matplotlib_studio.cfn.yaml

# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: MIT-0
AWSTemplateFormatVersion: 2010-09-09


Parameters:
  StudioName:
    Type: "String"
    Description: "Studio Name - can include letters (A-Z and a-z), numbers (0-9), and dashes (-)."
    AllowedPattern: ^[a-zA-Z0-9-]*$
    ConstraintDescription: "Must only include letters (A-Z and a-z), numbers (0-9), and dashes (-)."
  
  AdminUser:
    Type: "String"
    Description: "Your AWS SSO Username."

Conditions:
  InUsEast1:
    Fn::Equals:
    - { Ref: "AWS::Region" }
    - us-east-1

Resources:
  #S3 Bucket
  EmrStudioStorageBucket:
    Type: AWS::S3::Bucket

  # IAM resources
  EMRStudioServiceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - elasticmapreduce.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Description: "Service role for EMR Studio"
      RoleName:
        Fn::Join: ['_', [!Ref "StudioName", "EMRStudio_Service_Role"]]

  EMRStudioServiceRolePolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      Roles:
      - Ref: "EMRStudioServiceRole"
      ManagedPolicyName: 
        Fn::Join: ['_', [!Ref "StudioName", "EMRStudioServiceRolePolicy"]]
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: AllowEMRReadOnlyActions
            Effect: Allow
            Action:
              - elasticmapreduce:ListInstances
              - elasticmapreduce:DescribeCluster
              - elasticmapreduce:ListSteps
            Resource: '*'

          - Sid: AllowEC2ENIActionsWithEMRTags
            Effect: Allow
            Action:
              - ec2:CreateNetworkInterfacePermission
              - ec2:DeleteNetworkInterface
            Resource: !Sub 'arn:${AWS::Partition}:ec2:*:*:network-interface/*'
            Condition:
              StringEquals:
                "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true"

          - Sid: AllowEC2ENIAttributeAction
            Effect: Allow
            Action:
              - ec2:ModifyNetworkInterfaceAttribute
            Resource:
              - !Sub 'arn:${AWS::Partition}:ec2:*:*:instance/*'
              - !Sub 'arn:${AWS::Partition}:ec2:*:*:network-interface/*'
              - !Sub 'arn:${AWS::Partition}:ec2:*:*:security-group/*'

          - Sid: AllowEC2SecurityGroupActionsWithEMRTags
            Effect: Allow
            Action:
              - ec2:AuthorizeSecurityGroupEgress
              - ec2:AuthorizeSecurityGroupIngress
              - ec2:RevokeSecurityGroupEgress
              - ec2:RevokeSecurityGroupIngress
              - ec2:DeleteNetworkInterfacePermission
            Resource: '*'
            Condition:
              StringEquals:
                "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true"

          - Sid: AllowDefaultEC2SecurityGroupsCreationWithEMRTags
            Effect: Allow
            Action:
              - ec2:CreateSecurityGroup
            Resource: !Sub 'arn:${AWS::Partition}:ec2:*:*:security-group/*'
            Condition:
              StringEquals:
                "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true"

          - Sid: AllowDefaultEC2SecurityGroupsCreationInVPCWithEMRTags
            Effect: Allow
            Action:
              - ec2:CreateSecurityGroup
            Resource: !Sub 'arn:${AWS::Partition}:ec2:*:*:vpc/*'
            Condition:
              StringEquals:
                "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true"

          - Sid: AllowAddingEMRTagsDuringDefaultSecurityGroupCreation
            Effect: Allow
            Action:
              - ec2:CreateTags
            Resource: !Sub 'arn:${AWS::Partition}:ec2:*:*:security-group/*'
            Condition:
              StringEquals:
                "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true"
                "ec2:CreateAction": "CreateSecurityGroup"

          - Sid: AllowEC2ENICreationWithEMRTags
            Effect: Allow
            Action:
              - ec2:CreateNetworkInterface
            Resource: !Sub 'arn:${AWS::Partition}:ec2:*:*:network-interface/*'
            Condition:
              StringEquals:
                "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true"

          - Sid: AllowEC2ENICreationInSubnetAndSecurityGroupWithEMRTags
            Effect: Allow
            Action:
              - ec2:CreateNetworkInterface
            Resource:
              - !Sub 'arn:${AWS::Partition}:ec2:*:*:subnet/*'
              - !Sub 'arn:${AWS::Partition}:ec2:*:*:security-group/*'
            Condition:
              StringEquals:
                "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true"

