Re-add AWS Deployment Template (#1427)
This commit is contained in:
Scottpedia
GitHub
parent
3f10e2efaf
commit
ef24c47928
@ -92,7 +92,7 @@ Other supported Linux distributions.
|
||||
|
||||
This also includes Linux VMs in public clouds, such as [DigitalOcean](https://blog.ls20.com/digitalocean), [Vultr](https://blog.ls20.com/vultr), [Linode](https://blog.ls20.com/linode), [OVH](https://www.ovhcloud.com/en/vps/) and [Microsoft Azure](https://azure.microsoft.com). Public cloud users can also deploy using [user data](https://blog.ls20.com/ipsec-l2tp-vpn-auto-setup-for-ubuntu-12-04-on-amazon-ec2/#vpnsetup).
|
||||
|
||||
[](http://dovpn.carlfriess.com) [](https://cloud.linode.com/stackscripts/37239) [](azure/README.md)
|
||||
[](http://dovpn.carlfriess.com) [](https://cloud.linode.com/stackscripts/37239) [](azure/README.md) [](aws/README.md)
|
||||
|
||||
[**» I want to run my own VPN but don't have a server for that**](https://blog.ls20.com/ipsec-l2tp-vpn-auto-setup-for-ubuntu-12-04-on-amazon-ec2/#gettingavps)
|
||||
|
||||
|
||||
86
aws/README-zh.md
Normal file
86
aws/README-zh.md
Normal file
@ -0,0 +1,86 @@
|
||||
[English](README.md) | [中文](README-zh.md)
|
||||
|
||||
# 使用 CloudFormation 在 Amazon EC2 上部署
|
||||
|
||||
使用这个模板，你可以在 Amazon Elastic Compute Cloud（Amazon EC2）上快速搭建一个 IPsec VPN 服务器。在继续之前，请参见 EC2 [定价细节](https://aws.amazon.com/cn/ec2/pricing/on-demand/)。在部署中使用 `t2.micro` 服务器实例可能符合 [AWS 免费套餐](https://aws.amazon.com/cn/free/) 的资格。
|
||||
|
||||
可用的自定义参数：
|
||||
|
||||
- Amazon EC2 实例类型
|
||||
> <details><summary><strong>注：</strong> 在某些 AWS 区域中，此模版提供的某些实例类型可能不可用。（点击查看详情）
|
||||
> </summary>
|
||||
>
|
||||
> 比如 `m5a.large` 可能无法在 `ap-east-1` 区域部署（仅为假设）。在此情况下，你会在部署过程中遇到此错误：`The requested configuration is currently not supported. Please check the documentation for supported configurations`。新开放的 AWS 区域更容易出现此问题，因为它们提供的实例类型较少。如需了解更多关于实例可用性的信息，请参见 [https://ec2instances.info](https://ec2instances.info)。</details>
|
||||
|
||||
- VPN 服务器的操作系统（Ubuntu 22.04/20.04, Debian 10/11/12, CentOS 7, Amazon Linux 2）
|
||||
- 你的 VPN 用户名
|
||||
- 你的 VPN 密码
|
||||
- 你的 VPN IPsec PSK（预共享密钥）
|
||||
|
||||
> **注：** \*不要\* 在值中使用这些字符： `\ " '`
|
||||
|
||||
确保使用 **AWS 账户根用户** 或者有 **管理员权限** 的 **IAM 用户** 部署此模板。
|
||||
|
||||
右键单击这个 [**模板链接**](https://raw.githubusercontent.com/hwdsl2/setup-ipsec-vpn/master/aws/cloudformation-template-ipsec.json)，并将它保存到你的计算机上的一个新文件。然后在 ["创建堆栈" 向导](https://console.aws.amazon.com/cloudformation/home#/stacks/new)中将其作为模板源上传。
|
||||
|
||||
|
||||
|
||||
在步骤 4，你需要确认（选择）此模板可以创建 IAM 资源。
|
||||
|
||||
|
||||
|
||||
点击下面的图标开始：
