repository.
    AllowedPattern: "^https://.+"
    ConstraintDescription: Must be an HTTPS URL to a git repository.
  SourceBranch:
    Type: String
    Description: The name of the branch to build.
    Default: main
    MinLength: 3
  TerraformMode:
    Type: String
    Description: Mode of operation for the terraform commands.
    AllowedValues:
      - Apply (Create/Update)
      - Destroy
      - All
  StateBucketName:
    Type: String
    Description: Name of the S3 bucket to store terraform state.
    AllowedPattern: "^[a-z0-9][a-z0-9.-]+[a-z0-9.]$"
    ConstraintDescription: Must be a valid S3 bucket name.
  StateObjectKey:
    Type: String
    Description: Object key (path) for the terraform state in the bucket. This must be unique for each deployment.
    Default: "bastion/terraform.tfstate"
    AllowedPattern: "^[^/].*"
    ConstraintDescription: Must be a valid S3 object key.
  StateLockTableName:
    Type: String
    Description: Name of a DynamoDB table for terraform state locking.
    Default: terraform
    MinLength: 3

  Service:
    Type: String
    Description: Service Catalog name for these resources.
  Contact:
    Type: String
    Description: Service email address.
  DataClassification:
    Type: String
    Description: Data Classification value for what's stored and available through this host.
    Default: Internal
    AllowedValues: [ Public, Internal, Sensitive, HighRisk ]
  Environment:
    Type: String
    Description: Environment name (prod, test, dev, or poc).
    Default: ""
    AllowedValues:
      - ""
      - Prod
      - Production
      - Test
      - Dev
      - Development
      - DevTest
      - POC
      - prod
      - production
      - test
      - dev
      - development
      - devtest
      - poc

  Hostname:
    Type: String
    Description: Hostname of the bastion host that you will associate with the IP.
    AllowedPattern: "^[a-zA-Z0-9]([a-zA-Z0-9.-]{0,61}[a-zA-Z0-9])?\\.[a-zA-Z]{2,}$"
    ConstraintDescription: Must be a validly formatted hostname.
  InstanceType:
    Type: String
    Description: Type of the instance to launch, which affects cost and features.
    Default: t3.micro
  SSHKeyName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: EC2 SSH KeyPair for allowing access via the builtin account (ec2-user).
  EnhancedMonitoring:
    Type: String
    Description: Use enahanced/detailed monitoring on supported resources.
    Default: "false"
    AllowedValues: [ "true", "false" ]
  FalconSensorPackage:
    Type: String
    Description: S3 URL (s3://bucket/path/to/sensor.rpm) to download the CrowdStrike Falcon Sensor (optional).
    Default: ""
    AllowedPattern: "^(s3://[a-z0-9][a-z0-9.-]+[a-z0-9.]/.+\\.rpm)?$"
    ConstraintDescription: The S3 URL must be empty or of the form "s3://bucket/path/to/sensor.rpm".
  ShellIdleTimeout:
    Type: Number
    Description: Number of seconds before an idle shell is disconnected.
    Default: 900
    MinValue: 0

  AllowedCIDRs:
    Type: CommaDelimitedList
    Description: List of IPv4 CIDRs allowed to SSH to the bastion host.
    Default: "0.0.0.0/0"
    AllowedPattern: "^\\d+\\.\\d+\\.\\d+\\.\\d+/\\d+$"
    ConstraintDescription: "Values must be in CIDR form: XXX.XXX.XXX.XXX/YY"
  PublicSubnets:
    Type: List<AWS::EC2::Subnet::Id>
    Description: Subnet names for public access where the primary IP will be.
  InternalSubnets:
    Type: List<AWS::EC2::Subnet::Id>
    Description: Subnet names to use for internal resources unreachable from outside the VPC.
  ExtraSecurityGroups:
    Type: CommaDelimitedList
    Description: List of security groups to associate with the primary interface. The default one includes ingress SSH and all egress traffic.
    Default: ""
  ExtraENIs:
    Type: String
    Description: List of extra ENIs to attach to the bastion host (in HCL format). You can configure what routes this ENI is used for by provising prefix list names or IDs and/or VPC IDs.
    Default: ""
  ExtraEFS:
    Type: String
    Description: Map of extra EFS's to mount to the bastion host (in HCL format).
    Default: ""