          - Sid: AllowAddingTagsDuringEC2ENICreation
            Effect: Allow
            Action:
              - ec2:CreateTags
            Resource: !Sub 'arn:${AWS::Partition}:ec2:*:*:network-interface/*'
            Condition:
              StringEquals:
                "ec2:CreateAction": "CreateNetworkInterface"

          - Sid: AllowEC2ReadOnlyActions
            Effect: Allow
            Action:
              - ec2:DescribeSecurityGroups
              - ec2:DescribeNetworkInterfaces
              - ec2:DescribeTags
              - ec2:DescribeInstances
              - ec2:DescribeSubnets
              - ec2:DescribeVpcs
            Resource: '*'

          - Sid: AllowSecretsManagerReadOnlyActionsWithEMRTags
            Effect: Allow
            Action:
              - secretsmanager:GetSecretValue
            Resource: !Sub 'arn:${AWS::Partition}:secretsmanager:*:*:secret:*'
            Condition:
              StringEquals:
                "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true"

          - Sid: S3permission
            Effect: Allow
            Action:
              - s3:PutObject
              - s3:GetObject
              - s3:GetEncryptionConfiguration
              - s3:ListBucket
              - s3:DeleteObject
            Resource: "*"

          - Sid: KmsPermission
            Effect: Allow
            Action:
              - "kms:Decrypt"
              - "kms:ReEncrypt*"
              - "kms:GenerateDataKey*"
              - "kms:DescribeKey"
            Resource: "*"

  EMRStudioUserRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: 
        Fn::Join: ['_', [!Ref "StudioName", "EMRStudio_User_Role"]]
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - elasticmapreduce.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Description: "User role for EMR Studio"

  EMRStudioBasicUserPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      Roles:
      - Ref: "EMRStudioUserRole"
      ManagedPolicyName: 
        Fn::Join: ['_', [!Ref "StudioName", "EMRStudio_Basic_User_Policy"]]
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Sid: AllowEMRBasicActions
          Effect: Allow
          Resource: "*"
          Action:
          - "elasticmapreduce:CreateEditor"
          - "elasticmapreduce:DescribeEditor"
          - "elasticmapreduce:ListEditors"
          - "elasticmapreduce:StartEditor"
          - "elasticmapreduce:StopEditor"
          - "elasticmapreduce:DeleteEditor"
          - "elasticmapreduce:OpenEditorInConsole"
          - "elasticmapreduce:AttachEditor"
          - "elasticmapreduce:DetachEditor"
          - "elasticmapreduce:CreateRepository"
          - "elasticmapreduce:DescribeRepository"
          - "elasticmapreduce:DeleteRepository"
          - "elasticmapreduce:ListRepositories"
          - "elasticmapreduce:LinkRepository"
          - "elasticmapreduce:UnlinkRepository"
          - "elasticmapreduce:DescribeCluster"
          - "elasticmapreduce:ListInstanceGroups"
          - "elasticmapreduce:ListBootstrapActions"
          - "elasticmapreduce:ListClusters"
          - "elasticmapreduce:ListSteps"
          - "elasticmapreduce:CreatePersistentAppUI"
          - "elasticmapreduce:DescribePersistentAppUI"
          - "elasticmapreduce:GetPersistentAppUIPresignedURL"
          - "elasticmapreduce:GetOnClusterAppUIPresignedURL"
        - Sid: AllowEMRContainersBasicActions
          Effect: Allow
          Resource: "*"
          Action: 
          - "emr-containers:DescribeVirtualCluster"
          - "emr-containers:ListVirtualClusters"
          - "emr-containers:DescribeManagedEndpoint"
          - "emr-containers:ListManagedEndpoints"
          - "emr-containers:CreateAccessTokenForManagedEndpoint"
          - "emr-containers:DescribeJobRun"
          - "emr-containers:ListJobRuns"
        - Sid: AllowSecretManagerListSecrets
          Effect: Allow
          Resource: "*"
          Action: "secretsmanager:ListSecrets"  
        - Sid: AllowSecretCreationWithEMRTagsAndEMRStudioPrefix
          Effect: Allow
          Resource: 
          - "arn:aws:secretsmanager:*:*:secret:emr-studio-*"
          Action:
          - "secretsmanager:CreateSecret"
          Condition:
            StringEquals:
              "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true"
        - Sid: AllowAddingTagsOnSecretsWithEMRStudioPrefix
          Effect: Allow
          Resource: 
          - "arn:aws:secretsmanager:*:*:secret:emr-studio-*"
          Action:
          - "secretsmanager:TagResource"
        - Sid: AllowPassingServiceRoleForWorkspaceCreation
          Effect: Allow
          Resource: 
          - !GetAtt EMRStudioServiceRole.Arn
          Action: "iam:PassRole"  
        - Sid: AllowS3ListAndLocationPermissions
          Effect: Allow
          Resource: "arn:aws:s3:::*"
          Action:
          - "s3:ListAllMyBuckets"  
          - "s3:ListBucket"  
          - "s3:GetBucketLocation"
        - Sid: AllowS3ReadOnlyAccessToLogs
          Effect: Allow
          Resource: 
          - !Sub 'arn:aws:s3:::aws-logs-${AWS::AccountId}-${AWS::Region}/elasticmapreduce/*'
          Action:
          - "s3:GetObject" 

  EMRStudioIntermediateUserPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      Roles:
      - Ref: "EMRStudioUserRole"
      ManagedPolicyName: 
        Fn::Join: ['_', [!Ref "StudioName", "EMRStudio_Intermediate_User_Policy"]]
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Sid: AllowEMRBasicActions
          Effect: Allow
          Resource: "*"
          Action:
          - "elasticmapreduce:CreateEditor"
          - "elasticmapreduce:DescribeEditor"
          - "elasticmapreduce:ListEditors"
          - "elasticmapreduce:StartEditor"
          - "elasticmapreduce:StopEditor"
          - "elasticmapreduce:DeleteEditor"
          - "elasticmapreduce:OpenEditorInConsole"
          - "elasticmapreduce:AttachEditor"
          - "elasticmapreduce:DetachEditor"
          - "elasticmapreduce:CreateRepository"
          - "elasticmapreduce:DescribeRepository"
          - "elasticmapreduce:DeleteRepository"
          - "elasticmapreduce:ListRepositories"
          - "elasticmapreduce:LinkRepository"
          - "elasticmapreduce:UnlinkRepository"
          - "elasticmapreduce:DescribeCluster"
          - "elasticmapreduce:ListInstanceGroups"
          - "elasticmapreduce:ListBootstrapActions"
          - "elasticmapreduce:ListClusters"
          - "elasticmapreduce:ListSteps"
          - "elasticmapreduce:CreatePersistentAppUI"
          - "elasticmapreduce:DescribePersistentAppUI"
          - "elasticmapreduce:GetPersistentAppUIPresignedURL"
          - "elasticmapreduce:GetOnClusterAppUIPresignedURL"
        - Sid: AllowEMRContainersBasicActions
          Effect: Allow
          Resource: "*"
          Action: 
          - "emr-containers:DescribeVirtualCluster"
          - "emr-containers:ListVirtualClusters"
          - "emr-containers:DescribeManagedEndpoint"
          - "emr-containers:ListManagedEndpoints"
          - "emr-containers:CreateAccessTokenForManagedEndpoint"
          - "emr-containers:DescribeJobRun"
          - "emr-containers:ListJobRuns"
        - Sid: AllowSecretManagerListSecrets
          Effect: Allow
          Resource: "*"
          Action: "secretsmanager:ListSecrets"  
        - Sid: AllowSecretCreationWithEMRTagsAndEMRStudioPrefix
          Effect: Allow
          Resource: 
          - "arn:aws:secretsmanager:*:*:secret:emr-studio-*"
          Action:
          - "secretsmanager:CreateSecret"
          Condition:
            StringEquals:
              "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true"
        - Sid: AllowAddingTagsOnSecretsWithEMRStudioPrefix
          Effect: Allow
          Resource: 
          - "arn:aws:secretsmanager:*:*:secret:emr-studio-*"
          Action:
          - "secretsmanager:TagResource"
        - Sid: AllowPassingServiceRoleForWorkspaceCreation
          Effect: Allow
          Resource: 
          - !GetAtt EMRStudioServiceRole.Arn
          Action: "iam:PassRole"  
        - Sid: AllowS3ListAndLocationPermissions
          Effect: Allow
          Resource: "arn:aws:s3:::*"
          Action:
          - "s3:ListAllMyBuckets"  
          - "s3:ListBucket"  
          - "s3:GetBucketLocation"
        - Sid: AllowS3ReadOnlyAccessToLogs
          Effect: Allow
          Resource: 
          - !Sub 'arn:aws:s3:::aws-logs-${AWS::AccountId}-${AWS::Region}/elasticmapreduce/*'
          Action:
          - "s3:GetObject"  
        - Sid: AllowClusterTemplatesRelatedIntermediateActions
          Effect: Allow
          Resource: "*"
          Action:
          - "servicecatalog:DescribeProduct"
          - "servicecatalog:DescribeProductView"
          - "servicecatalog:ListLaunchPaths"
          - "servicecatalog:DescribeProvisioningParameters"
          - "servicecatalog:ProvisionProduct"
          - "servicecatalog:SearchProducts"
          - "servicecatalog:ListProvisioningArtifacts"
          - "servicecatalog:DescribeRecord"
          - "cloudformation:DescribeStackResources"

  EMRStudioAdvancedUserPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      Roles:
      - Ref: "EMRStudioUserRole"
      ManagedPolicyName: 
        Fn::Join: ['_', [!Ref "StudioName", "EMRStudio_Advanced_User_Policy"]]
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Sid: AllowEMRBasicActions
          Effect: Allow
          Resource: "*"
          Action:
          - "elasticmapreduce:CreateEditor"
          - "elasticmapreduce:DescribeEditor"
          - "elasticmapreduce:ListEditors"
          - "elasticmapreduce:StartEditor"
          - "elasticmapreduce:StopEditor"
          - "elasticmapreduce:DeleteEditor"
          - "elasticmapreduce:OpenEditorInConsole"
          - "elasticmapreduce:AttachEditor"
          - "elasticmapreduce:DetachEditor"
          - "elasticmapreduce:CreateRepository"
          - "elasticmapreduce:DescribeRepository"
          - "elasticmapreduce:DeleteRepository"
          - "elasticmapreduce:ListRepositories"
          - "elasticmapreduce:LinkRepository"
          - "elasticmapreduce:UnlinkRepository"
          - "elasticmapreduce:DescribeCluster"
          - "elasticmapreduce:ListInstanceGroups"
          - "elasticmapreduce:ListBootstrapActions"
          - "elasticmapreduce:ListClusters"
          - "elasticmapreduce:ListSteps"
          - "elasticmapreduce:CreatePersistentAppUI"
          - "elasticmapreduce:DescribePersistentAppUI"
          - "elasticmapreduce:GetPersistentAppUIPresignedURL"
          - "elasticmapreduce:GetOnClusterAppUIPresignedURL"
        - Sid: AllowEMRContainersBasicActions
          Effect: Allow
          Resource: "*"
          Action: 
          - "emr-containers:DescribeVirtualCluster"
          - "emr-containers:ListVirtualClusters"
          - "emr-containers:DescribeManagedEndpoint"
          - "emr-containers:ListManagedEndpoints"
          - "emr-containers:CreateAccessTokenForManagedEndpoint"
          - "emr-containers:DescribeJobRun"
          - "emr-containers:ListJobRuns"
        - Sid: AllowSecretManagerListSecrets
          Effect: Allow
          Resource: "*"
          Action: "secretsmanager:ListSecrets"  
        - Sid: AllowSecretCreationWithEMRTagsAndEMRStudioPrefix
          Effect: Allow
          Resource: 
          - "arn:aws:secretsmanager:*:*:secret:emr-studio-*"
          Action:
          - "secretsmanager:CreateSecret"
          Condition:
            StringEquals:
              "aws:RequestTag/for-use-with-amazon-emr-managed-policies": "true"
        - Sid: AllowAddingTagsOnSecretsWithEMRStudioPrefix
          Effect: Allow
          Resource: 
          - "arn:aws:secretsmanager:*:*:secret:emr-studio-*"
          Action:
          - "secretsmanager:TagResource"
        - Sid: AllowPassingServiceRoleForWorkspaceCreation
          Effect: Allow
          Resource: 
          - !GetAtt EMRStudioServiceRole.Arn
          - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/EMR_DefaultRole
          - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/EMR_EC2_DefaultRole
          Action: "iam:PassRole"  
        - Sid: AllowS3ListAndLocationPermissions
          Effect: Allow
          Resource: "arn:aws:s3:::*"
          Action:
          - "s3:ListAllMyBuckets"  
          - "s3:ListBucket"  
          - "s3:GetBucketLocation"
        - Sid: AllowS3ReadOnlyAccessToLogs
          Effect: Allow
          Resource: 
          - !Sub 'arn:aws:s3:::aws-logs-${AWS::AccountId}-${AWS::Region}/elasticmapreduce/*'
          Action:
          - "s3:GetObject"  
        - Sid: AllowClusterTemplatesRelatedIntermediateActions
          Effect: Allow
          Resource: "*"
          Action:
          - "servicecatalog:DescribeProduct"
          - "servicecatalog:DescribeProductView"
          - "servicecatalog:ListLaunchPaths"
          - "servicecatalog:DescribeProvisioningParameters"
          - "servicecatalog:ProvisionProduct"
          - "servicecatalog:SearchProducts"
          - "servicecatalog:ListProvisioningArtifacts"
          - "servicecatalog:DescribeRecord"
          - "cloudformation:DescribeStackResources"
        - Sid: AllowAdvancedActions
          Effect: Allow
          Resource: "*"
          Action:
          - "elasticmapreduce:RunJobFlow"


