kumogata 0.4.17 → 0.4.18

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: d5f0d6857d6a041d6536eea743a194b8afdca4af
-  data.tar.gz: 6df7c7b58ea4c37a5c000ff702e3d4055ed74555
+  metadata.gz: 2c52814103c4dfd004239aeb9cd54b86323b8d1a
+  data.tar.gz: bc647f27a50468920365f9b6ddb18975668ebe37
 SHA512:
-  metadata.gz: 0c117ae2daefe0e134745cd7d6e1a4f4ede6e3fb557c25407d5756f4383837596d5b67c96c57b88597579f94eadf31f58a105639771d3b6de5385d100beb0b2b
-  data.tar.gz: b3dff3cfdf600b6e0e76d4e153da977138acf0e0c05faf17e856e675e071a57d03efb121897e4bc3dff0dcbff9ce6eec2bded483e521fb1272cc87df7a4b4079
+  metadata.gz: 12b445111efc2f36caf2ca79f1ec7aa0e6dcb37921188882124fe0674400a7552b0832fdb663505a24eafb3d91cccdd774a34836550f69390438e17b11057a8e
+  data.tar.gz: c547e1adc47c4e4e719fe3f10997b031ac41576c92ca46322b09badd890d836e0da6b9887083050be32e13fc8f9cbf1d6ef84d795ea51e7d7d79ce6214fb1625

data/.travis.yml

@@ -0,0 +1,6 @@
+language: ruby
+rvm:
+  - 2.0.0
+script:
+  - bundle install
+  - bundle exec rake

data/README.md

@@ -1,12 +1,17 @@
 # Kumogata
 
-![Stack is not required!](http://serif.hatelabo.jp/images/cache/a69b56ca6985b6ee7e605a102445953f355f54f5/62192c286da4377e608f3f5a5200f1bec272a92e.gif)
+Kumogata is a tool for [AWS CloudFormation](https://aws.amazon.com/cloudformation/).
 
+This is a `format converter` + `useful tool`.
+It supports the following format:
 
-Kumogata is a tool for [AWS CloudFormation](https://aws.amazon.com/cloudformation/).
+* JSON
+* Ruby
+* YAML
+* JavaScript
 
 [![Gem Version](https://badge.fury.io/rb/kumogata.png?201406152020)](http://badge.fury.io/rb/kumogata)
-[![Build Status](https://drone.io/github.com/winebarrel/kumogata/status.png?201406152020)](https://drone.io/github.com/winebarrel/kumogata/latest)
+[![Build Status](https://travis-ci.org/winebarrel/kumogata.svg?branch=master)](https://travis-ci.org/winebarrel/kumogata)
 
 It can define a template in Ruby DSL, such as:
 
@@ -132,8 +137,6 @@ If you want to pass parameters, please use `-p` option:
 **The stack will be delete if you do not specify the stack name explicitly.**
 (And only the resources will remain)
 
-I think the stack that manage resources is not required in many case...
-
 ### Convert JSON to Ruby
 
 JSON template can be converted to Ruby template.
@@ -367,6 +370,67 @@ Status: 0
 (Save to `/foo/bar/command_result.json`)
 ```
 
+## JavaScript template
+
+You can also use the YAML template instead of JSON and Ruby.
+
+```javascript
+function fetch_ami() {
+  return "ami-XXXXXXXX";
+}
+
+/* For JS Object is evaluated last, it must be enclosed in parentheses */
+({
+  Resources: { /* comment */
+    myEC2Instance: {
+      Type: "AWS::EC2::Instance",
+      Properties: {
+        ImageId: fetch_ami(),
+        InstanceType: "t1.micro"
+      }
+    }
+  },
+  Outputs: {
+    AZ: { /* comment */
+      Value: {
+        "Fn::GetAtt": [
+          "myEC2Instance",
+          "AvailabilityZone"
+        ]
+      }
+    }
+  }
+})
+
+/*
+ {
+   "Resources": {
+     "myEC2Instance": {
+       "Type": "AWS::EC2::Instance",
+       "Properties": {
+         "ImageId": "ami-XXXXXXXX",
+         "InstanceType": "t1.micro"
+       }
+     }
+   },
+   "Outputs": {
+     "AZ": {
+       "Value": {
+         "Fn::GetAtt": [
+           "myEC2Instance",
+           "AvailabilityZone"
+         ]
+       }
+     }
+   }
+ }
+ */
+```
+
+### Convert JSON template to JavaScript
+
+    $ kumogata convert Drupal_Single_Instance.template --output-format=js
+
 ## YAML template
 
 You can also use the YAML template instead of JSON and Ruby.

data/bin/kumogata

@@ -3,6 +3,7 @@ $: << File.expand_path("#{File.dirname __FILE__}/../lib")
 require 'rubygems'
 require 'kumogata'
 require 'kumogata/argument_parser'
+require 'kumogata/config_parser'
 
 options = nil
 
@@ -21,6 +22,7 @@ begin
   Diffy::Diff.default_format = options.color? ? :color : :text
 
   aws_opts = {}
+  config_parser = Kumogata::ConfigParser.new
 
   # Set config file path
   if options.config_path?
@@ -28,23 +30,29 @@ begin
       raise "No such config file: #{options.config_path}"
     end
 
-    AWSConfig.config_file = options.config_path
+    config_parser.path = options.config_path
   end
 
   # Load .aws/config
   # See http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html
-  if File.exist?(AWSConfig.config_file)
-    unless AWSConfig.has_profile?(options.config_profile)
-      raise "No profile: #{AWSConfig.config_file} => #{options.config_profile}"
+  if config_parser.path.exist?
+    config_parser.parse!
