VPC-NAT-Instance.yaml

Description:  Deploys a VPC with 2 AZs, and custom NAT instances. 

Parameters:
  Prefix:
    Description: Something to prefix all the resources with
    Type: String
    Default: Dev

  CostCenter:
    Description: Tag for cost tracking. Leave blank to ignore
    Type: String
    Default: "" 
  
  MaxBandwidth:
    Description: Maximum bandwidth each NAT instance will limit traffic to in Mbps. Defaults to 100Mbps
    Type: Number
    Default: 100

  GatewayCount:
    Description: Number of NAT Gateways to deploy
    Type: Number
    Default: 2
    AllowedValues: [ 1, 2 ]

  InstanceSize:
    Description: How big to make the NAT Instance(s)
    Type: String
    Default: nano
    AllowedValues: 
    - nano
    - micro
    - small
    - medium
    - large
    - 2xlarge

  EnableSSMEndpoint:
    Description: Should the SSM Endpoint be enabled (costs about $20/mo in us-east-1). 
    Type: String
    Default: "no"
    AllowedValues: 
    - "yes"
    - "no"

  VpcCIDR:
    Description: Please enter the IP range (CIDR notation) for this VPC
    Type: String
    Default: 10.0.0.0/16

  CIDRPublic1:
    Description: Please enter the IP range (CIDR notation) for the public subnet in the first Availability Zone
    Type: String
    Default: 10.0.0.0/24

  CIDRPublic2:
    Description: Please enter the IP range (CIDR notation) for the public subnet in the second Availability Zone
    Type: String
    Default: 10.0.1.0/24

  CIDRPrivate1:
    Description: Please enter the IP range (CIDR notation) for the private subnet in the first Availability Zone
    Type: String
    Default: 10.0.128.0/24

  CIDRPrivate2:
    Description: Please enter the IP range (CIDR notation) for the private subnet in the second Availability Zone
    Type: String
    Default: 10.0.129.0/24

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
    - Label:
        default: General
      Parameters:
      - Prefix
      - CostCenter
      - MaxBandwidth
      - GatewayCount
      - InstanceSize
      - EnableSSMEndpoint
    - Label:
        default: Networking
      Parameters:
      - VpcCIDR
      - CIDRPublic1
      - CIDRPublic2
      - CIDRPrivate1
      - CIDRPrivate2

Conditions:
  HaveCostCenterTag: !Not 
    - !Equals
      - !Ref CostCenter
      - ""
  HasTwoNAT: !Equals [ !Ref GatewayCount, 2 ]
  HasSSMEndpoint: !Equals [ !Ref EnableSSMEndpoint, "yes" ]

Mappings:
  AWSAMIRegionMap:
    ap-northeast-1:
      AMI: ami-0d874cf52d89e1e4b
      type: t4g
    ap-northeast-2:
      AMI: ami-06a997e23f0199d45
      type: t4g
    ap-northeast-3:
      AMI: ami-063f458e2f70f8951
      type: t4g
    ap-south-1:
      AMI: ami-0494f7473bf694265
      type: t4g
    ap-southeast-1:
      AMI: ami-0b404894f3a1e6da0
      type: t4g
    ap-southeast-2:
      AMI: ami-0c1c73154cfdcc852
      type: t4g
    ca-central-1:
      AMI: ami-045efbe545362bcfa
      type: t4g
    eu-central-1:
      AMI: ami-08b91e717872d4caf
      type: t4g
    eu-north-1:
      AMI: ami-06c417cf0d6b13d9c
      type: t4g
    eu-west-1:
      AMI: ami-06055ab1b3dc70f03
      type: t4g
    eu-west-2:
      AMI: ami-08a5f51a19810bf69
      type: t4g
    eu-west-3:
      AMI: ami-0958b74cb185c1beb
      type: t4g
    sa-east-1:
      AMI: ami-04e03458901339bf1
      type: t4g
    us-east-1:
      AMI: ami-090230ed0c6b13c74
      type: t4g
    us-east-2:
      AMI: ami-00b9738bf35b1d1de
      type: t4g
    us-west-1:
      AMI: ami-0e48a188782d0412a
      type: t4g
    us-west-2:
      AMI: ami-0d3127dab514c6a1a
      type: t4g