|
||||
|
||||
<a href="https://console.aws.amazon.com/cloudformation/home#/stacks/new" target="_blank"><img src="cloudformation-launch-stack-button.png" alt="Launch stack" height="34px"></a>
|
||||
|
||||
要指定一个 AWS 区域，你可以使用导航栏上你的帐户信息右侧的选择器。当你在最后一步中点击 "create stack" 之后，请等待堆栈创建和 VPN 安装完成，可能需要最多 15 分钟。一旦堆栈的部署状态变成 **"CREATE_COMPLETE"** ，你就可以连接到 VPN 服务器了。单击 **Outputs** 选项卡以查看你的 VPN 登录信息，然后继续下一步：[配置 VPN 客户端](../README-zh.md#下一步)。
|
||||
|
||||
> **注**：如果你删除使用此模板部署的 CloudFormation 堆栈，在部署期间添加的密钥对将不会自动被清理。要管理你的密钥对，请转到 EC2 控制台 -> 密钥对。
|
||||
|
||||
## 常见问题
|
||||
|
||||
<details>
|
||||
<summary>
|
||||
部署后如何通过 SSH 连接到服务器？
|
||||
</summary>
|
||||
|
||||
你需要你的 Amazon EC2 实例的用户名和私钥，才能通过 SSH 登录到该实例。
|
||||
|
||||
EC2 上的每个 Linux 服务器发行版本都有它自己的默认登录用户名。新实例默认禁用密码登录，必须使用私钥或 “密钥对” 登录。
|
||||
|
||||
默认用户名列表：
|
||||
> **参考链接：** [https://docs.aws.amazon.com/zh_cn/AWSEC2/latest/UserGuide/connection-prereqs.html#connection-prereqs-private-key](https://docs.aws.amazon.com/zh_cn/AWSEC2/latest/UserGuide/connection-prereqs.html#connection-prereqs-private-key)
|
||||
|
||||
| 发行版本 | 默认登录用户名 |
|
||||
| --- | --- |
|
||||
| Ubuntu | `ubuntu` |
|
||||
| Debian | `admin` |
|
||||
| CentOS (`CentOS Linux 7`) | `centos` |
|
||||
| Amazon Linux 2 | `ec2-user` |
|
||||
|
||||
此模板在部署期间为你生成一个密钥对，并且在成功创建堆栈后，其中的私钥将在 **Outputs** 选项卡下以文本形式提供。
|
||||
|
||||
如果要通过 SSH 访问 VPN 服务器，则需要将 **Outputs** 选项卡中的私钥保存到你的计算机上的一个新文件。
|
||||
|
||||
> **注：** 在保存到你的计算机之前，你可能需要修改私钥的格式，比如用换行符替换所有的空格。在保存后，需要为该私钥文件设置[适当的权限](https://docs.aws.amazon.com/zh_cn/AWSEC2/latest/UserGuide/connection-prereqs.html#connection-prereqs-private-key)才能使用。
|
||||
|
||||
|
||||
|
||||
要为私钥文件设置适当的权限，请在该文件所在的目录下运行以下命令：
|
||||
```bash
|
||||
sudo chmod 400 key-file.pem
|
||||
```
|
||||
|
||||
使用 SSH 登录到 EC2 实例的示例命令：
|
||||
```bash
|
||||
$ ssh -i path/to/your/key-file.pem instance-username@instance-ip-address
|
||||
```
|
||||
</details>
|
||||
|
||||
## 作者
|
||||
|
||||
版权所有 (C) 2020-2023 [S. X. Liang](https://github.com/scottpedia)
|
||||
|
||||
## 屏幕截图
|
||||
|
||||
|
||||
86
aws/README.md
Normal file
86
aws/README.md
Normal file
@ -0,0 +1,86 @@
|
||||
[English](README.md) | [中文](README-zh.md)
|
||||
|
||||
# Deploy to Amazon EC2 using CloudFormation
|
||||
|
||||
This template will create a fully-working IPsec VPN server on Amazon Elastic Compute Cloud (Amazon EC2). Please make sure to check the EC2 [pricing details](https://aws.amazon.com/ec2/pricing/on-demand/) before continuing. Using a `t2.micro` server instance for your deployment may qualify for the [AWS Free Tier](https://aws.amazon.com/free/).
