Description:  SM_STUDIO Hybrid DNS Demo - AWS
Parameters:
  LatestAmiId:
    Description: AMI for EC2 instances (default = AmaLinux Latest)
    Type: 'AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>'
    Default: '/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2'
Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.16.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: studio-aws
  SubnetPRIVATEA:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 0, !GetAZs '' ]
      CidrBlock: 10.16.32.0/20
      Tags:
        - Key: Name
          Value: sn-aws-private-A
  RouteTablePrivate: 
    Type: 'AWS::EC2::RouteTable'
    Properties:
      VpcId: !Ref VPC
      Tags:
      - Key: Name
        Value: studio-AWS-RT
  SubnetPRIVATEB:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 1, !GetAZs '' ]
      CidrBlock: 10.16.96.0/20
      Tags:
        - Key: Name
          Value: sn-aws-private-B
  RouteTableAssociationPrivateA:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      SubnetId: !Ref SubnetPRIVATEA
      RouteTableId: !Ref RouteTablePrivate
  RouteTableAssociationPrivateB:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      SubnetId: !Ref SubnetPRIVATEB
      RouteTableId: !Ref RouteTablePrivate
  AWSSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      VpcId: !Ref VPC
      GroupDescription: Enable SSH and DNS
      SecurityGroupIngress: 
        - Description: 'Allow SSH IPv4 IN'
          IpProtocol: tcp
          FromPort: '22'
          ToPort: '22'
          CidrIp: '0.0.0.0/0'
        - Description: 'Allow HTTP IPv4 IN'
          IpProtocol: tcp
          FromPort: '80'
          ToPort: '80'
          CidrIp: '0.0.0.0/0'
        - Description: 'Allow DNS IN'
          IpProtocol: -1
          FromPort: '53'
          ToPort: '53'
          CidrIp: '0.0.0.0/0'
        - IpProtocol: icmp
          FromPort: -1
          ToPort: -1
          CidrIp: '0.0.0.0/0'
  SMStudioEPSG:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      VpcId: !Ref VPC
      GroupDescription: Enable dns and https for studio ep
      SecurityGroupIngress: 
        - Description: 'Allow HTTPS IPv4 IN'
          IpProtocol: tcp
          FromPort: '443'
          ToPort: '443'
          CidrIp: '0.0.0.0/0'
        - Description: 'Allow DNS IN'
          IpProtocol: -1
          FromPort: '53'
          ToPort: '53'
          CidrIp: '0.0.0.0/0'
  DefaultInstanceSecurityGroupSelfReferenceRule:
    Type: "AWS::EC2::SecurityGroupIngress"
    Properties:
      GroupId: !Ref AWSSecurityGroup
      IpProtocol: 'tcp'
      FromPort: '0'
      ToPort: '65535'
      SourceSecurityGroupId: !Ref AWSSecurityGroup
  EC2A:
    Type: AWS::EC2::Instance
    DependsOn: 
      - ssminterfaceendpoint
      - ssmec2messagesinterfaceendpoint
      - ssmmessagesinterfaceendpoint
    Properties:
      InstanceType: "t2.micro"
      ImageId: !Ref LatestAmiId
      IamInstanceProfile: !Ref EC2InstanceProfile
      SubnetId: !Ref SubnetPRIVATEA
      SecurityGroupIds: 
        - !Ref AWSSecurityGroup
      Tags:
        - Key: Name
          Value: studio-AWS-EC2-A
  EC2B:
    Type: AWS::EC2::Instance
    DependsOn: 
      - ssminterfaceendpoint
      - ssmec2messagesinterfaceendpoint
      - ssmmessagesinterfaceendpoint
    Properties:
      InstanceType: "t2.micro"
      ImageId: !Ref LatestAmiId
      IamInstanceProfile: !Ref EC2InstanceProfile
      SubnetId: !Ref SubnetPRIVATEB
      SecurityGroupIds: 
        - !Ref AWSSecurityGroup
      Tags:
        - Key: Name
          Value: studio-AWS-EC2-B
  EC2Role:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
              - ec2.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action: 