+
+    if options.config_profile and not config_parser[options.config_profile]
+      raise "No profile: #{config_parser.path} => #{options.config_profile}"
     end
 
-    {
-      'aws_access_key_id'     => :access_key_id,
-      'aws_secret_access_key' => :secret_access_key,
-      'region'                => :region,
-    }.each do |config_key, option_key|
-      option_value = AWSConfig[options.config_profile][config_key]
-      aws_opts[option_key] = option_value if option_value
+    profile_name = options.config_profile || :default
+
+    if (profile = config_parser[profile_name])
+      {
+        'aws_access_key_id'     => :access_key_id,
+        'aws_secret_access_key' => :secret_access_key,
+        'region'                => :region,
+      }.each do |config_key, option_key|
+        option_value = profile[config_key]
+        aws_opts[option_key] = option_value if option_value
+      end
     end
   end
 

data/kumogata.gemspec

@@ -19,16 +19,16 @@ Gem::Specification.new do |spec|
   spec.require_paths = ['lib']
 
   spec.add_dependency 'aws-sdk'
-  spec.add_dependency 'aws_config', '>= 0.0.2'
   spec.add_dependency 'coderay'
   spec.add_dependency 'diffy'
-  spec.add_dependency 'dslh', '>= 0.2.6'
+  spec.add_dependency 'dslh', '>= 0.2.7'
   spec.add_dependency 'hashie'
   spec.add_dependency 'highline'
   spec.add_dependency 'json'
   spec.add_dependency 'net-ssh'
   spec.add_dependency 'retryable'
   spec.add_dependency 'term-ansicolor'
+  spec.add_dependency 'therubyracer'
   spec.add_dependency 'uuidtools'
   spec.add_development_dependency 'bundler'
   spec.add_development_dependency 'rake'

data/lib/kumogata.rb

@@ -2,7 +2,6 @@ module Kumogata; end
 require 'kumogata/version'
 
 require 'aws-sdk'
-require 'aws_config'
 require 'base64'
 require 'coderay'
 require 'diffy'
@@ -15,6 +14,7 @@ require 'net/ssh'
 require 'open-uri'
 require 'open3'
 require 'optparse'
+require 'pathname'
 require 'rbconfig'
 require 'retryable'
 require 'set'
@@ -23,6 +23,7 @@ require 'strscan'
 require 'term/ansicolor'
 require 'thread'
 require 'uuidtools'
+require 'v8'
 require 'yaml'
 
 require 'kumogata/client'
@@ -35,3 +36,4 @@ require 'kumogata/outputs_filter'
 require 'kumogata/post_processing'
 require 'kumogata/string_stream'
 require 'kumogata/utils'
+require 'kumogata/v8_object_ext'

data/lib/kumogata/argument_parser.rb

@@ -8,7 +8,6 @@ class Kumogata::ArgumentParser
     :command_result_log => File.join(Dir.pwd, 'command_result.json'),
     :color => $stdout.tty?,
     :debug => false,
-    :config_profile => :default,
   }
 
   COMMANDS = {
@@ -81,7 +80,7 @@ class Kumogata::ArgumentParser
       update_usage(opt)
 
       begin
-        supported_formats = [:ruby, :json, :yaml]
+        supported_formats = [:ruby, :json, :yaml, :js]
         opt.on('-k', '--access-key ACCESS_KEY')                    {|v| options[:access_key_id]           = v     }
         opt.on('-s', '--secret-key SECRET_KEY')                    {|v| options[:secret_access_key]       = v     }
         opt.on('-r', '--region REGION')                            {|v| options[:region]                  = v     }

data/lib/kumogata/client.rb

@@ -40,6 +40,7 @@ class Kumogata::Client
                       when :ruby then :json
                       when :json then :ruby
                       when :yaml then :json
+                      when :js then :json
                       end
     end
 
@@ -50,6 +51,8 @@ class Kumogata::Client
       JSON.pretty_generate(template).colorize_as(:json)
     when :yaml
       YAML.dump(template).colorize_as(:yaml)
+    when :js
+      '(' + JSON.pretty_generate(template).colorize_as(:json) + ')'
     end
   end
 
@@ -163,6 +166,14 @@ class Kumogata::Client
       when :yaml
         parsed = YAML.load(f.read)
         Kumogata::Utils.stringify(parsed)
+      when :js
+        obj = V8::Context.new.eval(f.read)
+
+        unless obj.instance_of?(V8::Object)
+          raise "Invalid JavaScript template. Please return Object: #{path_or_url}"
+        end
+
+        Kumogata::Utils.stringify(obj.to_hash)
       else
         raise "Unknown format: #{format}"
       end
@@ -179,10 +190,12 @@ class Kumogata::Client
     case File.extname(path_or_url)
     when '.rb'
       :ruby
-    when '.json', '.js'
+    when '.json'
       :json
     when '.yml', '.yaml'
       :yaml
+    when '.js'
+      :js
     else
       :json
     end

data/lib/kumogata/config_parser.rb

@@ -0,0 +1,33 @@
+class Kumogata::ConfigParser
+  attr_reader :path
+
+  def initialize(path = '~/.aws/config')
+    self.path = path
+    @profiles = {}
+  end
+
+  def path=(v)
+    @path = Pathname.new(v).expand_path
+  end
+
+  def [](profile_name)
+    @profiles[profile_name.to_s]
+  end
+
+  def parse!
+    profile_name = nil
+
+    @path.each_line do |line|
+      line.strip!
+      next if line.empty?
+
+      if line =~ /\A\[(.+)\]\z/
+        profile_name = $1
+      elsif profile_name
+        key, value = line.split('=', 2).map {|i| i.strip }
+        @profiles[profile_name] ||= {}
+        @profiles[profile_name][key] = value
+      end
+    end
+  end
+end

data/lib/kumogata/v8_object_ext.rb

@@ -0,0 +1,20 @@
+class V8::Object
+  def to_hash
+    to_hash0(self)
+  end
+
+  def to_hash0(obj)
+    case obj
+    when V8::Array
+      obj.map {|v| to_hash0(v) }
+    when V8::Object
+      h = {}
+      obj.each do |k, v|
+        h[to_hash0(k)] = to_hash0(v)
+      end
+      h
+    else
+      obj
+    end
+  end
+end

data/lib/kumogata/version.rb

@@ -1,3 +1,3 @@
 module Kumogata
-  VERSION = '0.4.17'
+  VERSION = '0.4.18'
 end

data/spec/kumogata_config_parser_spec.rb

@@ -0,0 +1,38 @@
+describe Kumogata::ConfigParser do
+  subject { Kumogata::ConfigParser.new }
+
+  it 'parse aws/config' do
+    content = <<-EOS
+[default]
+aws_access_key_id = AKIAIOSFODNN7EXAMPLE
+aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
+aws_security_token = texample123324
+
+[profile2]
+aws_access_key_id = xAKIAIOSFODNN7EXAMPLE
+aws_secret_access_key = xwJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
+aws_security_token = xtexample123324
+
+[invalid]
+    EOS
+
+    tempfile(content) do |config|
+      subject.path = config.path
+      subject.parse!
