nested-identity.yaml

# Copyright (c) 2020, WSO2 Inc. (http://www.wso2.org) All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

AWSTemplateFormatVersion: '2010-09-09'
Description: WSO2 Identity Server deployment with Clustering

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Basic Configuration
        Parameters:
          - AWSAccessKeyId
          - AWSAccessKeySecret
          - DBUsername
          - DBPassword
          - KeyPairName
          - CertificateName
      - Label:
          default: Advanced Configuration
        Parameters:
          - CustomUserData
          - ElasticSearchEndpoint
          - ElasticSearchRegion
          - DB
          - DBAllocationStorage
          - DBInstanceType
          - EnvironmentName
          - WSO2InstanceType
          - JDK
          - OperatingSystem
          - PrivateSubnet1CIDR
          - PrivateSubnet2CIDR
          - PublicSubnet1CIDR
          - PublicSubnet2CIDR
          - VpcCIDR
          - BastionInstanceType
          - BastionOperatingSystem
    ParameterLabels:
      AWSAccessKeyId:
        default: AWS Access Key ID
      AWSAccessKeySecret:
        default: AWS Access Secret Key
      BastionInstanceType:
        default: Instance Type for Bastion Instance
      BastionOperatingSystem:
        default: Operating System for Bastion Instance
      CertificateName:
        default: SSL Certificate Name
      CustomUserData:
        default: Custom User Data
      DB:
        default: Database
      DBUsername:
        default: Database Username
      DBPassword:
        default: Database Password
      DBAllocationStorage:
        default: Database Allocation Storage
      DBInstanceType:
        default: Database Instance Type
      ElasticSearchEndpoint:
        default: ElasticSearch Endpoint
      ElasticSearchRegion:
        default: ElasticSearch Region
      EnvironmentName:
        default: Environment Name
      JDK:
        default: JDK
      KeyPairName:
        default: Key Pair Name
      OperatingSystem:
        default: Operating System
      PrivateSubnet1CIDR:
        default: Private Subnet 1 CIDR
      PrivateSubnet2CIDR:
        default: Private Subnet 2 CIDR
      PublicSubnet1CIDR:
        default: Public Subnet 1 CIDR
      PublicSubnet2CIDR:
        default: Public Subnet 2 CIDR
      VpcCIDR:
        default: VPC CIDR
      WSO2InstanceType:
        default: Instance type for Identity Server deployment

Parameters:
  AWSAccessKeyId:
    Type: String

  AWSAccessKeySecret:
    Type: String

  CertificateName:
    Description: A valid SSL certificate used for HTTPS
    Type: String
    MinLength: 1

  CustomUserData:
    Type: String
    Default: "echo"

  DBUsername:
    Type: String
    MinLength: 4
    AllowedPattern: '[A-Za-z0-9\-]+'

  DBPassword:
    Type: String
    MinLength: 8
    NoEcho: true

  DBAllocationStorage:
    Description: Provide storage size in Gigabytes
    Type: Number
    Default: 200

  DBInstanceType:
    Type: String
    Default: db.t2.medium
    AllowedValues:
      - db.t2.medium
      - db.t2.large
      - db.t2.xlarge
      - db.t2.2xlarge
      - db.m3.medium
      - db.m3.large
      - db.m3.xlarge
      - db.m3.2xlarge
      - db.m4.large
      - db.m4.xlarge

  DB:
    Description: Choose preffered Database from the list
    Type: String
    Default: MySQL-5.7
    AllowedValues:
      - MySQL-5.7
      - Postgres-9.6
      - Postgres-10.5
      - Oracle-SE1-11.2
      - Oracle-SE2-12.1
      - SQLServer-SE-13.00
      - SQLServer-SE-14.00

  ElasticSearchEndpoint:
    Description: If you have ElasticSearch endpoint to publish logs, else keep this empty
    Type: String
    Default: ""

  ElasticSearchRegion:
    Type: String
    Default: "us-east-1"
    AllowedValues:
      - "us-east-1"
      - "us-east-2"
      - "us-west-1"
      - "us-west-2"
      - "ap-southeast-2"
      - "eu-west-1"

