enscalator 0.4.0.pre.alpha.pre.16

data/lib/enscalator/templates/vpc_peering.rb

@@ -0,0 +1,112 @@
+module Enscalator
+  module Templates
+    # VPC Peering connection between two VPCs
+    class VPCPeering < Enscalator::RichTemplateDSL
+      include Enscalator::Plugins::VPCPeeringConnection
+
+      # Retrieve local VPC configuration from provisioned stack
+      # @return [Aws::CloudFormation::Stack]
+      def local_vpc_stack
+        @local_vpc_stack ||= cfn_resource(cfn_client(region)).stack(vpc_stack_name)
+      end
+
+      # Interface for VPC
+      # @param [String] id logical id of VPC
+      # @return [Aws::EC2::Vpc]
+      def vpc(id: get_resource(local_vpc_stack, 'VPC'))
+        Aws::EC2::Vpc.new(id: id, region: region)
+      end
+
+      # VPC Peering connection can be created only when
+      #
+      # - both VPCs are in the same region
+      # - connected VPCs has distinct CIDR blocks
+      #
+      # Route tables should be created in the following way:
+      #
+      # VPC Local's route table
+      # 172.16.0.0/16	-> Local
+      # 10.0.0.0/16	-> pcx-11112222
+      #
+      # VPC Remote's route table
+      # 10.0.0.0/16	Local
+      # 172.16.0.0/16	pcx-11112222
+      def tpl
+        connection_name = 'PrivateConnection'
+        local_vpc_id_ref, remote_vpc_id_ref = %W(#{connection_name}VpcId #{connection_name}PeerVpcId)
+
+        def validate_params(*params)
+          params.each do |param|
+            fail "Unable to find required parameter #{param}" unless @parameters.key?(param)
+          end
+        rescue RuntimeError => e
+          puts e
+          exit 1
+        end
+
+        validate_params(*[remote_vpc_id_ref])
+
+        local_vpc, remote_vpc = [vpc, vpc(id: @parameters[remote_vpc_id_ref])]
+
+        description 'Stack to create peering connection between two VPCs'
+
+        parameter_vpc_id(local_vpc_id_ref,
+                         'VpcId from where connection gets created',
+                         local_vpc.id)
+
+        parameter_vpc_id(remote_vpc_id_ref,
+                         'VpcId where peering connection should go',
+                         remote_vpc.id)
+
+        # Initialize Peering connection
+        vpc_peering_init(connection_name,
+                         tags: [
+                           {
+                             Key: 'Name',
+                             Value: connection_name
+                           }
+                         ])
+
+        def read_vpc_route_tables(vpc)
+          routes = []
+          vpc.route_tables.each do |rt|
+            routes << rt
+          end
+          routes
+        end
+
+        # Add rules to local VPC routing table
+        read_vpc_route_tables(local_vpc).map(&:id).each_with_index do |rt_id, i|
+          local_vpc_route_rule = "LocalVPCPeeringRoute#{i + 1}"
+          resource local_vpc_route_rule,
+                   Type: 'AWS::EC2::Route',
+                   Properties: {
+                     RouteTableId: rt_id,
+                     DestinationCidrBlock: remote_vpc.cidr_block,
+                     VpcPeeringConnectionId: ref(connection_name)
+                   }
+
+          output local_vpc_route_rule,
+                 Description: "Local VPC Peering connection for #{rt_id}",
+                 Value: ref(local_vpc_route_rule)
+        end
+
+        # Add rules to remote VPC routing table
+        read_vpc_route_tables(remote_vpc).map(&:id).each_with_index do |rt_id, i|
+          remote_vpc_route_rule = "RemoteVPCPeeringRoute#{i + 1}"
+          resource remote_vpc_route_rule,
+                   Type: 'AWS::EC2::Route',
+                   Properties: {
+                     RouteTableId: rt_id,
+                     DestinationCidrBlock: local_vpc.cidr_block,
+                     VpcPeeringConnectionId: ref(connection_name)
+                   }
+
+          output remote_vpc_route_rule,
+                 Description: "Remote VPC Peering connection for #{rt_id}",
+                 Value: ref(remote_vpc_route_rule)
+        end
+      end # tpl
+    end # class VPCPeering
+  end # module Plugins
+end # module Enscalator

