directory.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: SSB managed CloudFormation template for identity related resources.

Parameters: 

  KeyName: 
    Description: Select an existing EC2 KeyPair
    Type: AWS::EC2::KeyPair::KeyName
    ConstraintDescription: must be the name of an existing EC2 KeyPair.

  AdminPwd: 
    Description: Password for the domain admin user. Must be at least 12 characters containing letters, numbers and symbols.
    Type: String
    MinLength: 12
    AllowedPattern: (?=^.{6,255}$)((?=.*\\d)(?=.*[A-Z])(?=.*[a-z])|(?=.*\\d)(?=.*[^A-Za-z0-9])(?=.*[a-z])|(?=.*[^A-Za-z0-9])(?=.*[A-Z])(?=.*[a-z])|(?=.*\\d)(?=.*[A-Z])(?=.*[^A-Za-z0-9]))^.*
    NoEcho: true

  AdminInstanceToggle:
    Description: Toggle the Windows instance for AD administration. On=Create/Keep, Off=Remove/Skip
    Type: String
    AllowedValues:
      - On
      - Off 
      
  AdminInstanceImageId:
    Description: AMI ID used to create the Admin Windows instance
    Default: /aws/service/ami-windows-latest/Windows_Server-2019-English-Full-Base
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>

  VpcId:
    Type: AWS::EC2::VPC::Id

  PrivateSubnet1Id:
    Type: AWS::EC2::Subnet::Id
  
  PrivateSubnet2Id:
    Type: AWS::EC2::Subnet::Id

  PublicSubnet1Id:
    Type: AWS::EC2::Subnet::Id

  DirectoryType:
    Type: String
    AllowedValues:
      - Samba
      - Microsoft

  DirectoryName:
    Type: String
  
  DirectoryAlias:
    Type: String

Conditions:
  CreateAdminInstance: !Equals [ !Ref AdminInstanceToggle, On ]
  CreateSambaDirectory: !Equals [ !Ref DirectoryType, Samba ]
  CreateMicrosoftDirectory: !Equals [ !Ref DirectoryType, Microsoft ]

Resources:
  LogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      RetentionInDays: 180

  AdminInstanceProfile:
    Type: 'AWS::IAM::InstanceProfile'
    Condition: CreateAdminInstance
    Properties:
      Roles:
        - !Ref SSMRole

  SSMRole:
    Type: AWS::IAM::Role
    Condition: CreateAdminInstance
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
        - arn:aws:iam::aws:policy/AmazonSSMDirectoryServiceAccess 
  
  SsmDocument:
    Type: "AWS::SSM::Document"
    Condition: CreateAdminInstance
    DependsOn: AdminInstanceProfile
    Properties:
      Content:
        schemaVersion: "1.2"
        description: "Join instances to an AWS Directory Service domain."
        parameters:
          directoryId:
            type: "String"
            description: "(Required) The ID of the AWS Directory Service directory."
          directoryName:
            type: "String"
            description: "(Required) The name of the directory; for example, test.example.com"
          dnsIpAddresses:
            type: "StringList"
            default: []
            description: "(Optional) The IP addresses of the DNS servers in the directory. Required when DHCP is not configured. Learn more at http://docs.aws.amazon.com/directoryservice/latest/simple-ad/join_get_dns_addresses.html"
            allowedPattern: "((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)"
        runtimeConfig:
          aws:domainJoin:
            properties:
              directoryId: "{{ directoryId }}"
              directoryName: "{{ directoryName }}"
              dnsIpAddresses: "{{ dnsIpAddresses }}"        
  
  AdminSG: 
    Type: AWS::EC2::SecurityGroup
    Condition: CreateAdminInstance
    Properties: 
      GroupDescription: "Allow RDP access to the Windows Admin instance for AD"
      VpcId: !Ref VpcId

