Skip to content
This repository was archived by the owner on May 29, 2024. It is now read-only.

Commit d85452d

Browse files
matteofigusmatteofigus
authored
Merge pull request #1 from aws-samples/cc-master
Sync from templates repo
2 parents 3b1a310 + 9efa940 commit d85452d

File tree

5 files changed

+506
-7
lines changed

5 files changed

+506
-7
lines changed

‎README.md‎

Lines changed: 60 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,66 @@
1-
## My Project
1+
# AWS WAF workshop
22

3-
TODO: Fill this README out!
3+
> Warning: This project is currently being developed and the code shouldn't be used in production.
44
5-
Be sure to:
5+
### usage
66

7-
* Change the title in this README
8-
* Edit your repository description on GitHub
7+
- create a VPC, add two public subnets in two separate AZs
8+
- point an ALB at an AutoScaling Group
9+
- allow http:80 access
10+
- instantiate EC2s with a running webserver
911

10-
## License
1112

12-
This library is licensed under the MIT-0 License. See the LICENSE file.
13+
#### deploy
14+
15+
`aws s3 mb s3://$BUCKETNAME`
16+
> bucket must be created in same region as deployment
17+
18+
`aws cloudformation package --template-file main.template --s3-bucket $BUCKETNAME --s3-prefix stacks --output-template-file rootstack --force-upload`
19+
20+
`aws cloudformation deploy --template-file rootstack --stack-name WAFDEMO --capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM CAPABILITY_AUTO_EXPAND && aws cloudformation list-exports --query 'Exports[].{Name: Name, Value: Value}'`
21+
22+
`aws cloudformation delete-stack --stack-name WAFDEMO && rm rootstack.json`
23+
24+
25+
#### TODO
26+
- convert config to inst and add cfn-sig?
27+
- cloudwatch dashboards
28+
- use fargate?
29+
30+
31+
#### userdata to spin up sample web servers on **port 80**
32+
33+
*httpserver on python2.7:* no special installs nor updates required, so quick to spin up
34+
35+
```
36+
#!/bin/bash
37+
echo "<h1>Hello AWS WAF Security Automations</h1>" > index.html
38+
python -m SimpleHTTPServer 80 .
39+
```
40+
41+
*default example:* provided by US builders for waf demo
42+
```
43+
#!/bin/bash
44+
sudo yum update -y
45+
sudo yum install -y httpd
46+
sudo systemctl enable httpd
47+
sudo touch /var/www/html/index.html
48+
sudo chmod 666 /var/www/html/index.html
49+
echo "<h1>Hello AWS WAF Security Automations</h1>" > /var/www/html/index.html
50+
sudo systemctl restart httpd
51+
```
52+
53+
*juiceshop:* full fledged vulnerable site
54+
55+
```
56+
#!/bin/bash
57+
yum update -y
58+
yum install -y httpd-tools
59+
yum install -y docker
60+
service docker start
61+
docker pull bkimminich/juice-shop\ndocker run -d -p 80:3000 bkimminich/juice-shop
62+
```
63+
64+
## License
1365

66+
This library is licensed under the MIT-0 License. See the LICENSE file.