  EnvironmentName:
    Description: An environment name that is prefixed to resource names
    Type: String
    Default: Dev

  JDK:
    Description: Choose preffered JDK from the list
    Type: String
    Default: "OPEN_JDK8"
    AllowedValues:
      - "OPEN_JDK8"
      - "ORACLE_JDK8"
      - "CORRETTO_JDK8"
      - "ADOPT_OPEN_JDK11"

  VpcCIDR:
    Description: Please enter the IP range (CIDR notation) for this VPC
    Type: String
    Default: 10.0.0.0/16

  PublicSubnet1CIDR:
    Description: IP range (CIDR notation) for the public subnet in the first Availability Zone
    Type: String
    Default: 10.0.254.0/24

  PublicSubnet2CIDR:
    Description: IP range (CIDR notation) for the public subnet in the second Availability Zone
    Type: String
    Default: 10.0.252.0/24

  PrivateSubnet1CIDR:
    Description: IP range (CIDR notation) for the private subnet in the first Availability Zone
    Type: String
    Default: 10.0.1.0/24

  PrivateSubnet2CIDR:
    Description: IP range (CIDR notation) for the private subnet in the second Availability Zone
    Type: String
    Default: 10.0.2.0/24

  KeyPairName:
    Description: The private key used to log in to instances through SSH
    Type: AWS::EC2::KeyPair::KeyName

  BastionInstanceType:
    Description: Instance Type for the Bastion Instance
    Type: String
    Default: t2.micro
    AllowedValues:
      - t2.micro
      - t2.medium
      - t2.large
    ConstraintDescription: Must be a valid EC2 instance type

  BastionOperatingSystem:
    Description: Operating System for Bastion Instance
    Type: String
    Default: Ubuntu1804
    AllowedValues:
      - Ubuntu1804
      - CentOS7

  OperatingSystem:
    Description: Operating System for Identity Server deployment
    Type: String
    Default: Ubuntu1804
    AllowedValues:
      - Ubuntu1804
      - CentOS7

  WSO2InstanceType:
    Description: Choose Instance type for Identity Server deployment from the list
    Type: String
    Default: t2.medium
    AllowedValues:
      - t2.medium
      - t2.large
      - t2.xlarge
      - t2.2xlarge
      - m3.medium
      - m3.large
      - m3.xlarge
      - m3.2xlarge
      - m4.large
    ConstraintDescription: Must be a valid EC2 instance type

Resources:
  WSO2Network:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://aws-nested-cloudformation-iam.s3.amazonaws.com/wso2is-5.11.0/network.yaml
      TimeoutInMinutes: '60'
      Parameters:
        EnvironmentName: !Ref EnvironmentName
        VpcCIDR: !Ref VpcCIDR
        PublicSubnet1CIDR: !Ref PublicSubnet1CIDR
        PublicSubnet2CIDR: !Ref PublicSubnet2CIDR
        PrivateSubnet1CIDR: !Ref PrivateSubnet1CIDR
        PrivateSubnet2CIDR: !Ref PrivateSubnet2CIDR
        KeyPairName: !Ref KeyPairName
        BastionInstanceType: !Ref BastionInstanceType
        OperatingSystem: !Ref BastionOperatingSystem
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName} WSO2Network

  Database:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://aws-nested-cloudformation-iam.s3.amazonaws.com/wso2is-5.11.0/database.yaml
      TimeoutInMinutes: '60'
      Parameters:
        DBUsername: !Ref DBUsername
        DBPassword: !Ref DBPassword
        DB: !Ref DB
        DBAllocationStorage: !Ref DBAllocationStorage
        DBInstanceType: !Ref DBInstanceType
        EnvironmentName: !Ref EnvironmentName
        WSO2VPC: !GetAtt WSO2Network.Outputs.VPC
        WSO2PrivateSubnet1: !GetAtt WSO2Network.Outputs.PrivateSubnet1
        WSO2PrivateSubnet2: !GetAtt WSO2Network.Outputs.PrivateSubnet2
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName} WSO2Database