  AdminInstance: 
    Type: AWS::EC2::Instance
    Condition: CreateAdminInstance
    Metadata: 
      AWS::CloudFormation::Init: 
        config: 
          files:
            c:\\cfn\\cfn-hup.conf: 
              content: !Sub | 
                [main]
                stack=${AWS::StackId}
                region=${AWS::Region}
            c:\\cfn\\hooks.d\\cfn-auto-reloader.conf: 
              content: !Sub | 
                [cfn-auto-reloader-hook]
                triggers=post.update
                path=Resources.AdminInstance.Metadata.AWS::CloudFormation::Init
                action=cfn-init.exe -v -s ${AWS::StackId} -r AdminInstance --region ${AWS::Region}
                
          commands:
            1-install-rsat:
              command: if not \"None\" EQU \"RSAT-AD-Tools\" (powershell.exe -ExecutionPolicy Unrestricted Install-WindowsFeature -name RSAT-AD-Tools -IncludeAllSubFeature)
              waitAfterCompletion: '1'
            2-install-rsat-dns:
              command: if not \"None\" EQU \"RSAT-DNS-Server\" (powershell.exe -ExecutionPolicy Unrestricted Install-WindowsFeature -name RSAT-DNS-Server -IncludeAllSubFeature)
              waitAfterCompletion: '1'
            3-Enable-SSM:
              command: 'powershell.exe -ExecutionPolicy UnRestricted -Command "Set-Service -Name AmazonSSMAgent -StartupType Automatic"'
              waitAfterCompletion: '1'            
            4-restartSSM:
              command: 'powershell.exe -ExecutionPolicy UnRestricted -Command "Restart-Service AmazonSSMAgent"'
              waitAfterCompletion: '2'               
            5-signal-success:
              command: !Join
                - ''
                - - cfn-signal.exe -e %ERRORLEVEL% "
                  - !Base64
                    Ref: AdminInstanceWaitHandle
                  - '"'
              
          services: 
            windows: 
              cfn-hup: 
                enabled: true
                ensureRunning: true
                files: 
                  - c:\\cfn\\cfn-hup.conf
                  - c:\\cfn\\hooks.d\\cfn-auto-reloader.conf
          
    Properties: 
      IamInstanceProfile: !Ref AdminInstanceProfile
      InstanceType: t2.medium
      ImageId: !Ref AdminInstanceImageId
      SubnetId: !Ref PublicSubnet1Id
      
      SecurityGroupIds:
        - !GetAtt AdminSG.GroupId
      KeyName: !Ref KeyName
      # SsmAssociations:
      #   -
      #     DocumentName: !Ref SsmDocument
      #     AssociationParameters:
      #       -
      #         Key: "directoryId"
      #         Value: 
      #           - !If
      #             - CreateMicrosoftDirectory
      #             - !Ref MicrosoftAD1
      #             - !Ref SimpleAD1
      #       -
      #         Key: "directoryName"
      #         Value: 
      #           - !Ref DirectoryName
      #       -
      #         Key: "dnsIpAddresses"
      #         Value: 
      #           - !If
      #             - CreateMicrosoftDirectory
      #             - !GetAtt MicrosoftAD1.DnsIpAddresses  
      #             - !GetAtt SimpleAD1.DnsIpAddresses
      UserData:
        Fn::Base64:
          !Sub |
            <script>
            cfn-init.exe -v -s ${AWS::StackId} -r AdminInstance --region ${AWS::Region}
            </script>
      Tags:
        - 
          Key: "Name"
          Value: !Join [ "", [ Admin@, !Ref DirectoryName ] ]
      
  AdminInstanceWaitHandle: 
    Type: AWS::CloudFormation::WaitConditionHandle
    Condition: CreateAdminInstance
    
  AdminInstanceWaitCondition: 
    Type: AWS::CloudFormation::WaitCondition
    Condition: CreateAdminInstance
    DependsOn: AdminInstance
    Properties:
      Handle: !Ref AdminInstanceWaitHandle
      Timeout: 1800

  MicrosoftAD1: 
    Type: AWS::DirectoryService::MicrosoftAD
    Condition: CreateMicrosoftDirectory
    Properties: 
      Edition: Standard
      Name: !Ref DirectoryName
      Password: !Ref AdminPwd
      ShortName: !Ref DirectoryAlias
      VpcSettings: 
        SubnetIds:
          - !Ref PrivateSubnet1Id
          - !Ref PrivateSubnet2Id
        VpcId: !Ref VpcId

  SimpleAD1:
    Type: AWS::DirectoryService::SimpleAD
    Condition: CreateSambaDirectory
    Properties:
      Size: Small
      Name: !Ref DirectoryName
      Password: !Ref AdminPwd
      ShortName: !Ref DirectoryAlias
      VpcSettings: 
        SubnetIds:
          - !Ref PrivateSubnet1Id
          - !Ref PrivateSubnet2Id
        VpcId: !Ref VpcId