enscalator 0.4.0.pre.alpha.pre.16

data/lib/enscalator/vpc_with_nat_instance.rb

@@ -0,0 +1,402 @@
+module Enscalator
+  module Templates
+    # Amazon AWS Virtual Private Cloud template with NAT instance
+    class VPCWithNATInstance < Enscalator::RichTemplateDSL
+      # Subnet size (256 addresses)
+      SUBNET_CIDR_BLOCK_SIZE = 24
+
+      # Template method
+      def tpl
+        description = <<-EOS.gsub(/^\s+\|/, '')
+          |AWS CloudFormation template for the VPC environment.
+          |For each availability zone stack creates: the public subnet, internet gateway, NAT EC2 instance
+          |internet access from private subnets, routing configuration for corresponding subnets
+          |and security groups.
+        EOS
+        value Description: description
+
+        nat_key_name = gen_ssh_key_name('vpc-nat', region, stack_name)
+        pre_run { create_ssh_key nat_key_name, region, force_create: false }
+
+        parameter_ec2_instance_type 'NAT', type: 'c4.large'
+
+        mapping 'AWSNATAMI',
+                'us-east-1': { AMI: 'ami-68115b02' },
+                'us-west-1': { AMI: 'ami-ef1a718f' },
+                'us-west-2': { AMI: 'ami-77a4b816' },
+                'eu-west-1': { AMI: 'ami-c0993ab3' },
+                'eu-central-1': { AMI: 'ami-0b322e67' },
+                'ap-northeast-1': { AMI: 'ami-f885ae96' },
+                'ap-southeast-1': { AMI: 'ami-e2fc3f81' },
+                'ap-southeast-2': { AMI: 'ami-e3217a80' },
+                'sa-east-1': { AMI: 'ami-8631b5ea' }
+
+        mapping 'AWSRegionNetConfig', Core::NetworkConfig.mapping_vpc_net
+
+        resource 'VPC',
+                 Type: 'AWS::EC2::VPC',
+                 Properties: {
+                   CidrBlock: find_in_map('AWSRegionNetConfig', ref('AWS::Region'), 'VPC'),
+                   EnableDnsSupport: 'true',
+                   EnableDnsHostnames: 'true',
+                   Tags: [
+                     {
+                       Key: 'Name',
+                       Value: aws_stack_name
+                     },
+                     {
+                       Key: 'Application',
+                       Value: aws_stack_name
+                     },
+                     {
+                       Key: 'Network',
+                       Value: 'Public'
+                     }
+                   ]
+                 }
+
+        resource 'InternetGateway',
+                 Type: 'AWS::EC2::InternetGateway',
+                 Properties: {
+                   Tags: [
+                     {
+                       Key: 'Name',
+                       Value: 'Public Gateway'
+                     },
+                     {
+                       Key: 'Application',
+                       Value: aws_stack_name
+                     },
+                     {
+                       Key: 'Network',
+                       Value: 'Public'
+                     }
+                   ]
+                 }
+
+        resource 'GatewayToInternet',
+                 DependsOn: %w( VPC InternetGateway ),
+                 Type: 'AWS::EC2::VPCGatewayAttachment',
+                 Properties: {
+                   VpcId: ref('VPC'),
+                   InternetGatewayId: ref('InternetGateway')
+                 }
+
+        resource 'PublicRouteTable',
+                 DependsOn: ['VPC'],
+                 Type: 'AWS::EC2::RouteTable',
+                 Properties: {
+                   VpcId: ref('VPC'),
+                   Tags: [
+                     {
+                       Key: 'Name',
+                       Value: 'Public'
+                     },
+                     {
+                       Key: 'Application',
+                       Value: aws_stack_name
+                     },
+                     {
+                       Key: 'Network',
+                       Value: 'Public'
+                     }
+                   ]
+                 }
+
+        resource 'PublicRoute',
+                 DependsOn: %w( PublicRouteTable InternetGateway ),
+                 Type: 'AWS::EC2::Route',
+                 Properties: {
+                   RouteTableId: ref('PublicRouteTable'),
+                   DestinationCidrBlock: '0.0.0.0/0',
+                   GatewayId: ref('InternetGateway')
+                 }
+
+        resource 'PublicNetworkAcl',
+                 DependsOn: ['VPC'],
+                 Type: 'AWS::EC2::NetworkAcl',
+                 Properties: {
+                   VpcId: ref('VPC'),
+                   Tags: [
+                     {
+                       Key: 'Name',
+                       Value: 'Public'
+                     },
+                     {
+                       Key: 'Application',
+                       Value: aws_stack_name
+                     },
+                     {
+                       Key: 'Network',
+                       Value: 'Public'
