AWSTemplateFormatVersion: 2010-09-09
Description: >-
  This AWS CloudFormation template installs the Aqua Command Center components
  in an EKS cluster.
Metadata:
  'AWS::CloudFormation::Interface':
    ParameterLabels:
      VpcID:
        default: VPC ID that hosts the EKS and will host the RDS instance
      VpcIPCidr:
        default: VPC CIDR
      EksInstanceSubnets:
        default: Private Subnets from the EKS VPC
      RdsInstanceName:
        default: RDS instance name
      RdsMasterUsername:
        default: RDS username
      RdsMasterPassword:
        default: RDS password
      RdsInstanceClass:
        default: RDS instance type
      RdsStorage:
        default: RDS storage size (GB)
      MultiAzDatabase:
        default: Enable Multi-AZ RDS
Parameters:
  EksClusterName:
    Description: Existing EKS cluster name
    Type: String
  VpcID:
    Description: VpcId of the EKS cluster to deploy into
    Type: 'AWS::EC2::VPC::Id'
  VpcIPCidr:
    Description: 'Enter VPC CIDR that hosts the EKS cluster. Ex: 192.168.0.0/16'
    Type: String
  EksInstanceSubnets:
    Type: 'List<AWS::EC2::Subnet::Id>'
    Description: Select all the subnets EKS utilizes. Recommended approach is to use only private subnets
    ConstraintDescription: >-
      Password must be at least 9 characters long and have 3 out of the
      following: one number, one lower case, one upper case, or one special
      character.
  RdsInstanceName:
    Default: aquadb
    Description: ''
    Type: String
    MinLength: '1'
    MaxLength: '64'
    AllowedPattern: '[a-zA-Z][a-zA-Z0-9]*'
    ConstraintDescription: Must begin with a letter and between 1 and 64 alphanumeric characters.
  RdsMasterUsername:
    Description: Enter the master username for the RDS instance.
    Default: postgres
    Type: String
    MinLength: '1'
    MaxLength: '63'
    AllowedPattern: '^[a-zA-Z0-9]*$'
    ConstraintDescription: >-
      Must be 1 to 63 characters long, begin with a letter, contain only
      alphanumeric characters, and not be a reserved word by PostgreSQL engine.
  RdsMasterPassword:
    NoEcho: 'true'
    Description: >-
      Enter the master password for the RDS instance. This password must contain
      8 to 128 characters and can be any printable ASCII character except @, /,
      or ".
    Type: String
    MinLength: '8'
    MaxLength: '128'
    AllowedPattern: >-
      ^((?=.*[0-9])(?=.*[a-z])(?=.*[A-Z])|(?=.*[0-9])(?=.*[a-z])(?=.*[!@#$%^&*])|(?=.*[0-9])(?=.*[A-Z])(?=.*[!@#$%^&*])|(?=.*[a-z])(?=.*[A-Z])(?=.*[!@#$%^&*])).{8,128}$
    ConstraintDescription: >-
      Password must be at least 9 characters long and have 3 out of the
      following: one number, one lower case, one upper case, or one special
      character.
  RdsInstanceClass:
    Description: ''
    Type: String
    Default: db.t2.medium
    AllowedValues:
      - db.t2.micro
      - db.t2.small
      - db.t2.medium
      - db.t2.large
      - db.t2.xlarge
      - db.t2.2xlarge
      - db.m4.large
      - db.m4.xlarge
      - db.m4.2xlarge
      - db.m4.4xlarge
      - db.m4.10xlarge
      - db.m4.16xlarge
      - db.r4.large
      - db.r4.xlarge
      - db.r4.2xlarge
      - db.r4.4xlarge
      - db.r4.8xlarge
      - db.r4.16xlarge
      - db.r3.large
      - db.r3.2xlarge
      - db.r3.4xlarge
      - db.r3.8xlarge
    ConstraintDescription: Must be a valid EC2 RDS instance type
  RdsStorage:
    Default: '40'
    Description: ''
    Type: Number
    MinValue: '40'
    MaxValue: '1024'
    ConstraintDescription: Must be set to between 40 and 1024GB.
  MultiAzDatabase:
    Default: 'false'
    Description: ''
    Type: String
    AllowedValues:
      - 'true'
      - 'false'
    ConstraintDescription: Must be either true or false.
Resources:
  RdsInstance:
    Type: 'AWS::RDS::DBInstance'
    DependsOn:
      - DbSecurityGroup
      - RdsInstanceSubnetGroup
    Properties:
      AllocatedStorage: !Ref RdsStorage
      AutoMinorVersionUpgrade: 'false'
      VPCSecurityGroups:
        - !Ref DbSecurityGroup
      DBName: !Ref RdsInstanceName
      BackupRetentionPeriod: '7'
      DBInstanceIdentifier: !Ref RdsInstanceName
      DBInstanceClass: !Ref RdsInstanceClass
      DBSubnetGroupName: !Ref RdsInstanceSubnetGroup
      Engine: postgres
      EngineVersion: 11.15
      MasterUsername: !Ref RdsMasterUsername
      MasterUserPassword: !Ref RdsMasterPassword
      MultiAZ: !Ref MultiAzDatabase
      StorageType: gp2
  RdsInstanceSubnetGroup:
    Type: 'AWS::RDS::DBSubnetGroup'
    Properties:
      DBSubnetGroupDescription: Source subnet
      SubnetIds: !Ref EksInstanceSubnets
  # Create DB Security Group
  DbSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: For RDS Instance
      VpcId: !Ref VpcID
      Tags:
      - Key: Name
        Value: RDS-SecurityGroup
  # Attach Security Group Rule
  DbIngress1:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref DbSecurityGroup
      IpProtocol: tcp
      FromPort: '5432'
      ToPort: '5432'
      CidrIp: !Ref 'VpcIPCidr'
Outputs:
  RdsInstanceEndpoint:
    Description: Postgres endpoint for Aqua CSP
    Value: !GetAtt RdsInstance.Endpoint.Address
  RdsInstancePort:
    Description: Postgres port for Aqua CSP
    Value: !GetAtt RdsInstance.Endpoint.Port
  RdsInstanceUser:
    Description: Username for the RDS instance
    Value: !Ref RdsMasterUsername