data/lib/enscalator/templates.rb

@@ -0,0 +1,20 @@
+require_relative 'templates/vpc_peering'
+
+module Enscalator
+  # Namespace for template collection
+  module Templates
+    # Get all loaded template classes
+    # @return [Array]
+    def self.all
+      namespace = Enscalator::Templates
+      templates = namespace.constants
+      templates.map { |t| (namespace.to_s.split('::') << t.to_s).join('::').constantize }
+    end
+
+    # Verify if all loaded templates have required tpl method
+    # @return [Boolean]
+    def self.all_valid?
+      all.map { |t| t.instance_methods.include?(:tpl) }.all?
+    end
+  end
+end

data/lib/enscalator/version.rb

@@ -0,0 +1,5 @@
+# Enscalator
+module Enscalator
+  # Current version
+  VERSION = '0.4.0'
+end

data/lib/enscalator/vpc.rb

@@ -0,0 +1,11 @@
+module Enscalator
+  module Templates
+    # Amazon AWS Virtual Private Cloud template (defaults to template with NAT gateway)
+    class VPC < Enscalator::Templates::VPCWithNATGateway
+      # Call method with same name from superclass
+      def tpl
+        super
+      end
+    end # class VPC
+  end # module Templates
+end # module Enscalator

data/lib/enscalator/vpc_with_nat_gateway.rb

@@ -0,0 +1,311 @@
+module Enscalator
+  module Templates
+    # Amazon AWS Virtual Private Cloud template with NAT gateway
+    class VPCWithNATGateway < Enscalator::RichTemplateDSL
+      include Enscalator::Plugins::NATGateway
+
+      # Subnet size (256 addresses)
+      SUBNET_CIDR_BLOCK_SIZE = 24
+
+      # Template method
+      def tpl
+        description = <<-EOS.gsub(/^\s+\|/, '')
+          |AWS CloudFormation template for the VPC environment.
+          |For each availability zone stack creates: the public subnet, internet and NAT gateways,
+          |internet access from private subnets, routing configuration for corresponding subnets
+          |and security groups.
+        EOS
+
+        value Description: description
+
+        mapping 'AWSRegionNetConfig', Core::NetworkConfig.mapping_vpc_net
+
+        resource 'VPC',
+                 Type: 'AWS::EC2::VPC',
+                 Properties: {
+                   CidrBlock: find_in_map('AWSRegionNetConfig', ref('AWS::Region'), 'VPC'),
+                   EnableDnsSupport: 'true',
+                   EnableDnsHostnames: 'true',
+                   Tags: [
+                     {
+                       Key: 'Name',
+                       Value: aws_stack_name
+                     },
+                     {
+                       Key: 'Application',
+                       Value: aws_stack_name
+                     },
+                     {
+                       Key: 'Network',
+                       Value: 'Public'
+                     }
+                   ]
+                 }
+
+        resource 'InternetGateway',
+                 Type: 'AWS::EC2::InternetGateway',
+                 Properties: {
+                   Tags: [
+                     {
+                       Key: 'Name',
+                       Value: 'Public Gateway'
+                     },
+                     {
+                       Key: 'Application',
+                       Value: aws_stack_name
+                     },
+                     {
+                       Key: 'Network',
+                       Value: 'Public'
+                     }
+                   ]
+                 }
+
+        resource 'GatewayToInternet',
+                 DependsOn: %w( VPC InternetGateway ),
+                 Type: 'AWS::EC2::VPCGatewayAttachment',
+                 Properties: {
+                   VpcId: ref('VPC'),
+                   InternetGatewayId: ref('InternetGateway')
+                 }
+
+        resource 'PublicRouteTable',
+                 DependsOn: ['VPC'],
+                 Type: 'AWS::EC2::RouteTable',
+                 Properties: {
+                   VpcId: ref('VPC'),
+                   Tags: [
+                     {
+                       Key: 'Name',
+                       Value: 'Public'
+                     },
+                     {
+                       Key: 'Application',
+                       Value: aws_stack_name
+                     },
+                     {
+                       Key: 'Network',
+                       Value: 'Public'
+                     }