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label: Source Code
        Parameters:
          - SourceURL
          - SourceBranch
      - Label: Terraform
        Parameters:
          - TerraformMode
          - StateBucketName
          - StateObjectKey
          - StateLockTableName
      - Label: Tagging
        Parameters:
          - Service
          - Contact
          - DataClassification
          - Environment
      - Label: Instance
        Parameters:
          - Hostname
          - InstanceType
          - SSHKeyName
          - EnhancedMonitoring
          - FalconSensorPackage
          - ShellIdleTimeout
      - Label: Networking
        Parameters:
          - AllowedCIDRs
          - PublicSubnets
          - InternalSubnets
          - ExtraSecurityGroups
          - ExtraENIs
          - ExtraEFS

Conditions:
  HasDestroy: !Or
    - !Equals [ !Ref TerraformMode, "Destroy" ]
    - !Equals [ !Ref TerraformMode, "All" ]
  HasApply: !Or
    - !Equals [ !Ref TerraformMode, "Apply (Create/Update)" ]
    - !Equals [ !Ref TerraformMode, "All" ]

Resources:
  TerraformRole:
    Type: AWS::IAM::Role
    Properties:
      Description: Allow CodeBuild to run terraform to deploy the bastion host.
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - codebuild.amazonaws.com
            Action: [ 'sts:AssumeRole' ]
      Path: /
      ManagedPolicyArns:
        - !Ref TerraformDeployReadOnlyPolicy
        - !Ref TerraformDeployReadWritePolicy
        - !Ref TerraformDeploySecurityPolicy
      Policies:
        - PolicyName: codebuild
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "logs:CreateLogStream"
                  - "logs:PutLogEvents"
                Resource:
                  - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${ApplyProjectLogs}
                  - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${ApplyProjectLogs}:*
                  - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${DestroyProjectLogs}
                  - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${DestroyProjectLogs}:*
        - PolicyName: terraform
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: "s3:GetBucketLocation"
                Resource: "*"
              - Effect: Allow
                Action: "s3:ListBucket"
                Resource: !Sub "arn:aws:s3:::${StateBucketName}"
              - Effect: Allow
                Action:
                  - "s3:GetObject"
                  - "s3:PutObject"
                Resource: !Sub "arn:aws:s3:::${StateBucketName}/${StateObjectKey}"
              - Effect: Allow
                Action:
                  - "dynamodb:GetItem"
                  - "dynamodb:PutItem"
                  - "dynamodb:DeleteItem"
                Resource: !Sub "arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${StateLockTableName}"
        - PolicyName: parameters
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Sid: ReadOnly
                Effect: Allow
                Action:
                  - "ssm:DescribeParameters"
                  - "ssm:ListTagsForResource"
                  - "kms:ListKeys"
                Resource: "*"
              - Sid: ReadWrite
                Effect: Allow
                Action:
                  - "ssm:GetParameter*"
                  - "ssm:PutParameter"
                  - "ssm:*Tags*"
                Resource:
                  - !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${AWS::StackName}/ssh/*"
              - Sid: KMSReadWrite
                Effect: Allow
                Action:
                  - "kms:Decrypt"
                  - "kms:Encrypt"
                  - "kms:GenerateDataKey"
                Resource:
                  - !Sub "arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/*"
                Condition:
                  ArnLike:
                    "kms:EncryptionContext:PARAMETER_ARN":
                      - !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${AWS::StackName}/ssh/*"
      Tags:
        - { Key: Service, Value: !Ref Service }
        - { Key: Contact, Value: !Ref Contact }
        - { Key: Environment, Value: !Ref Environment }
        - { Key: Project, Value: !Ref "AWS::StackName" }
  TerraformDeployReadOnlyPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: !Sub "${AWS::StackName}-DeployReadOnly-${AWS::Region}"
      Description: Policy to deploy resources in the terraform.
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: ReadOnly
            Effect: Allow
            Action:
              - "ec2:DescribeAddresses*"
              - "ec2:DescribeImages"
              - "ec2:DescribeInstanceTypes"
              - "ec2:DescribeLaunchTemplate*"
              - "ec2:DescribeManagedPrefixLists"
              - "ec2:DescribeNetworkInterfaces"
              - "ec2:DescribePrefixLists"
              - "ec2:DescribeSecurityGroup*"
              - "ec2:DescribeStaleSecurityGroups"
              - "ec2:DescribeSubnets"
              - "ec2:DescribeVpc*"
              - "ec2:GetManagedPrefixList*"