+
+      expect(subject[:default]).to eq(
+        'aws_access_key_id' => 'AKIAIOSFODNN7EXAMPLE',
+        'aws_secret_access_key' => 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
+        'aws_security_token' => 'texample123324',
+      )
+
+      expect(subject['profile2']).to eq(
+        'aws_access_key_id' => 'xAKIAIOSFODNN7EXAMPLE',
+        'aws_secret_access_key' => 'xwJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
+        'aws_security_token' => 'xtexample123324',
+      )
+
+      expect(subject['invalid']).to be_nil
+    end
+  end
+end

data/spec/kumogata_convert_spec.rb

@@ -126,6 +126,105 @@ end
     EOS
   end
 
+  it 'convert Ruby template to JavaScript template' do
+    template = <<-EOS
+Resources do
+  myEC2Instance do
+    Type "AWS::EC2::Instance"
+    Properties do
+      ImageId "ami-XXXXXXXX"
+      InstanceType "t1.micro"
+    end
+  end
+end
+
+Outputs do
+  AZ do
+    Value do
+      Fn__GetAtt "myEC2Instance", "AvailabilityZone"
+    end
+  end
+end
+    EOS
+
+    js_template = run_client(:convert, :template => template, :options => {:output_format => :js})
+
+    expect(js_template).to eq <<-EOS.strip
+({
+  "Resources": {
+    "myEC2Instance": {
+      "Type": "AWS::EC2::Instance",
+      "Properties": {
+        "ImageId": "ami-XXXXXXXX",
+        "InstanceType": "t1.micro"
+      }
+    }
+  },
+  "Outputs": {
+    "AZ": {
+      "Value": {
+        "Fn::GetAtt": [
+          "myEC2Instance",
+          "AvailabilityZone"
+        ]
+      }
+    }
+  }
+})
+    EOS
+  end
+
+  it 'convert JavaScript template to Ruby template' do
+    template = <<-EOS
+function fetch_ami() {
+  return "ami-XXXXXXXX";
+}
+
+({
+  Resources: { /* comment */
+    myEC2Instance: {
+      Type: "AWS::EC2::Instance",
+      Properties: {
+        ImageId: fetch_ami(),
+        InstanceType: "t1.micro"
+      }
+    }
+  },
+  Outputs: {
+    AZ: { /* comment */
+      Value: {
+        "Fn::GetAtt": [
+          "myEC2Instance",
+          "AvailabilityZone"
+        ]
+      }
+    }
+  }
+})
+    EOS
+
+    ruby_template = run_client(:convert, :template => template, :template_ext => '.js', :options => {:output_format => :ruby})
+
+    expect(ruby_template).to eq((<<-EOS).chomp)
+Resources do
+  myEC2Instance do
+    Type "AWS::EC2::Instance"
+    Properties do
+      ImageId "ami-XXXXXXXX"
+      InstanceType "t1.micro"
+    end
+  end
+end
+Outputs do
+  AZ do
+    Value do
+      Fn__GetAtt "myEC2Instance", "AvailabilityZone"
+    end
+  end
+end
+    EOS
+  end
+
   it 'convert YAML template to JSON template' do
     template = <<-EOS
 ---
@@ -863,4 +962,1298 @@ end
 
     expect(ruby_template).to eq(json_template)
   end
+
+  let(:vpc_knowhow_2014_04_template) do
+    path = File.expand_path('../vpc-knowhow-2014-04.template', __FILE__)
+    open(path) {|f| f.read }
+  end
+
+  it 'convert JSON template to Ruby template (include yum key)' do
+    ruby_template = run_client(:convert, :template => vpc_knowhow_2014_04_template, :template_ext => '.template')
+
+    expect(ruby_template).to eq <<-'EOS'.strip
+AWSTemplateFormatVersion "2010-09-09"
+Description "VPC knowhow template"
+Parameters do
+  KeyName do
+    Description "Name of an existing EC2 KeyPair to enable SSH access to the instances"
+    Type "String"
+    MinLength 1
+    MaxLength 64
+    AllowedPattern "[-_ a-zA-Z0-9]*"
+    ConstraintDescription "can contain only alphanumeric characters, spaces, dashes and underscores."
+  end
+  SSHFrom do
+    Description "Lockdown SSH access to the bastion host (default can be accessed from anywhere)"
+    Type "String"
+    MinLength 9
+    MaxLength 18
+    Default "0.0.0.0/0"
+    AllowedPattern "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
+    ConstraintDescription "must be a valid CIDR range of the form x.x.x.x/x."
+  end
+  DBInstanceType do
+    Description "EC2 instance type for the Blue environment"
+    Default "db.t1.micro"
+    Type "String"
+  end
+  DBSnapshotName do
+    Default ""
+    Description "The name of a DB snapshot (optional)"
+    Type "String"
+  end
+  DBAllocatedStorage do
+    Default 5
+    Description "DB instance disk size"
+    Type "Number"
+  end
+  DBUsername do
+    Default "admin"
+    Description "The database master account username"
+    Type "String"
+    MinLength 1
+    MaxLength 16
+    AllowedPattern "[a-zA-Z][a-zA-Z0-9]*"
+    ConstraintDescription "must begin with a letter and contain only alphanumeric characters."