  WSO2IdentityServerSetup:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://aws-nested-cloudformation-iam.s3.amazonaws.com/wso2is-5.11.0/identity.yaml
      TimeoutInMinutes: '60'
      Parameters:
        AWSAccessKeyId: !Ref AWSAccessKeyId
        AWSAccessKeySecret: !Ref AWSAccessKeySecret
        CertificateName: !Ref CertificateName
        CustomUserData: !Ref CustomUserData
        DBUsername: !Ref DBUsername
        DBPassword: !Ref DBPassword
        DB: !Ref DB
        ElasticSearchEndpoint: !Ref ElasticSearchEndpoint
        ElasticSearchRegion: !Ref ElasticSearchRegion
        EnvironmentName: !Ref EnvironmentName
        JDK: !Ref JDK
        KeyPairName: !Ref KeyPairName
        OperatingSystem: !Ref OperatingSystem
        WSO2ISDBInstanceEndpointAddress: !GetAtt Database.Outputs.WSO2ISDBInstanceEndpointAddress
        WSO2ISDBInstanceEndpointPort: !GetAtt Database.Outputs.WSO2ISDBInstanceEndpointPort
        WSO2InstanceType: !Ref WSO2InstanceType
        WSO2ISVPC: !GetAtt WSO2Network.Outputs.VPC
        WSO2ISPrivateSubnet1: !GetAtt WSO2Network.Outputs.PrivateSubnet1
        WSO2ISPrivateSubnet2: !GetAtt WSO2Network.Outputs.PrivateSubnet2
        WSO2ISPublicSubnet1: !GetAtt WSO2Network.Outputs.PublicSubnet1
        WSO2ISPublicSubnet2: !GetAtt WSO2Network.Outputs.PublicSubnet2
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName} WSO2IdentityServerSetup

Outputs:
  MgtConsoleUrl:
    Value: !GetAtt WSO2IdentityServerSetup.Outputs.MgtConsoleUrl
    Description: Identity Server Management Console URL
  CarbonServerUrl:
    Value: !GetAtt WSO2IdentityServerSetup.Outputs.CarbonServerUrl
    Description: Carbon Server URL
  ISHttpUrl:
    Value: !GetAtt WSO2IdentityServerSetup.Outputs.ISHttpUrl
    Description: IS HTTP Gateway endpoint
  ISHttpsUrl:
    Value: !GetAtt WSO2IdentityServerSetup.Outputs.ISHttpsUrl
    Description: IS HTTPS Gateway endpoint

  WSO2ISDBInstanceEndpointAddress:
    Value: !GetAtt Database.Outputs.WSO2ISDBInstanceEndpointAddress
    Description: Identity Server DB Instance Endpoint Address
    Export:
      Name: WSO2ISDBInstanceEndpointAddress

  WSO2ISDBInstanceEndpointPort:
    Value: !GetAtt Database.Outputs.WSO2ISDBInstanceEndpointPort
    Description: Identity Server DB Instance Endpoint Port
    Export:
      Name: WSO2ISDBInstanceEndpointPort

  PrivateSubnet1:
    Value: !GetAtt WSO2Network.Outputs.PrivateSubnet1
    Description: Private Subnet for PuppetMaster, Prodcut Instance, EFS and the DB
    Export:
      Name: PrivateSubnet1

  PrivateSubnet2:
    Value: !GetAtt WSO2Network.Outputs.PrivateSubnet2
    Description: Private Subnet for Prodcut Instance and the DB
    Export:
      Name: PrivateSubnet2

  PublicSubnet1:
    Value: !GetAtt WSO2Network.Outputs.PublicSubnet1
    Description: Public Subnet for NAT Gateway, Bastion Instance and Load Balancer
    Export:
      Name: PublicSubnet1

  PublicSubnet2:
    Value: !GetAtt WSO2Network.Outputs.PublicSubnet2
    Description: Public Subnet for Load Balancer
    Export:
      Name: PublicSubnet2

  VPC:
    Value: !GetAtt WSO2Network.Outputs.VPC
    Description: VPC
    Export:
      Name: WSO2VPC