              - "autoscaling:Describe*"

              - "logs:DescribeLogGroups"
              - "logs:DescribeResourcePolicies"
              - "logs:TestMetricFilter"

              - "elasticfilesystem:Describe*"
              - "elasticfilesystem:ListTagsForResource"

              - "iam:ListInstanceProfiles"
              - "iam:ListPolicies"
              - "iam:ListRoles"

              - "kms:ListAliases"
              - "kms:ListKeys"

              - "s3:GetAccountPublicAccessBlock"
              - "s3:ListAllMyBuckets"

              - "lambda:GetAccountSettings"
              - "lambda:ListCodeSigningConfigs"
              - "lambda:ListEventSourceMappings"
              - "lambda:ListFunctions*"
              - "lambda:ListLayer*"

              - "events:DescribeRule"
              - "events:ListEventBuses"
              - "events:ListRule*"
              - "events:TestEventPattern"

              - "ssm:DescribeAssociation*"
              - "ssm:DescribeAvailablePatches"
              - "ssm:DescribeDocument*"
              - "ssm:DescribeEffective*"
              - "ssm:DescribeInstance*"
              - "ssm:DescribeMaintenanceWindow*"
              - "ssm:DescribePatchBaselines"
              - "ssm:DescribePatchGroup*"
              - "ssm:DescribePatchProperties"
              - "ssm:GetDefaultPatchBaseline"
              - "ssm:GetDocument"
              - "ssm:GetInventory*"
              - "ssm:GetMaintenanceWindow*"
              - "ssm:GetParameter*"
              - "ssm:GetPatchBaseline*"
              - "ssm:ListAssociation*"
              - "ssm:ListDocument*"
              - "ssm:ListInstanceAssociations"
              - "ssm:ListInventoryEntries"
              - "ssm:ListTagsForResource"
            Resource: '*'
  TerraformDeployReadWritePolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: !Sub "${AWS::StackName}-DeployReadWrite-${AWS::Region}"
      Description: Policy to deploy resources in the terraform.
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: ReadWrite
            Effect: Allow
            Action:
              - "ec2:CreateLaunchTemplate*"
              - "ec2:DeleteLaunchTemplate*"
              - "ec2:ModifyLaunchTemplate"

              - "ec2:AuthorizeSecurityGroup*"
              - "ec2:CreateSecurityGroup"
              - "ec2:DeleteSecurityGroup"
              - "ec2:RevokeSecurityGroup*"
              - "ec2:UpdateSecurityGroupRuleDescriptions*"

              - "ec2:CreateTags"
              - "ec2:DeleteTags"

              - "ec2:RunInstances"
              - "autoscaling:*"

              - "logs:AssociateKmsKey"
              - "logs:CreateLogGroup"
              - "logs:CreateLogStream"
              - "logs:DeleteLogGroup"
              - "logs:DeleteLogStream"
              - "logs:DeleteMetricFilter"
              - "logs:DeleteRetentionPolicy"
              - "logs:DeleteSubscriptionFilter"
              - "logs:DescribeLogStreams"
              - "logs:DescribeMetricFilters"
              - "logs:DescribeSubscriptionFilters"
              - "logs:DisassociateKmsKey"
              - "logs:ListTagsLogGroup"
              - "logs:PutMetricFilter"
              - "logs:PutRetentionPolicy"
              - "logs:PutSubscriptionFilter"
              - "logs:TagLogGroup"
              - "logs:UntagLogGroup"