  # Security Groups
  WorkspaceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Metadata: {Comment: 'Security group attached to workspace'}
    Properties:
      GroupName: WorkspaceSecurityGroup
      GroupDescription: Security group attached to workspace to communicate with cluster
      VpcId:
        Ref: VPC
      # needed for git
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: "0.0.0.0/0"
      Tags:
      - Key: for-use-with-amazon-emr-managed-policies
        Value: true

  EngineSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Metadata: {Comment: 'Security group attached to cluster master instance'}
    Properties:
      GroupDescription: Security group attached to cluster master to communicate with workspace
      GroupName: EngineSecurityGroup
      VpcId:
        Ref: VPC
      Tags:
      - Key: for-use-with-amazon-emr-managed-policies
        Value: true

  EngineSecurityGroupIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      Description: Allow inbound traffic to EngineSecurityGroup ( from notebook to cluster for port 18888 )
      GroupId:
        Ref: EngineSecurityGroup
      SourceSecurityGroupId:
        Ref: WorkspaceSecurityGroup
      IpProtocol: tcp
      FromPort: 18888
      ToPort: 18888

  WorkspaceSecurityGroupEgress:
    Type: AWS::EC2::SecurityGroupEgress
    Properties:
      Description: Allow outbound traffic from WorkspaceSecurityGroup ( from notebook to cluster for port 18888 )
      GroupId:
        Ref: WorkspaceSecurityGroup
      DestinationSecurityGroupId:
        Ref: EngineSecurityGroup
      IpProtocol: tcp
      FromPort: 18888
      ToPort: 18888


  # Service catalog resources for cluster templates
  ClusterTemplateLaunchRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - servicecatalog.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Description: "Launch constraint role"
      RoleName: EMRStudioClusterTemplateLaunchRole

  ClusterTemplateLaunchConstraintPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      Roles:
      - Ref: "ClusterTemplateLaunchRole"
      ManagedPolicyName: 
        Fn::Join: ['_', [!Ref "StudioName", "ClusterTemplateLaunchConstraintPolicy"]]
      PolicyDocument:
        Version: '2012-10-17'
        # Ref: https://docs.aws.amazon.com/servicecatalog/latest/adminguide/constraints-launch.html
        Statement:
        - Effect: Allow
          Resource: "*"
          Action:
          - "cloudformation:CreateStack"
          - "cloudformation:DeleteStack"
          - "cloudformation:DescribeStackEvents"
          - "cloudformation:DescribeStacks"
          - "cloudformation:GetTemplateSummary"
          - "cloudformation:SetStackPolicy"
          - "cloudformation:ValidateTemplate"
          - "cloudformation:UpdateStack"
          - "elasticmapreduce:RunJobFlow"
          - "elasticmapreduce:DescribeCluster"
          - "elasticmapreduce:TerminateJobFlows"
          - "servicecatalog:*"
          - "s3:GetObject"
        - Effect: Allow
          Resource:
          - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/EMR_DefaultRole
          - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/EMR_EC2_DefaultRole
          Action:
          - "iam:passRole"