|
||||
|
||||
Available customization parameters:
|
||||
|
||||
- Amazon EC2 instance type
|
||||
> <details><summary><strong>Note</strong>: It is possible that not all instance type options offered by this template are available in a specific AWS region.(expand for details)
|
||||
> </summary>
|
||||
>
|
||||
> For example, you may not be able to deploy an `m5a.large` instance in `ap-east-1` (hypothetically). In that case, you might experience the following error during deployment: `The requested configuration is currently not supported. Please check the documentation for supported configurations`. Newly released regions are more prone to having this problem as there are less variety of instances. For more info about instance type availability, refer to [https://instances.vantage.sh/](https://instances.vantage.sh/).</details>
|
||||
|
||||
- OS for your VPN server (Ubuntu 22.04/20.04, Debian 10/11/12, CentOS 7, Amazon Linux 2)
|
||||
- Your VPN username
|
||||
- Your VPN password
|
||||
- Your VPN IPsec PSK (pre-shared key)
|
||||
|
||||
> **Note**: DO NOT use these special characters within values: `\ " '`
|
||||
|
||||
Make sure to deploy this template with an **AWS Account Root User** or an **IAM Account** with **Administrator Access**.
|
||||
|
||||
Right-click this [**template link**](https://raw.githubusercontent.com/hwdsl2/setup-ipsec-vpn/master/aws/cloudformation-template-ipsec.json) and save as a file on your computer. Then upload it as the template source in the [stack creation wizard](https://console.aws.amazon.com/cloudformation/home#/stacks/new).
|
||||
|
||||
|
||||
|
||||
At step 4, make sure to confirm that this template may create IAM resources.
|
||||
|
||||
|
||||
|
||||
Click the icon below to start:
|
||||
|
||||
<a href="https://console.aws.amazon.com/cloudformation/home#/stacks/new" target="_blank"><img src="cloudformation-launch-stack-button.png" alt="Launch stack" height="34px"></a>
|
||||
|
||||
You may choose an AWS region using the selector to the right of your account information on the navigation bar. After you click "create stack" in the final step, please wait for the stack creation and VPN setup to complete, which may take up to 15 minutes. As soon as the stack's status changes to **"CREATE_COMPLETE"**, you are ready to connect to the VPN server. Click the **Outputs** tab to view your VPN login details. Then continue to [Next steps: Configure VPN Clients](../README.md#next-steps).
|
||||
|
||||
> **Note**: If you delete a CloudFormation stack deployed using this template, the key pair that was added during deployment won't be automatically cleaned up. To manage your key pairs, go to EC2 console -> Key Pairs.
|
||||
|
||||
## FAQs
|
||||
|
||||
<details>
|
||||
<summary>
|
||||
How to connect to the server via SSH after deployment?
|
||||
</summary>
|
||||
|
||||
You need to know the username and the private key for your Amazon EC2 instance in order to login to it via SSH.
|
||||
|
||||
Each Linux server distribution on EC2 has its own default login username. Password login is disabled by default for new instances, and the use of private keys, or "key pairs", is enforced.
|
||||
|
||||
List of default usernames:
|
||||
> **Reference:** [https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/connection-prereqs.html](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/connection-prereqs.html)
|
||||
|
||||
| Distribution | Default Login Username |
|
||||
| --- | --- |
|
||||
| Ubuntu | `ubuntu` |
|
||||
| Debian | `admin` |
|
||||
| CentOS (`CentOS Linux 7`) | `centos` |
|
||||
| Amazon Linux 2 | `ec2-user` |
|
||||
|
||||
This template generates a key pair for you during deployment, and the private key will be available as text under the **Outputs** tab after the stack is successfully created.
|
||||
|
||||
You will need to save the private key from the **Outputs** tab to a file on your computer, if you want to access the VPN server via SSH.
|
||||
|
||||
> **Note:** You may need to format the private key by replacing all spaces with newlines, before saving to a file. The file will need to be set with [proper permissions](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/connection-prereqs.html#connection-prereqs-private-key) before using.