Resources:
  # /----------------------------------------------/
  # / The VPC and Network
  # /----------------------------------------------/

  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCIDR
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: !Sub ${Prefix}-VPC
        - !If
          - HaveCostCenterTag
          - {Key: CostCenter, Value: !Ref CostCenter}
          - !Ref AWS::NoValue

  Gateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: !Sub ${Prefix}-Gateway
        - !If
          - HaveCostCenterTag
          - {Key: CostCenter, Value: !Ref CostCenter}
          - !Ref AWS::NoValue

  InternetGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref Gateway
      VpcId: !Ref VPC

  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      MapPublicIpOnLaunch: true
      AvailabilityZone: !Select [ 0, !GetAZs '' ]
      CidrBlock: !Ref CIDRPublic1
      Tags:
        - Key: Name
          Value: !Sub ${Prefix} Public Subnet 1

  PublicSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      MapPublicIpOnLaunch: true
      AvailabilityZone: !Select [ 1, !GetAZs  '' ]
      CidrBlock: !Ref CIDRPublic2
      Tags:
        - Key: Name
          Value: !Sub ${Prefix} Public Subnet 2

  PrivateSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 0, !GetAZs  '' ]
      CidrBlock: !Ref CIDRPrivate1
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub ${Prefix} Private Subnet 1

  PrivateSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 1, !GetAZs  '' ]
      CidrBlock: !Ref CIDRPrivate2
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub ${Prefix} Private Subnet 2
  # /----------------------------------------------/
  # / Endpoints
  # /----------------------------------------------/
  EndpointSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Sub ${Prefix}-Enpoint-SG
      VpcId: !Ref VPC
      GroupDescription: Enable HTTPS from VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: !Ref VpcCIDR
      SecurityGroupEgress:
        - IpProtocol: -1
          CidrIp: !Ref VpcCIDR
  S3Endpoint: 
    Type: "AWS::EC2::VPCEndpoint"
    Properties: 
      # SecurityGroupIds:
      #    - !Ref EndpointSecurityGroup
      RouteTableIds: 
        - !Ref PublicRouteTable
        - !Ref PrivateRouteTable1
      ServiceName: !Join
        - ''
        - - com.amazonaws.
          - !Ref 'AWS::Region'
          - .s3
      VpcId: !Ref VPC
  SSMEndpoint: 
    Type: "AWS::EC2::VPCEndpoint"
    Condition: HasSSMEndpoint
    Properties: 
      PrivateDnsEnabled: true
      VpcEndpointType: Interface
      SubnetIds:
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2
      SecurityGroupIds:
         - !Ref EndpointSecurityGroup
      ServiceName: !Join
        - ''
        - - com.amazonaws.
          - !Ref 'AWS::Region'
          - .ssm
      VpcId: !Ref VPC
  Ec2MessagesEndpoint: 
    Type: "AWS::EC2::VPCEndpoint"
    Condition: HasSSMEndpoint
    Properties: 
      PrivateDnsEnabled: true
      VpcEndpointType: Interface
      SubnetIds:
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2
      SecurityGroupIds:
         - !Ref EndpointSecurityGroup
      ServiceName: !Join
        - ''
        - - com.amazonaws.
          - !Ref 'AWS::Region'
          - .ec2messages
      VpcId: !Ref VPC
  SSMMessagesEndpoint: 
    Type: "AWS::EC2::VPCEndpoint"
    Condition: HasSSMEndpoint
    Properties: 
      PrivateDnsEnabled: true
      VpcEndpointType: Interface
      SubnetIds:
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2
      SecurityGroupIds:
         - !Ref EndpointSecurityGroup
      ServiceName: !Join
        - ''
        - - com.amazonaws.
          - !Ref 'AWS::Region'
          - .ssmmessages
      VpcId: !Ref VPC
  # /----------------------------------------------/
  # / NACLs
  # /----------------------------------------------/
  NACL:
    Type: AWS::EC2::NetworkAcl
    Properties:
       VpcId: !Ref VPC
       Tags:
       - Key: Name
         Value: !Sub ${Prefix}-NACL
  # Outbound
  AllowInternal:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
       NetworkAclId:
         Ref: NACL
       RuleNumber: 1
       Protocol: -1
       Egress: true
       RuleAction: allow
       CidrBlock: !Ref VpcCIDR
  AllowHTTP:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId:
        Ref: NACL
      RuleNumber: 2
      Protocol: 6
      Egress: true
      RuleAction: allow
      CidrBlock: 0.0.0.0/0
      PortRange:
        From: 80
        To: 80
  AllowHTTPS:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId:
        Ref: NACL
      RuleNumber: 3
      Protocol: 6
      Egress: true
      RuleAction: allow
      CidrBlock: 0.0.0.0/0
      PortRange:
        From: 443
        To: 443
  AllowICMP:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId:
        Ref: NACL
      RuleNumber: 4
      Protocol: 1
      Icmp: 
        Code: -1
        Type: -1
      Egress: true
      RuleAction: allow
      CidrBlock: 0.0.0.0/0
  AllowNTP:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId:
        Ref: NACL
      RuleNumber: 5
      Protocol: 17
      PortRange:
        From: 123
        To: 123
      Egress: true
      RuleAction: allow
      CidrBlock: 0.0.0.0/0
  DefaultOutbound:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
       NetworkAclId:
         Ref: NACL
       RuleNumber: 99
       Protocol: -1
       Egress: true
       RuleAction: deny
       CidrBlock: 0.0.0.0/0
  DefaultInbound:
    # Your SGs should be handling this, right?
    Type: AWS::EC2::NetworkAclEntry
    Properties:
       NetworkAclId:
         Ref: NACL
       RuleNumber: 100
       Protocol: -1
       Egress: false
       RuleAction: allow
       CidrBlock: 0.0.0.0/0
  NACLPublic1:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    Properties: 
      NetworkAclId: !Ref NACL
      SubnetId: !Ref PublicSubnet1
  NACLPublic2:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    Properties: 
      NetworkAclId: !Ref NACL
      SubnetId: !Ref PublicSubnet2
  # /----------------------------------------------/
  # / The NAT Gateways
  # /----------------------------------------------/

