VSCode-code-server.yaml

Description: Create a VSCode code-server instance with an Amazon CloudFront distribution.

Parameters:
  InstanceVolumeSize:
    Type: Number
    Description: The volume size in GB
    Default: 30
  InstanceType:
    Description: Type of EC2 instance to launch
    Type: String
    Default: c7i.xlarge
    AllowedValues: [
      c4.large, c4.xlarge, c4.2xlarge, c4.4xlarge, c4.8xlarge,
      c5.large, c5.xlarge, c5.2xlarge, c5.4xlarge, c5.9xlarge, c5.12xlarge, c5.18xlarge, c5.24xlarge,
      c5a.large, c5a.xlarge, c5a.2xlarge, c5a.4xlarge, c5a.8xlarge, c5a.12xlarge, c5a.16xlarge, c5a.24xlarge,
      c5ad.large, c5ad.xlarge, c5ad.2xlarge, c5ad.4xlarge, c5ad.8xlarge, c5ad.12xlarge, c5ad.16xlarge, c5ad.24xlarge,
      c5d.large, c5d.xlarge, c5d.2xlarge, c5d.4xlarge, c5d.9xlarge, c5d.12xlarge, c5d.18xlarge, c5d.24xlarge,
      c5n.large, c5n.xlarge, c5n.2xlarge, c5n.4xlarge, c5n.9xlarge, c5n.18xlarge,
      c6a.large, c6a.xlarge, c6a.2xlarge, c6a.4xlarge, c6a.8xlarge, c6a.12xlarge, c6a.16xlarge, c6a.24xlarge, c6a.32xlarge, c6a.48xlarge,
      c6g.medium, c6g.large, c6g.xlarge, c6g.2xlarge, c6g.4xlarge, c6g.8xlarge, c6g.12xlarge, c6g.16xlarge,
      c6gd.medium, c6gd.large, c6gd.xlarge, c6gd.2xlarge, c6gd.4xlarge, c6gd.8xlarge, c6gd.12xlarge, c6gd.16xlarge,
      c6gn.medium, c6gn.large, c6gn.xlarge, c6gn.2xlarge, c6gn.4xlarge, c6gn.8xlarge, c6gn.12xlarge, c6gn.16xlarge,
      c6i.large, c6i.xlarge, c6i.2xlarge, c6i.4xlarge, c6i.8xlarge, c6i.12xlarge, c6i.16xlarge, c6i.24xlarge, c6i.32xlarge,
      c7g.medium, c7g.large, c7g.xlarge, c7g.2xlarge, c7g.4xlarge, c7g.8xlarge, c7g.12xlarge, c7g.16xlarge,
      c7gd.medium, c7gd.large, c7gd.xlarge, c7gd.2xlarge, c7gd.4xlarge, c7gd.8xlarge, c7gd.12xlarge, c7gd.16xlarge,
      c7gn.medium, c7gn.large, c7gn.xlarge, c7gn.2xlarge, c7gn.4xlarge, c7gn.8xlarge, c7gn.12xlarge, c7gn.16xlarge,
      c7i.large, c7i.xlarge, c7i.2xlarge, c7i.4xlarge, c7i.8xlarge, c7i.12xlarge, c7i.16xlarge, c7i.24xlarge, c7i.48xlarge,
      m4.large, m4.xlarge, m4.2xlarge, m4.4xlarge, m4.10xlarge, m4.16xlarge,
      m5.large, m5.xlarge, m5.2xlarge, m5.4xlarge, m5.8xlarge, m5.12xlarge, m5.16xlarge, m5.24xlarge,
      m5a.large, m5a.xlarge, m5a.2xlarge, m5a.4xlarge, m5a.8xlarge, m5a.12xlarge, m5a.16xlarge, m5a.24xlarge,
      m6a.large, m6a.xlarge, m6a.2xlarge, m6a.4xlarge, m6a.8xlarge, m6a.12xlarge, m6a.16xlarge, m6a.24xlarge, m6a.32xlarge, m6a.48xlarge,
      m7a.medium, m7a.large, m7a.xlarge, m7a.2xlarge, m7a.4xlarge, m7a.8xlarge, m7a.12xlarge, m7a.16xlarge, m7a.24xlarge, m7a.32xlarge, m7a.48xlarge,
      t2.nano, t2.micro, t2.small, t2.medium, t2.large, t2.xlarge, t2.2xlarge,
      t3.nano, t3.micro, t3.small, t3.medium, t3.large, t3.xlarge, t3.2xlarge,
      t3a.nano, t3a.micro, t3a.small, t3a.medium, t3a.large, t3a.xlarge, t3a.2xlarge,
      t4g.nano, t4g.micro, t4g.small, t4g.medium, t4g.large, t4g.xlarge, t4g.2xlarge
    ]
  HomeFolder:
    Type: String
    Description: The home folder in the VSCodeInstance
    Default: /Workshop
  DevServerBasePath:
    Type: String
    Description: The base path for the application to be added to nginx sites-available list for code-server
    Default: app
  DevServerPort:
    Type: Number
    Description: The port for the DevServer
    Default: 8081
  AssetZipS3Path:
    Description: The S3 path holding the asset zip file to be copied into the home folder. To leave the empty, leave blank.
    Type: String
    Default: AWS::NoValue