+  end
+  DBPassword do
+    Description "Password of RDS master password"
+    Type "String"
+    NoEcho "true"
+    MinLength 4
+  end
+  DBName do
+    Default ""
+    Description "The name of a DB01 database"
+    Type "String"
+  end
+  WebInstanceType do
+    Description "EC2 instance type for the web server"
+    Default "t1.micro"
+    Type "String"
+  end
+  WebFleetSize do
+    Description "Number of EC2 instances to launch for the web server"
+    Default 2
+    Type "Number"
+    MaxValue 100
+    MinValue 1
+  end
+  HostedZone do
+    Description "The DNS name of an existing Amazon Route 53 hosted zone"
+    Type "String"
+  end
+end
+Conditions do
+  UseDBSnapshot do
+    Fn__Not [
+      _{
+        Fn__Equals [
+          _{
+            Ref "DBSnapshotName"
+          },
+          ""
+        ]
+      }
+    ]
+  end
+end
+Mappings do
+  AWSAmazonLinuxAMI(
+    {"us-east-1"=>
+      {"name"=>"Virginia",
+       "201303"=>"ami-3275ee5b",
+       "201309"=>"ami-35792c5c",
+       "201403"=>"ami-2f726546"},
+     "us-west-2"=>
+      {"name"=>"Oregon",
+       "201303"=>"ami-ecbe2adc",
+       "201309"=>"ami-d03ea1e0",
+       "201403"=>"ami-b8f69f88"},
+     "us-west-1"=>
+      {"name"=>"California",
+       "201303"=>"ami-66d1fc23",
+       "201309"=>"ami-687b4f2d",
+       "201403"=>"ami-84f1cfc1"},
+     "eu-west-1"=>
+      {"name"=>"Ireland",
+       "201303"=>"ami-44939930",
+       "201309"=>"ami-149f7863",
+       "201403"=>"ami-a921dfde"},
+     "ap-southeast-1"=>
+      {"name"=>"Singapole",
+       "201303"=>"ami-aa9ed2f8",
+       "201309"=>"ami-14f2b946",
+       "201403"=>"ami-787c2c2a"},
+     "ap-southeast-2"=>
+      {"name"=>"Sydney",
+       "201303"=>"ami-363eaf0c",
+       "201309"=>"ami-a148d59b",
+       "201403"=>"ami-0bc85031"},
+     "ap-northeast-1"=>
+      {"name"=>"Tokyo",
+       "201303"=>"ami-173fbf16",
+       "201309"=>"ami-3561fe34",
+       "201403"=>"ami-a1bec3a0"},
+     "sa-east-1"=>
+      {"name"=>"SaoPaulo",
+       "201303"=>"ami-dd6bb0c0",
+       "201309"=>"ami-9f6ec982",
+       "201403"=>"ami-89de7c94"}})
+  ELBLogger(
+    {"us-east-1"=>{"AccountID"=>"127311923021"},
+     "us-west-2"=>{"AccountID"=>"797873946194"},
+     "us-west-1"=>{"AccountID"=>"027434742980"},
+     "eu-west-1"=>{"AccountID"=>"156460612806"},
+     "ap-southeast-1"=>{"AccountID"=>"114774131450"},
+     "ap-southeast-2"=>{"AccountID"=>"783225319266"},
+     "ap-northeast-1"=>{"AccountID"=>"582318560864"},
+     "sa-east-1"=>{"AccountID"=>"507241528517"},
+     "us-gov-west-1"=>{"AccountID"=>"048591011584"}})
+  StackConfig do
+    VPC do
+      CIDR "10.0.0.0/16"
+    end
+    FrontendSubnet1 do
+      CIDR "10.0.0.0/24"
+    end
+    FrontendSubnet2 do
+      CIDR "10.0.1.0/24"
+    end
+    ApplicationSubnet1 do
+      CIDR "10.0.100.0/24"
+    end
+    ApplicationSubnet2 do
+      CIDR "10.0.101.0/24"
+    end
+    DatastoreSubnet1 do
+      CIDR "10.0.200.0/24"
+    end
+    DatastoreSubnet2 do
+      CIDR "10.0.201.0/24"
+    end
+    BastionServer do
+      InstanceType "t1.micro"
+    end
+  end
+end
+Resources do
+  PowerUserRole do
+    Type "AWS::IAM::Role"
+    Properties do
+      AssumeRolePolicyDocument do
+        Statement [
+          _{
+            Effect "Allow"
+            Principal do
+              Service ["ec2.amazonaws.com"]
+            end
+            Action ["sts:AssumeRole"]
+          }
+        ]
+      end
+      Path "/"
+      Policies [
+        _{
+          PolicyName "PowerUserPolicy"
+          PolicyDocument do
+            Statement [
+              _{
+                Sid "PowerUserStmt"
+                Effect "Allow"
+                NotAction "iam:*"
+                Resource "*"
+              }
+            ]
+          end
+        }
+      ]
+    end
+  end
+  PowerUserProfile do
+    Type "AWS::IAM::InstanceProfile"
+    Properties do
+      Path "/"
+      Roles [
+        _{
+          Ref "PowerUserRole"
+        }
+      ]
+    end
+  end
+  LogBucket do
+    Type "AWS::S3::Bucket"
+    DeletionPolicy "Retain"
+  end
+  LogBucketPolicy do
+    Type "AWS::S3::BucketPolicy"
+    Properties do
+      Bucket do
+        Ref "LogBucket"
+      end
+      PolicyDocument do
+        Id "LogBucketPolicy"
+        Statement [
+          _{
+            Sid "WriteAccess"
+            Action ["s3:PutObject"]
+            Effect "Allow"
+            Resource do
+              Fn__Join [
+                "",
+                [
+                  "arn:aws:s3:::",
+                  _{
+                    Ref "LogBucket"
+                  },
+                  "/AWSLogs/",
+                  _{
+                    Ref "AWS::AccountId"
+                  },
+                  "/*"
+                ]
+              ]
+            end
+            Principal do
+              AWS do
+                Fn__FindInMap [
+                  "ELBLogger",
+                  _{
+                    Ref "AWS::Region"
