cloudformation.template

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "aws auth proxy",
  "Parameters": {
    "DnsName": {
      "Description": "DNS name",
      "Type": "String",
      "Default": "aws.example.com"
    },
    "KeyPair": {
      "Description": "Keypair",
      "Type": "String",
      "Default": ""
    },
    "FrontendSSLCertificateARN": {
      "Description": "Frontend SSL Certificate ARN",
      "Type": "String",
      "Default": ""
    },
    "GoogleDomain": {
      "Description": "The name of your google apps domain. Only users from this domain are allowed to log in.",
      "Type": "String",
      "Default": ""
    },
    "GoogleClientID": {
      "Description": "Your Google OAuth client ID. This is used to enable identity federation. Get yours from https://console.developers.google.com/",
      "Type": "String",
      "Default": ""
    },
    "GoogleClientSecret": {
      "Description": "The secret that goes with GoogleClientId",
      "Type": "String",
      "Default": ""
    },
    "GoogleServiceEmail": {
      "Description": "Your Google service account email address and private key. This is used to determine a users group membership",
      "Type": "String",
      "Default": ""
    },
    "GoogleServicePrivateKey": {
      "Description": "The private kye that goes with GoogleServiceEmail",
      "Type": "String",
      "Default": ""
    },
    "GoogleServiceUser": {
      "Description": "The Google service account requires a user to impersonate when checking the directory to see which groups a user is in. Specify this user here. This user is also used to test the directory service at startup.",
      "Type": "String",
      "Default": ""
    },
    "DockerImage": {
      "Description": "Docker image for the auth proxy",
      "Type": "String",
      "Default": "crewjam/awsauthproxy:latest"
    }
  },
  "Mappings": {
    "RegionMap": {
      "us-east-1": {
        "AMI": "ami-76e27e1e"
      }
    }
  },
  "Resources": {
    "FederationUser": {
      "Type": "AWS::IAM::User",
      "Properties" : {
        "Policies": [{
          "PolicyName" : "AllowGetFederationToken",
          "PolicyDocument" : {
            "Version": "2012-10-17",
            "Statement": [
              {
                "Effect": "Allow",
                "Action": "sts:GetFederationToken",
                "Resource": "*"
              }
            ]
          }
        },
        {
          "PolicyName" : "MaxAllowedAccessOfFederatedUsers",
          "PolicyDocument" : {
            "Version": "2012-10-17",
            "Statement": [
              {
                "Action": ["iam:List*","iam:Get*","iam:PassRole"],
                "Resource": "*",
                "Effect": "Allow"
              },
              {
                "Effect": "Allow",
                "NotAction": "iam:*",
                "Resource": "*"
              },
              {
                "Action": ["cloudformation:*"],
                "Effect": "Deny",
                "Resource": {"Fn::Join": ["", ["arn:aws:cloudformation:",
                  {"Ref": "AWS::Region"}, ":", {"Ref": "AWS::AccountId"}, ":stack/",
                  {"Ref": "AWS::StackName"}, "/*"]]}
              }
            ]
          }
        }]
      }
    },
    "FederationUserAccessKey": {
      "Type": "AWS::IAM::AccessKey",
      "Properties": {
        "Serial": 4,
        "UserName": {"Ref": "FederationUser"}
      }
    },
    "LoadBalancer": {
      "Type": "AWS::ElasticLoadBalancing::LoadBalancer",
      "Properties": {
        "ConnectionDrainingPolicy": {
          "Enabled": true,
          "Timeout": 30
        },
        "CrossZone": true,
        "HealthCheck": {
          "HealthyThreshold": "2",
          "Interval": "6",
          "Target": "TCP:80",
          "Timeout": "5",
          "UnhealthyThreshold": "2"
        },
        "AvailabilityZones": [
          {
            "Fn::Select": [
              "1",
              {
                "Fn::GetAZs": {
                  "Ref": "AWS::Region"
                }
              }
            ]
          },
          {
            "Fn::Select": [
              "2",
              {
                "Fn::GetAZs": {
                  "Ref": "AWS::Region"
                }
              }
            ]
          },
          {
            "Fn::Select": [
              "3",
              {
                "Fn::GetAZs": {
                  "Ref": "AWS::Region"
                }
              }
            ]
          }
        ],
        "Listeners": [
          {
            "InstancePort": "80",
            "InstanceProtocol": "HTTP",
            "LoadBalancerPort": "443",
            "Protocol": "HTTPS",
            "SSLCertificateId": {"Ref": "FrontendSSLCertificateARN"}