‎templates/instance.template‎

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
AWSTemplateFormatVersion: '2010-09-09'
2+
Description: set up a launch configuration and attach to ASG
3+
Metadata: {}
4+
Parameters:
5+
TheAmi:
6+
Type: String
7+
WebSecurityGroup:
8+
Type: String
9+
ALBSecurityGroup:
10+
Type: String
11+
TheVpcId:
12+
Type: String
13+
TheSubnetId:
14+
Type: String
15+
TheOtherSubnetId:
16+
Type: String
17+
TheWebPort:
18+
Type: Number
19+
Mappings: {}
20+
Conditions: {}
21+
Resources:
22+
TheRolePolicies:
23+
Type: AWS::IAM::Policy
24+
Properties:
25+
PolicyName: TheSystemManagerPolicy
26+
PolicyDocument:
27+
Version: '2012-10-17'
28+
Statement:
29+
- Effect: Allow
30+
Action:
31+
- ssmmessages:CreateControlChannel
32+
- ssmmessages:CreateDataChannel
33+
- ssmmessages:OpenControlChannel
34+
- ssmmessages:OpenDataChannel
35+
- ssm:UpdateInstanceInformation
36+
Resource: '*'
37+
- Effect: Allow
38+
Action:
39+
- s3:GetEncryptionConfiguration
40+
Resource: '*'
41+
Roles:
42+
- !Ref 'TheRole'
43+
TheRole:
44+
Type: AWS::IAM::Role
45+
Properties:
46+
AssumeRolePolicyDocument:
47+
Statement:
48+
- Effect: Allow
49+
Principal:
50+
Service:
51+
- ec2.amazonaws.com
52+
Action:
53+
- sts:AssumeRole
54+
Path: /
55+
ManagedPolicyArns:
56+
- arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM
57+
TheInstanceProfile:
58+
DependsOn:
59+
- TheRole
60+
Type: AWS::IAM::InstanceProfile
61+
Properties:
62+
Path: /
63+
Roles:
64+
- !Ref 'TheRole'
65+
TheLoadBalancer:
66+
Type: AWS::ElasticLoadBalancingV2::LoadBalancer
67+
Properties:
68+
Name: ApplicationLoadBalancer
69+
Scheme: internet-facing
70+
SecurityGroups:
71+
- !Ref 'ALBSecurityGroup'
72+
Subnets:
73+
- !Ref 'TheSubnetId'
74+
- !Ref 'TheOtherSubnetId'
75+
Tags:
76+
- Key: Name
77+
Value: !Sub '${AWS::StackName}-ALB'
78+
Type: application
79+
TheListener:
80+
DependsOn:
81+
- TheTargetGroup
82+
- TheLoadBalancer
83+
Type: AWS::ElasticLoadBalancingV2::Listener
84+
Properties:
85+
DefaultActions:
86+
- TargetGroupArn: !Ref 'TheTargetGroup'
87+
Type: forward
88+
LoadBalancerArn: !Ref 'TheLoadBalancer'
89+
Port: !Ref 'TheWebPort'
90+
Protocol: HTTP
91+
TheRule:
92+
DependsOn:
93+
- TheListener
94+
Type: AWS::ElasticLoadBalancingV2::ListenerRule
95+
Properties:
96+
Actions:
97+
- TargetGroupArn: !Ref 'TheTargetGroup'
98+
Type: forward
99+
Conditions:
100+
- Field: path-pattern
101+
Values:
102+
- /
103+
ListenerArn: !Ref 'TheListener'
104+
Priority: '1'
105+
TheTargetGroup:
106+
Type: AWS::ElasticLoadBalancingV2::TargetGroup
107+
Properties:
108+
Name: WafDemoTargetGroup
109+
Port: !Ref 'TheWebPort'
110+
Protocol: HTTP
111+
VpcId: !Ref 'TheVpcId'
112+
Tags:
113+
- Key: Name
114+
Value: !Sub '${AWS::StackName}-TargetGroup'
115+
HealthCheckEnabled: true
116+
HealthyThresholdCount: 3
117+
HealthCheckIntervalSeconds: 10
118+
UnhealthyThresholdCount: 10
119+
HealthCheckPath: /
120+
HealthCheckPort: !Ref 'TheWebPort'
121+
HealthCheckProtocol: HTTP
122+
HealthCheckTimeoutSeconds: 5
123+
Matcher:
124+
HttpCode: 200-299
125+
TargetType: instance
126+
Targets: []
127+
TheAutoScalingGroup:
128+
Type: AWS::AutoScaling::AutoScalingGroup
129+
Properties:
130+
TargetGroupARNs:
131+
- !Ref 'TheTargetGroup'
132+
VPCZoneIdentifier:
133+
- !Ref 'TheSubnetId'
134+
- !Ref 'TheOtherSubnetId'
135+
AvailabilityZones:
136+
- !Select
137+
- 0
138+
- !GetAZs
139+
Ref: AWS::Region
140+
- !Select
141+
- 1
142+
- !GetAZs
143+
Ref: AWS::Region
144+
LaunchConfigurationName: !Ref 'TheLaunchConfig'
145+
DesiredCapacity: '2'
146+
MinSize: '1'
147+
MaxSize: '3'
148+
TheLaunchConfig:
149+
DependsOn:
150+
- TheInstanceProfile
151+
Type: AWS::AutoScaling::LaunchConfiguration
152+
Properties:
153+
IamInstanceProfile: !Ref 'TheInstanceProfile'
154+
ImageId: !Ref 'TheAmi'
155+
InstanceType: t2.micro
156+
AssociatePublicIpAddress: true
157+
SecurityGroups:
158+
- !Ref 'WebSecurityGroup'
159+
UserData: !Base64
160+
Fn::Sub: "#!/bin/bash\nsudo yum update -y\nsudo yum install -y httpd-tools\n\
161+
sudo yum install -y docker\nservice docker start\ndocker pull bkimminich/juice-shop\n\
162+
docker run -d -p ${TheWebPort}:3000 bkimminich/juice-shop"
163+
Outputs:
164+
TheSiteUrl:
165+
Description: public url of the application
166+
Value: !Sub 'http://${TheLoadBalancer.DNSName}:${TheWebPort}/'
167+
Export:
168+
Name: site-url