+                     }
+                   ]
+                 }
+
+        resource 'InboundHTTPPublicNetworkAclEntry',
+                 DependsOn: ['PublicNetworkAcl'],
+                 Type: 'AWS::EC2::NetworkAclEntry',
+                 Properties: {
+                   NetworkAclId: ref('PublicNetworkAcl'),
+                   RuleNumber: '100',
+                   Protocol: '-1',
+                   RuleAction: 'allow',
+                   Egress: 'false',
+                   CidrBlock: '0.0.0.0/0',
+                   PortRange: { From: '0', To: '65535' }
+                 }
+
+        resource 'OutboundHTTPPublicNetworkAclEntry',
+                 DependsOn: ['PublicNetworkAcl'],
+                 Type: 'AWS::EC2::NetworkAclEntry',
+                 Properties: {
+                   NetworkAclId: ref('PublicNetworkAcl'),
+                   RuleNumber: '100',
+                   Protocol: '-1',
+                   RuleAction: 'allow',
+                   Egress: 'true',
+                   CidrBlock: '0.0.0.0/0',
+                   PortRange: { From: '0', To: '65535' }
+                 }
+
+        resource 'PrivateNetworkAcl',
+                 DependsOn: ['VPC'],
+                 Type: 'AWS::EC2::NetworkAcl',
+                 Properties: {
+                   VpcId: ref('VPC'),
+                   Tags: [
+                     {
+                       Key: 'Name',
+                       Value: 'Private'
+                     },
+                     {
+                       Key: 'Application',
+                       Value: aws_stack_name
+                     },
+                     {
+                       Key: 'Network',
+                       Value: 'Private'
+                     }
+                   ]
+                 }
+
+        resource 'InboundPrivateNetworkAclEntry',
+                 DependsOn: ['PrivateNetworkAcl'],
+                 Type: 'AWS::EC2::NetworkAclEntry',
+                 Properties: {
+                   NetworkAclId: ref('PrivateNetworkAcl'),
+                   RuleNumber: '100',
+                   Protocol: '6',
+                   RuleAction: 'allow',
+                   Egress: 'false',
+                   CidrBlock: '0.0.0.0/0',
+                   PortRange: { From: '0', To: '65535' }
+                 }
+
+        resource 'OutBoundPrivateNetworkAclEntry',
+                 DependsOn: ['PrivateNetworkAcl'],
+                 Type: 'AWS::EC2::NetworkAclEntry',
+                 Properties: {
+                   NetworkAclId: ref('PrivateNetworkAcl'),
+                   RuleNumber: '100',
+                   Protocol: '6',
+                   RuleAction: 'allow',
+                   Egress: 'true',
+                   CidrBlock: '0.0.0.0/0',
+                   PortRange: { From: '0', To: '65535' }
+                 }
+
+        resource 'NATSecurityGroup',
+                 DependsOn: ['PrivateSecurityGroup'],
+                 Type: 'AWS::EC2::SecurityGroup',
+                 Properties: {
+                   GroupDescription: 'Enable internal access to the NAT device',
+                   VpcId: ref('VPC'),
+                   SecurityGroupIngress: [
+                     {
+                       IpProtocol: 'tcp',
+                       FromPort: '22',
+                       ToPort: '22',
+                       SourceSecurityGroupId: ref('PrivateSecurityGroup')
+                     },
+                     {
+                       IpProtocol: 'tcp',
+                       FromPort: '80',
+                       ToPort: '80',
+                       SourceSecurityGroupId: ref('PrivateSecurityGroup')
+                     },
+                     {
+                       IpProtocol: 'tcp',
+                       FromPort: '443',
+                       ToPort: '443',
+                       SourceSecurityGroupId: ref('PrivateSecurityGroup')
+                     },
+                     {
+                       IpProtocol: 'tcp',
+                       FromPort: '465',
+                       ToPort: '465',
+                       SourceSecurityGroupId: ref('PrivateSecurityGroup')
+                     },
+                     {
+                       IpProtocol: 'icmp',
+                       FromPort: '-1',
+                       ToPort: '-1',
+                       CidrIp: '10.0.0.0/8'
+                     }
+                   ],
+                   SecurityGroupEgress: [
+                     {
+                       IpProtocol: '-1',
+                       FromPort: '0',
+                       ToPort: '65535',
+                       CidrIp: '0.0.0.0/0'
+                     }
+                   ],
+                   Tags: [
+                     {
+                       Key: 'Name',
+                       Value: 'NAT'
+                     }
+                   ]
+                 }
+
