{
	"Metadata": {
		"AWSToolsMetrics": {
			"IaC_Generator": "arn:aws:cloudformation:eu-central-1:671607590936:generatedTemplate/2dab13ab-9b07-45f7-b975-c10fa2c42bc7"
		},
		"AWS::CloudFormation::Interface": {
			"ParameterGroups": [
				{
					"Label": {
						"default": "Network Configuration"
					},
					"Parameters": [
						"VpcId",
						"SubnetIDs",
						"SecurityGroupIDs",
						"PrivateRouteTable"
					]
				}
			],
			"ParameterLabels": {
				"VpcId": {
					"default": "Target VPC"
				},
				"SubnetIDs": {
					"default": "Target Subnets"
				},
				"SecurityGroupIDs": {
					"default": "Security group ID"
				},
				"PrivateRouteTable": {
					"default": "VPC Route table for use with S3 and DynamoDB Endpoints"
				}
			}
		},
		"AWS::Composer::Groups": {
			"Group": {
				"Label": "VPC Endpoints",
				"Members": [
					"VPCEndpointS3",
					"VPCEndpointSTS",
					"VPCEndpointSM",
					"VPCEndpointMetering",
					"VPCEndpointDynamoDB",
					"VPCEndpointLogs",
					"VPCEndpointUSEastECRApi",
					"VPCEndpointUSEastECRDkr",
					"VPCEndpointUSEastS3"
				]
			}
		}
	},
	"AWSTemplateFormatVersion": "2010-09-09",
	"Description": "CloudFormation Stack template for creation of VPC Endpoints for S3, STS, Secrects Manager, DynamoDB, Metering and AWS Logs to ensure all communication happens within AWS network and doesn't go over public internet. In addition 3 endpoitns for Marketplace access in the US-EAST-1 region are installed: ECR API, ECR DKR and S3.",
	"Parameters": {
		"VpcId": {
			"ConstraintDescription": "VPC Id must begin with 'vpc-' and have a valid uuid",
			"Type": "AWS::EC2::VPC::Id",
			"Description": "Select an existing VPC to install the endpoints into"
		},
		"SecurityGroupIDs": {
			"Type": "List<AWS::EC2::SecurityGroup::Id>",
			"Description": "Specify list of the Security Groups for creation of endpoints."
		},
		"SubnetIDs": {
			"Type": "List<AWS::EC2::Subnet::Id>",
			"Description": "Specifies the list of existing VPC Subnets where ECS cluster services will run"
		},
		"PrivateRouteTable": {
			"Type": "String",
			"Description": "Specify route table of the subnets above (necessary for S3 and DynamoDB endpoitns). In new browser window go to VPC/Route tables and copy the ID of the route table. Route table needs to allow connection to application load balancer and to SAP system."
		}
	},
	"Conditions": {
		"IsNotUsEast1": {
			"Fn::Not": [
				{
					"Fn::Equals": [
					{ "Ref": "AWS::Region" },
					"us-east-1"
					]
				}
			]
		}
    },
	"Resources": {
		"VPCEndpointS3": {
			"UpdateReplacePolicy": "Retain",
			"Type": "AWS::EC2::VPCEndpoint",
			"DeletionPolicy": "Delete",
			"Properties": {
				"PrivateDnsEnabled": false,
				"VpcId": {
					"Ref": "VpcId"
				},
				"RouteTableIds": [
					{
						"Ref": "PrivateRouteTable"
					}
				],
				"ServiceName": {
					"Fn::Sub": "com.amazonaws.${AWS::Region}.s3"
				},
				"PolicyDocument": {
					"Version": "2008-10-17",
					"Statement": [
						{
							"Resource": "*",
							"Action": "*",
							"Effect": "Allow",
							"Principal": "*"
						}
					]
				},
				"VpcEndpointType": "Gateway"
			}
		},
		"VPCEndpointSTS": {
			"UpdateReplacePolicy": "Retain",
			"Type": "AWS::EC2::VPCEndpoint",
			"DeletionPolicy": "Delete",
			"Properties": {
				"PrivateDnsEnabled": true,
				"SecurityGroupIds": {
					"Ref": "SecurityGroupIDs"
				},
				"SubnetIds": {
					"Ref": "SubnetIDs"
				},
				"VpcId": {
					"Ref": "VpcId"
				},
				"RouteTableIds": [],
				"ServiceName": {
					"Fn::Sub": "com.amazonaws.${AWS::Region}.sts"
				},
				"PolicyDocument": {
					"Statement": [
						{
							"Resource": "*",
							"Action": "*",
							"Effect": "Allow",
							"Principal": "*"
						}
					]
				},
				"VpcEndpointType": "Interface"
			}
		},
		"VPCEndpointSM": {
			"UpdateReplacePolicy": "Retain",
			"Type": "AWS::EC2::VPCEndpoint",
			"DeletionPolicy": "Delete",
			"Properties": {
				"PrivateDnsEnabled": true,
				"SecurityGroupIds": {
					"Ref": "SecurityGroupIDs"
				},
				"SubnetIds": {
					"Ref": "SubnetIDs"
				},
				"VpcId": {
					"Ref": "VpcId"
				},
				"RouteTableIds": [],
				"ServiceName": {
					"Fn::Sub": "com.amazonaws.${AWS::Region}.secretsmanager"
				},
				"PolicyDocument": {
					"Statement": [
						{
							"Resource": "*",
							"Action": "*",
