Provision a hardened AWS EC2 web server in a private VPC

AWSTemplateFormatVersion: "2010-09-09"
Description: Private SSM-managed web host
Parameters:
  VpcCidr: {Type: String}
  PrivateSubnetACidr: {Type: String}
  PrivateSubnetBCidr: {Type: String}
  ClientSecurityGroupId: {Type: AWS::EC2::SecurityGroup::Id}
  S3PrefixListId: {Type: String}
  InstanceType: {Type: String, Default: t3.small}
  ImageId: {Type: AWS::EC2::Image::Id}
Resources:
  Vpc:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCidr
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags: [{Key: Name, Value: private-web}]
  PrivateSubnetA:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref Vpc
      CidrBlock: !Ref PrivateSubnetACidr
      AvailabilityZone: !Select [0, !GetAZs ""]
      MapPublicIpOnLaunch: false
  PrivateSubnetB:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref Vpc
      CidrBlock: !Ref PrivateSubnetBCidr
      AvailabilityZone: !Select [1, !GetAZs ""]
      MapPublicIpOnLaunch: false
  RouteTableA:
    Type: AWS::EC2::RouteTable
    Properties: {VpcId: !Ref Vpc}
  RouteTableB:
    Type: AWS::EC2::RouteTable
    Properties: {VpcId: !Ref Vpc}
  AssociationA:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties: {SubnetId: !Ref PrivateSubnetA, RouteTableId: !Ref RouteTableA}
  AssociationB:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties: {SubnetId: !Ref PrivateSubnetB, RouteTableId: !Ref RouteTableB}
  S3Endpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref Vpc
      ServiceName: !Sub com.amazonaws.${AWS::Region}.s3
      VpcEndpointType: Gateway
      RouteTableIds: [!Ref RouteTableA, !Ref RouteTableB]

aws cloudformation validate-template --template-body file://private-web.yml --query 'Parameters[].ParameterKey' --output text

EndpointSecurityGroup:
  Type: AWS::EC2::SecurityGroup
  Properties:
    GroupDescription: TLS from private web instances to AWS endpoints
    VpcId: !Ref Vpc
    SecurityGroupEgress: []
InstanceSecurityGroup:
  Type: AWS::EC2::SecurityGroup
  Properties:
    GroupDescription: Private web host explicit paths
    VpcId: !Ref Vpc
    SecurityGroupEgress: []
EndpointTlsIngress:
  Type: AWS::EC2::SecurityGroupIngress
  Properties:
    GroupId: !Ref EndpointSecurityGroup
    IpProtocol: tcp
    FromPort: 443
    ToPort: 443
    SourceSecurityGroupId: !Ref InstanceSecurityGroup
PrivateWebIngress:
  Type: AWS::EC2::SecurityGroupIngress
  Properties:
    GroupId: !Ref InstanceSecurityGroup
    IpProtocol: tcp
    FromPort: 8080
    ToPort: 8080
    SourceSecurityGroupId: !Ref ClientSecurityGroupId
EndpointTlsEgress:
  Type: AWS::EC2::SecurityGroupEgress
  Properties:
    GroupId: !Ref InstanceSecurityGroup
    IpProtocol: tcp
    FromPort: 443
    ToPort: 443
    DestinationSecurityGroupId: !Ref EndpointSecurityGroup
S3TlsEgress:
  Type: AWS::EC2::SecurityGroupEgress
  Properties:
    GroupId: !Ref InstanceSecurityGroup
    IpProtocol: tcp
    FromPort: 443
    ToPort: 443
    DestinationPrefixListId: !Ref S3PrefixListId
SsmEndpoint:
  Type: AWS::EC2::VPCEndpoint
  Properties:
    VpcId: !Ref Vpc
    ServiceName: !Sub com.amazonaws.${AWS::Region}.ssm
    VpcEndpointType: Interface
    PrivateDnsEnabled: true
    SubnetIds: [!Ref PrivateSubnetA, !Ref PrivateSubnetB]
    SecurityGroupIds: [!Ref EndpointSecurityGroup]
SsmMessagesEndpoint:
  Type: AWS::EC2::VPCEndpoint
  Properties:
    VpcId: !Ref Vpc
    ServiceName: !Sub com.amazonaws.${AWS::Region}.ssmmessages
    VpcEndpointType: Interface
    PrivateDnsEnabled: true
    SubnetIds: [!Ref PrivateSubnetA, !Ref PrivateSubnetB]
    SecurityGroupIds: [!Ref EndpointSecurityGroup]
LogsEndpoint:
  Type: AWS::EC2::VPCEndpoint
  Properties:
    VpcId: !Ref Vpc
    ServiceName: !Sub com.amazonaws.${AWS::Region}.logs
    VpcEndpointType: Interface
    PrivateDnsEnabled: true
    SubnetIds: [!Ref PrivateSubnetA, !Ref PrivateSubnetB]
    SecurityGroupIds: [!Ref EndpointSecurityGroup]

