Prod.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: EKS with ALB 

Resources:
  # VPC
  ProdVpc:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.2.0.0/24
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: Prod-Vpc

  # Public Subnet
  ProdVpcPublicSubnetA:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref ProdVpc
      CidrBlock: 10.2.0.0/26
      AvailabilityZone: ap-northeast-2a
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: Prod-Vpc-Public-SubnetA
  ProdVpcPublicSubnetB:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref ProdVpc
      CidrBlock: 10.2.0.64/26
      AvailabilityZone: ap-northeast-2b
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: Prod-Vpc-Public-SubnetB

  # EKS Private Subnets
  ProdVpcPrivateSubnetA:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref ProdVpc
      CidrBlock: 10.2.0.128/27
      AvailabilityZone: ap-northeast-2a
      Tags:
        - Key: Name
          Value: Prod-Vpc-Private-SubnetA

  ProdVpcPrivateSubnetB:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref ProdVpc
      CidrBlock: 10.2.0.160/27
      AvailabilityZone: ap-northeast-2b
      Tags:
        - Key: Name
          Value: Prod-Vpc-Private-SubnetB

  # RDS Private Subnets
  ProdVpcPrivateDBSubnetA:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref ProdVpc
      CidrBlock: 10.2.0.192/27
      AvailabilityZone: ap-northeast-2a
      Tags:
        - Key: Name
          Value: ProdVpc-Private-DB-Subnet-A

  ProdVpcPrivateDBSubnetB:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref ProdVpc
      CidrBlock: 10.2.0.224/27
      AvailabilityZone: ap-northeast-2b
      Tags:
        - Key: Name
          Value: ProdVpc-Private-DB-Subnet-B

  # Internet Gateway
  ProdIgw:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: Prod-Igw

  AttachIGW:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref ProdVpc
      InternetGatewayId: !Ref ProdIgw

  # NAT Gateway
  NatEIP:
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc

  ProdNgw:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt NatEIP.AllocationId  
      SubnetId: !Ref  ProdVpcPublicSubnetA
      Tags:
        - Key: Name
          Value: Prod-Ngw

  # Route Tables
  ## public route
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref ProdVpc
      Tags:
        - Key: Name
          Value: Public-Route-Table

  PublicRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref ProdIgw

  AssociatePublicSubnetA:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref  ProdVpcPublicSubnetA
      RouteTableId: !Ref PublicRouteTable

  AssociatePublicSubnetB:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref ProdVpcPublicSubnetB
      RouteTableId: !Ref PublicRouteTable

  ## Private route
  ProdPrivateRouteTableA:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref ProdVpc
      Tags:
        - Key: Name
          Value: Prod-Private-Route-Table-A

  PrivateRouteA:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref ProdPrivateRouteTableA
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref ProdNgw

  ProdPrivateRouteTableB:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref ProdVpc
      Tags:
        - Key: Name
          Value: Prod-Private-Route-Table-B

  PrivateRouteB:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref ProdPrivateRouteTableB
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref ProdNgw

  AssociatePrivateSubnetA:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref ProdVpcPrivateSubnetA
      RouteTableId: !Ref ProdPrivateRouteTableA

  AssociatePrivateSubnetB:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref ProdVpcPrivateSubnetB
      RouteTableId: !Ref ProdPrivateRouteTableB

  ## RDS route
  ProdPrivateDBRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref ProdVpc
      Tags:
        - Key: Name
          Value: Prod-Private-DB-Route-Table

  RDSAssociatePrivateSubnetA:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref ProdVpcPrivateDBSubnetA
      RouteTableId: !Ref ProdPrivateDBRouteTable

  RDSAssociatePrivateSubnetB:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref ProdVpcPrivateDBSubnetB
      RouteTableId: !Ref ProdPrivateDBRouteTable

  # Security Group
  ## 1. Bastion security group
  ProdBastionSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: "Allow SSH access to Bastion and HTTP/HTTPS to ALB"
      VpcId: !Ref ProdVpc
      SecurityGroupIngress:
        - IpProtocol: "tcp"
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0  # bastion ssh allow
      SecurityGroupEgress:
        - IpProtocol: "-1"
          CidrIp: 0.0.0.0/0
      Tags:
        - Key: Name
          Value: Prod-Bastion-Security-Group

  ## 2. ALB Security group
  ProdALBSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: "Allow HTTP/HTTPS access from Bastion and forward to EKS"
      VpcId: !Ref ProdVpc
      SecurityGroupIngress:
        - IpProtocol: "tcp"
          FromPort: 80
          ToPort: 80
          SourceSecurityGroupId: !Ref ProdBastionSecurityGroup  # bastion allow
        - IpProtocol: "tcp"
          FromPort: 443
          ToPort: 443
          SourceSecurityGroupId: !Ref ProdBastionSecurityGroup
      SecurityGroupEgress:
        - IpProtocol: "-1"
          CidrIp: 0.0.0.0/0  # backend fowrding allow
      Tags:
        - Key: Name
          Value: Prod-ALB-Security-Group