+        resource 'PrivateSecurityGroup',
+                 DependsOn: ['VPC'],
+                 Type: 'AWS::EC2::SecurityGroup',
+                 Properties: {
+                   GroupDescription: 'Allow the Application instances to access the NAT device',
+                   VpcId: ref('VPC'),
+                   SecurityGroupEgress: [
+                     {
+                       IpProtocol: 'tcp',
+                       FromPort: '0',
+                       ToPort: '65535',
+                       CidrIp: '10.0.0.0/8'
+                     }
+                   ],
+                   SecurityGroupIngress: [
+                     {
+                       IpProtocol: 'tcp',
+                       FromPort: '0',
+                       ToPort: '65535',
+                       CidrIp: '10.0.0.0/8'
+                     }
+                   ],
+                   Tags: [
+                     {
+                       Key: 'Name',
+                       Value: 'Private'
+                     }
+                   ]
+                 }
+
+        current_cidr_block = Core::NetworkConfig.mapping_vpc_net[region.to_sym][:VPC]
+        public_cidr_blocks =
+          IPAddress(current_cidr_block).subnet(SUBNET_CIDR_BLOCK_SIZE).map(&:to_string).first(availability_zones.size)
+
+        availability_zones.zip(public_cidr_blocks).each do |pair, cidr_block|
+          suffix = pair.first
+          public_subnet_name = "PublicSubnet#{suffix.upcase}"
+          resource public_subnet_name,
+                   DependsOn: ['VPC'],
+                   Type: 'AWS::EC2::Subnet',
+                   Properties: {
+                     VpcId: ref('VPC'),
+                     AvailabilityZone: join('', ref('AWS::Region'), suffix.to_s),
+                     CidrBlock: cidr_block,
+                     Tags: [
+                       {
+                         Key: 'Name',
+                         Value: "Public #{suffix.upcase}"
+                       },
+                       {
+                         Key: 'Application',
+                         Value: aws_stack_name
+                       },
+                       {
+                         Key: 'Network',
+                         Value: 'Public'
+                       }
+                     ]
+                   }
+
+          resource "PublicSubnetRouteTableAssociation#{suffix.upcase}",
+                   DependsOn: [public_subnet_name, 'PublicRouteTable'],
+                   Type: 'AWS::EC2::SubnetRouteTableAssociation',
+                   Properties: {
+                     SubnetId: ref(public_subnet_name),
+                     RouteTableId: ref('PublicRouteTable')
+                   }
+
+          nat_device_name = "NATDevice#{suffix.upcase}"
+          resource nat_device_name,
+                   DependsOn: [public_subnet_name, 'NATSecurityGroup'],
+                   Type: 'AWS::EC2::Instance',
+                   Properties: {
+                     InstanceType: ref('NATInstanceType'),
+                     KeyName: nat_key_name,
+                     SourceDestCheck: 'false',
+                     ImageId: find_in_map('AWSNATAMI', ref('AWS::Region'), 'AMI'),
+                     NetworkInterfaces: [
+                       {
+                         AssociatePublicIpAddress: 'true',
+                         DeviceIndex: '0',
+                         SubnetId: ref(public_subnet_name),
+                         GroupSet: [ref('NATSecurityGroup')]
+                       }
+                     ],
+                     Tags: [
+                       {
+                         Key: 'Name',
+                         Value: nat_device_name
+                       }
+                     ]
+                   }
+
+          private_route_table_name = "PrivateRouteTable#{suffix.upcase}"
+          resource private_route_table_name,
+                   DependsOn: ['VPC'],
+                   Type: 'AWS::EC2::RouteTable',
+                   Properties: {
+                     VpcId: ref('VPC'),
+                     Tags: [
+                       {
+                         Key: 'Name',
+                         Value: "Private #{suffix.upcase}"
+                       },
+                       {
+                         Key: 'Application',
+                         Value: aws_stack_name
+                       },
+                       {
+                         Key: 'Network',
+                         Value: 'Private'
+                       }
+                     ]
+                   }
+
+          resource "PrivateRoute#{suffix.upcase}",
+                   DependsOn: [private_route_table_name, nat_device_name],
+                   Type: 'AWS::EC2::Route',
+                   Properties: {
+                     RouteTableId: ref(private_route_table_name),
+                     DestinationCidrBlock: '0.0.0.0/0',
+                     InstanceId: ref(nat_device_name)
