create_rds_psql_instance_cfn.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: Create complete RDS PostgreSQL testing environment with VPC, NAT
  Gateway, and all required components

Parameters:
  RDSMasterUsername:
    Type: String
    Description: Username for RDS master user
    NoEcho: true
    MinLength: 1
    MaxLength: 16
    AllowedPattern: ^[a-zA-Z][a-zA-Z0-9]*$
    ConstraintDescription: Must begin with a letter and contain only alphanumeric characters

  EnvironmentName:
    Type: String
    Default: rds-patch-test-env
    Description: Environment name prefix for resources

  VpcCIDR:
    Type: String
    Default: 10.20.0.0/16
    Description: CIDR block for VPC

  PublicSubnet1CIDR:
    Type: String
    Default: 10.20.1.0/24
    Description: CIDR block for public subnet 1

  PrivateSubnet1CIDR:
    Type: String
    Default: 10.20.2.0/24
    Description: CIDR block for private subnet 1

  PrivateSubnet2CIDR:
    Type: String
    Default: 10.20.3.0/24
    Description: CIDR block for private subnet 2

  BucketNamePrefix:
    Type: String
    Default: rds-patch-test-scripts
    Description: Prefix for S3 bucket name

  LatestAmiId:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-6.1-x86_64

  SnsEmailAddress:
    Type: String
    Description: Email address for SNS topic subscription
    AllowedPattern: ^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$
    ConstraintDescription: Must be a valid email address

Resources:
  # VPC and Networking Components
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCIDR
      EnableDnsHostnames: true
      EnableDnsSupport: true
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-VPC

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-IGW

  InternetGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref VPC

  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select
        - 0
        - !GetAZs ''
      CidrBlock: !Ref PublicSubnet1CIDR
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-PublicSubnet1

  PrivateSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select
        - 0
        - !GetAZs ''
      CidrBlock: !Ref PrivateSubnet1CIDR
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-PrivateSubnet1

  PrivateSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select
        - 1
        - !GetAZs ''
      CidrBlock: !Ref PrivateSubnet2CIDR
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-PrivateSubnet2

  # NAT Gateway Configuration
  NatGatewayEIP:
    Type: AWS::EC2::EIP
    DependsOn: InternetGatewayAttachment
    Properties:
      Domain: vpc

  NatGateway:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt NatGatewayEIP.AllocationId
      SubnetId: !Ref PublicSubnet1
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-NatGW

  # Route Tables
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-PublicRT

  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: InternetGatewayAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  PublicSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref PublicSubnet1

  PrivateRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-PrivateRT

  PrivateRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway

  PrivateSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateRouteTable
      SubnetId: !Ref PrivateSubnet1

  PrivateSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateRouteTable
      SubnetId: !Ref PrivateSubnet2

  # Security Groups
  EC2SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for EC2 instance
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: !Ref VpcCIDR
          Description: Management access
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: !Ref VpcCIDR
          Description: Management access
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0
          Description: Allow HTTPS outbound for SSM
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
          Description: Allow HTTP outbound for package updates
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-EC2-SG

  RDSSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for RDS instance
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 5432
          ToPort: 5432
          SourceSecurityGroupId: !Ref EC2SecurityGroup
          Description: DB access
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 0
          ToPort: 65535
          CidrIp: 0.0.0.0/0
          Description: Outbound access
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-RDS-SG

  # SNS Topic
  RdsUpgradeTestSnsTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: !Sub ${EnvironmentName}-RdsUpgradeTestSnsTopic
      KmsMasterKeyId: alias/aws/sns

  RdsUpgradeTestSnsTopicPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties:
      PolicyDocument:
        Statement:
          - Sid: DenyInsecure
            Effect: Deny
            Principal: '*'
            Action: 'sns:Publish'
            Condition:
              Bool:
                'aws:SecureTransport': false
            Resource:
              - !Ref RdsUpgradeTestSnsTopic
      Topics:
        - !Ref RdsUpgradeTestSnsTopic

  RdsUpgradeTestSnsSubscription:
    Type: AWS::SNS::Subscription
    Properties:
      TopicArn: !Ref RdsUpgradeTestSnsTopic
      Protocol: email
      Endpoint: !Ref SnsEmailAddress