  ClusterTemplatePortfolio:
    Type: "AWS::ServiceCatalog::Portfolio"
    Properties:
      DisplayName: "ClusterTemplatePortfolio"
      ProviderName: "emr-studio-examples"
  ClusterTemplatePortfolioPrincipalAssociationForEndUser:
    Type: "AWS::ServiceCatalog::PortfolioPrincipalAssociation"
    Properties:
      PrincipalARN: !GetAtt EMRStudioUserRole.Arn
      PortfolioId: !Ref ClusterTemplatePortfolio
      PrincipalType: IAM

  OneNodeClusterProduct:
    Type: "AWS::ServiceCatalog::CloudFormationProduct"
    Properties:
      Name: "matplotlib-cluster"
      Description: "An emr-6.2.0 cluster that has matplotlib and basemap pre-installed."
      Owner: "emr-studio-examples"
      ProvisioningArtifactParameters:
        - Description: "Matplotlib Cluster Template"
          Name: "Matplotlib Cluster Template"
          Info:
            LoadTemplateFromURL: https://gist.githubusercontent.com/dacort/14466352d025c7fcdeafda438de1384b/raw/8fd58c5f9f6414030411894ef584aed9993db01b/matplotlib-cluster.yaml
  OneNodeClusterProductPortfolioAssociation:
    Type: "AWS::ServiceCatalog::PortfolioProductAssociation"
    Properties:
      PortfolioId: !Ref ClusterTemplatePortfolio
      ProductId: !Ref OneNodeClusterProduct
  OneNodeClusterProductLaunchRoleConstraint:
    DependsOn:
      - OneNodeClusterProduct
      - ClusterTemplatePortfolio
    Type: AWS::ServiceCatalog::LaunchRoleConstraint
    Properties:
      PortfolioId: !Ref ClusterTemplatePortfolio
      ProductId: !Ref OneNodeClusterProduct
      RoleArn: !GetAtt ClusterTemplateLaunchRole.Arn

  # Network resources
  VPC:
    Properties:
      # Default CIDR block for public subnet
      CidrBlock: 172.31.0.0/16
      EnableDnsHostnames: 'true'
      Tags:
      - Key: for-use-with-amazon-emr-managed-policies
        Value: true
    Type: AWS::EC2::VPC

  VPCDHCPAssociation:
    Properties:
      DhcpOptionsId: {Ref: VPCDHCPOptions}
      VpcId: {Ref: VPC}
    Type: AWS::EC2::VPCDHCPOptionsAssociation

  VPCDHCPOptions:
    Properties:
      DomainName:
        Fn::If:
        - InUsEast1
        - ec2.internal
        - Fn::Sub: "${AWS::Region}.compute.internal"
      DomainNameServers: [AmazonProvidedDNS]
    Type: AWS::EC2::DHCPOptions

  # CIDR block for private subnets
  VpcCidrBlock1:
    Type: AWS::EC2::VPCCidrBlock
    Properties:
      VpcId: {Ref: VPC}
      CidrBlock: 172.16.0.0/16