+                  },
+                  "AccountID"
+                ]
+              end
+            end
+          }
+        ]
+      end
+    end
+  end
+  VPC do
+    Type "AWS::EC2::VPC"
+    Properties do
+      CidrBlock do
+        Fn__FindInMap "StackConfig", "VPC", "CIDR"
+      end
+      EnableDnsSupport "true"
+      EnableDnsHostnames "true"
+      InstanceTenancy "default"
+      Tags [
+        _{
+          Key "Application"
+          Value do
+            Ref "AWS::StackId"
+          end
+        },
+        _{
+          Key "Network"
+          Value "Public"
+        }
+      ]
+    end
+  end
+  InternetGateway do
+    Type "AWS::EC2::InternetGateway"
+    Properties do
+      Tags [
+        _{
+          Key "Application"
+          Value do
+            Ref "AWS::StackId"
+          end
+        },
+        _{
+          Key "Network"
+          Value "Public"
+        }
+      ]
+    end
+  end
+  AttachGateway do
+    Type "AWS::EC2::VPCGatewayAttachment"
+    Properties do
+      VpcId do
+        Ref "VPC"
+      end
+      InternetGatewayId do
+        Ref "InternetGateway"
+      end
+    end
+  end
+  PublicRouteTable do
+    Type "AWS::EC2::RouteTable"
+    DependsOn "AttachGateway"
+    Properties do
+      VpcId do
+        Ref "VPC"
+      end
+      Tags [
+        _{
+          Key "Application"
+          Value do
+            Ref "AWS::StackId"
+          end
+        },
+        _{
+          Key "Network"
+          Value "Public"
+        }
+      ]
+    end
+  end
+  PrivateRouteTable do
+    Type "AWS::EC2::RouteTable"
+    DependsOn "AttachGateway"
+    Properties do
+      VpcId do
+        Ref "VPC"
+      end
+      Tags [
+        _{
+          Key "Application"
+          Value do
+            Ref "AWS::StackId"
+          end
+        },
+        _{
+          Key "Network"
+          Value "Private"
+        }
+      ]
+    end
+  end
+  PublicRoute do
+    Type "AWS::EC2::Route"
+    DependsOn "AttachGateway"
+    Properties do
+      RouteTableId do
+        Ref "PublicRouteTable"
+      end
+      DestinationCidrBlock "0.0.0.0/0"
+      GatewayId do
+        Ref "InternetGateway"
+      end
+    end
+  end
+  FrontendSubnet1 do
+    Type "AWS::EC2::Subnet"
+    DependsOn "AttachGateway"
+    Properties do
+      VpcId do
+        Ref "VPC"
+      end
+      AvailabilityZone do
+        Fn__Select [
+          "0",
+          _{
+            Fn__GetAZs do
+              Ref "AWS::Region"
+            end
+          }
+        ]
+      end
+      CidrBlock do
+        Fn__FindInMap "StackConfig", "FrontendSubnet1", "CIDR"
+      end
+      Tags [
+        _{
+          Key "Application"
+          Value do
+            Ref "AWS::StackId"
+          end
+        },
+        _{
+          Key "Network"
+          Value "Public"
+        }
+      ]
+    end
+  end
+  FrontendSubnet2 do
+    Type "AWS::EC2::Subnet"
+    DependsOn "AttachGateway"
+    Properties do
+      VpcId do
+        Ref "VPC"
+      end
+      AvailabilityZone do
+        Fn__Select [
+          "1",
+          _{
+            Fn__GetAZs do
+              Ref "AWS::Region"
+            end
+          }
+        ]
+      end
+      CidrBlock do
+        Fn__FindInMap "StackConfig", "FrontendSubnet2", "CIDR"
+      end
+      Tags [
+        _{
+          Key "Application"
+          Value do
+            Ref "AWS::StackId"
+          end
+        },
+        _{
+          Key "Network"
+          Value "Public"
+        }
+      ]
+    end
+  end
+  ApplicationSubnet1 do
+    Type "AWS::EC2::Subnet"
+    DependsOn "AttachGateway"
+    Properties do
+      VpcId do
+        Ref "VPC"
+      end
+      CidrBlock do
+        Fn__FindInMap "StackConfig", "ApplicationSubnet1", "CIDR"
+      end
+      AvailabilityZone do
+        Fn__Select [
+          "0",
+          _{
+            Fn__GetAZs do
+              Ref "AWS::Region"
+            end
+          }
+        ]
+      end
+      Tags [
+        _{
+          Key "Application"
+          Value do
+            Ref "AWS::StackId"
+          end
+        },
+        _{
+          Key "Network"
+          Value "Public"
+        }
+      ]
+    end
+  end
+  ApplicationSubnet2 do
+    Type "AWS::EC2::Subnet"
+    DependsOn "AttachGateway"
+    Properties do
+      VpcId do
+        Ref "VPC"
+      end
+      CidrBlock do
+        Fn__FindInMap "StackConfig", "ApplicationSubnet2", "CIDR"
+      end
+      AvailabilityZone do
+        Fn__Select [
+          "1",
+          _{
+            Fn__GetAZs do
+              Ref "AWS::Region"
+            end
+          }
+        ]
+      end
+      Tags [
+        _{
+          Key "Application"
+          Value do
+            Ref "AWS::StackId"
+          end
+        },
+        _{
+          Key "Network"
+          Value "Public"
+        }
+      ]
+    end
+  end
+  DatastoreSubnet1 do
+    Type "AWS::EC2::Subnet"
+    DependsOn "AttachGateway"