aws cloudformation validate-template --template-body file://private-web.yml >/dev/null && grep -nE 'SecurityGroup(Ingress|Egress)|VPCEndpoint' infrastructure/private-web.yml

SessionLogGroup:
  Type: AWS::Logs::LogGroup
  DeletionPolicy: Retain
  UpdateReplacePolicy: Retain
  Properties:
    LogGroupName: !Sub /aws/ssm/${AWS::StackName}
    RetentionInDays: 90
InstanceRole:
  Type: AWS::IAM::Role
  Properties:
    AssumeRolePolicyDocument:
      Version: "2012-10-17"
      Statement:
        - Effect: Allow
          Principal: {Service: ec2.amazonaws.com}
          Action: sts:AssumeRole
    Policies:
      - PolicyName: SsmMessagingAndInventory
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Sid: SsmControlChannelsNoResourceArn
              Effect: Allow
              Action:
                - ssmmessages:CreateControlChannel
                - ssmmessages:CreateDataChannel
                - ssmmessages:OpenControlChannel
                - ssmmessages:OpenDataChannel
                - ssm:UpdateInstanceInformation
              Resource: "*"
            - Sid: DiscoverConfiguredSessionLogGroup
              Effect: Allow
              Action: logs:DescribeLogGroups
              Resource: "*"
            - Sid: SessionLogsOnly
              Effect: Allow
              Action:
                - logs:CreateLogStream
                - logs:DescribeLogStreams
                - logs:PutLogEvents
              Resource: !Sub ${SessionLogGroup.Arn}:*
InstanceProfile:
  Type: AWS::IAM::InstanceProfile
  Properties:
    Roles: [!Ref InstanceRole]

aws accessanalyzer validate-policy --policy-type IDENTITY_POLICY --policy-document file://instance-policy.json --query 'findings[].[findingType,issueCode]' --output table

WebInstance:
  Type: AWS::EC2::Instance
  Properties:
    ImageId: !Ref ImageId
    InstanceType: !Ref InstanceType
    IamInstanceProfile: {Name: !Ref InstanceProfile}
    SubnetId: !Ref PrivateSubnetA
    SecurityGroupIds: [!Ref InstanceSecurityGroup]
    DisableApiTermination: true
    Monitoring: true
    MetadataOptions:
      HttpEndpoint: enabled
      HttpTokens: required
      HttpPutResponseHopLimit: 1
      InstanceMetadataTags: disabled
    BlockDeviceMappings:
      - DeviceName: /dev/xvda
        Ebs:
          Encrypted: true
          VolumeType: gp3
          VolumeSize: 16
          DeleteOnTermination: true
    Tags:
      - {Key: Name, Value: private-web}
      - {Key: ManagedBy, Value: cloudformation}
    UserData:
      Fn::Base64: |
        #!/bin/bash
        set -euo pipefail
        dnf -y install nginx
        cat >/etc/nginx/conf.d/private-web.conf <<'CONF'
        server {
          listen 8080;
          server_name _;
          server_tokens off;
          location = /healthz { return 200 "healthy
"; }
          location / { return 404; }
        }
        CONF
        nginx -t
        systemctl enable --now nginx

aws cloudformation validate-template --template-body file://private-web.yml >/dev/null && grep -nE 'MetadataOptions|Encrypted|AssociatePublicIpAddress|DisableApiTermination|KeyName' infrastructure/private-web.yml