  GatewayAttachment:
    Properties:
      InternetGatewayId: {Ref: InternetGateway}
      VpcId: {Ref: VPC}
    Type: AWS::EC2::VPCGatewayAttachment
  InternetGateway: {Type: 'AWS::EC2::InternetGateway'}
  PublicRouteTableIGWRoute:
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: {Ref: InternetGateway}
      RouteTableId: {Ref: PublicRouteTable}
    Type: AWS::EC2::Route
  PublicRouteTable:
    Properties:
      Tags:
      - Key: Name
        Value: Public Route Table
      VpcId: {Ref: VPC}
    Type: AWS::EC2::RouteTable
  PublicSubnetRouteTableAssociation:
    Properties:
      RouteTableId: {Ref: PublicRouteTable}
      SubnetId: {Ref: PublicSubnet1}
    Type: AWS::EC2::SubnetRouteTableAssociation
  PublicSubnet1:
    DependsOn: VpcCidrBlock1
    Properties:
      Tags:
        - Key: Name
          Value: PublicSubnet1
        - Key: for-use-with-amazon-emr-managed-policies
          Value: true
      VpcId: {Ref: VPC}
      MapPublicIpOnLaunch: 'true'
      AvailabilityZone:
        Fn::Select:
        - 0
        - Fn::GetAZs: {Ref: 'AWS::Region'}
      CidrBlock: 172.16.0.0/20
    Type: AWS::EC2::Subnet
  NATGateway:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt ElasticIPAddress.AllocationId
      SubnetId: !Ref PublicSubnet1
      Tags:
        - Key: Name
          Value: NAT
  ElasticIPAddress:
    Type: AWS::EC2::EIP
    Properties:
      Domain: VPC
  # private subnets
  PrivateRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      Tags:
        - Key: Name
          Value: Private Route Table
      VpcId: {Ref: VPC}
  PrivateRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: {Ref: PrivateRouteTable}
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: {Ref: NATGateway}
  PrivateSubnet1:
    DependsOn: VpcCidrBlock1
    Type: AWS::EC2::Subnet
    Properties:
      Tags:
        - Key: Name
          Value: PrivateSubnet1
        - Key: for-use-with-amazon-emr-managed-policies
          Value: true
      VpcId: {Ref: VPC}
      MapPublicIpOnLaunch: 'false'
      AvailabilityZone:
        Fn::Select:
        - 0
        - Fn::GetAZs: {Ref: 'AWS::Region'}
      CidrBlock: 172.31.0.0/20
  PrivateSubnetRouteTableAssociation1:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: {Ref: PrivateRouteTable}
      SubnetId: {Ref: PrivateSubnet1}
  PrivateSubnet2:
    DependsOn: VpcCidrBlock1
    Type: AWS::EC2::Subnet
    Properties:
      Tags:
        - Key: Name
          Value: PrivateSubnet2
        - Key: for-use-with-amazon-emr-managed-policies
          Value: true
      VpcId: {Ref: VPC}
      MapPublicIpOnLaunch: 'false'
      AvailabilityZone:
        Fn::Select:
        - 1
        - Fn::GetAZs: {Ref: 'AWS::Region'}
      CidrBlock: 172.31.16.0/20
  PrivateSubnetRouteTableAssociation2:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: {Ref: PrivateRouteTable}
      SubnetId: {Ref: PrivateSubnet2}




  TestEmrStudio:
    Type: AWS::EMR::Studio
    Properties:
        AuthMode: SSO
        DefaultS3Location: !Sub "s3://${EmrStudioStorageBucket}"
        Description: test-studio
        EngineSecurityGroupId: !Ref EngineSecurityGroup
        Name: !Ref StudioName
        ServiceRole: !GetAtt EMRStudioServiceRole.Arn
        SubnetIds: 
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2
        UserRole: !GetAtt EMRStudioUserRole.Arn
        VpcId: !Ref VPC
        WorkspaceSecurityGroupId: !Ref WorkspaceSecurityGroup

  TestStudioSessionMapping:
    Type: AWS::EMR::StudioSessionMapping
    Properties:
      IdentityName: !Ref AdminUser
      IdentityType: USER
      SessionPolicyArn: !Ref EMRStudioAdvancedUserPolicy
      StudioId: !Ref TestEmrStudio


Outputs:
  EmrStudioId:
    Value: !Ref TestEmrStudio
  EmrStudioUrl:
    Value: !GetAtt TestEmrStudio.Url
  WorkspaceSecurityGroup:
    Value: !Ref WorkspaceSecurityGroup
  EngineSecurityGroup:
    Value: !Ref EngineSecurityGroup
  EMRStudioServiceRoleArn:
    Value: !GetAtt EMRStudioServiceRole.Arn
  EMRStudioUserRoleArn:
    Value: !GetAtt EMRStudioUserRole.Arn
  EMRStudioBasicUserPolicyArn:
    Value: !Ref EMRStudioBasicUserPolicy
  EMRStudioIntermediateUserPolicyArn:
    Value: !Ref EMRStudioIntermediateUserPolicy
  EMRStudioAdvancedUserPolicyArn:
    Value: !Ref EMRStudioAdvancedUserPolicy
  ClusterTemplatePortfolio:
    Value:
      Ref: ClusterTemplatePortfolio
    Description: The Arn of ClusterTemplatePortfolio
  OneNodeClusterProduct:
    Value:
      Ref: OneNodeClusterProduct
    Description: The Arn of OneNodeClusterProduct used as example cluster template
  VPC:
    Value: !Ref VPC
  PrivateSubnet1:
    Value: !Ref PrivateSubnet1
  PrivateSubnet2:
    Value: !Ref PrivateSubnet2
  EmrStudioStorageBucket:
    Value: !Ref EmrStudioStorageBucket