+    Properties do
+      VpcId do
+        Ref "VPC"
+      end
+      CidrBlock do
+        Fn__FindInMap "StackConfig", "DatastoreSubnet1", "CIDR"
+      end
+      AvailabilityZone do
+        Fn__Select [
+          "0",
+          _{
+            Fn__GetAZs do
+              Ref "AWS::Region"
+            end
+          }
+        ]
+      end
+      Tags [
+        _{
+          Key "Application"
+          Value do
+            Ref "AWS::StackId"
+          end
+        },
+        _{
+          Key "Network"
+          Value "Private"
+        }
+      ]
+    end
+  end
+  DatastoreSubnet2 do
+    Type "AWS::EC2::Subnet"
+    DependsOn "AttachGateway"
+    Properties do
+      VpcId do
+        Ref "VPC"
+      end
+      CidrBlock do
+        Fn__FindInMap "StackConfig", "DatastoreSubnet2", "CIDR"
+      end
+      AvailabilityZone do
+        Fn__Select [
+          "1",
+          _{
+            Fn__GetAZs do
+              Ref "AWS::Region"
+            end
+          }
+        ]
+      end
+      Tags [
+        _{
+          Key "Application"
+          Value do
+            Ref "AWS::StackId"
+          end
+        },
+        _{
+          Key "Network"
+          Value "Private"
+        }
+      ]
+    end
+  end
+  FrontendSubnet1RouteTableAssociation do
+    Type "AWS::EC2::SubnetRouteTableAssociation"
+    Properties do
+      SubnetId do
+        Ref "FrontendSubnet1"
+      end
+      RouteTableId do
+        Ref "PublicRouteTable"
+      end
+    end
+  end
+  FrontendSubnet2RouteTableAssociation do
+    Type "AWS::EC2::SubnetRouteTableAssociation"
+    Properties do
+      SubnetId do
+        Ref "FrontendSubnet2"
+      end
+      RouteTableId do
+        Ref "PublicRouteTable"
+      end
+    end
+  end
+  ApplicationSubnet1RouteTableAssociation do
+    Type "AWS::EC2::SubnetRouteTableAssociation"
+    Properties do
+      SubnetId do
+        Ref "ApplicationSubnet1"
+      end
+      RouteTableId do
+        Ref "PublicRouteTable"
+      end
+    end
+  end
+  ApplicationSubnet2RouteTableAssociation do
+    Type "AWS::EC2::SubnetRouteTableAssociation"
+    Properties do
+      SubnetId do
+        Ref "ApplicationSubnet2"
+      end
+      RouteTableId do
+        Ref "PublicRouteTable"
+      end
+    end
+  end
+  DatastoreSubnet1RouteTableAssociation do
+    Type "AWS::EC2::SubnetRouteTableAssociation"
+    Properties do
+      SubnetId do
+        Ref "DatastoreSubnet1"
+      end
+      RouteTableId do
+        Ref "PrivateRouteTable"
+      end
+    end
+  end
+  DatastoreSubnet2RouteTableAssociation do
+    Type "AWS::EC2::SubnetRouteTableAssociation"
+    Properties do
+      SubnetId do
+        Ref "DatastoreSubnet2"
+      end
+      RouteTableId do
+        Ref "PrivateRouteTable"
+      end
+    end
+  end
+  VPCDefaultSecurityGroup do
+    Type "AWS::EC2::SecurityGroup"
+    Properties do
+      VpcId do
+        Ref "VPC"
+      end
+      GroupDescription "Allow all communications in VPC"
+      SecurityGroupIngress [
+        _{
+          IpProtocol "tcp"
+          FromPort 0
+          ToPort 65535
+          CidrIp do
+            Fn__FindInMap "StackConfig", "VPC", "CIDR"
+          end
+        },
+        _{
+          IpProtocol "udp"
+          FromPort 0
+          ToPort 65535
+          CidrIp do
+            Fn__FindInMap "StackConfig", "VPC", "CIDR"
+          end
+        },
+        _{
+          IpProtocol "icmp"
+          FromPort "-1"
+          ToPort "-1"
+          CidrIp do
+            Fn__FindInMap "StackConfig", "VPC", "CIDR"
+          end
+        }
+      ]
+    end
+  end
+  SSHSecurityGroup do
+    Type "AWS::EC2::SecurityGroup"
+    Properties do
+      VpcId do
+        Ref "VPC"
+      end
+      GroupDescription "Enable SSH access via port 22"
+      SecurityGroupIngress [
+        _{
+          IpProtocol "tcp"
+          FromPort 22
+          ToPort 22
+          CidrIp do
+            Ref "SSHFrom"
+          end
+        }
+      ]
+    end
+  end
+  PublicWebSecurityGroup do
+    Type "AWS::EC2::SecurityGroup"
+    Properties do
+      VpcId do
+        Ref "VPC"
+      end
+      GroupDescription "Public Security Group with HTTP access on port 443 from the internet"
+      SecurityGroupIngress [
+        _{
+          IpProtocol "tcp"
+          FromPort 80
+          ToPort 80
+          CidrIp "0.0.0.0/0"
+        },
+        _{
+          IpProtocol "tcp"
+          FromPort 443
+          ToPort 443
+          CidrIp "0.0.0.0/0"
+        }
+      ]
+    end
+  end
+  ApplicationSecurityGroup do
+    Type "AWS::EC2::SecurityGroup"
+    Properties do
+      VpcId do
+        Ref "VPC"
+      end
+      GroupDescription "Marker security group for Application server."
+    end
+  end
+  MySQLSecurityGroup do
+    Type "AWS::EC2::SecurityGroup"
+    Properties do
+      VpcId do
+        Ref "VPC"
+      end
+      GroupDescription "Marker security group for MySQL server."