|
||||
|
||||
|
||||
|
||||
To apply proper permissions to your private key file, run the following command under the directory where the file is located:
|
||||
```bash
|
||||
sudo chmod 400 key-file.pem
|
||||
```
|
||||
|
||||
Example command to login to your EC2 instance using SSH:
|
||||
```bash
|
||||
$ ssh -i path/to/your/key-file.pem instance-username@instance-ip-address
|
||||
```
|
||||
</details>
|
||||
|
||||
## Author
|
||||
|
||||
Copyright (C) 2020-2023 [S. X. Liang](https://github.com/scottpedia)
|
||||
|
||||
## Screenshots
|
||||
|
||||
|
||||
BIN
aws/cloudformation-launch-stack-button.png
Normal file
BIN
aws/cloudformation-launch-stack-button.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 2.2 KiB |
582
aws/cloudformation-template-ipsec.json
Normal file
582
aws/cloudformation-template-ipsec.json
Normal file
@ -0,0 +1,582 @@
|
||||
{
|
||||
"AWSTemplateFormatVersion": "2010-09-09",
|
||||
"Mappings": {
|
||||
"OS": {
|
||||
"Ubuntu2004": {
|
||||
"HelperInstallationCommands": "export DEBIAN_FRONTEND=noninteractive\napt-get -yq update\napt-get -yq install python3-pip\npython3 -m pip install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-latest.tar.gz\n"
|
||||
},
|
||||
"Ubuntu2204": {
|
||||
"HelperInstallationCommands": "export DEBIAN_FRONTEND=noninteractive\napt-get -yq update\napt-get -yq install python3-pip\npython3 -m pip install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-latest.tar.gz\n"
|
||||
},
|
||||
"Debian10": {
|
||||
"HelperInstallationCommands": "export DEBIAN_FRONTEND=noninteractive\napt-get -yq update\napt-get -yq install python3-pip\npython3 -m pip install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-latest.tar.gz\n"
|
||||
},
|
||||
"Debian11": {
|
||||
"HelperInstallationCommands": "export DEBIAN_FRONTEND=noninteractive\napt-get -yq update\napt-get -yq install python3-pip\npython3 -m pip install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-latest.tar.gz\n"
|
||||
},
|
||||
"Debian12": {
|
||||
"HelperInstallationCommands": "export DEBIAN_FRONTEND=noninteractive\nrm -rf /usr/lib/python3.*/EXTERNALLY-MANAGED\napt-get -yq update\napt-get -yq install python3-pip\npython3 -m pip install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-latest.tar.gz\n"
|
||||
},
|
||||
"CentOS7": {
|
||||
"HelperInstallationCommands": "yum -y install python3 wget\npython3 -m pip install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-latest.tar.gz\n"
|
||||
},
|
||||
"AmazonLinux2": {
|
||||
"HelperInstallationCommands": "export PATH=\"$PATH:/opt/aws/bin\"\n"
|
||||
}
|
||||
}
|
||||
},
|
||||
"Metadata": {},
|
||||
"Resources": {
|
||||
"VpnVpc": {
|
||||
"Type": "AWS::EC2::VPC",
|
||||
"Properties": {
|
||||
"CidrBlock": "10.0.0.0/24"
|
||||
},
|
||||
"Metadata": {}
|
||||
},
|
||||
"VpnSubnet": {
|
||||
"Type": "AWS::EC2::Subnet",
|
||||
"Properties": {
|
||||
"VpcId": {
|
||||
"Ref": "VpnVpc"
|
||||
},
|
||||
"CidrBlock": "10.0.0.0/24",
|
||||
"MapPublicIpOnLaunch": true,
|
||||
"AvailabilityZone": {
|
||||
"Fn::Select": [
|
||||
"0",
|
||||
{
|
||||
"Fn::GetAZs": ""
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"Metadata": {},
|
||||
"DependsOn": [
|
||||
"VpnVpc",
|
||||
"VpcInternetGateway"
|
||||
]
|
||||
},
|
||||
"VpnRouteTable": {
|
||||
"Type": "AWS::EC2::RouteTable",
