AWS CDK template for Networking/VPC

cdk-vpc-template.ts

import * as cdk from '@aws-cdk/core';
import * as ec2 from '@aws-cdk/aws-ec2';
import * as iam from '@aws-cdk/aws-iam';
import { InfraNestedStackProps, InfraNestedStack } from '@infra/common';

export interface NetworkStackProps extends cdk.StackProps {
	// Define construct properties here
}

export class NetworkStack extends cdk.Stack {
	vpc: ec2.Vpc;
	vpcId: cdk.CfnOutput;

	vpcPrivateSecurityGroup: ec2.SecurityGroup;
	vpcPrivateSecurityGroupId: cdk.CfnOutput;

	vpcPublicSecurityGroup: ec2.SecurityGroup;
	vpcPublicSecurityGroupId: cdk.CfnOutput;

	vpcSecretsInterfaceEndpoint: ec2.InterfaceVpcEndpoint;
	vpcSecretsInterfaceEndpointId: cdk.CfnOutput;

	flowLog: ec2.FlowLog;

	jumpbox: ec2.BastionHostLinux;

	constructor(scope: cdk.Construct, id: string, props: NetworkStackProps) {
		super(scope, id, props);

		this.vpc = new ec2.Vpc(this, 'Vpc', {
			enableDnsHostnames: true,
			enableDnsSupport: true,
			vpnGateway: true,
			subnetConfiguration: [
				{
					cidrMask: 24,
					name: 'Ingress',
					subnetType: ec2.SubnetType.PUBLIC,
				},
				{
					cidrMask: 24,
					name: 'Application',
					subnetType: ec2.SubnetType.PRIVATE,
				},
				{
					cidrMask: 24,
					name: 'Database',
					subnetType: ec2.SubnetType.ISOLATED,
				},
			],
		});

		this.vpcId = new cdk.CfnOutput(this, 'VpcId', {
			value: this.vpc.vpcId,
		});

		this.flowLog = new ec2.FlowLog(this, 'VpcFlowLog', {
			resourceType: ec2.FlowLogResourceType.fromVpc(this.vpc),
		});

		this.vpcPublicSecurityGroup = new ec2.SecurityGroup(this, 'PubSecGrp', {
			vpc: this.vpc,
			securityGroupName: 'pub-sec-group',
		});

		this.vpcPrivateSecurityGroup = new ec2.SecurityGroup(this, 'PrvSecGrp', {
			vpc: this.vpc,
			securityGroupName: 'prv-sec-group',
		});

		this.vpcSecretsInterfaceEndpoint = new ec2.InterfaceVpcEndpoint(
			this,
			'SecretsManagerEndpoint',
			{
				service: ec2.InterfaceVpcEndpointAwsService.SECRETS_MANAGER,
				vpc: this.vpc,
				privateDnsEnabled: true,
				subnets: { subnetType: ec2.SubnetType.ISOLATED },
				securityGroups: [this.vpcPrivateSecurityGroup],
			}
		);

		this.vpcPrivateSecurityGroupId = new cdk.CfnOutput(
			this,
			'PrivateSecurityGroupId',
			{
				value: this.vpcPrivateSecurityGroup.securityGroupId,
			}
		);

		this.vpcPublicSecurityGroupId = new cdk.CfnOutput(
			this,
			'PublicSecurityGroupId',
			{
				value: this.vpcPublicSecurityGroup.securityGroupId,
			}
		);

		this.vpcSecretsInterfaceEndpointId = new cdk.CfnOutput(
			this,
			'SecretsInterfaceEndpointId',
			{
				value: this.vpcSecretsInterfaceEndpoint.vpcEndpointId,
			}
		);

		this.addPrivateSGIngressRule({
			peer: this.vpcPrivateSecurityGroup,
			port: ec2.Port.allTraffic(),
			description: 'allow internal SG access',
		});

		this.addPublicSGIngressRule({
			peer: ec2.Peer.anyIpv4(),
			port: ec2.Port.tcp(22),
			description: 'allow ssh access',
		});

		this.addPrivateSGIngressRule({
			peer: this.vpcPublicSecurityGroup,
			port: ec2.Port.tcp(5432),
			description: 'allow Aurora Serverless Postgress access',
		});

		this.addPrivateSGIngressRule({
			peer: this.vpcPublicSecurityGroup,
			port: ec2.Port.tcp(6379),
			description: 'allow elasticache access',
		});

		this.jumpbox = new ec2.BastionHostLinux(this, 'ProdJumpBox', {
			vpc: this.vpc,
			securityGroup: this.vpcPublicSecurityGroup,
			subnetSelection: { subnetType: ec2.SubnetType.PUBLIC },
			instanceType: ec2.InstanceType.of(
				ec2.InstanceClass.T4G,
				ec2.InstanceSize.MEDIUM
			),
		});

		new cdk.CfnOutput(this, 'JumpBoxIP', {
			value: this.jumpbox.instancePublicIp,
		});

		new cdk.CfnOutput(this, 'JumpBoxHost', {
			value: this.jumpbox.instancePublicDnsName,
		});
	}

	addPrivateSGIngressRule(args: {
		peer?: ec2.IPeer;
		port?: ec2.Port;
		description?: string;
	}) {
		return this.vpcPrivateSecurityGroup.addIngressRule(
			args.peer ?? this.vpcPrivateSecurityGroup,
			args.port ?? ec2.Port.allTraffic(),
			args.description
		);
	}

	addPrivateSGEgressRule(args: {
		peer?: ec2.IPeer;
		port?: ec2.Port;
		description?: string;
	}) {
		return this.vpcPublicSecurityGroup.addEgressRule(
			args.peer ?? this.vpcPublicSecurityGroup,
			args.port ?? ec2.Port.allTraffic(),
			args.description
		);
	}

	addPublicSGIngressRule(args: {
		peer?: ec2.IPeer;
		port?: ec2.Port;
		description?: string;
	}) {
		return this.vpcPublicSecurityGroup.addIngressRule(
			args.peer ?? this.vpcPublicSecurityGroup,
			args.port ?? ec2.Port.allTraffic(),
			args.description
		);
	}

	addPublicSGEgressRule(args: {
		peer?: ec2.IPeer;
		port?: ec2.Port;
		description?: string;
	}) {
		return this.vpcPublicSecurityGroup.addEgressRule(
			args.peer ?? this.vpcPublicSecurityGroup,
			args.port ?? ec2.Port.allTraffic(),
			args.description
		);
	}
}