          }
        ],
        "SecurityGroups": [
          {"Fn::GetAtt": ["LoadBalancerSecurityGroup", "GroupId"]}
        ]
      }
    },
    "LoadBalancerSecurityGroup": {
      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "GroupDescription": "Enable SSH access",
        "SecurityGroupIngress": [
          {
            "IpProtocol": "tcp",
            "FromPort": "443",
            "ToPort": "443",
            "CidrIp": "0.0.0.0/0"
          }
        ]
      }
    },
    "SecurityGroup": {
      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "GroupDescription": "Enable SSH access",
        "SecurityGroupIngress": [
          {
            "IpProtocol": "tcp",
            "FromPort": "22",
            "ToPort": "22",
            "CidrIp": "0.0.0.0/0"
          },
          {
            "IpProtocol": "tcp",
            "FromPort": "80",
            "ToPort": "80",
            "SourceSecurityGroupOwnerId": {
              "Fn::GetAtt": [
                "LoadBalancer",
                "SourceSecurityGroup.OwnerAlias"
              ]
            },
            "SourceSecurityGroupName": {
              "Fn::GetAtt": ["LoadBalancer", "SourceSecurityGroup.GroupName"]
            }
          }
        ]
      }
    },
    "ASG": {
      "Type": "AWS::AutoScaling::AutoScalingGroup",
      "Properties": {
        "AvailabilityZones": [
          {
            "Fn::Select": [
              "1",
              {
                "Fn::GetAZs": {
                  "Ref": "AWS::Region"
                }
              }
            ]
          },
          {
            "Fn::Select": [
              "2",
              {
                "Fn::GetAZs": {
                  "Ref": "AWS::Region"
                }
              }
            ]
          },
          {
            "Fn::Select": [
              "3",
              {
                "Fn::GetAZs": {
                  "Ref": "AWS::Region"
                }
              }
            ]
          }
        ],
        "MaxSize": "1",
        "MinSize": "1",
        "HealthCheckGracePeriod": "600",
        "HealthCheckType": "ELB",
        "LaunchConfigurationName": {
          "Ref": "LaunchConfig"
        },
        "LoadBalancerNames": [
          {"Ref": "LoadBalancer"}
        ],
        "Tags": [
          {
            "PropagateAtLaunch": true,
            "Key": "Name",
            "Value": {
              "Ref": "DnsName"
            }
          }
        ]
      }
    },
    "LaunchConfig": {
      "Type": "AWS::AutoScaling::LaunchConfiguration",
      "Metadata": {
        "SecretAccessKey": {"Fn::GetAtt": ["FederationUserAccessKey", "SecretAccessKey"]},
        "GoogleClientSecret": {"Ref": "GoogleClientSecret"},
        "GoogleServicePrivateKey": {"Ref": "GoogleServicePrivateKey"}
      },
      "Properties": {
        "ImageId": {
          "Fn::FindInMap": [
            "RegionMap",
            {
              "Ref": "AWS::Region"
            },
            "AMI"
          ]
        },
        "InstanceType": "t2.micro",
        "KeyName": {
          "Ref": "KeyPair"
        },
        "SecurityGroups": [
          {
            "Ref": "SecurityGroup"
          }
        ],
        "UserData": {
          "Fn::Base64": {
            "Fn::Join": [
              "",
              [
                "#!/bin/bash\n",
                "set -ex\n",
                "curl https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-latest.tar.gz | tar -xz --strip-components=1\n",
                "python setup.py install\n",
                "curl -sSL https://get.docker.com/ | sh\n",
                "docker run -d",
                " -e AWSAUTHD_TRUST_X_FORWARDED=true",
                " -e AWSAUTHD_AWS_ACCESS_KEY_ID=", {"Ref": "FederationUserAccessKey"},
                " -e AWSAUTHD_AWS_SECRET_ACCESS_KEY=$(cfn-get-metadata -v -s ", {"Ref": "AWS::StackName"}, " -r LaunchConfig -k SecretAccessKey)",
                " -e AWSAUTHD_GOOGLE_DOMAIN=", {"Ref": "GoogleDomain"},
                " -e AWSAUTHD_GOOGLE_CLIENT_ID=", {"Ref": "GoogleClientID"},
                " -e AWSAUTHD_GOOGLE_CLIENT_SECRET=$(cfn-get-metadata -v -s ", {"Ref": "AWS::StackName"}, " -r LaunchConfig -k GoogleClientSecret)",
                " -e AWSAUTHD_GOOGLE_SERVICE_EMAIL=", {"Ref": "GoogleServiceEmail"},
                " -e AWSAUTHD_GOOGLE_SERVICE_PRIVATE_KEY=\"$(cfn-get-metadata -v -s ", {"Ref": "AWS::StackName"}, " -r LaunchConfig -k GoogleServicePrivateKey)\"",
                " -e AWSAUTHD_GOOGLE_SERVICE_USER=", {"Ref": "GoogleServiceUser"},
                " -p 80:80",
                " ", {"Ref": "DockerImage"},
                " awsauthd -listen=0.0.0.0:80\n"
              ]
            ]
          }
        }
      }
    }
  }
}