AWSTemplateFormatVersion: "2010-09-09"
Description: CF Template to build VPN to Sophos UTM + test instance
Parameters:
  KeyName:
    Description: "Keypair for SSH"
    Type: "AWS::EC2::KeyPair::KeyName" #Will search for KeyPair specific to Region
  
  InstanceType:
    Description: "Possible instance types"
    Type: String
    Default: "t2.micro"
    AllowedValues: 
     - t2.micro
     - t2.small
     - t2.medium
     - t2.large

  VpcCIDR:
    Description: "The CIDR block for the VPC"
    Type: "String"
    AllowedPattern: "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
    Default: "192.168.0.0/16"
   
  SubnetCIDR:
    Description: "CIDR for public subnet"
    Type: "String"
    AllowedPattern: "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
    Default: "192.168.2.0/24"

Resources: 
  vpnVPC:
    Type: "AWS::EC2::VPC"
    Properties:
      CidrBlock: !Ref VpcCIDR 
      EnableDnsSupport: true
      EnableDnsHostnames: true  
      Tags: 
       - Key: Name
         Value: "Sophos VPN VPC"

  subnet:
    Type: "AWS::EC2::Subnet"
    Properties:
     VpcId: !Ref vpnVPC
     CidrBlock: !Ref SubnetCIDR
     MapPublicIpOnLaunch: true
     Tags:
      - Key: Name
        Value: "Sophos VPN Subnet"

  SophosCGW: 
    Type: "AWS::EC2::CustomerGateway"
    Properties:
      BgpAsn: 65000
      IpAddress: 76.222.222.205
      Type: "ipsec.1"
      Tags:
       - Key: Name
         Value: "Sophos CGW"

  AWSvpnGW:
    Type: "AWS::EC2::VPNGateway"
    Properties:
      Type: "ipsec.1"
      Tags: 
       - Key: Name
         Value: "AWS to Sophos"

  VPCattach:
    Type: "AWS::EC2::VPCGatewayAttachment"
    Properties:
      VpcId: !Ref vpnVPC
      VpnGatewayId: !Ref AWSvpnGW

  VPNConnection: 
    Type: "AWS::EC2::VPNConnection"
    Properties: 
      Type: "ipsec.1"
      CustomerGatewayId: !Ref SophosCGW       
      VpnGatewayId: !Ref AWSvpnGW
      Tags:
       - Key: Name
         Value: "AWS to Sophos"
  
  SecurityGroup:
    Type: "AWS::EC2::SecurityGroup"
    Properties:
      GroupDescription: "SG for Testing instance"
      VpcId: !Ref vpnVPC
      SecurityGroupIngress: 
      -
        CidrIp: 0.0.0.0/0
        FromPort: 22
        IpProtocol: tcp
        ToPort: 22
      - 
        CidrIp: 172.16.2.0/24
        FromPort: 8
        ToPort: -1
        IpProtocol: icmp
      Tags: 
        - Key: Name
          Value: "VPNsg"

  IGW:
    Type: "AWS::EC2::InternetGateway"
    Properties: 
      Tags:
        - Key: Name
          Value: "vpn"

  VPCgwAttach:
    Type: "AWS::EC2::VPCGatewayAttachment"
    Properties:
      InternetGatewayId: !Ref IGW
      VpcId: !Ref vpnVPC

  VPNec2Route:
    Type: "AWS::EC2::RouteTable"
    Properties:
      VpcId: !Ref vpnVPC

  VPNrouteOut:
    Type: "AWS::EC2::Route"
    DependsOn: IGW
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref IGW
      RouteTableId: !Ref VPNec2Route
    DependsOn: VPCattach

  SubnetRouteAssociate:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Properties:
      RouteTableId: !Ref VPNec2Route
      SubnetId: !Ref subnet
  
  VPNrouteProp:
    Type: "AWS::EC2::VPNGatewayRoutePropagation"
    Properties: 
      RouteTableIds:
        - !Ref VPNec2Route
      VpnGatewayId: !Ref AWSvpnGW
    DependsOn: VPCattach

  TestInstance:
    Type: "AWS::EC2::Instance"
    Properties:
      ImageId: ami-d8be01a0
      InstanceType: !Ref InstanceType
      KeyName: !Ref KeyName
      SecurityGroupIds: 
      -
        !Ref SecurityGroup
      SubnetId: !Ref subnet
      Tags:
        - Key: Name
          Value: "TestVPN"
