Parameters:
  KeyName:
    Description: Name of an existing EC2 KeyPair to enable SSH access to the instances. Linked to AWS Parameter
    Type: AWS::EC2::KeyPair::KeyName
    ConstraintDescription: must be the name of an existing EC2 KeyPair.

Resources:
  ServerChkVPC:
    Type: AWS::EC2::VPC
    Properties:
     CidrBlock: 10.0.0.0/16
     EnableDnsSupport: true
     EnableDnsHostnames: true
     Tags:
        - Key: Name
          Value: ServerChk-VPC

  ServerChkIGW:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: ServerChk-IGW

  ServerChkIGWAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref ServerChkIGW
      VpcId: !Ref ServerChkVPC

  ServerChkPublicRT:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref ServerChkVPC
      Tags:
        - Key: Name
          Value: ServerChk-Public-RT

  DefaultPublicRoute:
    Type: AWS::EC2::Route
    DependsOn: ServerChkIGWAttachment
    Properties:
      RouteTableId: !Ref ServerChkPublicRT
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref ServerChkIGW

  ServerChkPrivateRT:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref ServerChkVPC
      Tags:
        - Key: Name
          Value: ServerChk-Private-RT

  ServerChkPublicSN:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref ServerChkVPC
      AvailabilityZone: !Select [ 0, !GetAZs '' ]
      CidrBlock: 10.0.0.0/24
      Tags:
        - Key: Name
          Value: ServerChk-Public-SN

  ServerChkPrivateSN:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref ServerChkVPC
      AvailabilityZone: !Select [ 2, !GetAZs '' ]
      CidrBlock: 10.0.1.0/24
      Tags:
        - Key: Name
          Value: ServerChk-Private-SN

  ServerChkPublicSNRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref ServerChkPublicRT
      SubnetId: !Ref ServerChkPublicSN

  ServerChkPrivateSNRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref ServerChkPrivateRT
      SubnetId: !Ref ServerChkPrivateSN

  ServerChkSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Enable HTTP access via port 80 and SSH access via port 22 and ICMP
      VpcId: !Ref ServerChkVPC
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: '80'
        ToPort: '80'
        CidrIp: 0.0.0.0/0
      - IpProtocol: tcp
        FromPort: '22'
        ToPort: '22'
        CidrIp: 0.0.0.0/0
      - IpProtocol: icmp
        FromPort: -1
        ToPort: -1
        CidrIp: 0.0.0.0/0

  ServerChkPublicEC2:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: t2.micro
      ImageId: ami-0094965d55b3bb1ff
      KeyName: !Ref KeyName
      Tags:
        - Key: Name
          Value: ServerChk-Public-EC2
      NetworkInterfaces:
        - DeviceIndex: 0
          SubnetId: !Ref ServerChkPublicSN
          GroupSet:
          - !Ref ServerChkSecurityGroup
          AssociatePublicIpAddress: true
      UserData:
        Fn::Base64:
          !Sub |
            #!/bin/bash
            AZ=`curl -s http://169.254.169.254/latest/meta-data/placement/availability-zone`
            IP=`curl -s http://169.254.169.254/latest/meta-data/local-ipv4`
            yum install -y httpd
            service httpd start
            chkconfig httpd on
            echo "<html><h1>Hello from Web Server - Region ( "$AZ" ) - Private IP ( "$IP" )</h1></html>" > /var/www/html/index.html

  ServerChkPrivateEC2:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: t2.micro
      ImageId: ami-0094965d55b3bb1ff
      KeyName: !Ref KeyName
      Tags:
        - Key: Name
          Value: ServerChk-Private-EC2
      NetworkInterfaces:
        - DeviceIndex: 0
          SubnetId: !Ref ServerChkPrivateSN
          GroupSet:
          - !Ref ServerChkSecurityGroup
      UserData:
        Fn::Base64:
          !Sub |
            #!/bin/bash
            (
            echo "qwe123seo"
            echo "qwe123seo"
            ) | passwd --stdin root
            sed -i "s/^PasswordAuthentication no/PasswordAuthentication yes/g" /etc/ssh/sshd_config
            sed -i "s/^#PermitRootLogin yes/PermitRootLogin yes/g" /etc/ssh/sshd_config
            service sshd restart