                  - 'ssm:DescribeAssociation'
                  - 'ssm:GetDeployablePatchSnapshotForInstance'
                  - 'ssm:GetDocument'
                  - 'ssm:DescribeDocument'
                  - 'ssm:GetManifest'
                  - 'ssm:GetParameter'
                  - 'ssm:GetParameters'
                  - 'ssm:ListAssociations'
                  - 'ssm:ListInstanceAssociations'
                  - 'ssm:PutInventory'
                  - 'ssm:PutComplianceItems'
                  - 'ssm:PutConfigurePackageResult'
                  - 'ssm:UpdateAssociationStatus'
                  - 'ssm:UpdateInstanceAssociationStatus'
                  - 'ssm:UpdateInstanceInformation'
                Resource: '*'
              - Effect: Allow
                Action:
                  - 'ssmmessages:CreateControlChannel'
                  - 'ssmmessages:CreateDataChannel'
                  - 'ssmmessages:OpenControlChannel'
                  - 'ssmmessages:OpenDataChannel' 
                Resource: '*'
              - Effect: Allow
                Action: 
                  - 'ec2messages:AcknowledgeMessage'
                  - 'ec2messages:DeleteMessage'
                  - 'ec2messages:FailMessage'
                  - 'ec2messages:GetEndpoint'
                  - 'ec2messages:GetMessages'
                  - 'ec2messages:SendReply'
                Resource: '*'
  EC2InstanceProfile:
    Type: 'AWS::IAM::InstanceProfile'
    Properties:
      Path: /
      Roles:
        - !Ref EC2Role
  ssminterfaceendpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcEndpointType: "Interface"
      PrivateDnsEnabled: "True"
      SubnetIds:
        - !Ref SubnetPRIVATEA
        - !Ref SubnetPRIVATEB
      SecurityGroupIds:
        - !Ref AWSSecurityGroup
      ServiceName: !Sub com.amazonaws.${AWS::Region}.ssm
      VpcId: !Ref VPC
  ssmec2messagesinterfaceendpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcEndpointType: "Interface"
      PrivateDnsEnabled: "True"
      SubnetIds:
        - !Ref SubnetPRIVATEA
        - !Ref SubnetPRIVATEB
      SecurityGroupIds:
        - !Ref AWSSecurityGroup
      ServiceName: !Sub com.amazonaws.${AWS::Region}.ec2messages
      VpcId: !Ref VPC
  ssmmessagesinterfaceendpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcEndpointType: "Interface"
      PrivateDnsEnabled: "True"
      SubnetIds:
        - !Ref SubnetPRIVATEA
        - !Ref SubnetPRIVATEB
      SecurityGroupIds:
        - !Ref AWSSecurityGroup
      ServiceName: !Sub com.amazonaws.${AWS::Region}.ssmmessages
      VpcId: !Ref VPC
  studiointerfaceendpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcEndpointType: "Interface"
      PrivateDnsEnabled: "True"
      SubnetIds:
        - !Ref SubnetPRIVATEA
        - !Ref SubnetPRIVATEB
      SecurityGroupIds:
        - !Ref SMStudioEPSG
      ServiceName: !Sub aws.sagemaker.${AWS::Region}.studio
      VpcId: !Ref VPC
  smruntimeinterfaceendpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcEndpointType: "Interface"
      PrivateDnsEnabled: "True"
      SubnetIds:
        - !Ref SubnetPRIVATEA
        - !Ref SubnetPRIVATEB
      SecurityGroupIds:
        - !Ref SMStudioEPSG
      ServiceName: !Sub com.amazonaws.${AWS::Region}.sagemaker.runtime
      VpcId: !Ref VPC
  smapiinterfaceendpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcEndpointType: "Interface"
      PrivateDnsEnabled: "True"
      SubnetIds:
        - !Ref SubnetPRIVATEA
        - !Ref SubnetPRIVATEB
      SecurityGroupIds:
        - !Ref SMStudioEPSG
      ServiceName: !Sub com.amazonaws.${AWS::Region}.sagemaker.api
      VpcId: !Ref VPC