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Instance Configuration
        Parameters:
          - InstanceVolumeSize
      - Label:
          default: Code Server Configuration
        Parameters:
          - HomeFolder
          - AssetZipS3Path
          - DevServerBasePath
          - DevServerPort
    ParameterLabels:
      InstanceVolumeSize:
        default: Attached volume size
      HomeFolder:
        default: Folder to open in code server when launching
      DevServerBasePath:
        default: BasePath where the application runs
      DevServerPort:
        default: Port where the application runs
      AssetZipS3Path:
        default: S3 path to the assets zip file
Mappings:
  Subnets:
    VPC:
      CIDR: 10.0.0.0/16
    PublicOne:
      CIDR: 10.0.1.0/24
    PublicTwo:
      CIDR: 10.0.2.0/24
    PrivateOne:
      CIDR: 10.0.3.0/24
    PrivateTwo:
      CIDR: 10.0.4.0/24
  # aws ec2 describe-managed-prefix-lists  --region <REGION> | jq -r '.PrefixLists[] | select (.PrefixListName == "com.amazonaws.global.cloudfront.origin-facing") | .PrefixListId'
  AWSRegions2PrefixListID:
    ap-northeast-1:
      PrefixList: pl-58a04531
    ap-northeast-2:
      PrefixList: pl-22a6434b
    ap-south-1:
      PrefixList: pl-9aa247f3
    ap-southeast-1:
      PrefixList: pl-31a34658
    ap-southeast-2:
      PrefixList: pl-b8a742d1
    ca-central-1:
      PrefixList: pl-38a64351
    eu-central-1:
      PrefixList: pl-a3a144ca
    eu-north-1:
      PrefixList: pl-fab65393
    eu-west-1:
      PrefixList: pl-4fa04526
    eu-west-2:
      PrefixList: pl-93a247fa
    eu-west-3:
      PrefixList: pl-75b1541c
    sa-east-1:
      PrefixList: pl-5da64334
    us-east-1:
      PrefixList: pl-3b927c52
    us-east-2:
      PrefixList: pl-b6a144df
    us-west-1:
      PrefixList: pl-4ea04527
    us-west-2:
      PrefixList: pl-82a045eb

Resources:
  ########### VPC Resources ###########
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !FindInMap [Subnets, VPC, CIDR]
      EnableDnsSupport: true
      EnableDnsHostnames: true

  InternetGateway:
    Type: AWS::EC2::InternetGateway

  GatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  PublicSubnetOne:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: !FindInMap [Subnets, PublicOne, CIDR]
      VpcId: !Ref VPC
      MapPublicIpOnLaunch: true
      AvailabilityZone: !Select [0, !GetAZs '']

  PublicOneRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC

  PublicOneRoute:
    Type: AWS::EC2::Route
    DependsOn: GatewayAttachment
    Properties:
      RouteTableId: !Ref PublicOneRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  PublicOneRouteTableAssoc:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicOneRouteTable
      SubnetId: !Ref PublicSubnetOne

  PublicSubnetTwo:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: !FindInMap [Subnets, PublicTwo, CIDR]
      VpcId: !Ref VPC
      MapPublicIpOnLaunch: true
      AvailabilityZone: !Select [1, !GetAZs '']

  PublicTwoRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC

  PublicTwoRoute:
    Type: AWS::EC2::Route
    DependsOn: GatewayAttachment
    Properties:
      RouteTableId: !Ref PublicTwoRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  PublicTwoRouteTableAssoc:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicTwoRouteTable
      SubnetId: !Ref PublicSubnetTwo