              - "elasticfilesystem:Create*"
              - "elasticfilesystem:DeleteAccessPoint"
              - "elasticfilesystem:DeleteFileSystemPolicy"
              - "elasticfilesystem:DeleteMountTarget"
              - "elasticfilesystem:DeleteTags"
              - "elasticfilesystem:ModifyMountTargetSecurityGroups"
              - "elasticfilesystem:PutBackupPolicy"
              - "elasticfilesystem:PutFileSystemPolicy"
              - "elasticfilesystem:PutLifecycleConfiguration"
              - "elasticfilesystem:TagResource"
              - "elasticfilesystem:UntagResource"
              - "elasticfilesystem:UpdateFileSystem"

              - "s3:*"
              - "lambda:*"
              - "ssm:*"
            Resource:
              - !Sub arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:elastic-ip/*
              - !Sub arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:instance/*
              - !Sub arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:launch-template/*
              - !Sub arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:volume/*
              - !Sub arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:network-interface/*
              - !Sub arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:security-group/*
              - !Sub arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:subnet/*
              - !Sub arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:vpc/*
              - !Sub arn:aws:ec2:${AWS::Region}::image/*
              - !Sub arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:key-pair/${SSHKeyName}

              - !Sub arn:aws:autoscaling:${AWS::Region}:${AWS::AccountId}:autoScalingGroup:*:autoScalingGroupName/${AWS::StackName}
              - !Sub arn:aws:autoscaling:${AWS::Region}:${AWS::AccountId}:autoScalingGroup:*:autoScalingGroupName/${AWS::StackName}-*

              - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${AWS::StackName}
              - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${AWS::StackName}:*
              - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${AWS::StackName}-*
              - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${AWS::StackName}-*:*
              - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/${AWS::StackName}/*
              - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/${AWS::StackName}/*:*

              - !Sub arn:aws:elasticfilesystem:${AWS::Region}:${AWS::AccountId}:file-system/*
              - !Sub arn:aws:elasticfilesystem:${AWS::Region}:${AWS::AccountId}:access-point/*

              - !Sub arn:aws:s3:::${AWS::StackName}
              - !Sub arn:aws:s3:::${AWS::StackName}-*
              - !Sub arn:aws:s3:::${AWS::StackName}/*
              - !Sub arn:aws:s3:::${AWS::StackName}-*/*

              - !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}
              - !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}-*
              - !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}:*
              - !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}-*:*
              - !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:layer:${AWS::StackName}
              - !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:layer:${AWS::StackName}-*
              - !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:layer:${AWS::StackName}:*
              - !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:layer:${AWS::StackName}-*:*

              - !Sub arn:aws:ssm:${AWS::Region}:*:document/*
              - !Sub arn:aws:ssm:${AWS::Region}:*:patchbaseline/*
              - !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:association/*
              - !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:maintenancewindow/*
              - !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${AWS::StackName}/outputs/*
              - !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:windowtarget/*
              - !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:windowtask/*
              - !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:task/*
            Condition:
              StringEqualsIfExists:
                "aws:RequestTag/Project": !Ref "AWS::StackName"
                "aws:ResourceTag/Project": !Ref "AWS::StackName"
                "ec2:Owner": amazon
              ArnLikeIfExists:
                "ec2:InstanceProfile":
                  - !Sub "arn:aws:iam::${AWS::AccountId}:instance-profile/${AWS::StackName}"
                  - !Sub "arn:aws:iam::${AWS::AccountId}:instance-profile/${AWS::StackName}-*"

          - Sid: EC2Global
            Effect: Allow
            Action:
              - "ec2:AllocateAddress"
              - "ec2:DisassociateAddress"
              - "ec2:ModifyAddressAttribute"
              - "ec2:ResetAddressAttribute"
            Resource: "*"

          - Sid: LambdaEventSourceMappings
            Effect: Allow
            Action:
              - "lambda:CreateEventSourceMapping"
              - "lambda:DeleteEventSourceMapping"
              - "lambda:GetEventSourceMapping"
              - "lambda:UpdateEventSourceMapping"
            Resource: "*"
            Condition:
              ArnLike:
                "lambda:FunctionArn":
                  - !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}
                  - !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}-*
                  - !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}:*
                  - !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}-*:*

