D2L Course Site Request - CloudFormation Template (4 of 4)

Deploys D2L Course Site Request remaining infrastructure.

• assumes existance of:

  S3 bucket (template 1) RDS SQL instance (template 2) CloudFront Distribution (template 3)

Parameters

These are the input parameters for this template. All of these parameters must be supplied for this template to be deployed.

ScheduledTasksDisabled is a flag used to determine if scheduled tasks should be disabled when task server is created

S3StackName is the name of the stack that created the S3 buckets

RdsStackName is the name of the stack that created the RDS SQL Server instance

CloudFrontStackName is the name of the stack that created the CloudFront Distribution

BucketNamePrefix is the prefix of the name of the S3 buckets

AmiId is the AMI ID to use for the Windows EC2 instances (Windows Server 2012 R2 Base)

Ec2KeyPairName is the EC2 KeyPair name used for instance launch (req'd to retrieve Windows admin password)

EmailForSNSSubscription is the email address to use for the SNS subscription

• sls-nonprod: d2lcsr-aws-nonprod@list.arizona.edu
• sls-prod: d2lcsr-aws-prod@list.arizona.edu

InstanceTypeTask is the EC2 instance type for the task server

InstanceTypeWeb is the EC2 instance type for the web servers

VPCID is the ID of the VPC where this template will be deployed. -sls-nonprod: vpc-2dc9b34a -sls-prod: vpc-82ee9de5

PrivateSubnetA is the private Subnet ID for us-west-2a -sls-nonprod: subnet-49338600 -sls-prod: subnet-fd862bb4

PrivateSubnetB is the private Subnet ID for us-west-2b -sls-nonprod: subnet-7f019218 -sls-prod: subnet-ca49c2ad

PublicSubnetA is the public Subnet ID for us-west-2a -sls-nonprod: subnet-48338601 -sls-prod: subnet-fc862bb5

PublicSubnetB is the public Subnet ID for us-west-2b -sls-nonprod: subnet-fc862bb5 -sls-prod: subnet-cb49c2ac

AsgAZs is the list of AZs to use for the Auto Scaling Groups

SSLCertARN is the ARN of the SSL certificate to use for the ELB

• sls-nonprod: arn:aws:acm:us-west-2:776095071695:certificate/14d7a136-05d8-47ec-a917-7cc6fba2c007
• sls-prod: arn:aws:acm:us-west-2:918461542486:certificate/df1e7a1a-8413-4f57-9c69-baac375a06e3

KMSDefaultSSMKeyARN is the ARN of of the default aws/ssm KMS key -sls-nonprod: arn:aws:kms:us-west-2:998687558142:key/1ff283f9-2cf7-4d39-9af3-7c5c19c82bac -sls-prod: arn:aws:kms:us-west-2:918461542486:key/82ebf30f-2c0e-4b84-845a-21665c56e7b0

Metadata

Metadata is mostly for organizing and presenting Parameters in a better way when using CloudFormation in the AWS Console UI.

Conditions

Establishes conditions based on input parameters.

Resources

Wow. This is a lot of resources to deploy. Do you really need them all?

EC2 Security Groups

EC2 Security Groups for the EC2 instances & ELB

EC2 Security Group for the Elastic Load Balancer (ELB)

EC2 Security Group for the web servers

EC2 Security Group Ingress to update the existing Security Group for RDS to allow access to web & task servers

Elastic Load Balancers (ELB) v2

 - Includes ELB, target group & listeners

ELB itself

ELB Target Group

ELB Listeners

CloudWatch Logs

 - Includes Log Group & SSM Document

CloudWatch Log Group

SSM Document (to associate with the web servers for CloudWatch Log configuration)

Auto Scaling Groups

 - includes ASG, Scaling Policy, Launch Config & CW Alarms

Auto Scaling Groups

Launch Configurations

$msiInstalls.Add("AWSCLI", "https://s3.amazonaws.com/aws-cli/AWSCLI64.msi")

Add the Windows Feature "Active Directory module for Windows PowerShell"

Download and install MSIs

(New-Object System.Net.WebClient).DownloadFile($msiInstalls.Item($msi), (Join-Path -Path $rootBootstrap -ChildPath "$($msi).msi"))