  NatEip1:
    Type: AWS::EC2::EIP
    DependsOn: InternetGatewayAttachment
    Properties:
      Domain: vpc
      InstanceId: !Ref Nat1
      Tags:
        - Key: Name
          Value: !Sub ${Prefix}-NAT-EIP-1
        - !If
          - HaveCostCenterTag
          - {Key: CostCenter, Value: !Ref CostCenter}
          - !Ref AWS::NoValue
  NatEip2:
    Type: AWS::EC2::EIP
    Condition: HasTwoNAT
    DependsOn: InternetGatewayAttachment
    Properties:
      Domain: vpc
      InstanceId: !Ref Nat2
      Tags:
        - Key: Name
          Value: !Sub ${Prefix}-NAT-EIP-2
        - !If
          - HaveCostCenterTag
          - {Key: CostCenter, Value: !Ref CostCenter}
          - !Ref AWS::NoValue
  NatRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM
  NatProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles: [!Ref 'NatRole']
  Nat1:
    Type: AWS::EC2::Instance
    Properties:
      IamInstanceProfile: !Ref 'NatProfile'
      ImageId: !FindInMap
        - AWSAMIRegionMap
        - !Ref 'AWS::Region'
        - AMI
      InstanceType: !Sub 
        - "${type}.${InstanceSize}"
        - type: !FindInMap
          - AWSAMIRegionMap
          - !Ref 'AWS::Region'
          - type
          InstanceSize: !Ref InstanceSize
      SecurityGroupIds: [!Ref 'NatSecurityGroup']
      SubnetId: !Ref PublicSubnet1
      SourceDestCheck: false
      Tags:
      - Key: Name
        Value: !Sub ${Prefix}-Nat-1
      - !If
        - HaveCostCenterTag
        - {Key: CostCenter, Value: !Ref CostCenter}
        - !Ref AWS::NoValue
      UserData:
        Fn::Base64: !Sub |
          #cloud-config

