Parameters:
  KeyName:
    Description: Name of an existing EC2 KeyPair to enable SSH access to the instances. Linked to AWS Parameter
    Type: AWS::EC2::KeyPair::KeyName
    ConstraintDescription: must be the name of an existing EC2 KeyPair.
  InstanceType:
    Description: Enter t2.micro, t3.micro. Default is t2.micro.
    Type: String
    Default: t2.micro
    AllowedValues: 
      - t2.micro
      - t3.micro
  LatestAmiId:
    Description: (DO NOT CHANGE)
    Type: 'AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>'
    Default: '/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2'
    AllowedValues:
      - /aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2

Resources:
# IAM Role
  ASLabInstanceRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: ASLabInstanceRole
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess

  ASLabInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      InstanceProfileName: ASLabInstanceProfile
      Path: /
      Roles:
        - !Ref ASLabInstanceRole

# MyVPC
  MyVPC:
    Type: AWS::EC2::VPC
    Properties:
     CidrBlock: 10.0.0.0/16
     Tags:
        - Key: Name
          Value: MyVPC

  MyIGW:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: MyIGW

  MyIGWAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref MyIGW
      VpcId: !Ref MyVPC

  MyPublicRT:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref MyVPC
      Tags:
        - Key: Name
          Value: My-Public-RT

  MyDefaultPublicRoute:
    Type: AWS::EC2::Route
    DependsOn: MyIGWAttachment
    Properties:
      RouteTableId: !Ref MyPublicRT
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref MyIGW

  MyPublicSN:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref MyVPC
      AvailabilityZone: !Select [ 0, !GetAZs '' ]
      CidrBlock: 10.0.0.0/24
      Tags:
        - Key: Name
          Value: My-Public-SN

  MyPublicSNRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref MyPublicRT
      SubnetId: !Ref MyPublicSN

# VPC1
  VPC1:
    Type: AWS::EC2::VPC
    Properties:
     CidrBlock: 10.1.0.0/16
     EnableDnsSupport: true
     EnableDnsHostnames: true
     Tags:
        - Key: Name
          Value: VPC1

  VPC1IGW:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: VPC1-IGW

  VPCIGWAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref VPC1IGW
      VpcId: !Ref VPC1

  VPC1PublicRT:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC1
      Tags:
        - Key: Name
          Value: VPC1-Public-RT

  VPC1DefaultPublicRoute:
    Type: AWS::EC2::Route
    DependsOn: VPCIGWAttachment
    Properties:
      RouteTableId: !Ref VPC1PublicRT
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref VPC1IGW

  VPC1PublicSN1:
    Type: AWS::EC2::Subnet
    Properties:
      MapPublicIpOnLaunch: true
      VpcId: !Ref VPC1
      AvailabilityZone: !Select [ 0, !GetAZs '' ]
      CidrBlock: 10.1.1.0/24
      Tags:
        - Key: Name
          Value: VPC1-Public-SN-1

  VPC1PublicSN2:
    Type: AWS::EC2::Subnet
    Properties:
      MapPublicIpOnLaunch: true
      VpcId: !Ref VPC1
      AvailabilityZone: !Select [ 2, !GetAZs '' ]
      CidrBlock: 10.1.2.0/24
      Tags:
        - Key: Name
          Value: VPC1-Public-SN-2

  VPC1PublicSN1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref VPC1PublicRT
      SubnetId: !Ref VPC1PublicSN1

  VPC1PublicSN2RouteTableAssociation2:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref VPC1PublicRT
      SubnetId: !Ref VPC1PublicSN2

# MyVPC Instance
  MyEC2:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: !Ref InstanceType
      IamInstanceProfile : ASLabInstanceProfile
      ImageId: !Ref LatestAmiId
      KeyName: !Ref KeyName
      Tags:
        - Key: Name
          Value: MyEC2
      NetworkInterfaces:
        - DeviceIndex: 0
          SubnetId: !Ref MyPublicSN
          GroupSet:
          - !Ref MySG
          AssociatePublicIpAddress: true
      UserData:
        Fn::Base64:
          !Sub |
            #!/bin/bash
            hostnamectl --static set-hostname  MyEC2
            yum install httpd tmux -y
            curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
            unzip awscliv2.zip
            ./aws/install --bin-dir /usr/bin --install-dir /usr/bin --update
            sed -i "s/UTC/Asia\/Seoul/g" /etc/sysconfig/clock
            ln -sf /usr/share/zoneinfo/Asia/Seoul /etc/localtime

  MySG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow - SSH HTTP ICMP
      VpcId: !Ref MyVPC
      Tags:
        - Key: Name
          Value: My-SG
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: '22'
        ToPort: '22'
        CidrIp: 0.0.0.0/0
      - IpProtocol: tcp
        FromPort: '80'
        ToPort: '80'
        CidrIp: 0.0.0.0/0
      - IpProtocol: icmp
        FromPort: -1
        ToPort: -1
        CidrIp: 0.0.0.0/0

# VPC1 ALB
  VPC1SG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow - SSH HTTP ICMP
      VpcId: !Ref VPC1
      Tags:
        - Key: Name
          Value: VPC1-SG
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: '22'
        ToPort: '22'
        CidrIp: 0.0.0.0/0
      - IpProtocol: tcp
        FromPort: '80'
        ToPort: '80'
        CidrIp: 0.0.0.0/0
      - IpProtocol: icmp
        FromPort: -1
        ToPort: -1
        CidrIp: 0.0.0.0/0

  ALB:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Scheme: internet-facing
      Name: ALB-TEST
      SecurityGroups:
        - !Ref VPC1SG
      Subnets:
        - !Ref VPC1PublicSN1
        - !Ref VPC1PublicSN2

  ALBTG:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Name: ALB-TG
      Port: 80
      Protocol: HTTP
      HealthCheckPath: '/HealthCheck.txt'
      HealthCheckIntervalSeconds: 10
      HealthyThresholdCount: 3
      UnhealthyThresholdCount: 3
      TargetGroupAttributes: 
      - Key : deregistration_delay.timeout_seconds
        Value : '60'
      VpcId: !Ref VPC1
      Tags:
      - Key : Name
        Value : VPC1-ALBTG

  ALBListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref ALBTG
      LoadBalancerArn: !Ref ALB
      Port: 80
      Protocol: HTTP