+                   ]
+                 }
+
+        resource 'PublicRoute',
+                 DependsOn: %w( PublicRouteTable InternetGateway ),
+                 Type: 'AWS::EC2::Route',
+                 Properties: {
+                   RouteTableId: ref('PublicRouteTable'),
+                   DestinationCidrBlock: '0.0.0.0/0',
+                   GatewayId: ref('InternetGateway')
+                 }
+
+        resource 'PublicNetworkAcl',
+                 DependsOn: ['VPC'],
+                 Type: 'AWS::EC2::NetworkAcl',
+                 Properties: {
+                   VpcId: ref('VPC'),
+                   Tags: [
+                     {
+                       Key: 'Name',
+                       Value: 'Public'
+                     },
+                     {
+                       Key: 'Application',
+                       Value: aws_stack_name
+                     },
+                     {
+                       Key: 'Network',
+                       Value: 'Public'
+                     }
+                   ]
+                 }
+
+        resource 'InboundHTTPPublicNetworkAclEntry',
+                 DependsOn: ['PublicNetworkAcl'],
+                 Type: 'AWS::EC2::NetworkAclEntry',
+                 Properties: {
+                   NetworkAclId: ref('PublicNetworkAcl'),
+                   RuleNumber: '100',
+                   Protocol: '-1',
+                   RuleAction: 'allow',
+                   Egress: 'false',
+                   CidrBlock: '0.0.0.0/0',
+                   PortRange: { From: '0', To: '65535' }
+                 }
+
+        resource 'OutboundHTTPPublicNetworkAclEntry',
+                 DependsOn: ['PublicNetworkAcl'],
+                 Type: 'AWS::EC2::NetworkAclEntry',
+                 Properties: {
+                   NetworkAclId: ref('PublicNetworkAcl'),
+                   RuleNumber: '100',
+                   Protocol: '-1',
+                   RuleAction: 'allow',
+                   Egress: 'true',
+                   CidrBlock: '0.0.0.0/0',
+                   PortRange: { From: '0', To: '65535' }
+                 }
+
+        resource 'PrivateNetworkAcl',
+                 DependsOn: ['VPC'],
+                 Type: 'AWS::EC2::NetworkAcl',
+                 Properties: {
+                   VpcId: ref('VPC'),
+                   Tags: [
+                     {
+                       Key: 'Name',
+                       Value: 'Private'
+                     },
+                     {
+                       Key: 'Application',
+                       Value: aws_stack_name
+                     },
+                     {
+                       Key: 'Network',
+                       Value: 'Private'
+                     }
+                   ]
+                 }
+
+        resource 'InboundPrivateNetworkAclEntry',
+                 DependsOn: ['PrivateNetworkAcl'],
+                 Type: 'AWS::EC2::NetworkAclEntry',
+                 Properties: {
+                   NetworkAclId: ref('PrivateNetworkAcl'),
+                   RuleNumber: '100',
+                   Protocol: '6',
+                   RuleAction: 'allow',
+                   Egress: 'false',
+                   CidrBlock: '0.0.0.0/0',
+                   PortRange: { From: '0', To: '65535' }
+                 }
+
+        resource 'OutBoundPrivateNetworkAclEntry',
+                 DependsOn: ['PrivateNetworkAcl'],
+                 Type: 'AWS::EC2::NetworkAclEntry',
+                 Properties: {
+                   NetworkAclId: ref('PrivateNetworkAcl'),
+                   RuleNumber: '100',
+                   Protocol: '6',
+                   RuleAction: 'allow',
+                   Egress: 'true',
+                   CidrBlock: '0.0.0.0/0',
+                   PortRange: { From: '0', To: '65535' }
+                 }
+
+        resource 'PrivateSecurityGroup',
+                 DependsOn: ['VPC'],
+                 Type: 'AWS::EC2::SecurityGroup',
+                 Properties: {
+                   GroupDescription: 'Allow the Application instances to access the NAT device',
+                   VpcId: ref('VPC'),
+                   SecurityGroupEgress: [
+                     {
+                       IpProtocol: 'tcp',
+                       FromPort: '0',
+                       ToPort: '65535',