							"Effect": "Allow",
							"Principal": "*"
						}
					]
				},
				"VpcEndpointType": "Interface"
			}
		},
		"VPCEndpointMetering": {
			"UpdateReplacePolicy": "Retain",
			"Type": "AWS::EC2::VPCEndpoint",
			"DeletionPolicy": "Delete",
			"Properties": {
				"PrivateDnsEnabled": true,
				"SecurityGroupIds": {
					"Ref": "SecurityGroupIDs"
				},
				"SubnetIds": {
					"Ref": "SubnetIDs"
				},
				"VpcId": {
					"Ref": "VpcId"
				},
				"RouteTableIds": [],
				"ServiceName": {
					"Fn::Sub": "com.amazonaws.${AWS::Region}.metering-marketplace"
				},
				"PolicyDocument": {
					"Statement": [
						{
							"Resource": "*",
							"Action": "*",
							"Effect": "Allow",
							"Principal": "*"
						}
					]
				},
				"VpcEndpointType": "Interface"
			}
		},
		"VPCEndpointUSEastS3": {
			"UpdateReplacePolicy": "Retain",
			"Type": "AWS::EC2::VPCEndpoint",
			"Condition": "IsNotUsEast1",			
			"DeletionPolicy": "Delete",
			"Properties": {
				"PrivateDnsEnabled": true,
				"IpAddressType": "ipv4",
				"ServiceRegion": "us-east-1",
				"SecurityGroupIds": {
					"Ref": "SecurityGroupIDs"
				},
				"SubnetIds": {
					"Ref": "SubnetIDs"
				},
				"ServiceNetworkArn": "",
				"VpcId": {
					"Ref": "VpcId"
				},
				"RouteTableIds": [],
				"ServiceName": "com.amazonaws.us-east-1.s3",
				"PolicyDocument": {
					"Statement": [
						{
							"Resource": "*",
							"Action": "*",
							"Effect": "Allow",
							"Principal": "*"
						}
					]
				},
				"VpcEndpointType": "Interface",
				"Tags": [
					{
						"Value": "us-east-s3-endpoint",
						"Key": "Name"
					}
				]
			}
		},
		"VPCEndpointUSEastECRDkr": {
			"UpdateReplacePolicy": "Retain",
			"Type": "AWS::EC2::VPCEndpoint",
			"DeletionPolicy": "Delete",
			"Properties": {
				"PrivateDnsEnabled": true,
				"IpAddressType": "ipv4",
				"ServiceRegion": "us-east-1",
				"SecurityGroupIds": {
					"Ref": "SecurityGroupIDs"
				},
				"SubnetIds": {
					"Ref": "SubnetIDs"
				},
				"ServiceNetworkArn": "",
				"VpcId": {
					"Ref": "VpcId"
				},
				"RouteTableIds": [],
				"ServiceName": "com.amazonaws.us-east-1.ecr.dkr",
				"PolicyDocument": {
					"Statement": [
						{
							"Resource": "*",
							"Action": "*",
							"Effect": "Allow",
							"Principal": "*"
						}
					]
				},
				"VpcEndpointType": "Interface",
				"Tags": [
					{
						"Value": "us-east-ecr-dkr-endpoint",
						"Key": "Name"
					}
				]
			}
		},
		"VPCEndpointUSEastECRApi": {
			"UpdateReplacePolicy": "Retain",
			"Type": "AWS::EC2::VPCEndpoint",
			"DeletionPolicy": "Delete",
			"Properties": {
				"PrivateDnsEnabled": true,
				"IpAddressType": "ipv4",
				"ServiceRegion": "us-east-1",
				"SecurityGroupIds": {
					"Ref": "SecurityGroupIDs"
				},
				"SubnetIds": {
					"Ref": "SubnetIDs"
				},
				"ServiceNetworkArn": "",
				"VpcId": {
					"Ref": "VpcId"
				},
				"RouteTableIds": [],
				"ServiceName": "com.amazonaws.us-east-1.ecr.api",
				"PolicyDocument": {
					"Statement": [
						{
							"Resource": "*",
							"Action": "*",
							"Effect": "Allow",
							"Principal": "*"
						}
					]
				},
				"VpcEndpointType": "Interface",
				"Tags": [
					{
						"Value": "us-east-ecr-endpoint",
						"Key": "Name"
					}
				]
			}
		},
		"VPCEndpointDynamoDB": {
			"UpdateReplacePolicy": "Retain",
			"Type": "AWS::EC2::VPCEndpoint",
			"DeletionPolicy": "Delete",
			"Properties": {
				"VpcId": {
					"Ref": "VpcId"
				},
				"ServiceName": {
					"Fn::Sub": "com.amazonaws.${AWS::Region}.dynamodb"
				},
				"VpcEndpointType": "Gateway",
				"RouteTableIds": [
					{
						"Ref": "PrivateRouteTable"
					}
				]
			}
		},
		"VPCEndpointLogs": {
			"UpdateReplacePolicy": "Retain",
			"Type": "AWS::EC2::VPCEndpoint",
			"DeletionPolicy": "Delete",
			"Properties": {
				"PrivateDnsEnabled": true,
				"SecurityGroupIds": {
					"Ref": "SecurityGroupIDs"
				},
				"SubnetIds": {
					"Ref": "SubnetIDs"
				},
				"VpcId": {
					"Ref": "VpcId"
				},
				"RouteTableIds": [],
				"ServiceName": {
					"Fn::Sub": "com.amazonaws.${AWS::Region}.logs"
				},
				"PolicyDocument": {
					"Statement": [
						{
							"Resource": "*",
							"Action": "*",
							"Effect": "Allow",
							"Principal": "*"
						}
					]
				},
				"VpcEndpointType": "Interface"
			}
		}
	}
}