ec2-windows-bastion.yaml

# aws cloudformation create-stack --capabilities CAPABILITY_NAMED_IAM --stack-name windows-bastion-us-east-1-demo --template-body file://ec2-windows-bastion.yaml --parameters file://params/windows-bastion-params-us-east-1-demo.json

AWSTemplateFormatVersion: '2010-09-09'

Description: >
  This template creates a Windows Bastion EC2 instance.

Parameters:
  DeploymentId:
    Type: String
    Description: A unique deployment identifier.

  KeyName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: EC2 KeyPair to enable SSH access to the ECS instances.

  InstanceType:
    Description: EC2 instance type
    Type: String
    Default: t2.micro
    AllowedValues: [t2.micro, t2.small, t2.medium, t2.large]
    ConstraintDescription: Please choose a valid instance type.

  Service:
    Type: String
    Description: Name of the service or product that is associated with this stack.

  Owner:
    Type: String
    Description: Email address of the person that created the stack.

  AmiId:
    Type: String
    Description: Amazon Machine Image ID

Resources:
### EC2 ###
  WindowsBastionEc2Instance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Ref 'AmiId'
      InstanceType: !Ref 'InstanceType'
      SubnetId: !ImportValue 'PublicSubnetAz1'
      KeyName: !Ref 'KeyName'
      SecurityGroupIds: [!Ref 'WindowsBastionEc2SecurityGroup']
      IamInstanceProfile: !Ref 'WindowsBastionInstanceProfile'
      BlockDeviceMappings:
        - DeviceName: /dev/sda1
          Ebs:
            VolumeSize: '50'
            VolumeType: 'gp2'
      Tags:
        - Key: Name
          Value: !Sub ${Service}-${DeploymentId}
        - Key: Service
          Value: !Ref 'Service'
        - Key: Owner
          Value: !Ref 'Owner'

### EC2 EIP ###
  WindowsBastionEc2Eip:
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      InstanceId: !Ref 'WindowsBastionEc2Instance'

### Route 53 ###
  WindowsBastionDnsRecord:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneName: !Ref 'HostedZoneName'
      Comment: DNS name for Windows Bastion instance.
      Name: !Join ['', [!Ref 'Service', ., !Ref 'HostedZoneName']]
      Type: A
      TTL: '300'
      ResourceRecords:
      - !Ref 'WindowsBastionEc2Eip'

### Security Groups ###
  WindowsBastionEc2SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: WindowsBastion Security Group
      VpcId: !ImportValue 'VpcId'
      Tags:
        - Key: Service
          Value: windows-bastion
        - Key: Name
          Value: windows-bastion-ec2-sg

# Allow RDP port 3389 access to Windows Bastion EC2 instance from specific addresses
  WindowsBastionEc2SecurityGroupSshInbound:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref 'WindowsBastionEc2SecurityGroup'
      IpProtocol: tcp
      FromPort: '3389'
      ToPort: '3389'
      CidrIp: 5.5.5.5/32

### IAM Role & Policies ###
  WindowsBastionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
                - sts:AssumeRole
      Path: /

# Allow Windows Bastion service access to Assume IAM roles
  WindowsBastionAssumeRolePolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: WindowsBastionAssumeRolePolicy
      Roles:
        - !Ref 'WindowsBastionRole'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - sts:AssumeRole
            Resource:
              - '*'

# Allow Windows Bastion service access to CloudWatch
  WindowsBastionCloudWatchPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: WindowsBastionCloudWatchPolicy
      Roles:
        - !Ref 'WindowsBastionRole'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - cloudwatch:List*
              - cloudwatch:Get*
              - cloudwatch:PutMetricData
            Resource: '*'

# Windows Bastion EC2 Instance profile for which the Windows Bastion IAM role is associated
  WindowsBastionInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - !Ref 'WindowsBastionRole'

### Outputs:
  # WindowsBastionEc2InstancePrivateDnsName:
  #   Value: !GetAtt WindowsBastionEc2Instance.PrivateDnsName