  # S3 Bucket
  S3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${BucketNamePrefix}-${AWS::Region}-${AWS::AccountId}
      VersioningConfiguration:
        Status: Enabled
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
  S3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref S3Bucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          Sid: DenyInsecureAccess
          Action: "*"
          Effect: Deny
          Resource:
            - !Sub arn:aws:s3:::${S3Bucket}
            - !Sub arn:aws:s3:::${S3Bucket}/*
          Condition:
            Bool:
              "aws:SecureTransport": false
          Principal: "*"

  # IAM Roles and Policies
  InstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
      Policies:
        - PolicyName: RDSUpgradeInstancePolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - rds:DescribeDBEngineVersions
                  - rds:DescribeOrderableDBInstanceOptions
                Resource: '*'
              - Effect: Allow
                Action:
                  - rds:DescribeDBInstances
                  - rds:ModifyDBInstance
                  - rds:RebootDBInstance
                  - rds:CreateDBSnapshot
                  - rds:DescribeDBSnapshots
                  - rds:DescribeDBEngineVersions
                  - rds:DescribeOrderableDBInstanceOptions
                  - rds:DescribeDBParameterGroups
                  - rds:CreateDBParameterGroup
                  - rds:ModifyDBParameterGroup
                  - rds:DescribeDBParameters
                  - rds:DescribePendingMaintenanceActions
                  - rds:ApplyPendingMaintenanceAction
                  - rds:AddTagsToResource
                  - rds:ListTagsForResource
                Resource:
                  - !Sub arn:aws:rds:${AWS::Region}:${AWS::AccountId}:db:*
                  - !Sub arn:aws:rds:${AWS::Region}:${AWS::AccountId}:pg:*
                  - !Sub arn:aws:rds:${AWS::Region}:${AWS::AccountId}:snapshot:*
              - Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:ListBucket
                Resource:
                  - !Sub arn:aws:s3:::${S3Bucket}
                  - !Sub arn:aws:s3:::${S3Bucket}/*
              - Effect: Allow
                Action:
                  - sns:Publish
                Resource: !Ref RdsUpgradeTestSnsTopic
              - Effect: Allow
                Action:
                  - secretsmanager:GetSecretValue
                Resource:
                  - !Sub arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:rds*

  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - !Ref InstanceRole

  # EC2 Instance
  ToolsInstance:
    Type: AWS::EC2::Instance
    Properties:
      EbsOptimized: true
      IamInstanceProfile: !Ref InstanceProfile
      ImageId: !Ref LatestAmiId
      InstanceType: t3.micro
      SecurityGroupIds:
        - !Ref EC2SecurityGroup
        - !Ref RDSSecurityGroup
      SubnetId: !Ref PrivateSubnet1
      UserData: !Base64
        Fn::Sub: |
          #!/bin/bash
          yum update -y
          yum install -y postgresql15 jq awscli
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-ToolsInstance

  # RDS Components
  RDSSubnetGroup:
    Type: AWS::RDS::DBSubnetGroup
    Properties:
      DBSubnetGroupDescription: RDS VPC Subnet Group
      SubnetIds:
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-DBSubnetGroup

  RDSParameterGroup:
    Type: AWS::RDS::DBParameterGroup
    Properties:
      Family: postgres14
      Description: RDS PostgreSQL parameter group
      Parameters:
        rds.force_ssl: 1
        rds.logical_replication: 1
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-DBParameterGroup

  RDSInstance:
    Type: AWS::RDS::DBInstance
    Properties:
      DBInstanceIdentifier: !Sub ${EnvironmentName}-postgres
      DBInstanceClass: db.t3.micro
      Engine: postgres
      EngineVersion: '14.12'
      MasterUsername: !Ref RDSMasterUsername
      ManageMasterUserPassword: true
      DBParameterGroupName: !Ref RDSParameterGroup
      AllocatedStorage: 200
      BackupRetentionPeriod: 7
      DeletionProtection: false
      PubliclyAccessible: false
      MultiAZ: true
      VPCSecurityGroups:
        - !Ref RDSSecurityGroup
      DBSubnetGroupName: !Ref RDSSubnetGroup
      DBName: rdspatch
      StorageEncrypted: true
      AutoMinorVersionUpgrade: false
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-RDSInstance
        - Key: UpgradeDB
          Value: Y
        - Key: rds-maintenance-user-secret
          Value: !Sub ${EnvironmentName}-postgres-maintenance-user-secret

  MaintenanceUserSecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: !Sub ${EnvironmentName}-postgres-maintenance-user-secret
      Description: "Maintenance user credentials for PostgreSQL RDS instance"
      GenerateSecretString:
        SecretStringTemplate: '{"username": "rds_maintenance_user"}'
        GenerateStringKey: "password"
        PasswordLength: 18
        ExcludeCharacters: '"@/\'''
        ExcludePunctuation: true


  # Gateway endpoint for the  script S3 endpoint
  S3GatewayEndpoint:
    Type: 'AWS::EC2::VPCEndpoint'
    Properties:
      VpcEndpointType: 'Gateway'
      VpcId: !Ref VPC
      ServiceName: !Sub 'com.amazonaws.${AWS::Region}.s3'
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal: '*'
            Action:
              - s3:PutObject
              - s3:GetObject
              - s3:ListBucket
            Resource:
              - !Sub 'arn:aws:s3:::${BucketNamePrefix}-${AWS::Region}-${AWS::AccountId}/*'
              - !Sub 'arn:aws:s3:::${BucketNamePrefix}-${AWS::Region}-${AWS::AccountId}'
          # Gateway endpoint for the AmazonLinux yum repository S3 bucket
          - Effect: Allow
            Principal: '*'
            Action:
              - s3:GetObject
            Resource:
              - !Sub 'arn:aws:s3:::al2023-repos-${AWS::Region}-de612dc2/*'
      RouteTableIds:
        - !Ref PrivateRouteTable

  # VPC Endpoint Security Group
  VPCEndpointSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for VPC Endpoints
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: !Ref VpcCIDR
          Description: HTTPS from VPC CIDR
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-VPCEndpoint-SG
  # SSM VPC Endpoints
  SSMEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref VPC
      ServiceName: !Sub com.amazonaws.${AWS::Region}.ssm
      VpcEndpointType: Interface
      PrivateDnsEnabled: true
      SubnetIds:
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2
      SecurityGroupIds:
        - !Ref VPCEndpointSecurityGroup

  SSMMessagesEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref VPC
      ServiceName: !Sub com.amazonaws.${AWS::Region}.ssmmessages
      VpcEndpointType: Interface
      PrivateDnsEnabled: true
      SubnetIds:
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2
      SecurityGroupIds:
        - !Ref VPCEndpointSecurityGroup

  EC2MessagesEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref VPC
      ServiceName: !Sub com.amazonaws.${AWS::Region}.ec2messages
      VpcEndpointType: Interface
      PrivateDnsEnabled: true
      SubnetIds:
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2
      SecurityGroupIds:
        - !Ref VPCEndpointSecurityGroup


Outputs:
  VpcId:
    Description: VPC ID
    Value: !Ref VPC

  PublicSubnet1:
    Description: Public Subnet 1 ID
    Value: !Ref PublicSubnet1

  PrivateSubnet1:
    Description: Private Subnet 1 ID
    Value: !Ref PrivateSubnet1

  PrivateSubnet2:
    Description: Private Subnet 2 ID
    Value: !Ref PrivateSubnet2

  NatGatewayId:
    Description: NAT Gateway ID
    Value: !Ref NatGateway

  NatGatewayEIP:
    Description: NAT Gateway Elastic IP
    Value: !Ref NatGatewayEIP

  S3BucketName:
    Description: S3 Bucket Name
    Value: !Ref S3Bucket

  SnsTopicArn:
    Description: SNS Topic ARN
    Value: !Ref RdsUpgradeTestSnsTopic

  EC2InstanceId:
    Description: EC2 Instance ID
    Value: !Ref ToolsInstance

  RDSEndpoint:
    Description: RDS Instance Endpoint
    Value: !GetAtt RDSInstance.Endpoint.Address

  RDSPort:
    Description: RDS Instance Port
    Value: !GetAtt RDSInstance.Endpoint.Port

  RDSInstanceId:
    Description: RDS Instance ID
    Value: !Ref RDSInstance
  
  MaintenanceUserSecretArn:
    Description: ARN of the maintenance user secret
    Value: !Ref MaintenanceUserSecret