  PrivateSubnetOne:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: !FindInMap [Subnets, PrivateOne, CIDR]
      VpcId: !Ref VPC
      MapPublicIpOnLaunch: true
      AvailabilityZone: !Select [0, !GetAZs '']

  PrivateSubnetTwo:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: !FindInMap [Subnets, PrivateTwo, CIDR]
      VpcId: !Ref VPC
      MapPublicIpOnLaunch: true
      AvailabilityZone: !Select [1, !GetAZs '']

  SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: SG for Developer Machine - only allow CloudFront ingress
      SecurityGroupIngress:
        - Description: Allow HTTP from com.amazonaws.global.cloudfront.origin-facing
          IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          SourcePrefixListId:  !FindInMap [AWSRegions2PrefixListID, !Ref 'AWS::Region', PrefixList]
      SecurityGroupEgress:
        - Description: Allow all outbound traffic
          IpProtocol: -1
          CidrIp: 0.0.0.0/0
      VpcId: !Ref VPC


  ########### SSM Resources ###########
  SSMLogBucket:
    Type: AWS::S3::Bucket
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W35
            reason: Access logs aren't needed for this bucket
    DeletionPolicy: Delete
    Properties:
      AccessControl: Private
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

  VSCodeInstanceSSMDoc:
    Type: AWS::SSM::Document
    Properties:
      DocumentType: Command
      Content:
        schemaVersion: '2.2'
        description: Bootstrap VSCode code-server instance
        parameters:
          architecture:
            type: String
            default: amd64
            description: Instance architecture type
            allowedValues:
              - arm64
              - amd64
        mainSteps:
          - action: aws:runShellScript
            name: UpdateDnf
            inputs:
              runCommand:
                - sudo dnf update
          - action: aws:runShellScript
            name: InstallAWSCLI
            inputs:
              runCommand:
                - sudo dnf install --allowerasing curl-full -y
                - curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
                - unzip awscliv2.zip
                - sudo ./aws/install
                - rm awscliv2.zip
                - aws --version
          - action: aws:runShellScript
            name: UpdateAWSProfile
            inputs:
              runCommand:
                - !Sub echo 'export AWS_REGION=${AWS::Region}' >> /home/ec2-user/.bashrc
                - !Sub echo 'export AWS_ACCOUNTID=${AWS::AccountId}' >> /home/ec2-user/.bashrc
          - action: aws:runShellScript
            name: InstallGit
            inputs:
              runCommand:
                - sudo dnf install git -y
                - git --version
          - action: aws:runShellScript
            name: InstallNode
            inputs:
              runCommand:
                - sudo dnf install nodejs -y
          - action: aws:runShellScript
            name: InstallPython
            inputs:
              runCommand:
                - sudo dnf install python3.9 -y
                - sudo dnf install python3.9-pip -y
                - python3 --version
                - pip3 --version
          - action: aws:runShellScript
            name: InstallNginx
            inputs:
              runCommand:
                - sudo dnf install nginx -y
          - action: aws:runShellScript
            name: ConfigureCodeServer
            inputs:
              runCommand:
                - export HOME=/home/ec2-user
                - curl -fsSL https://code-server.dev/install.sh | sh
                - sudo systemctl enable --now code-server@ec2-user
                - !Sub |
                  sudo tee /etc/nginx/conf.d/code-server.conf <<EOF
                  server {
                      listen 80;
                      listen [::]:80;
                      server_name ${CloudFrontDistribution.DomainName};
                      location / {
                        proxy_pass http://localhost:8080/;
                        proxy_set_header Host \$host;
                        proxy_set_header Upgrade \$http_upgrade;
                        proxy_set_header Connection upgrade;
                        proxy_set_header Accept-Encoding gzip;
                      }
                  }
                  EOF
                - sudo dnf -y install argon2
                - |
                  sudo tee /home/ec2-user/.config/code-server/config.yaml <<EOF
                  cert: false
                  auth: password
                  hashed-password: "$(echo -n $(aws sts get-caller-identity --query "Account" --output text) | sudo argon2 $(aws sts get-caller-identity --query "Account" --output text) -e)"
                  EOF
                - sudo -u ec2-user --login mkdir -p /home/ec2-user/.local/share/code-server/User/
                - sudo -u ec2-user --login touch /home/ec2-user/.local/share/code-server/User/settings.json
                - !Sub |
                  sudo tee /home/ec2-user/.l...