‎templates/main.template‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
AWSTemplateFormatVersion: '2010-09-09'
2+
Description: create all non-WAF resources for the Summit WAF session
3+
Metadata:
4+
AWS::CloudFormation::Interface:
5+
ParameterGroups:
6+
- Label:
7+
Default: 'Setup: leave as defaults unless you know what you''re doing'
8+
Parameters:
9+
- TheAmi
10+
- TheVpcRange
11+
- TheSubnetRange
12+
- TheOtherSubnetRange
13+
- ThePublicIp
14+
- TheWebPort
15+
ParameterLabels:
16+
TheAmi:
17+
Description: must be a linux2 ami
18+
TheVpcRange:
19+
Description: vpc cidr block
20+
TheSubnetRange:
21+
Description: subnet cidr block
22+
TheOtherSubnetRange:
23+
Description: another subnet cidr block
24+
TheWebPort:
25+
Description: port application is listening at
26+
ThePublicIp:
27+
Description: public ip to whitelist, your public ip nomrally
28+
Parameters:
29+
TheAmi:
30+
Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
31+
Default: /aws/service/ami-amazon-linux-latest/amzn-ami-hvm-x86_64-gp2
32+
ThePublicIp:
33+
Description: public ip to whitelist
34+
Type: String
35+
Default: '0.0.0.0/0'
36+
TheVpcRange:
37+
Description: vpc CIDR range
38+
Default: 10.0.3.0/26
39+
Type: String
40+
TheSubnetRange:
41+
Description: subnet CIDR
42+
Default: 10.0.3.16/28
43+
Type: String
44+
TheOtherSubnetRange:
45+
Description: subnet CIDR
46+
Default: 10.0.3.32/28
47+
Type: String
48+
TheSubnetId:
49+
Description: for load balancer
50+
Type: String
51+
Default: ''
52+
TheVpcId:
53+
Description: for load balancer
54+
Type: String
55+
Default: ''
56+
TheOtherSubnetId:
57+
Description: for load balancer
58+
Default: ''
59+
Type: String
60+
WebSecurityGroup:
61+
Description: output from security template
62+
Type: String
63+
Default: ''
64+
ALBSecurityGroup:
65+
Description: output from security template
66+
Type: String
67+
Default: ''
68+
TheWebPort:
69+
Description: port application is listening at
70+
Default: 80
71+
Type: Number
72+
Mappings: {}
73+
Conditions: {}
74+
Resources:
75+
TheNeworkStack:
76+
Type: AWS::CloudFormation::Stack
77+
Properties:
78+
Parameters:
79+
TheVpcRange: !Ref 'TheVpcRange'
80+
TheSubnetRange: !Ref 'TheSubnetRange'
81+
TheOtherSubnetRange: !Ref 'TheOtherSubnetRange'
82+
ThePublicIp: !Ref 'ThePublicIp'
83+
Tags:
84+
- Key: Name
85+
Value: !Sub '${AWS::StackName}-VPC'
86+
TemplateURL: ./network.template
87+
TimeoutInMinutes: 20
88+
TheSecurityStack:
89+
DependsOn:
90+
- TheNeworkStack
91+
Type: AWS::CloudFormation::Stack
92+
Properties:
93+
Parameters:
94+
ThePublicIp: !Ref 'ThePublicIp'
95+
TheWebPort: !Ref 'TheWebPort'
96+
TheVpcId: !GetAtt 'TheNeworkStack.Outputs.VpcId'
97+
Tags:
98+
- Key: Name
99+
Value: !Sub '${AWS::StackName}-SecurityGroup'
100+
TemplateURL: ./security.template
101+
TimeoutInMinutes: 20
102+
TheInstanceStack:
103+
DependsOn:
104+
- TheSecurityStack
105+
- TheNeworkStack
106+
Type: AWS::CloudFormation::Stack
107+
Properties:
108+
Parameters:
109+
TheAmi: !Ref 'TheAmi'
110+
WebSecurityGroup: !GetAtt 'TheSecurityStack.Outputs.WebSecurityGroup'
111+
TheWebPort: !Ref 'TheWebPort'
112+
ALBSecurityGroup: !GetAtt 'TheSecurityStack.Outputs.ALBSecurityGroup'
113+
TheSubnetId: !GetAtt 'TheNeworkStack.Outputs.SubnetId'
114+
TheVpcId: !GetAtt 'TheNeworkStack.Outputs.VpcId'
115+
TheOtherSubnetId: !GetAtt 'TheNeworkStack.Outputs.OtherSubnetId'
116+
Tags:
117+
- Key: Name
118+
Value: !Sub '${AWS::StackName}-ASG'
119+
TemplateURL: ./instance.template
120+
TimeoutInMinutes: 30
121+
Outputs: {}

0 commit comments

Comments
 (0)