          package_update: true
          package_upgrade: true
          write_files:
            - owner: root:root
              path: /usr/local/bin/trafficShape.sh
              permissions: "0755"
              content: |
                #!/bin/bash
                INTERFACE=eth0
                LIMIT=$(printf "%.0fkbit" "$((10**3 * ${MaxBandwidth}))")
                LIMIT20=$(printf "%.0fkbit" "$((10**6 * ${MaxBandwidth} * 2))e-4")
                LIMIT40=$(printf "%.0fkbit" "$((10**6 * ${MaxBandwidth} * 4))e-4")
                LIMIT80=$(printf "%.0fkbit" "$((10**6 * ${MaxBandwidth} * 8))e-4")
                tc qdisc add dev $INTERFACE root handle 1: htb default 12
                tc class add dev $INTERFACE parent 1: classid 1:1 htb rate $LIMIT ceil $LIMIT burst 10k
                tc class add dev $INTERFACE parent 1:1 classid 1:10 htb rate $LIMIT20 ceil $LIMIT40 prio 1 burst 10k
                tc class add dev $INTERFACE parent 1:1 classid 1:12 htb rate $LIMIT80 ceil $LIMIT prio 2
                tc filter add dev $INTERFACE protocol ip parent 1:0 prio 1 u32 match ip protocol 0x11 0xff flowid 1:10
                tc qdisc add dev $INTERFACE parent 1:10 handle 20: sfq perturb 10
                tc qdisc add dev $INTERFACE parent 1:12 handle 30: sfq perturb 10
            - owner: root:root
              path: /etc/sysctl.d/85-ip-forward.conf
              permissions: "0644"
              content: |
                net.ipv4.ip_forward = 1
            - owner: root:root
              path: /etc/systemd/system/traffic_shaping.service
              permissions: "0644"
              content: |
                [Unit]
                Description=Enable traffic shaping queueing
                After=network-online.target

                [Service]
                Type=oneshot
                ExecStart=/usr/local/bin/trafficShape.sh
          packages:
            - iptables-services
            - tc
          runcmd: 
          - |
            sysctl -w net.ipv4.ip_forward=1
            INTERFACE=eth0
            iptables -t nat -A POSTROUTING -s ${VpcCIDR} -o $INTERFACE -j MASQUERADE
            /usr/local/bin/trafficShape.sh

            # Set high-priority class and relevant protocols which uses it
            iptables -t mangle -A POSTROUTING -o $INTERFACE -p tcp -m tos --tos Minimize-Delay -j CLASSIFY --set-class 1:10
            iptables -t mangle -A POSTROUTING -o $INTERFACE -p icmp -j CLASSIFY --set-class 1:10
            iptables -t mangle -A POSTROUTING -o $INTERFACE -p tcp --sport 53  -j CLASSIFY --set-class 1:10
            iptables -t mangle -A POSTROUTING -o $INTERFACE -p tcp --dport 53  -j CLASSIFY --set-class 1:10
            iptables -t mangle -A POSTROUTING -o $INTERFACE -p tcp --sport 123 -j CLASSIFY --set-class 1:10
            iptables -t mangle -A POSTROUTING -o $INTERFACE -p tcp --dport 123 -j CLASSIFY --set-class 1:10
            iptables -t mangle -A POSTROUTING -o $INTERFACE -p tcp --sport 22  -j CLASSIFY --set-class 1:10
            iptables -t mangle -A POSTROUTING -o $INTERFACE -p tcp --dport 22  -j CLASSIFY --set-class 1:10
            # a couple more tables to tag short, TCP signalling packets correctly
            iptables -t mangle -N ack
            iptables -t mangle -A ack -m tos ! --tos Normal-Service -j RETURN
            iptables -t mangle -A ack -p tcp -m length --length 0:128 -j TOS --set-tos Minimize-Delay
            iptables -t mangle -A ack -p tcp -m length --length 128: -j TOS --set-tos Maximize-Throughput
            iptables -t mangle -A ack -j RETURN
            iptables -t mangle -A POSTROUTING -p tcp -m tcp --tcp-flags SYN,RST,ACK ACK -j ack
            iptables -t mangle -N tosfix
            iptables -t mangle -A tosfix -p tcp -m length --length 0:512 -j RETURN
            iptables -t mangle -A tosfix -j TOS --set-tos Maximize-Throughput
            iptables -t mangle -A tosfix -j RETURN
            service iptables save
            systemctl daemon-reload
            systemctl enable iptables.service
            systemctl enable traffic_shaping.service
  Nat2:
    Type: AWS::EC2::Instance
    Condition: HasTwoNAT
    Properties:
      IamInstanceProfile: !Ref 'NatProfile'
      ImageId: !FindInMap
        - AWSAMIRegionMap
        - !Ref 'AWS::Region'
        - AMI
      InstanceType: !Sub 
        - "${type}.${InstanceSize}"
        - type: !FindInMap
          - AWSAMIRegionMap
          - !Ref 'AWS::Region'
          - type
          InstanceSize: !Ref InstanceSize
      SecurityGroupIds: [!Ref 'NatSecurityGroup']
      SubnetId: !Ref PublicSubnet2
      SourceDestCheck: false
      Tags:
      - Key: Name
        Value: !Sub ${Prefix}-Nat-2
      - !If
        - HaveCostCenterTag
        - {Key: CostCenter, Value: !Ref CostCenter}
        - !Ref AWS::NoValue
      UserData:
        Fn::Base64: !Sub |
          #cloud-config