+    end
+  end
+  BastionWaitHandle do
+    Type "AWS::CloudFormation::WaitConditionHandle"
+  end
+  BastionWaitCondition do
+    Type "AWS::CloudFormation::WaitCondition"
+    DependsOn "BastionInstance"
+    Properties do
+      Handle do
+        Ref "BastionWaitHandle"
+      end
+      Timeout 900
+    end
+  end
+  BastionInstance do
+    Type "AWS::EC2::Instance"
+    Properties do
+      InstanceType do
+        Fn__FindInMap "StackConfig", "BastionServer", "InstanceType"
+      end
+      KeyName do
+        Ref "KeyName"
+      end
+      SubnetId do
+        Ref "FrontendSubnet1"
+      end
+      ImageId do
+        Fn__FindInMap [
+          "AWSAmazonLinuxAMI",
+          _{
+            Ref "AWS::Region"
+          },
+          "201403"
+        ]
+      end
+      IamInstanceProfile do
+        Ref "PowerUserProfile"
+      end
+      SecurityGroupIds [
+        _{
+          Ref "SSHSecurityGroup"
+        },
+        _{
+          Ref "VPCDefaultSecurityGroup"
+        }
+      ]
+      Tags [
+        _{
+          Key "Name"
+          Value "Bastion"
+        }
+      ]
+      UserData do
+        Fn__Base64 do
+          Fn__Join [
+            "",
+            [
+              "#! /bin/bash -v\n",
+              "yum update -y\n",
+              "# Helper function\n",
+              "function error_exit\n",
+              "{\n",
+              "  /opt/aws/bin/cfn-signal -e 1 -r \"$1\" '",
+              _{
+                Ref "BastionWaitHandle"
+              },
+              "'\n",
+              "  exit 1\n",
+              "}\n",
+              "# Install packages\n",
+              "/opt/aws/bin/cfn-init -s ",
+              _{
+                Ref "AWS::StackId"
+              },
+              " -r BastionInstance ",
+              "    --region ",
+              _{
+                Ref "AWS::Region"
+              },
+              " || error_exit 'Failed to run cfn-init'\n",
+              "# All is well so signal success\n",
+              "/opt/aws/bin/cfn-signal -e $? -r \"BastionInstance setup complete\" '",
+              _{
+                Ref "BastionWaitHandle"
+              },
+              "'\n"
+            ]
+          ]
+        end
+      end
+    end
+    Metadata do
+      AWS__CloudFormation__Init do
+        config do
+          packages do
+            yum(
+              {"mysql55"=>[], "jq"=>[], "python-magic"=>[]})
+          end
+        end
+      end
+    end
+  end
+  BastionInstanceEIP do
+    Type "AWS::EC2::EIP"
+    DependsOn "AttachGateway"
+    Properties do
+      Domain "vpc"
+      InstanceId do
+        Ref "BastionInstance"
+      end
+    end
+  end
+  BastionDNSRecord do
+    Type "AWS::Route53::RecordSet"
+    Properties do
+      HostedZoneName do
+        Fn__Join [
+          "",
+          [
+            _{
+              Ref "HostedZone"
+            },
+            "."
+          ]
+        ]
+      end
+      Comment "A record for the Bastion instance."
+      Name do
+        Fn__Join [
+          "",
+          [
+            "bastion.",
+            _{
+              Ref "HostedZone"
+            },
+            "."
+          ]
+        ]
+      end
+      Type "A"
+      TTL 300
+      ResourceRecords [
+        _{
+          Ref "BastionInstanceEIP"
+        }
+      ]
+    end
+  end
+  BastionLocalDNSRecord do
+    Type "AWS::Route53::RecordSet"
+    Properties do
+      HostedZoneName do
+        Fn__Join [
+          "",
+          [
+            _{
+              Ref "HostedZone"
+            },
+            "."
+          ]
+        ]
+      end
+      Comment "A record for the private IP address of Bastion instance."
+      Name do
+        Fn__Join [
+          "",
+          [
+            "bastion.local.",
+            _{
+              Ref "HostedZone"
+            },
+            "."
+          ]
+        ]
+      end
+      Type "A"
+      TTL 300
+      ResourceRecords [
+        _{
+          Fn__GetAtt "BastionInstance", "PrivateIp"
+        }
+      ]
+    end
+  end
+  DBParamGroup do
+    Type "AWS::RDS::DBParameterGroup"
+    Properties do
+      Description "Default parameter group for Portnoy"
+      Family "MySQL5.6"
+      Parameters(
+        {"character_set_database"=>"utf8mb4",
+         "character_set_client"=>"utf8mb4",
+         "character_set_connection"=>"utf8mb4",
+         "character_set_results"=>"utf8mb4",
+         "character_set_server"=>"utf8mb4",
+         "skip-character-set-client-handshake"=>"TRUE"})
+    end
+  end
+  DBSubnetGroup do
+    Type "AWS::RDS::DBSubnetGroup"
+    Properties do
+      DBSubnetGroupDescription "Database subnets for RDS"
+      SubnetIds [
+        _{
+          Ref "DatastoreSubnet1"
+        },
+        _{
+          Ref "DatastoreSubnet2"
+        }
+      ]
+    end
+  end
+  DBInstance do
+    Type "AWS::RDS::DBInstance"
+    DeletionPolicy "Snapshot"
+    Properties do
+      DBInstanceClass do
+        Ref "DBInstanceType"
+      end
+      AllocatedStorage do
+        Ref "DBAllocatedStorage"
+      end
+      Engine "MySQL"
+      MultiAZ "true"
+      EngineVersion "5.6.13"
+      MasterUsername do
+        Ref "DBUsername"
+      end
+      MasterUserPassword do
+        Ref "DBPassword"
+      end
+      BackupRetentionPeriod 35
+      DBParameterGroupName do
+        Ref "DBParamGroup"
+      end
+      DBSubnetGroupName do
+        Ref "DBSubnetGroup"
+      end
+      DBSnapshotIdentifier do
+        Fn__If [
+          "UseDBSnapshot",
+          _{
+            Ref "DBSnapshotName"
+          },
+          _{
+            Ref "AWS::NoValue"
+          }
+        ]
+      end
+      PreferredBackupWindow "19:00-19:30"
+      PreferredMaintenanceWindow "sat:20:00-sat:20:30"
+      VPCSecurityGroups [
+        _{
+          Ref "VPCDefaultSecurityGroup"
+        },
+        _{
+          Ref "MySQLSecurityGroup"
+        }
+      ]
+    end
+  end
+  DatabaseDNSRecord do
+    Type "AWS::Route53::RecordSet"
+    Properties do
+      HostedZoneName do
+        Fn__Join [
+          "",
+          [
+            _{
+              Ref "HostedZone"
+            },
+            "."
+          ]
+        ]
+      end
+      Comment "CNAME for the database."
+      Name do
+        Fn__Join [
+          "",
+          [
+            "db.local.",
+            _{
+              Ref "HostedZone"
+            },
+            "."