          - Sid: EventsReadWrite
            Effect: Allow
            Action:
              - "events:DeleteRule"
              - "events:DisableRule"
              - "events:EnableRule"
              - "events:ListTagsForResource"
              - "events:ListTargetsByRule"
              - "events:PutRule"
              - "events:PutTargets"
              - "events:RemoveTargets"
              - "events:TagResource"
              - "events:UntagResource"
            Resource:
              - !Sub arn:aws:events:${AWS::Region}:${AWS::AccountId}:rule/${AWS::StackName}
              - !Sub arn:aws:events:${AWS::Region}:${AWS::AccountId}:rule/${AWS::StackName}-*
              - !Sub arn:aws:events:${AWS::Region}:${AWS::AccountId}:rule/default/${AWS::StackName}
              - !Sub arn:aws:events:${AWS::Region}:${AWS::AccountId}:rule/default/${AWS::StackName}-*
            Condition:
              ArnLikeIfExists:
                "events:TargetArn":
                  - !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}
                  - !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}-*
                  - !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}:*
                  - !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${AWS::StackName}-*:*

          - Sid: SSMReadWrite
            Effect: Allow
            Action:
              - "ssm:CreateMaintenanceWindow"
              - "ssm:CreatePatchBaseline"
            Resource: "*"
            Condition:
              StringEqualsIfExists:
                "aws:RequestTag/Project": !Ref "AWS::StackName"
                "aws:ResourceTag/Project": !Ref "AWS::StackName"
          - Sid: SSMGlobalReadWrite
            Effect: Allow
            Action:
              - "ssm:AddTagsToResource"
              - "ssm:RemoveTagsFromResource"
            Resource: "*"
  TerraformDeploySecurityPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: !Sub "${AWS::StackName}-DeploySecurity-${AWS::Region}"
      Description: Policy to deploy resources in the terraform.
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: ReadWrite
            Effect: Allow
            Action:
              - "iam:AddRoleToInstanceProfile"
              - "iam:AttachRolePolicy"
              - "iam:CreateInstanceProfile"
              - "iam:CreatePolicy*"
              - "iam:CreateRole"
              - "iam:DeleteInstanceProfile"
              - "iam:DeletePolicy*"
              - "iam:DeleteRole*"
              - "iam:DetachRolePolicy"
              - "iam:GetInstanceProfile"
              - "iam:GetPolicy*"
              - "iam:GetRole*"
              - "iam:ListAttachedRolePolicies"
              - "iam:ListEntitiesForPolicy"
              - "iam:ListInstanceProfileTags"
              - "iam:ListInstanceProfilesForRole"
              - "iam:ListPolicy*"
              - "iam:ListRolePolicies"
              - "iam:ListRoleTags"
              - "iam:PassRole"
              - "iam:PutRole*"
              - "iam:RemoveRoleFromInstanceProfile"
              - "iam:SetDefaultPolicyVersion"
              - "iam:TagInstanceProfile"
              - "iam:TagPolicy"
              - "iam:TagRole"
              - "iam:UntagInstanceProfile"
              - "iam:UntagPolicy"
              - "iam:UntagRole"
              - "iam:UpdateAssumeRolePolicy"
              - "iam:UpdateRole*"

              - "kms:CreateAlias"
              - "kms:DeleteAlias"
              - "kms:DescribeKey"
              - "kms:DisableKey"
              - "kms:DisableKeyRotation"
              - "kms:EnableKey"
              - "kms:EnableKeyRotation"
              - "kms:GetKey*"
              - "kms:ListGrants"
              - "kms:ListKeyPolicies"
              - "kms:ListResourceTags"
              - "kms:ListRetirableGrants"
              - "kms:PutKeyPolicy"
              - "kms:ScheduleKeyDeletion"
              - "kms:TagResource"
              - "kms:UntagResource"
              - "kms:UpdateAlias"
              - "kms:UpdateKeyDescription"
            Resource:
              - !Sub arn:aws:iam::${AWS::AccountId}:instance-profile/${AWS::StackName}
              - !Sub arn:aws:iam::${AWS::AccountId}:instance-profile/${AWS::StackName}-*
              - !Sub arn:aws:iam::${AWS::AccountId}:role/${AWS::StackName}
              - !Sub arn:aws:iam::${AWS::AccountId}:role/${AWS::StackName}-*
              - !Sub arn:aws:iam::${AWS::AccountId}:role/${AWS::StackName}/*
              - !Sub arn:aws:iam::${AWS::AccountId}:policy/${AWS::StackName}
              - !Sub arn:aws:iam::${AWS::AccountId}:policy/${AWS::StackName}-*
              - !Sub arn:aws:iam::${AWS::AccountId}:policy/${AWS::StackName}/*