          package_update: true
          package_upgrade: true
          write_files:
            - owner: root:root
              path: /usr/local/bin/trafficShape.sh
              permissions: "0755"
              content: |
                #!/bin/bash
                INTERFACE=eth0
                LIMIT=$(printf "%.0fkbit" "$((10**3 * ${MaxBandwidth}))")
                LIMIT20=$(printf "%.0fkbit" "$((10**6 * ${MaxBandwidth} * 2))e-4")
                LIMIT40=$(printf "%.0fkbit" "$((10**6 * ${MaxBandwidth} * 4))e-4")
                LIMIT80=$(printf "%.0fkbit" "$((10**6 * ${MaxBandwidth} * 8))e-4")
                tc qdisc add dev $INTERFACE root handle 1: htb default 12
                tc class add dev $INTERFACE parent 1: classid 1:1 htb rate $LIMIT ceil $LIMIT burst 10k
                tc class add dev $INTERFACE parent 1:1 classid 1:10 htb rate $LIMIT20 ceil $LIMIT40 prio 1 burst 10k
                tc class add dev $INTERFACE parent 1:1 classid 1:12 htb rate $LIMIT80 ceil $LIMIT prio 2
                tc filter add dev $INTERFACE protocol ip parent 1:0 prio 1 u32 match ip protocol 0x11 0xff flowid 1:10
                tc qdisc add dev $INTERFACE parent 1:10 handle 20: sfq perturb 10
                tc qdisc add dev $INTERFACE parent 1:12 handle 30: sfq perturb 10
            - owner: root:root
              path: /etc/sysctl.d/85-ip-forward.conf
              permissions: "0644"
              content: |
                net.ipv4.ip_forward = 1
            - owner: root:root
              path: /etc/systemd/system/traffic_shaping.service
              permissions: "0644"
              content: |
                [Unit]
                Description=Enable traffic shaping queueing
                After=network-online.target

                [Service]
                Type=oneshot
                ExecStart=/usr/local/bin/trafficShape.sh
          packages:
            - iptables-services
            - tc
          runcmd: 
          - |
            sysctl -w net.ipv4.ip_forward=1
            INTERFACE=eth0
            iptables -t nat -A POSTROUTING -s ${VpcCIDR} -o $INTERFACE -j MASQUERADE
            /usr/local/bin/trafficShape.sh