+                   }
+
+          output public_subnet_name,
+                 Description: "Created Subnet #{suffix.upcase}",
+                 Value: ref(public_subnet_name)
+        end
+
+        output 'VpcId',
+               Description: 'Created VPC',
+               Value: ref('VPC')
+
+        output 'PrivateSecurityGroup',
+               Description: 'SecurityGroup to add private resources',
+               Value: ref('PrivateSecurityGroup')
+      end # def tpl
+    end # class VPC
+  end # module Templates
+end # module Enscalator

data/lib/enscalator.rb

@@ -0,0 +1,103 @@
+require 'trollop'
+require 'ipaddr'
+require 'ipaddress'
+require 'digest'
+require 'aws-sdk'
+require 'active_support'
+require 'active_support/core_ext'
+require 'active_support/inflector'
+require 'active_support/inflector/inflections'
+require 'enscalator/version'
+require 'enscalator/helpers'
+require 'enscalator/core'
+require 'enscalator/plugins'
+require 'enscalator/rich_template_dsl'
+require 'enscalator/vpc_with_nat_gateway'
+require 'enscalator/vpc_with_nat_instance'
+require 'enscalator/vpc'
+require 'enscalator/enapp'
+require 'enscalator/templates'
+
+# Namespace for Enscalator related code
+module Enscalator
+  # Main method to actually run Enscalator
+  # @param [Array] argv list of command-line arguments
+  def self.run!(argv)
+    argv_dup = argv.dup
+    display_name = name.downcase
+    parser = Trollop::Parser.new do
+      banner "Usage: #{display_name} [arguments]"
+
+      opt :list_templates, 'List all available templates', default: false, short: 'l'
+      opt :template, 'Template name', type: String, short: 't'
+      opt :template_file, 'Template filename', type: String, short: 'f'
+      opt :region, 'AWS Region', type: String, default: 'us-east-1', short: 'r'
+      opt :parameters, "Parameters 'Key1=Value1;Key2=Value2'", type: String, short: 'p'
+      opt :stack_name, 'Stack name', type: String, short: 's'
+      opt :private_hosted_zone, "Private hosted zone (e.x. 'default-vpc.internal')", type: String, short: 'z'
+      opt :public_hosted_zone, 'Public hosted zone', type: String, short: 'g'
+      opt :create_stack, 'Create the stack', default: false, short: 'c'
+      opt :update_stack, 'Update already deployed stack', default: false, short: 'u'
+      opt :pre_run, 'Use pre-run hooks', default: true, short: 'e'
+      opt :post_run, 'Use post-run hooks', default: true, short: 'o'
+      opt :expand, 'Print generated JSON template', default: false, short: 'x'
+      opt :capabilities, 'AWS capabilities', default: 'CAPABILITY_IAM', short: 'a'
+      opt :vpc_stack_name, 'VPC stack name', default: 'default-vpc', short: 'n'
+      opt :availability_zone, 'Deploy to specific availability zone', default: 'all', short: 'd'
+      opt :profile, 'Use a specific profile from your credential file', type: String, default: nil
+
+      conflicts :list_templates, :create_stack, :update_stack, :expand
+    end
+
+    opts = Trollop.with_standard_exception_handling(parser) do
+      fail Trollop::HelpNeeded if argv.empty?
+      parser.parse argv
+    end
+
+    if opts[:availability_zone_given]
+      valid_values = ('a'..'e').to_a << 'all'
+      unless valid_values.include? opts[:availability_zone]
+        STDERR.puts %(Availability zone can be only one off "#{valid_values.join(',')}")
+        exit
+      end
+    end
+
+    # fallback to create_stack action when no action was given
+    if !opts[:create_stack] && !opts[:update_stack]
+      opts[:create_stack] = true
+    end
+
+    # load template from given file and update template list
+    if opts[:template_file]
+      unless File.exist?(opts[:template_file])
+        abort(format('Unable to find file "%s"', opts[:template_file]))
+      end
+      load(opts[:template_file])
+      unless Enscalator::Templates.all_valid?
+        STDERR.puts 'Some templates missing required tpl method:'
+        Enscalator::Templates.all.select { |a| !a.instance_methods.include?(:tpl) }.each do |tpl|
+          STDERR.puts tpl.name.demodulize
+        end
+        exit
+      end
+    end
+
+    templates = Enscalator::Templates.constants.map(&:to_s)
+
+    if opts[:list_templates]
+      STDERR.puts 'Available templates:'
+      STDERR.puts templates.sort
+      exit
+    end
+
+    if opts[:template] && templates.include?(opts[:template])
+      # for stack_name use template name as a base and convert it from camelcase to underscore case
+      opts[:stack_name] ||= opts[:template].underscore.gsub(/[_]/, '-')
+      Object.const_get("Enscalator::Templates::#{opts[:template]}").new(opts.merge(ARGV: argv_dup)).exec!
+    elsif opts[:template_given] && !opts[:template].empty?
+      STDERR.puts %(Template "#{opts[:template]}" doesn't exist)
+    else
+      STDERR.puts 'Template name cannot be an empty string'
+    end
+  end
+end