              - !Sub arn:aws:kms:${AWS::Region}:${AWS::AccountId}:alias/${AWS::StackName}
              - !Sub arn:aws:kms:${AWS::Region}:${AWS::AccountId}:alias/${AWS::StackName}/*
              - !Sub arn:aws:kms:${AWS::Region}:${AWS::AccountId}:alias/${AWS::StackName}-*
              - !Sub arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/*
            Condition:
              StringEqualsIfExists:
                "aws:RequestTag/Project": !Ref "AWS::StackName"
                "aws:ResourceTag/Project": !Ref "AWS::StackName"
          - Sid: KMSCreate
            Effect: Allow
            Action: "kms:CreateKey"
            Resource: "*"
          - Sid: KMSGrants
            Effect: Allow
            Action:
              - "kms:CreateGrant"
              - "kms:RetireGrant"
              - "kms:RevokeGrant"
            Resource:
              - !Sub arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/*
            Condition:
              Bool:
                "kms:GrantIsForAWSResource": "true"
          - Sid: KMSReadWrite
            Effect: Allow
            Action:
              - "kms:Decrypt"
              - "kms:Encrypt"
              - "kms:GenerateDataKey"
            Resource:
              - !Sub "arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/*"
            Condition:
              ArnLike:
                "kms:EncryptionContext:PARAMETER_ARN":
                  - !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${AWS::StackName}/outputs/*"
  TerraformDestroyManagedPolicy:
    Condition: HasDestroy
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: !Sub "${AWS::StackName}-Destroy-${AWS::Region}"
      Description: Policy to destroy protected resources in the terraform.
      Roles: [ !Ref TerraformRole ]
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: Delete
            Effect: Allow
            Action:
              - "ec2:ReleaseAddress"
              - "elasticfilesystem:DeleteFileSystem"
            Resource:
              - !Sub arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:elastic-ip/*
              - !Sub arn:aws:elasticfilesystem:${AWS::Region}:${AWS::AccountId}:file-system/*
            Condition:
              StringEqualsIfExists:
                "aws:RequestTag/Project": !Ref "AWS::StackName"
                "aws:ResourceTag/Project": !Ref "AWS::StackName"

  ApplyProjectLogs:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/codebuild/${AWS::StackName}-APPLY"
      RetentionInDays: 7
  ApplyProject:
    Type: AWS::CodeBuild::Project
    Condition: HasApply
    DependsOn:
      - TerraformDeployReadOnlyPolicy
      - TerraformDeployReadWritePolicy
      - TerraformDeploySecurityPolicy
    Properties:
      Name: !Sub "${AWS::StackName}-APPLY"
      Description: Apply changes to the UIUC Bastion Host terraform.
      Source:
        Type: NO_SOURCE
        BuildSpec: |
          version: 0.2
          env:
            shell: bash
            variables:
              TERRAFORM_VERSION: 1.4.5
              TF_INPUT: "false"
              TF_IN_AUTOMATION: "true"
              TF_CLI_ARGS: "-no-color"
          phases:
            install:
              runtime-versions:
                python: 3.10
              commands:
                - '[[ -e .local/bin ]] || mkdir -p .local/bin'
                - 'export PATH="$CODEBUILD_SRC_DIR/.local/bin:$PATH"'
                - |
                  if [[ ! -e .local/bin/terraform ]]; then
                    curl --silent --fail --location https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip | zcat > .local/bin/terraform
                    chmod a+rx .local/bin/terraform
                  fi
                - 'git clone --depth 1 -b "$SOURCE_BRANCH" $SOURCE_URL $CODEBUILD_SRC_DIR/repo'
                - 'chmod a+rx $CODEBUILD_SRC_DIR/repo/codebuild/bin/*'
                - 'export TF_DATA_DIR="$CODEBUILD_SRC_DIR/.terraform"'
                - 'mkdir -p $TF_DATA_DIR || :'
            build:
              on-failure: ABORT
              commands:
                - '$CODEBUILD_SRC_DIR/repo/codebuild/bin/update-hostkeys.sh "$TF_VAR_project" "$TF_VAR_hostname"'
                - '$CODEBUILD_SRC_DIR/repo/codebuild/bin/deploy.sh $CODEBUILD_SRC_DIR/repo/terraform/'
          cache:
            paths:
              - .terraform/**/*
      ConcurrentBuildLimit: 1
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Type: LINUX_CONTAINER
        Image: aws/codebuild/standard:6.0
        EnvironmentVariables:
          - { Name: AWS_REGION, Value: !Ref "AWS::Region" }
          - { Name: SOURCE_URL, Value: !Ref SourceURL }
          - { Name: SOURCE_BRANCH, Value: !Ref SourceBranch }
          - { Name: STATE_BUCKET_NAME, Value: !Ref StateBucketName }
          - { Name: STATE_OBJECT_KEY, Value: !Ref StateObjectKey }
          - { Name: STATE_LOCK_TABLE_NAME, Value: !Ref StateLockTableName }

