aws_vpc_builder

# Before you start please set up a AWS ClI IAM profile for the AWS account you are using.
# Based on instructions from http://blog.melnicki.com/2014/03/20/Set-up-public-and-private-subnets-using-AWS-VPC/
# Design concepts explained here http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Scenario2.html

export AWS_DEFAULT_PROFILE='your_iam_profile_for_aws_cli'
export VPC_ID=`aws ec2 create-vpc --cidr-block '10.0.0.0/16' | grep VpcId | head -1 | awk '{gsub(/\"/, "");gsub(/,/,""); print $2}'`
echo 'VPC_ID='$VPC_ID >> vpc-details.txt

echo "New VPC Created"

aws ec2 modify-vpc-attribute --vpc-id $VPC_ID --enable-dns-support 
aws ec2 modify-vpc-attribute --vpc-id $VPC_ID --enable-dns-hostnames 

export IGW_ID=`aws ec2 create-internet-gateway | grep InternetGatewayId | head -1 | awk '{gsub(/\"/, "");gsub(/,/,""); print $2}'` 
echo 'IGW_ID='$IGW_ID >> vpc-details.txt
aws ec2 attach-internet-gateway --internet-gateway-id $IGW_ID --vpc-id $VPC_ID --profile $AWS_PROFILE_NAME

echo "New Internet Gateway Created and attached to VPC"

export PUBLIC_SUBNET_ID=`aws ec2 create-subnet --vpc-id $VPC_ID --cidr-block '10.0.0.0/24' | grep SubnetId | head -1 | awk '{gsub(/\"/, "");gsub(/,/,""); print $2}'`
echo 'PUBLIC_SUBNET_ID='$PUBLIC_SUBNET_ID >> vpc-details.txt
export PRIVATE_SUBNET_ID=`aws ec2 create-subnet --vpc-id $VPC_ID --cidr-block '10.0.1.0/24' | grep SubnetId | head -1 | awk '{gsub(/\"/, "");gsub(/,/,""); print $2}'`
echo 'PRIVATE_SUBNET_ID='$PRIVATE_SUBNET_ID >> vpc-details.txt

echo "Public and Private Subnets created"

export MAIN_ROUTE_TABLE_ID=`aws ec2 describe-route-tables --filters "Name=vpc-id,Values=$VPC_ID" | grep RouteTableId | head -1 | awk '{gsub(/\"/, "");gsub(/,/,""); print $2}'`
echo 'MAIN_ROUTE_TABLE_ID='$MAIN_ROUTE_TABLE_ID >> vpc-details.txt
aws ec2 create-route --route-table-id $MAIN_ROUTE_TABLE_ID --destination-cidr-block '0.0.0.0/0' --gateway-id $IGW_ID
aws ec2 associate-route-table --route-table-id $MAIN_ROUTE_TABLE_ID --subnet-id $PUBLIC_SUBNET_ID

echo "Main Route Table created"

export NATSG_ID=`aws ec2 create-security-group --group-name 'natsg' --description 'NAT security group for your bastion host.' --vpc-id $VPC_ID | grep GroupId | head -1 | awk '{gsub(/\"/, "");gsub(/,/,""); print $2}'`
echo 'NATSG_ID='$NATSG_ID >> vpc-details.txt
export SERVICESG_ID=`aws ec2 create-security-group --group-name 'solr' --description 'Solr security group.' --vpc-id $VPC_ID | grep GroupId | head -1 | awk '{gsub(/\"/, "");gsub(/,/,""); print $2}'`
echo 'SERVICESG_ID='$SERVICESG_ID >> vpc-details.txt
aws ec2 authorize-security-group-ingress --group-id $NATSG_ID --protocol -1 --source-group $NATSG_ID
aws ec2 authorize-security-group-ingress --group-id $NATSG_ID --protocol 'tcp' --port 20022 --cidr '0.0.0.0/0'
aws ec2 authorize-security-group-ingress --group-id $NATSG_ID --protocol 'tcp' --port 22 --cidr '0.0.0.0/0'
aws ec2 authorize-security-group-ingress --group-id $NATSG_ID --protocol 'tcp' --port 80 --source-group $SERVICESG_ID
aws ec2 authorize-security-group-ingress --group-id $NATSG_ID --protocol 'tcp' --port 443 --source-group $SERVICESG_ID

aws ec2 revoke-security-group-egress --group-id $NATSG_ID --protocol '-1' --port all --cidr '0.0.0.0/0'
aws ec2 authorize-security-group-egress --group-id $NATSG_ID --protocol 'tcp' --port 80 --cidr '0.0.0.0/0'
aws ec2 authorize-security-group-egress --group-id $NATSG_ID --protocol 'tcp' --port 443 --cidr '0.0.0.0/0'
aws ec2 authorize-security-group-egress --group-id $NATSG_ID --protocol 'tcp' --port 22 --cidr '0.0.0.0/0'
aws ec2 authorize-security-group-egress --group-id $NATSG_ID --protocol 'udp' --port 123 --cidr '0.0.0.0/0'

aws ec2 authorize-security-group-ingress --group-id $SERVICESG_ID --protocol -1 --source-group $SERVICESG_ID
aws ec2 authorize-security-group-ingress --group-id $SERVICESG_ID --protocol 'tcp' --port 22 --source-group $NATSG_ID

echo "Security Groups Created"

# Please note we are using an Amazon NAT instance image here the other instances use a different image.
export NAT_INSTANCE_ID=`aws ec2 run-instances --image-id ami-303b1458 --count 1 --instance-type t2.micro --key-name MyKeyPair --security-group-ids $NATSG_ID --subnet-id $PUBLIC_SUBNET_ID --associate-public-ip-address --monitoring 'Enabled=true' | grep InstanceId | head -1 | awk '{gsub(/\"/, "");gsub(/,/,""); print $2}'`
echo 'NAT_INSTANCE_ID='$NAT_INSTANCE_ID >> vpc-details.txt
aws ec2 modify-instance-attribute --instance-id $NAT_INSTANCE_ID --no-source-dest-check

echo "NAT instance created"

export CUSTOM_ROUTE_TABLE_ID=`aws ec2 create-route-table --vpc-id $VPC_ID | grep RouteTableId | head -1 | awk '{gsub(/\"/, "");gsub(/,/,""); print $2}'`
echo 'CUSTOM_ROUTE_TABLE_ID='$CUSTOM_ROUTE_TABLE_ID >> vpc-details.txt

aws ec2 associate-route-table --route-table-id $CUSTOM_ROUTE_TABLE_ID --subnet-id $PRIVATE_SUBNET_ID
aws ec2 create-route --route-table-id $CUSTOM_ROUTE_TABLE_ID --destination-cidr-block '0.0.0.0/0' --instance-id $NAT_INSTANCE_ID

echo "Custome Route Table Created and attached to NAT Instance"

export PRIVATE_INSTANCE_ID=`aws ec2 run-instances --image-id ami-d05e75b8 --count 1 --instance-type t2.micro --key-name MyKeyPair --security-group-ids $SERVICESG_ID --subnet-id $PRIVATE_SUBNET_ID --monitoring 'Enabled=true' | grep InstanceId | head -1 | awk '{gsub(/\"/, "");gsub(/,/,""); print $2}'`
echo 'PRIVATE_INSTANCE_ID='$PRIVATE_INSTANCE_ID >> vpc-details.txt

echo "Private Instance Created"

echo "All steps completed. Please follow instructions for testing bastion server connection"