3장 실습 - 보안 그룹과 네트워크 ACL 구성

Parameters: KeyName: Description: Name of an existing EC2 KeyPair to enable SSH access to the instances. Linked to AWS Parameter Type: AWS::EC2::KeyPair::KeyName ConstraintDescription: must be the name of an existing EC2 KeyPair. InstanceType: Description: Enter t2.nano, t3.micro Default is t3.micro. Type: String Default: t3.micro AllowedValues: - t2.nano - t3.micro LatestAmiId: Description: (DO NOT CHANGE) Type: 'AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>' Default: '/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64' AllowedValues: - /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 Resources: # VPC Flow Log CNFlowLogRole: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Statement: - Effect: Allow Principal: Service: - vpc-flow-logs.amazonaws.com Action: - 'sts:AssumeRole' Path: / CNFlowLogPolicy: Type: AWS::IAM::Policy Properties: PolicyName: CNFlowLogPolicy PolicyDocument: Statement: - Effect: Allow Action: - logs:CreateLogGroup - logs:CreateLogStream - logs:PutLogEvents - logs:DescribeLogGroups - logs:DescribeLogStreams Resource: !GetAtt 'CNFlowLogGroup.Arn' Roles: - !Ref CNFlowLogRole CNFlowLogGroup: Type: AWS::Logs::LogGroup Properties: LogGroupName: CNvpcflowloggroup RetentionInDays: 1 CNFlowLog: Type: AWS::EC2::FlowLog DependsOn: MyVPC Properties: DeliverLogsPermissionArn: !GetAtt CNFlowLogRole.Arn LogGroupName: !Ref CNFlowLogGroup ResourceId: !Ref MyVPC MaxAggregationInterval: 60 ResourceType: VPC TrafficType: REJECT Tags: - Key: Name Value: FlowLogsForVPC LogFormat: '${srcaddr} ${srcport} ${dstaddr} ${dstport} ${protocol} ${action} ${instance-id}' # VPC MyVPC: Type: AWS::EC2::VPC Properties: CidrBlock: 10.3.0.0/16 Tags: - Key: Name Value: LAB3-VPC MyIGW: Type: AWS::EC2::InternetGateway Properties: Tags: - Key: Name Value: LAB3-IGW MyIGWAttachment: Type: AWS::EC2::VPCGatewayAttachment Properties: InternetGatewayId: !Ref MyIGW VpcId: !Ref MyVPC MyPublicRT: Type: AWS::EC2::RouteTable Properties: VpcId: !Ref MyVPC Tags: - Key: Name Value: LAB3-PUBLIC-RT DefaultPublicRoute: Type: AWS::EC2::Route DependsOn: MyIGWAttachment Properties: RouteTableId: !Ref MyPublicRT DestinationCidrBlock: 0.0.0.0/0 GatewayId: !Ref MyIGW MyPublicSN: Type: AWS::EC2::Subnet Properties: VpcId: !Ref MyVPC AvailabilityZone: !Select [ 0, !GetAZs '' ] CidrBlock: 10.3.0.0/24 Tags: - Key: Name Value: LAB3-PUBLIC-SN MyPublicSNRouteTableAssociation: Type: AWS::EC2::SubnetRouteTableAssociation Properties: RouteTableId: !Ref MyPublicRT SubnetId: !Ref MyPublicSN # Security Group ServerSG: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Server1 Security Group VpcId: !Ref MyVPC Tags: - Key: Name Value: SERVER-1-SG SecurityGroupIngress: - IpProtocol: tcp FromPort: '22' ToPort: '22' CidrIp: 0.0.0.0/0 ServerSG2: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Server2 Security Group VpcId: !Ref MyVPC Tags: - Key: Name Value: SERVER-2-SG SecurityGroupIngress: - IpProtocol: tcp FromPort: '22' ToPort: '22' CidrIp: 0.0.0.0/0 # EC2 Instance ServerEC2: Type: AWS::EC2::Instance Properties: InstanceType: !Ref InstanceType ImageId: !Ref LatestAmiId KeyName: !Ref KeyName Tags: - Key: Name Value: SERVER-1 NetworkInterfaces: - DeviceIndex: 0 SubnetId: !Ref MyPublicSN GroupSet: - !Ref ServerSG AssociatePublicIpAddress: true PrivateIpAddress: 10.3.0.10 UserData: Fn::Base64: !Sub | #!/bin/bash dnf install httpd -y systemctl start httpd && systemctl enable httpd echo "<h1>[인프런] Security Group & Network ACL TEST 1</h1>" > /var/www/html/index.html ServerEC22: Type: AWS::EC2::Instance Properties: InstanceType: !Ref InstanceType ImageId: !Ref LatestAmiId KeyName: !Ref KeyName Tags: - Key: Name Value: SERVER-2 NetworkInterfaces: - DeviceIndex: 0 SubnetId: !Ref MyPublicSN GroupSet: - !Ref ServerSG2 AssociatePublicIpAddress: true PrivateIpAddress: 10.3.0.20 UserData: Fn::Base64: !Sub | #!/bin/bash dnf install httpd -y systemctl start httpd && systemctl enable httpd echo "<h1>[인프런] Security Group & Network ACL TEST 2</h1>" > /var/www/html/index.html

curl ipinfo.io/ip --connect-timeout 3

dig +short ipinfo.io

curl wttr.in/seoul --connect-timeout 3