          - { Name: TF_VAR_service, Value: !Ref Service }
          - { Name: TF_VAR_contact, Value: !Ref Contact }
          - { Name: TF_VAR_data_classification, Value: !Ref DataClassification }
          - { Name: TF_VAR_environment, Value: !Ref Environment }
          - { Name: TF_VAR_project, Value: !Ref "AWS::StackName" }

          - { Name: TF_VAR_hostname, Value: !Ref Hostname }
          - { Name: TF_VAR_instance_type, Value: !Ref InstanceType }
          - { Name: TF_VAR_key_name, Value: !Ref SSHKeyName }
          - { Name: TF_VAR_enhanced_monitoring, Value: !Ref EnhancedMonitoring }
          - { Name: TF_VAR_falcon_sensor_package, Value: !Ref FalconSensorPackage }
          - { Name: TF_VAR_shell_idle_timeout, Value: !Ref ShellIdleTimeout }

          - Name: TF_VAR_allowed_cidrs
            Value: "{}"
          - Name: TF_VAR_allowed_cidrs_codebuild
            Value: !Join [ ",", !Ref AllowedCIDRs ]
          - Name: TF_VAR_public_subnets
            Value: !Join [ ",", !Ref PublicSubnets ]
          - Name: TF_VAR_internal_subnets
            Value: !Join [ ",", !Ref InternalSubnets ]
          - Name: TF_VAR_extra_security_groups
            Value: !Join [ ",", !Ref ExtraSecurityGroups ]
          - { Name: TF_VAR_extra_enis, Value: !Ref ExtraENIs }
          - { Name: TF_VAR_extra_efs, Value: !Ref ExtraEFS }
      TimeoutInMinutes: 60
      Artifacts:
        Type: NO_ARTIFACTS
      Cache:
        Type: LOCAL
        Modes: [ LOCAL_CUSTOM_CACHE ]
      LogsConfig:
        CloudWatchLogs:
          Status: ENABLED
          GroupName: !Ref ApplyProjectLogs
      ServiceRole: !Ref TerraformRole
      Tags:
        - { Key: Service, Value: !Ref Service }
        - { Key: Contact, Value: !Ref Contact }
        - { Key: Environment, Value: !Ref Environment }
        - { Key: Project, Value: !Ref "AWS::StackName" }