Download from S3

Install MSI

Make folders for apps

Download zipped apps from S3

Unzip zipped apps & delete zips when done

Change to use campus DNS to ease access to the Isilon

Create the scheduled tasks

Set argument (if value exists)

Configure Repetition Interval (if value exists)

Configure Repetition Duration (if value exists)

Disable task if set to be disabled (value is 'true')

Get the instanceId

Assign a "Name" tag to the instance to be friendly to the console UI

Retrieve/decrypt credentials from SSM Parameter Store for user with delagated rights to create/delete computer objects in domain

Check if the computer object already exists in the target OU, delete it if so

Join to the domain and reboot

$s3bucket = "edu-arizona-sls-nonprod-d2lcsr-$($environmentName)"

$msiInstalls.Add("AWSCLI", "https://s3.amazonaws.com/aws-cli/AWSCLI64.msi")

Install Windows features

Download and install MSIs

Testing revealed just how subject to change vendor URLs are so we'll maintain the MSIs ourselves in our S3 bucket (New-Object System.Net.WebClient).DownloadFile($msiInstalls.Item($msi), (Join-Path -Path $rootBootstrap -ChildPath "$($msi).msi"))

Make folders for web content

Create the app pools, enable 32-bit apps on the app pools & creating the web sites NOTE: forcing sort to get a consistent IIS site Id for use with Shibboleth SP

Create application in CSR site for Library Extract

Set default IIS logging folder

Create a default document on the Default Web Site for the ELB health check (lest you end up with 403.14 errors)

Download zipped apps from S3

Unzip zipped apps & delete zips when done

Set Modify folder/file permissions for Course Export app pool requires creating/writing to a file

Download Shibboleth configuration from S3

Override lock & set config for an ISAPI filter on CSR site for Shibboleth

* NOTE: The ISAPI filter is in the app's web.config so do not need to handle here at this time Add-WebConfiguration //isapiFilters "IIS:\sites\CSR" -Value @{ name = 'Shibboleth'; path = 'D:\opt\shibboleth-sp\lib\shibboleth\isapi_shib.dll' }

Override lock & set config for an ISAPI & CGI Restrictions for Shibboleth

Add a Handler Mapping for Shibboleth ** NOTE: the .sso handler mapping is in the app's web.config so do not need to handle this here at this time New-WebHandler -PSPath "IIS:\sites\CSR" -Name Shibboleth -Path .sso -ScriptProcessor "D:\opt\shibboleth-sp\lib\shibboleth\isapi_shib.dll" -Verb "" -Modules IsapiModule -ResourceType Unspecified

Restart Shibboleth service (so that config changes take effect)

Perform an IISReset (else the Shibboleth ISAPI filter won't load)

Override lock, set unlisted IP default deny & set allow IP range restrictions on Grade site * NOTE: the IP restriction settings are in the app's web.config so do not need to handle this here at this time (but we will unlock the section so they'll take)

Set-WebConfigurationProperty /system.webServer/security/ipSecurity -PSPath "IIS:\Sites\Grade" -Name allowUnlisted -Value "False" foreach ($ip in $ipRestrictions.Keys) { Add-WebConfiguration //ipSecurity "IIS:\Sites\Grade" -Value @{ ipAddress = "$($ip)"; subnetMask = "$($ipRestrictions.Item($ip))"; allowed = "True" }

Get the instanceId & availiability zone

Create an SSM association for the CloudWatch Logs configuration

Assign a "Name" tag to the instance to be friendly to the console UI

$awsEnvironmentTag = New-Object Amazon.EC2.Model.Tag $awsEnvironmentTag.Key = "environment" $awsEnvironmentTag.Value = $environmentName

$awsTags += $awsEnvironmentTag

Download PowerShell scripts and schedule a task to cleanup the IIS logs

Scaling Policies

CloudWatch Alarms

Route53

Route53 Record Set Group

SNS

SNS Topic

IAM

IAM Roles

IAM Instance Profiles

IAM Policies

Outputs

Outputs are values resulting from the CloudFormation stack that can be: 1) Viewed in the AWS cosole under the CloudFormation service. 2) Marked as export to be imported into another stack allowing cross-stack references.