            # Set high-priority class and relevant protocols which uses it
            iptables -t mangle -A POSTROUTING -o $INTERFACE -p tcp -m tos --tos Minimize-Delay -j CLASSIFY --set-class 1:10
            iptables -t mangle -A POSTROUTING -o $INTERFACE -p icmp -j CLASSIFY --set-class 1:10
            iptables -t mangle -A POSTROUTING -o $INTERFACE -p tcp --sport 53  -j CLASSIFY --set-class 1:10
            iptables -t mangle -A POSTROUTING -o $INTERFACE -p tcp --dport 53  -j CLASSIFY --set-class 1:10
            iptables -t mangle -A POSTROUTING -o $INTERFACE -p tcp --sport 123 -j CLASSIFY --set-class 1:10
            iptables -t mangle -A POSTROUTING -o $INTERFACE -p tcp --dport 123 -j CLASSIFY --set-class 1:10
            iptables -t mangle -A POSTROUTING -o $INTERFACE -p tcp --sport 22  -j CLASSIFY --set-class 1:10
            iptables -t mangle -A POSTROUTING -o $INTERFACE -p tcp --dport 22  -j CLASSIFY --set-class 1:10
            # a couple more tables to tag short, TCP signalling packets correctly
            iptables -t mangle -N ack
            iptables -t mangle -A ack -m tos ! --tos Normal-Service -j RETURN
            iptables -t mangle -A ack -p tcp -m length --length 0:128 -j TOS --set-tos Minimize-Delay
            iptables -t mangle -A ack -p tcp -m length --length 128: -j TOS --set-tos Maximize-Throughput
            iptables -t mangle -A ack -j RETURN
            iptables -t mangle -A POSTROUTING -p tcp -m tcp --tcp-flags SYN,RST,ACK ACK -j ack
            iptables -t mangle -N tosfix
            iptables -t mangle -A tosfix -p tcp -m length --length 0:512 -j RETURN
            iptables -t mangle -A tosfix -j TOS --set-tos Maximize-Throughput
            iptables -t mangle -A tosfix -j RETURN
            service iptables save
            systemctl daemon-reload
            systemctl enable iptables.service
            systemctl enable traffic_shaping.service
  NatSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: SG for Nat host
      VpcId: !Ref 'VPC'
      SecurityGroupEgress: 
        - Description: Allow ALL
          CidrIp: 0.0.0.0/0
          IpProtocol: -1
      SecurityGroupIngress: 
        - Description: Allow all from local
          IpProtocol: -1
          CidrIp: !Ref VpcCIDR
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    DependsOn: InternetGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub ${Prefix} Default Route Table (Public)

  PublicRouteTableDefaultRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref Gateway

  PublicSubnet1RouteAssoc:  
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref PublicSubnet1

  PublicSubnet2RouteAssoc:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref PublicSubnet2

  PrivateRouteTable1:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub ${Prefix} Private Routes (AZ1)

  PrivateRouteTable1Default:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateRouteTable1
      DestinationCidrBlock: 0.0.0.0/0
      InstanceId: !Ref Nat1

  PrivateRouteTable2:
    Type: AWS::EC2::RouteTable
    Condition: HasTwoNAT
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub ${Prefix} Private Routes 2

  PrivateRouteTable2Default:
    Type: AWS::EC2::Route
    Condition: HasTwoNAT
    Properties:
      RouteTableId: !Ref PrivateRouteTable2
      DestinationCidrBlock: 0.0.0.0/0
      InstanceId: !Ref Nat2

  PrivateSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateRouteTable1
      SubnetId: !Ref PrivateSubnet1

  PrivateSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !If [HasTwoNAT, !Ref PrivateRouteTable2, !Ref PrivateRouteTable1]
      SubnetId: !Ref PrivateSubnet2

Outputs:
  VPC:
    Description: A reference to the created VPC
    Value: !Ref VPC

  Nat1:
    Description: ID of AZ1's Nat Instance
    Value: !Ref Nat1

  Nat1PublicIp:
    Description: AZ1's Nat Public IP
    Value: !Ref NatEip1
  
  PublicSubnets:
    Description: A list of the public subnets
    Value: !Join [ ",", [ !Ref PublicSubnet1, !Ref PublicSubnet2 ]]

  PrivateSubnets:
    Description: A list of the private subnets
    Value: !Join [ ",", [ !Ref PrivateSubnet1, !Ref PrivateSubnet2 ]]