  DestroyProjectLogs:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/codebuild/${AWS::StackName}-DESTROY"
      RetentionInDays: 7
  DestroyProject:
    Type: AWS::CodeBuild::Project
    Condition: HasDestroy
    DependsOn:
      - TerraformDeployReadOnlyPolicy
      - TerraformDeployReadWritePolicy
      - TerraformDeploySecurityPolicy
      - TerraformDestroyManagedPolicy
    Properties:
      Name: !Sub "${AWS::StackName}-DESTROY"
      Description: Removes/Destroys the UIUC Bastion Host terraform.
      Source:
        Type: NO_SOURCE
        BuildSpec: |
          version: 0.2
          env:
            shell: bash
            variables:
              TERRAFORM_VERSION: 1.4.5
              TF_INPUT: "false"
              TF_IN_AUTOMATION: "true"
              TF_CLI_ARGS: "-no-color"
              TF_CLI_ARGS_plan: "-destroy"
          phases:
            install:
              runtime-versions:
                python: 3.10
              commands:
                - '[[ -e .local/bin ]] || mkdir -p .local/bin'
                - 'export PATH="$CODEBUILD_SRC_DIR/.local/bin:$PATH"'
                - |
                  if [[ ! -e .local/bin/terraform ]]; then
                    curl --silent --fail --location https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip | zcat > .local/bin/terraform
                    chmod a+rx .local/bin/terraform
                  fi
                - 'git clone --depth 1 -b "$SOURCE_BRANCH" $SOURCE_URL $CODEBUILD_SRC_DIR/repo'
                - 'chmod a+rx $CODEBUILD_SRC_DIR/repo/codebuild/bin/*'
                - 'export TF_DATA_DIR="$CODEBUILD_SRC_DIR/.terraform"'
                - 'mkdir -p $TF_DATA_DIR || :'
            build:
              on-failure: ABORT
              commands:
                - '$CODEBUILD_SRC_DIR/repo/codebuild/bin/deploy.sh $CODEBUILD_SRC_DIR/repo/terraform/'
          cache:
            paths:
              - .terraform/**/*
      ConcurrentBuildLimit: 1
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Type: LINUX_CONTAINER
        Image: aws/codebuild/standard:6.0
        EnvironmentVariables:
          - { Name: AWS_REGION, Value: !Ref "AWS::Region" }
          - { Name: SOURCE_URL, Value: !Ref SourceURL }
          - { Name: SOURCE_BRANCH, Value: !Ref SourceBranch }
          - { Name: STATE_BUCKET_NAME, Value: !Ref StateBucketName }
          - { Name: STATE_OBJECT_KEY, Value: !Ref StateObjectKey }
          - { Name: STATE_LOCK_TABLE_NAME, Value: !Ref StateLockTableName }

          - { Name: TF_VAR_service, Value: !Ref Service }
          - { Name: TF_VAR_contact, Value: !Ref Contact }
          - { Name: TF_VAR_data_classification, Value: !Ref DataClassification }
          - { Name: TF_VAR_environment, Value: !Ref Environment }
          - { Name: TF_VAR_project, Value: !Ref "AWS::StackName" }

          - { Name: TF_VAR_hostname, Value: !Ref Hostname }
          - { Name: TF_VAR_instance_type, Value: !Ref InstanceType }
          - { Name: TF_VAR_key_name, Value: !Ref SSHKeyName }
          - { Name: TF_VAR_enhanced_monitoring, Value: !Ref EnhancedMonitoring }
          - { Name: TF_VAR_falcon_sensor_package, Value: !Ref FalconSensorPackage }
          - { Name: TF_VAR_shell_idle_timeout, Value: !Ref ShellIdleTimeout }

          - Name: TF_VAR_allowed_cidrs
            Value: "{}"
          - Name: TF_VAR_allowed_cidrs_codebuild
            Value: !Join [ ",", !Ref AllowedCIDRs ]
          - Name: TF_VAR_public_subnets
            Value: !Join [ ",", !Ref PublicSubnets ]
          - Name: TF_VAR_internal_subnets
            Value: !Join [ ",", !Ref InternalSubnets ]
          - { Name: TF_VAR_extra_enis, Value: !Ref ExtraENIs }
          - { Name: TF_VAR_extra_efs, Value: !Ref ExtraEFS }
      TimeoutInMinutes: 60
      Artifacts:
        Type: NO_ARTIFACTS
      Cache:
        Type: LOCAL
        Modes: [ LOCAL_CUSTOM_CACHE ]
      LogsConfig:
        CloudWatchLogs:
          Status: ENABLED
          GroupName: !Ref DestroyProjectLogs
      ServiceRole: !Ref TerraformRole
      Tags:
        - { Key: Service, Value: !Ref Service }
        - { Key: Contact, Value: !Ref Contact }
        - { Key: Environment, Value: !Ref Environment }
        - { Key: Project, Value: !Ref "AWS::StackName" }