quickstart-trendmicro-deepsecurity/templates/common/dsm-elb.template.yaml at dbc9dcd0d62d418effd3c5d1b64645391d1b87ca · aws-quickstart/quickstart-trendmicro-deepsecurity · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
---
AWSTemplateFormatVersion: 2010-09-09
Description: 'v5.70: Deploys Elastic Load Balancers and Security Groups for Deep Security
  (qs-1ngr590je). Manager.'
Metadata:
  cfn-lint:
    config:
      ignore_checks: [W3005,W8001]
      ignore_reasons:
        W8001:'Conditions are referenced by other template'
        W3005:'DSM needs to depend on resource ELBSG to make sure the stack will create not fail'
Parameters:
  AWSIVPC:
    Description: Existing VPC to deploy Deep Security Manager
    Type: AWS::EC2::VPC::Id
    AllowedPattern: '[-_a-zA-Z0-9]*'
  DSIPHeartbeatPort:
    Description: The heartbeat port used by Deep Security Agents and appliances to
      communicate with the Deep Security Manager.
    Type: Number
    MinValue: 0
    MaxValue: 65535
    Default: '4120'
    ConstraintDescription: Must be a valid TCP port.
  DSIPGUIPort:
    Description: The Deep Security Manager application and GUI port.
    Type: Number
    MinValue: 0
    MaxValue: 65535
    Default: '4119'
    ConstraintDescription: Must be a valid TCP port.
  DSISubnetID:
    Description: Existing Subnet for Deep Security Manager. Must be a public subnet
      contained the in VPC chosen above.
    Type: String
    MinLength: '1'
    MaxLength: '255'
    AllowedPattern: '[-_a-zA-Z0-9]*'
    ConstraintDescription: Subnet ID must exist in the chosen VPC
  DSELBPosture:
    Description: Use internal or internet-facing ELB
    Type: String
    AllowedValues:
    - Internet-facing
    - Internal
    Default: Internet-facing
  QSS3BucketName:
    AllowedPattern: ^[0-9a-zA-Z]+([0-9a-zA-Z-]*[0-9a-zA-Z])*$
    ConstraintDescription: Quick Start bucket name can include numbers, lowercase
      letters, uppercase letters, and hyphens (-). It cannot start or end with a hyphen
      (-).
    Default: aws-quickstart
    Description: S3 bucket name for the Quick Start assets. Quick Start bucket name
      can include numbers, lowercase letters, uppercase letters, and hyphens (-).
      It cannot start or end with a hyphen (-).
    Type: String
  QSS3BucketRegion:
    Default: 'us-east-1'
    Description: 'The AWS Region where the Quick Start S3 bucket (QSS3BucketName) is hosted. When using your own bucket, you must specify this value.'
    Type: String
  QSS3KeyPrefix:
    AllowedPattern: ^[0-9a-zA-Z-/]*$
    ConstraintDescription: Quick Start key prefix can include numbers, lowercase letters,
      uppercase letters, hyphens (-), and forward slash (/).
    Default: quickstart-trendmicro-deepsecurity/
    Description: S3 key prefix for the Quick Start assets. Quick Start key prefix
      can include numbers, lowercase letters, uppercase letters, hyphens (-), and
      forward slash (/).
    Type: String
Resources:
  ELBSG:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL:
        !Sub
          - 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}templates/common/security-groups/ds-elb-sg.template.yaml'
          - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion]
            S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
      Parameters:
        AWSIVPC: !Ref AWSIVPC
        DSIPGUIPort: !Ref DSIPGUIPort
        DSIPHeartbeatPort: !Ref DSIPHeartbeatPort
  DSMELB:
    Type: AWS::ElasticLoadBalancing::LoadBalancer
    DependsOn: ELBSG
    Properties:
      Subnets:
      - !Ref DSISubnetID
      SecurityGroups:
      - !GetAtt
        - ELBSG
        - Outputs.ELBSG
      Scheme:
        !If
        - InternetFacingELB
        - internet-facing
        - internal
      Listeners:
      - LoadBalancerPort: !Ref DSIPHeartbeatPort
        InstancePort: !Ref DSIPHeartbeatPort
        Protocol: TCP
      - LoadBalancerPort: '4122'
        InstancePort: '4122'
        Protocol: TCP
      HealthCheck:
        Target:
          !Join
          - ''
          - - 'HTTPS:'
            - !Ref DSIPGUIPort
            - /rest/status/manager/ping
        HealthyThreshold: '3'
        UnhealthyThreshold: '5'
        Interval: '30'
        Timeout: '5'
      ConnectionSettings:
        IdleTimeout: 600
Conditions:
  UsingDefaultBucket: !Equals [!Ref QSS3BucketName, 'aws-quickstart']
  InternetFacingELB:
    !Equals
    - !Ref DSELBPosture
    - Internet-facing
  GovCloudCondition:
    !Or
    - !Equals
      - !Ref AWS::Region
      - us-gov-west-1
    - !Equals
      - !Ref AWS::Region
      - us-gov-east-1
Outputs:
  ELBFQDN:
    Value: !GetAtt DSMELB.DNSName
  ELBSourceSecurityGroup:
    Value: !GetAtt ELBSG.Outputs.ELBSG
  ELSBSourceSecurityGroupOnwerID:
    Value: !GetAtt DSMELB.SourceSecurityGroup.OwnerAlias
  DSIELB:
    Value: !Ref DSMELB
  ELBCanonicalHostedZoneNameID:
    Value: !GetAtt DSMELB.CanonicalHostedZoneNameID
  ELBDNSName:
    Value: !GetAtt DSMELB.DNSName
...