|
||||
"Properties": {
|
||||
"VpcId": {
|
||||
"Ref": "VpnVpc"
|
||||
}
|
||||
},
|
||||
"Metadata": {},
|
||||
"DependsOn": [
|
||||
"VpnSubnet"
|
||||
]
|
||||
},
|
||||
"PublicInternetRoute": {
|
||||
"Type": "AWS::EC2::Route",
|
||||
"Properties": {
|
||||
"DestinationCidrBlock": "0.0.0.0/0",
|
||||
"RouteTableId": {
|
||||
"Ref": "VpnRouteTable"
|
||||
},
|
||||
"GatewayId": {
|
||||
"Ref": "VpcInternetGateway"
|
||||
}
|
||||
},
|
||||
"Metadata": {},
|
||||
"DependsOn": [
|
||||
"VpnRouteTable",
|
||||
"VpcInternetGateway",
|
||||
"InternetGatewayAttachment"
|
||||
]
|
||||
},
|
||||
"VpnInstance": {
|
||||
"Type": "AWS::EC2::Instance",
|
||||
"CreationPolicy": {
|
||||
"ResourceSignal": {
|
||||
"Timeout": "PT15M"
|
||||
}
|
||||
},
|
||||
"Properties": {
|
||||
"UserData": {
|
||||
"Fn::Base64": {
|
||||
"Fn::Join": [
|
||||
"",
|
||||
[
|
||||
"#!/bin/bash -xe\n",
|
||||
"trap 'cfn-signal -e 1 ",
|
||||
" --stack ",
|
||||
{
|
||||
"Ref": "AWS::StackName"
|
||||
},
|
||||
" --resource VpnInstance ",
|
||||
" --region ",
|
||||
{
|
||||
"Ref": "AWS::Region"
|
||||
},
|
||||
"' ERR\n",
|
||||
"sleep 60\n",
|
||||
{
|
||||
"Fn::FindInMap": [
|
||||
"OS",
|
||||
{
|
||||
"Ref": "OS"
|
||||
},
|
||||
"HelperInstallationCommands"
|
||||
]
|
||||
},
|
||||
"export VPN_IPSEC_PSK='",
|
||||
{
|
||||
"Ref": "VpnIpsecPsk"
|
||||
},
|
||||
"'\n",
|
||||
"export VPN_USER='",
|
||||
{
|
||||
"Ref": "VpnUser"
|
||||
},
|
||||
"'\n",
|
||||
"export VPN_PASSWORD='",
|
||||
{
|
||||
"Ref": "VpnPassword"
|
||||
},
|
||||
"'\n",
|
||||
"wget -t 3 -T 30 -nv -O vpn.sh https://github.com/hwdsl2/setup-ipsec-vpn/raw/master/vpnsetup.sh\n",
|
||||
"sh vpn.sh\n",
|
||||
"cfn-signal -e 0 ",
|
||||
" --stack ",
|
||||
{
|
||||
"Ref": "AWS::StackName"
|
||||
},
|
||||
" --resource VpnInstance ",
|
||||
" --region ",
|
||||
{
|
||||
"Ref": "AWS::Region"
|
||||
},
|
||||
"\n"
|
||||
]
|
||||
]
|
||||
}
|
||||
},
|
||||
"SecurityGroupIds": [
|
||||
{
|
||||
"Fn::GetAtt": [
|
||||
"VpnSecurityGroup",
|
||||
"GroupId"
|
||||
]
|
||||
}
|
||||
],
|
||||
"SubnetId": {
|
||||
"Ref": "VpnSubnet"
|
||||
},
|
||||
"AvailabilityZone": {
|
||||
"Fn::Select": [
|
||||
"0",
|
||||
{
|
||||
"Fn::GetAZs": ""
|
||||
}
|
||||
]
|
||||
},
|
||||
"InstanceType": {
|
||||
"Ref": "InstanceType"
|
||||
},
|
||||
"KeyName": {
|
||||
"Fn::GetAtt": [
|
||||
"KeyPairInfo",
|
||||
"KeyName"
|
||||
]
|
||||
},
|
||||
"ImageId": {
|
||||
"Fn::GetAtt": [
|
||||
"AMIInfo",
|
||||
"AMIId"
|
||||
]
|
||||
}
|
||||
},
|
||||
"Metadata": {},
|
||||
"DependsOn": [
|
||||
"VpnRouteTable",
|
||||
"VpnServerVolume",
|
||||
"KeyPairCreation",
|
||||
"AMIInfoFunction",
|
||||
"VpnSecurityGroup"
|
||||
]
|
||||
},
|
||||
"VpnSecurityGroup": {
|
||||
"Type": "AWS::EC2::SecurityGroup",
|
||||
"Properties": {
|
||||
"GroupDescription": "The VPN Security Group, allowing ingress UDP traffic at port 4500 and 500.",
|
||||
"GroupName": "VpnSecurityGroup",
|
||||
"VpcId": {
|
||||
"Ref": "VpnVpc"
|
||||
},
|
||||
"SecurityGroupIngress": [
|
||||
{
|
||||
"CidrIp": "0.0.0.0/0",
|
||||
"IpProtocol": "tcp",
|
||||
"FromPort": 22,
|
||||
"ToPort": 22
|
||||
},
|
||||
{
|
||||
"CidrIp": "0.0.0.0/0",
|
||||
"IpProtocol": "udp",
|
||||
"FromPort": 500,
|
||||
"ToPort": 500
|
||||
},
|
||||
{
|
||||