  ## 3. EKS Backend Security group
  ProdBackendSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: "Allow traffic only from ALB and access to RDS"
      VpcId: !Ref ProdVpc
      SecurityGroupIngress:
        - IpProtocol: "tcp"
          FromPort: 80
          ToPort: 80
          SourceSecurityGroupId: !Ref ProdALBSecurityGroup  # ALB allow
        - IpProtocol: "tcp"
          FromPort: 443
          ToPort: 443
          SourceSecurityGroupId: !Ref ProdALBSecurityGroup
        - IpProtocol: "tcp"
          FromPort: 10250
          ToPort: 10250
          SourceSecurityGroupId: !Ref ProdALBSecurityGroup
        - IpProtocol: "tcp"
          FromPort: 8080
          ToPort: 8080
          SourceSecurityGroupId: !Ref ProdALBSecurityGroup
      SecurityGroupEgress:
        - IpProtocol: "-1"
          CidrIp: 0.0.0.0/0 
      Tags:
        - Key: Name
          Value: Prod-Backend-Security-Group

  ## 4. RDS Security allow
  ProdDBSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: "Allow MySQL traffic only from EKS backend"
      VpcId: !Ref ProdVpc
      SecurityGroupIngress:
        - IpProtocol: "tcp"
          FromPort: 3306
          ToPort: 3306
          SourceSecurityGroupId: !Ref ProdBackendSecurityGroup  # EKS backend allow
      SecurityGroupEgress:
        - IpProtocol: "-1"
          CidrIp: 0.0.0.0/0
      Tags:
        - Key: Name
          Value: Prod-DB-Security-Group

  #EKS IAM ROLE
  EKSControlPlaneRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: EKSControlPlaneRole
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - eks.amazonaws.com
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonEKSClusterPolicy
      Tags:
        - Key: Name
          Value: EKSControlPlaneRole
  
  EKSWorkerNodeRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: EKSWorkerNodeRole
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - eks.amazonaws.com
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy
        - arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly
        - arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy
      Tags:
        - Key: Name
          Value: EKSWorkerNodeRole

  #EKS 
  ProdEks:
    Type: AWS::EKS::Cluster
    Properties:
      Name: Prod-Eks
      RoleArn: arn:aws:iam::605134473022:role/EKSControlPlaneRole
      Logging:
        ClusterLogging:
          EnabledTypes:
            - Type: api
            - Type: audit
            - Type: authenticator
            - Type: controllerManager
            - Type: scheduler
      KubernetesNetworkConfig:
        IpFamily: ipv4
      ResourcesVpcConfig:
        SubnetIds:
          - !Ref ProdVpcPrivateSubnetA
          - !Ref ProdVpcPrivateSubnetB
        SecurityGroupIds:
          - !Ref ProdALBSecurityGroup
        EndpointPublicAccess: false  
        EndpointPrivateAccess: true  
      Tags:
        - Key: Name
          Value: Prod-Eks
  
  # EKS node group
  ProdEKSNodeGroup:
    Type: AWS::EKS::Nodegroup
    Properties:
      ClusterName: !Ref ProdEks
      NodegroupName: Prod-EKS-Node-Group
      NodeRole: arn:aws:iam::605134473022:role/EKSWorkerNodeRole
      ScalingConfig:
        MinSize: 2
        MaxSize: 3
        DesiredSize: 2
      Subnets:
        - !Ref ProdVpcPrivateSubnetA
        - !Ref ProdVpcPrivateSubnetB
      InstanceTypes:
        - t3.medium
      DiskSize: 20 
      Tags:
        Name: "Prod-EKS-Node-Group"
    DependsOn:
      - ProdEks  
  
  # RDS Subnet Group
  ProdDBSubnetGroup:
    Type: AWS::RDS::DBSubnetGroup
    Properties:
      DBSubnetGroupName: Prod-DB-Subnet-Group
      DBSubnetGroupDescription: "RDS subnet group for Multi-AZ"
      SubnetIds:
        - !Ref ProdVpcPrivateDBSubnetA
        - !Ref ProdVpcPrivateDBSubnetB
      Tags:
        - Key: Name
          Value: Prod-DB-Subnet-Group

  ProdDB:
    Type: AWS::RDS::DBInstance
    Properties:
      DBInstanceIdentifier: Prod-DB
      Engine: postgres
      EngineVersion: "16.3"
      DBInstanceClass: db.t3.micro
      AllocatedStorage: 20
      MultiAZ: true
      MasterUsername: !Ref DBUsername 
      MasterUserPassword: !Ref DBPassword  
      DBSubnetGroupName: !Ref ProdDBSubnetGroup
      VPCSecurityGroups:
        - !Ref ProdDBSecurityGroup
      StorageType: gp2 
      BackupRetentionPeriod: 7  
      StorageEncrypted: true  
      Tags:
        - Key: Name
          Value: Prod-DB
    DeletionPolicy: Delete
    DependsOn:
      - ProdDBSecurityGroup
  
# RDS Instance (Multi-AZ)
Parameters:
  DBUsername:
    Type: String
    Default: "dbadmin"
    Description: "Master username for the PostgreSQL database"

  DBPassword:
    Type: String
    NoEcho: true  
    MinLength: 8
    MaxLength: 41
    AllowedPattern: "^[a-zA-Z0-9]*$"
    Description: "Master password for the PostgreSQL database"