Parameters:
  Region:
    Type: String
    Default: us-east-2
    Description: Default region

  VpcName:
    Type: String 
    Default: dolvpc0x001
    Description: The name of the VPC

  VpcCidr:
    Type: String
    Default: 10.0.0.0/16
    Description: CIDR block for the VPC

  SubnetNames:
    Type: CommaDelimitedList
    Default: dolsub0x001, dolsub0x002
    Description: Names of the subnets

  SubnetCidrs:
    Type: CommaDelimitedList
    Default: 10.0.1.0/24, 10.0.2.0/24
    Description: CIDR blocks for the subnets

  InternetGatewayName:
    Type: String
    Default: doligw0x001
    Description: The name of the Internet Gateway

  InstanceType:
    Type: String
    Default: t2.micro
    Description: default instance type

  KeyName:
    Type: AWS::EC2::KeyPair::KeyName
    Default: dkoleary@2023
    Description: default ssh key

  InstanceName:
    Type: String
    Default: ub0x001
    Description: vm name

  ImageId:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-6.1-x86_64

  MyIp:
    Type: String
    Description: Your public IP address
    Default: 73.58.96.106/32

Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCidr
      EnableDnsHostnames: true
      EnableDnsSupport: true
      InstanceTenancy: default
      Tags:
        - Key: Name
          Value: !Ref VpcName

  Subnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Select [0, !Ref SubnetCidrs]
      AvailabilityZone: !Select [0, !GetAZs '']
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Select [0, !Ref SubnetNames]

  Subnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Select [1, !Ref SubnetCidrs]
      AvailabilityZone: !Select [1, !GetAZs '']
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Select [1, !Ref SubnetNames]

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: !Ref InternetGatewayName

  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: Public

  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: AttachGateway
    Properties:
      RouteTableId: !Ref RouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref Subnet2
      RouteTableId: !Ref RouteTable

  SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: allow_ssh
      GroupDescription: Allow SSH inbound traffic
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: !Ref MyIp
          Description: ssh de home
      SecurityGroupEgress:
        - IpProtocol: -1
          FromPort: 0
          ToPort: 0
          CidrIp: 0.0.0.0/0
          Description: allow all outbound
      Tags:
        - Key: Name
          Value: SSHAccess

  S3VpcEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref VPC
      ServiceName: !Sub 'com.amazonaws.${AWS::Region}.s3'
      RouteTableIds:
        - !Ref RouteTable
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: '*'
            Resource: '*'
            Principal: '*'

  SecretsManagerVpcEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref VPC
      ServiceName: !Sub 'com.amazonaws.${AWS::Region}.secretsmanager'
      VpcEndpointType: Interface
      SubnetIds:
        - !Ref Subnet2
      SecurityGroupIds:
        - !Ref SecurityGroup

  EC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Ref ImageId
      InstanceType: !Ref InstanceType
      KeyName: !Ref KeyName
      SubnetId: !Ref Subnet2
      SecurityGroupIds:
        - !Ref SecurityGroup
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            Encrypted: true
      Tags:
        - Key: Name
          Value: !Ref InstanceName

Outputs:
  LatestAmazonLinuxAmiId:
    Description: The ID of the latest Amazon Linux 2 AMI
    Value: !Ref ImageId

  MyIp:
    Value: !Ref MyIp

  InstanceIp:
    Description: The public IP address of the EC2 instance, prefixed with host and hostname
    Value: !Join 
      - ''
      - - 'host '
        - !Ref InstanceName
        - newline
        - '  hostname '
        - !GetAtt EC2Instance.PublicIp