"CidrIp": "0.0.0.0/0",
|
||||
"IpProtocol": "udp",
|
||||
"FromPort": 4500,
|
||||
"ToPort": 4500
|
||||
}
|
||||
],
|
||||
"SecurityGroupEgress": [
|
||||
{
|
||||
"CidrIp": "0.0.0.0/0",
|
||||
"IpProtocol": -1
|
||||
}
|
||||
]
|
||||
},
|
||||
"Metadata": {}
|
||||
},
|
||||
"VpnServerVolume": {
|
||||
"Type": "AWS::EC2::Volume",
|
||||
"Properties": {
|
||||
"AvailabilityZone": {
|
||||
"Fn::Select": [
|
||||
"0",
|
||||
{
|
||||
"Fn::GetAZs": ""
|
||||
}
|
||||
]
|
||||
},
|
||||
"Size": 8
|
||||
},
|
||||
"Metadata": {}
|
||||
},
|
||||
"VpcInternetGateway": {
|
||||
"Type": "AWS::EC2::InternetGateway",
|
||||
"Properties": {},
|
||||
"Metadata": {},
|
||||
"DependsOn": [
|
||||
"VpnVpc"
|
||||
]
|
||||
},
|
||||
"EC2SRTA4VJU5": {
|
||||
"Type": "AWS::EC2::SubnetRouteTableAssociation",
|
||||
"Properties": {
|
||||
"RouteTableId": {
|
||||
"Ref": "VpnRouteTable"
|
||||
},
|
||||
"SubnetId": {
|
||||
"Ref": "VpnSubnet"
|
||||
}
|
||||
},
|
||||
"Metadata": {}
|
||||
},
|
||||
"KeyPairCreation": {
|
||||
"Type": "AWS::Lambda::Function",
|
||||
"Properties": {
|
||||
"Handler": "index.handler",
|
||||
"Runtime": "python3.7",
|
||||
"Role": {
|
||||
"Fn::GetAtt": [
|
||||
"LambdaExecutionRole",
|
||||
"Arn"
|
||||
]
|
||||
},
|
||||
"Timeout": 30,
|
||||
"Code": {
|
||||
"ZipFile": {
|
||||
"Fn::Join": [
|
||||
"\n",
|
||||
[
|
||||
"import boto3",
|
||||
"import cfnresponse",
|
||||
"import string",
|
||||
"import random",
|
||||
"'''",
|
||||
"This python program should be embedded into its designated cloudformation",
|
||||
"template as the inline code of one of the lambda functions.",
|
||||
"'''",
|
||||
"def handler(event, context):",
|
||||
" try:",
|
||||
" keyName = 'setup-ipsec-vpn-' + ''.join(random.SystemRandom().choice(string.ascii_letters + string.digits) for _ in range(10))",
|
||||
" region = event['ResourceProperties']['Region']",
|
||||
" ec2 = boto3.client('ec2',region)",
|
||||
" response = ec2.create_key_pair(",
|
||||
" KeyName=keyName",
|
||||
" )",
|
||||
" keyMaterial = response['KeyMaterial']",
|
||||
" cfnresponse.send(event, context, cfnresponse.SUCCESS, {'KeyMaterial':keyMaterial, 'KeyName':keyName}, 'KeyPairInfo')",
|
||||
" except Exception:",
|
||||
" cfnresponse.send(event, context, cfnresponse.FAILED, {})"
|
||||
]
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
"Metadata": {},
|
||||
"DependsOn": [
|
||||
"LambdaExecutionRole"
|
||||
]
|
||||
},
|
||||
"AMIInfo": {
|
||||
"Type": "Custom::AMIInfo",
|
||||
"Properties": {
|
||||
"Region": {
|
||||
"Ref": "AWS::Region"
|
||||
},
|
||||
"ServiceToken": {
|
||||
"Fn::GetAtt": [
|
||||
"AMIInfoFunction",
|
||||
"Arn"
|
||||
]
|
||||
},
|
||||
"Distribution": {
|
||||
"Ref": "OS"
|
||||
}
|
||||
},
|
||||
"Metadata": {},
|
||||
"DependsOn": [
|
||||
"AMIInfoFunction"
|
||||
]
|
||||
},
|
||||
"AMIInfoFunction": {
|
||||
"Type": "AWS::Lambda::Function",
|
||||
"Properties": {
|
||||
"Handler": "index.handler",
|
||||
"Runtime": "python3.7",
|
||||
"Role": {
|
||||
"Fn::GetAtt": [
|
||||
"LambdaExecutionRole",
|
||||
"Arn"
|
||||
]
|
||||
},
|
||||
"Code": {
|
||||
"ZipFile": {
|
||||
"Fn::Join": [
|
||||
"\n",
|
||||
[
|
||||
"import boto3",
|
||||
"import cfnresponse",
|
||||
"'''",
|
||||
"This python script should be embeded into its designated cloudformation template.",