+          ]
+        ]
+      end
+      Type "CNAME"
+      TTL 300
+      ResourceRecords [
+        _{
+          Fn__GetAtt "DBInstance", "Endpoint.Address"
+        }
+      ]
+    end
+  end
+  ApplicationFleet do
+    Type "AWS::AutoScaling::AutoScalingGroup"
+    UpdatePolicy do
+      AutoScalingRollingUpdate do
+        MaxBatchSize 1
+        MinInstancesInService 1
+        PauseTime "PT2M30S"
+      end
+    end
+    Properties do
+      AvailabilityZones [
+        _{
+          Fn__GetAtt "ApplicationSubnet1", "AvailabilityZone"
+        },
+        _{
+          Fn__GetAtt "ApplicationSubnet2", "AvailabilityZone"
+        }
+      ]
+      VPCZoneIdentifier [
+        _{
+          Ref "ApplicationSubnet1"
+        },
+        _{
+          Ref "ApplicationSubnet2"
+        }
+      ]
+      LaunchConfigurationName do
+        Ref "ApplicationServerLaunchConfig"
+      end
+      MinSize do
+        Ref "WebFleetSize"
+      end
+      MaxSize do
+        Ref "WebFleetSize"
+      end
+      DesiredCapacity do
+        Ref "WebFleetSize"
+      end
+      LoadBalancerNames [
+        _{
+          Ref "ElasticLoadBalancer"
+        }
+      ]
+      Tags [
+        _{
+          Key "Name"
+          Value "Application"
+          PropagateAtLaunch "true"
+        }
+      ]
+    end
+  end
+  ApplicationServerLaunchConfig do
+    Type "AWS::AutoScaling::LaunchConfiguration"
+    Properties do
+      InstanceType do
+        Ref "WebInstanceType"
+      end
+      KeyName do
+        Ref "KeyName"
+      end
+      ImageId do
+        Fn__FindInMap [
+          "AWSAmazonLinuxAMI",
+          _{
+            Ref "AWS::Region"
+          },
+          "201403"
+        ]
+      end
+      SecurityGroups [
+        _{
+          Ref "VPCDefaultSecurityGroup"
+        },
+        _{
+          Ref "ApplicationSecurityGroup"
+        }
+      ]
+      AssociatePublicIpAddress "true"
+      IamInstanceProfile do
+        Ref "PowerUserProfile"
+      end
+      InstanceMonitoring "false"
+      UserData do
+        Fn__Base64 do
+          Fn__Join [
+            "",
+            [
+              "#! /bin/bash -v\n",
+              "yum update -y\n",
+              "# Install packages\n",
+              "/opt/aws/bin/cfn-init -s ",
+              _{
+                Ref "AWS::StackId"
+              },
+              " -r ApplicationServerLaunchConfig ",
+              "    --region ",
+              _{
+                Ref "AWS::Region"
+              },
+              " || error_exit 'Failed to run cfn-init'\n"
+            ]
+          ]
+        end
+      end
+    end
+    Metadata do
+      AWS__CloudFormation__Init do
+        config do
+          packages do
+            yum(
+              {"httpd"=>[], "mysql55"=>[]})
+          end
+          files do
+            _path("/var/www/html/index.html") do
+              content "<html><head><title>Hello</title></head><body>Hello, world!</body></html>"
+              mode "000644"
+              owner "apache"
+              group "apache"
+            end
+          end
+          services do
+            sysvinit do
+              httpd do
+                enabled "true"
+                ensureRunning "true"
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+  ElasticLoadBalancer do
+    Type "AWS::ElasticLoadBalancing::LoadBalancer"
+    DependsOn "AttachGateway"
+    Properties do
+      Subnets [
+        _{
+          Ref "FrontendSubnet1"
+        },
+        _{
+          Ref "FrontendSubnet2"
+        }
+      ]
+      Listeners [
+        _{
+          LoadBalancerPort 80
+          InstancePort 80
+          Protocol "HTTP"
+        }
+      ]
+      HealthCheck do
+        Target "HTTP:80/index.html"
+        HealthyThreshold 2
+        UnhealthyThreshold 2
+        Interval 6
+        Timeout 5
+      end
+      SecurityGroups [
+        _{
+          Ref "PublicWebSecurityGroup"
+        }
+      ]
+    end
+  end
+  LoadBalancerDNSRecord do
+    Type "AWS::Route53::RecordSetGroup"
+    Properties do
+      HostedZoneName do
+        Fn__Join [
+          "",
+          [
+            _{
+              Ref "HostedZone"
+            },
+            "."
+          ]
+        ]
+      end
+      Comment "Zone apex alias targeted to LoadBalancer."
+      RecordSets [
+        _{
+          Name do
+            Fn__Join [
+              "",
+              [
+                _{
+                  Ref "HostedZone"
+                },
+                "."
+              ]
+            ]
+          end
+          Type "A"
+          AliasTarget do
+            HostedZoneId do
+              Fn__GetAtt "ElasticLoadBalancer", "CanonicalHostedZoneNameID"
+            end
+            DNSName do
+              Fn__GetAtt "ElasticLoadBalancer", "CanonicalHostedZoneName"
+            end
+          end
+        }
+      ]
+    end
+  end
+end
+Outputs do
+  JdbcConnectionString do
+    Value do
+      Fn__Join [
+        "",
+        [
+          "jdbc:mysql://",
+          _{
+            Ref "DatabaseDNSRecord"
+          },
+          ":",
+          _{
+            Fn__GetAtt "DBInstance", "Endpoint.Port"
+          },
+          "/",
+          _{
+            Ref "DBName"
+          }
+        ]
+      ]
+    end
+    Description "-"
+  end
+  SSHToBackendServer do
+    Value do
+      Fn__Join [
+        "",
+        [
+          "ssh -i /path/to/",
+          _{
+            Ref "KeyName"
+          },
+          ".pem",
+          " -oProxyCommand='ssh -i /path/to/",
+          _{
+            Ref "KeyName"
+          },
+          ".pem -W %h:%p ec2-user@",
+          _{
+            Ref "BastionDNSRecord"
+          },
+          "'",
+          " ec2-user@<private-ip>"
+        ]
+      ]
+    end
+    Description "SSH command to connect to the backend servers"
+  end
+end
+    EOS
+  end
 end