+                       CidrIp: '10.0.0.0/8'
+                     }
+                   ],
+                   SecurityGroupIngress: [
+                     {
+                       IpProtocol: 'tcp',
+                       FromPort: '0',
+                       ToPort: '65535',
+                       CidrIp: '10.0.0.0/8'
+                     }
+                   ],
+                   Tags: [
+                     {
+                       Key: 'Name',
+                       Value: 'Private'
+                     }
+                   ]
+                 }
+
+        current_cidr_block = Core::NetworkConfig.mapping_vpc_net[region.to_sym][:VPC]
+        public_cidr_blocks =
+          IPAddress(current_cidr_block).subnet(SUBNET_CIDR_BLOCK_SIZE).map(&:to_string).first(availability_zones.size)
+
+        availability_zones.zip(public_cidr_blocks).each do |pair, cidr_block|
+          suffix = pair.first
+          public_subnet_name = "PublicSubnet#{suffix.upcase}"
+          resource public_subnet_name,
+                   DependsOn: ['VPC'],
+                   Type: 'AWS::EC2::Subnet',
+                   Properties: {
+                     VpcId: ref('VPC'),
+                     AvailabilityZone: join('', ref('AWS::Region'), suffix.to_s),
+                     CidrBlock: cidr_block,
+                     Tags: [
+                       {
+                         Key: 'Name',
+                         Value: "Public #{suffix.upcase}"
+                       },
+                       {
+                         Key: 'Application',
+                         Value: aws_stack_name
+                       },
+                       {
+                         Key: 'Network',
+                         Value: 'Public'
+                       }
+                     ]
+                   }
+
+          resource "PublicSubnetRouteTableAssociation#{suffix.upcase}",
+                   DependsOn: [public_subnet_name, 'PublicRouteTable'],
+                   Type: 'AWS::EC2::SubnetRouteTableAssociation',
+                   Properties: {
+                     SubnetId: ref(public_subnet_name),
+                     RouteTableId: ref('PublicRouteTable')
+                   }
+
+          private_route_table_name = "PrivateRouteTable#{suffix.upcase}"
+          resource private_route_table_name,
+                   DependsOn: ['VPC'],
+                   Type: 'AWS::EC2::RouteTable',
+                   Properties: {
+                     VpcId: ref('VPC'),
+                     Tags: [
+                       {
+                         Key: 'Name',
+                         Value: "Private #{suffix.upcase}"
+                       },
+                       {
+                         Key: 'Application',
+                         Value: aws_stack_name
+                       },
+                       {
+                         Key: 'Network',
+                         Value: 'Private'
+                       }
+                     ]
+                   }
+
+          # Important!
+          # When updating stack that was previously deployed using VPC template with NAT EC2 instance:
+          # 1. Comment out lines related to NAT device below
+          # 2. Update stack using this template (it will remove NAT instances and related security and routing rules)
+          # 3. Revert changes from 1. (i.e. uncomment lines below)
+          # 4. Update stack again (this time it will create new NAT Gateway, EIP and routing rule resources)
+          nat_device_name = "NATDevice#{suffix.upcase}"
+          nat_gateway_init(nat_device_name, public_subnet_name, private_route_table_name,
+                           depends_on: [public_subnet_name, 'PublicRouteTable', 'GatewayToInternet'])
+
+          output public_subnet_name,
+                 Description: "Created Subnet #{suffix.upcase}",
+                 Value: ref(public_subnet_name)
+        end # each availability zone
+
+        output 'VpcId',
+               Description: 'Created VPC',
+               Value: ref('VPC')
+
+        output 'PrivateSecurityGroup',
+               Description: 'SecurityGroup to add private resources',
+               Value: ref('PrivateSecurityGroup')
+      end # def tpl
+    end # class VPC
+  end # module Templates
+end # module Enscalator