|
||||
"Its function is to sort out the correct AMI image to use for each of the distribution options available.",
|
||||
"'''",
|
||||
"def creation_date(e):",
|
||||
" return e['CreationDate']",
|
||||
"",
|
||||
"def handler(event, context):",
|
||||
" try:",
|
||||
" regionName = event['ResourceProperties']['Region']",
|
||||
" distribution = event['ResourceProperties']['Distribution']",
|
||||
" ec2 = boto3.client('ec2',regionName)",
|
||||
" AMIName = {",
|
||||
" 'Ubuntu2004': 'ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*',",
|
||||
" 'Ubuntu2204': 'ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*',",
|
||||
" 'Debian10': 'debian-10-amd64-*',",
|
||||
" 'Debian11': 'debian-11-amd64-*',",
|
||||
" 'Debian12': 'debian-12-amd64-*',",
|
||||
" 'CentOS7': 'CentOS Linux 7 x86_64 - *',",
|
||||
" 'AmazonLinux2': 'amzn2-ami-hvm-*.*-x86_64-gp2',",
|
||||
" }[distribution]",
|
||||
" response = ec2.describe_images(Filters=[{'Name':'name', 'Values':[AMIName]}], Owners=['099720109477', '136693071363', '125523088429', 'amazon'])",
|
||||
" images = response['Images']",
|
||||
" images.sort(key=creation_date,reverse=True)",
|
||||
" AMIId = images[0]['ImageId']",
|
||||
" cfnresponse.send(event, context, cfnresponse.SUCCESS, {'AMIId':AMIId}, 'AMIInfo')",
|
||||
" except Exception:",
|
||||
" cfnresponse.send(event, context, cfnresponse.FAILED, {})"
|
||||
]
|
||||
]
|
||||
}
|
||||
},
|
||||
"Timeout": 30
|
||||
},
|
||||
"Metadata": {},
|
||||
"DependsOn": [
|
||||
"LambdaExecutionRole"
|
||||
]
|
||||
},
|
||||
"LambdaExecutionRole": {
|
||||
"Type": "AWS::IAM::Role",
|
||||
"Properties": {
|
||||
"AssumeRolePolicyDocument": {
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Principal": {
|
||||
"Service": "lambda.amazonaws.com"
|
||||
},
|
||||
"Action": [
|
||||
"sts:AssumeRole"
|
||||
]
|
||||
},
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Principal": {
|
||||
"Service": [
|
||||
"ec2.amazonaws.com"
|
||||
]
|
||||
},
|
||||
"Action": [
|
||||
"sts:AssumeRole"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"Path": "/",
|
||||
"Policies": [
|
||||
{
|
||||
"PolicyName": "root",
|
||||
"PolicyDocument": {
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": "*",
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"Metadata": {}
|
||||
},
|
||||
"KeyPairInfo": {
|
||||
"Type": "Custom::KeyPairInfo",
|
||||
"Properties": {
|
||||
"Region": {
|
||||
"Ref": "AWS::Region"
|
||||
},
|
||||
"ServiceToken": {
|
||||
"Fn::GetAtt": [
|
||||
"KeyPairCreation",
|
||||
"Arn"
|
||||
]
|
||||
}
|
||||
},
|
||||
"Metadata": {},
|
||||
"DependsOn": [
|
||||
"KeyPairCreation"
|
||||
]
|
||||
},
|
||||
"InternetGatewayAttachment": {
|
||||
"Type": "AWS::EC2::VPCGatewayAttachment",
|
||||
"Properties": {
|
||||
"InternetGatewayId": {
|
||||
"Ref": "VpcInternetGateway"
|
||||
},
|
||||
"VpcId": {
|
||||
"Ref": "VpnVpc"
|
||||
}
|
||||
},
|
||||
"Metadata": {}
|
||||
},
|
||||
"EC2VA41EUF": {
|
||||
"Type": "AWS::EC2::VolumeAttachment",
|
||||
"Properties": {
|
||||
"Device": "/dev/sdh",
|
||||
"VolumeId": {
|
||||
"Ref": "VpnServerVolume"
|
||||
},
|
||||
"InstanceId": {
|
||||
"Ref": "VpnInstance"
|
||||
}
|
||||
},
|
||||
"Metadata": {}
|
||||
}
|
||||
},
|
||||
"Parameters": {
|
||||
"VpnUser": {
|
||||
"Type": "String",
|
||||
"Description": "Your VPN username"
|
||||
},
|
||||
"VpnIpsecPsk": {
|
||||
"Type": "String",
|
||||
"Description": "Your VPN IPsec PSK (pre-shared key)"
|
||||
},
|
||||
"VpnPassword": {
|
||||
"Type": "String",
|
||||
"Description": "Your VPN password"
|
||||
},
|
||||
"OS": {
|
||||
"Type": "String",
|
||||
"Description": "The OS of your VPN server. Default: Ubuntu 22.04",
|
||||
"Default": "Ubuntu2204",
|
||||
"AllowedValues": [
|
||||
"Ubuntu2004",
|
||||
"Ubuntu2204",
|
||||
"Debian10",
|
||||
"Debian11",
|
||||
"Debian12",
|
||||
"CentOS7",
|
||||
"AmazonLinux2"
|
||||
]
|
||||
},
|
||||
"InstanceType": {
|
||||
"Type": "String",
|
||||
"Description": "The instance type of your VPN server. Using t2.micro may qualify for the AWS Free Tier.",
|
||||
"AllowedValues": [
|
||||
"t2.micro",
|
||||
"t3.nano",
|
||||
"m5.large",
|
||||
"t3.micro",
|
||||
"t3.small",
|
||||
"t2.nano",
|
||||
"t2.small",
|
||||
"t3a.nano",
|
||||
"t3a.micro",
|
||||
"t3a.small",
|
||||
"m5a.large",
|
||||
"t1.micro"
|
||||
],
|
||||
"Default": "t2.micro"
|
||||
}
|
||||
},
|
||||
"Outputs": {
|
||||
"VPNAddress": {
|
||||
"Description": "This is the public IP of your newly-launched VPN server.",
|
||||
"Value": {
|
||||
"Fn::GetAtt": [
|
||||
"VpnInstance",
|
||||
"PublicIp"
|
||||
]
|
||||
}
|
||||
},
|
||||
"VPNUsername": {
|
||||
"Description": "Your VPN username",
|
||||
"Value": {
|
||||
"Ref": "VpnUser"
|
||||
}
|
||||
},
|
||||
"VPNPassword": {
|
||||
"Description": "Your VPN password",
|
||||
"Value": {
|
||||
"Ref": "VpnPassword"
|
||||
}
|
||||
},
|
||||
"VPNKey": {
|
||||
"Description": "Your VPN IPsec PSK (pre-shared key)",
|
||||
"Value": {
|
||||
"Ref": "VpnIpsecPsk"
|
||||
}
|
||||
},
|
||||
"EC2PrivateKeyMaterial": {
|
||||
"Description": "The content of your private key for accessing the VPN server via SSH. Save it as a file for use when connecting.",
|
||||
"Value": {
|
||||
"Fn::GetAtt": [
|
||||
"KeyPairInfo",
|
||||
"KeyMaterial"
|
||||
]
|
||||
}
|
||||
},
|
||||
"NextStep": {
|
||||
"Description": "Learn how to configure VPN clients.",
|
||||
"Value": "https://github.com/hwdsl2/setup-ipsec-vpn#next-steps"
|
||||
},
|
||||
"WarningForDebianUsers": {
|
||||
"Description": "Please be noted that due to Debian images on AWS EC2 using cloud kernels, you are unable to use IPSec/L2TP mode if your server is running Debian. For more information, please refer to the link to the left.",
|
||||
"Value": "https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/docs/clients.md#debian-kernel"
|
||||
}
|
||||
}
|
||||
}
|
||||
BIN
aws/confirm-iam.png
Normal file
BIN
aws/confirm-iam.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 331 KiB |
BIN
aws/show-key.png
Normal file
BIN
aws/show-key.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 661 KiB |
BIN
aws/specify-parameters.png
Normal file
BIN
aws/specify-parameters.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 277 KiB |
BIN
aws/upload-the-template.png
Normal file
BIN
aws/upload-the-template.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 370 KiB |
BIN
docs/images/aws-deploy-button.png
Normal file
BIN
docs/images/aws-deploy-button.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 2.0 KiB |
Loading…
Reference in New Issue
Block a user