Panorama系列--(2)AWS上搭建Panorama测试情况 - IT评测·应用市场-qidao123.com

Mappings: RegionMap: cn-northwest-1: PA1022h2NWCD: ami-0738eadeed7e6b0fa Parameters: EC2InstanceAmiId: Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id> Default: '/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2' Environment: Type: String AllowedValues: - dev - prod Default: dev MyKeyPair: Description: Amazon EC2 Key Pair Type: AWS::EC2::KeyPair::KeyName Default: CloudFormation-Test-Key PaloaltoVersion: Description: Choice Paloalto Firewall Version Type Type: String Default: PA1022h2NWCD AllowedValues: - PA1022h2NWCD PaloaltoInstanceType: Description: Choice Paloalto Instance Type Type: String Default: m5.large AllowedValues: - m5.large - m5.4xlarge Resources: BastionSsmRole: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Statement: - Effect: Allow Principal: Service: - ec2.amazonaws.com Action: - 'sts:AssumeRole' Path: / BastionSsmPolicy: Type: AWS::IAM::Policy Properties: PolicyName: PrivatelianceInstanceAccess PolicyDocument: Statement: - Effect: Allow Action: - ssm:DescribeAssociation - ssm:GetDeployablePatchSnapshotForInstance - ssm:GetDocument - ssm:DescribeDocument - ssm:GetManifest - ssm:GetParameter - ssm:GetParameters - ssm:ListAssociations - ssm:ListInstanceAssociations - ssm:PutInventory - ssm:PutComplianceItems - ssm:PutConfigurePackageResult - ssm:UpdateAssociationStatus - ssm:UpdateInstanceAssociationStatus - ssm:UpdateInstanceInformation Resource: "*" - Effect: Allow Action: - ssmmessages:CreateControlChannel - ssmmessages:CreateDataChannel - ssmmessages:OpenControlChannel - ssmmessages:OpenDataChannel Resource: "*" - Effect: Allow Action: - ec2messages:AcknowledgeMessage - ec2messages:DeleteMessage - ec2messages:FailMessage - ec2messages:GetEndpoint - ec2messages:GetMessages - ec2messages:SendReply Resource: "*" Roles: - !Ref BastionSsmRole BastionSsmProfile: Type: AWS::IAM::InstanceProfile Properties: Path: / Roles: - !Ref BastionSsmRole #=============SecVpc============# # 创建SecVpc SecVpc: Type: AWS::EC2::VPC Properties: CidrBlock: 10.100.10.0/16 EnableDnsSupport: 'true' EnableDnsHostnames: 'true' Tags: - Key: Name Value: !Sub ${AWS::StackName}-SecVpc # 创建IGW并且关联到VPC SecVpcIGW: Type: "AWS::EC2::InternetGateway" Properties: Tags: - Key: Name Value: !Sub ${AWS::StackName}-SecVpcIGW SecVpcAttachIgw: Type: "AWS::EC2::VPCGatewayAttachment" Properties: VpcId: !Ref SecVpc InternetGatewayId: !Ref SecVpcIGW #-----------------SecVpc创建6个子网------------------# # SecVpc AZ1内创建公有子网 SecVpcAz1PublicSubnet: Type: AWS::EC2::Subnet Properties: VpcId: !Ref SecVpc CidrBlock: 10.100.10.0/24 AvailabilityZone: Fn::Select: - 0 - Fn::GetAZs: "" Tags: - Key: Name Value: !Sub ${AWS::StackName}-SecVpc-AZ1-Public-Subnet # SecVpc AZ2内创建公有子网 SecVpcAz2PublicSubnet: Type: AWS::EC2::Subnet Properties: VpcId: !Ref SecVpc CidrBlock: 10.100.20.0/24 AvailabilityZone: Fn::Select: - 1 - Fn::GetAZs: "" Tags: - Key: Name Value: !Sub ${AWS::StackName}-SecVpc-AZ2-Public-Subnet # SecVpc AZ1内创建私有子网 SecVpcAz1PrivateSubnet: Type: AWS::EC2::Subnet Properties: VpcId: !Ref SecVpc CidrBlock: 10.100.30.0/24 AvailabilityZone: Fn::Select: - 0 - Fn::GetAZs: "" Tags: - Key: Name Value: !Sub ${AWS::StackName}-SecVpc-AZ1-Private-Subnet # SecVpc AZ2内创建私有子网 SecVpcAz2PrivateSubnet: Type: AWS::EC2::Subnet Properties: VpcId: !Ref SecVpc CidrBlock: 10.100.40.0/24 AvailabilityZone: Fn::Select: - 1 - Fn::GetAZs: "" Tags: - Key: Name Value: !Sub ${AWS::StackName}-SecVpc-AZ2-Private-Subnet # SecVpc AZ1内创建TGW子网 SecVpcAz1TgwSubnet: Type: AWS::EC2::Subnet Properties: VpcId: !Ref SecVpc CidrBlock: 10.100.50.0/24 AvailabilityZone: Fn::Select: - 0 - Fn::GetAZs: "" Tags: - Key: Name Value: !Sub ${AWS::StackName}-SecVpc-AZ1-TGW-Subnet # SecVpc AZ2内创建TGW子网 SecVpcAz2TgwSubnet: Type: AWS::EC2::Subnet Properties: VpcId: !Ref SecVpc CidrBlock: 10.100.60.0/24 AvailabilityZone: Fn::Select: - 1 - Fn::GetAZs: "" Tags: - Key: Name Value: !Sub ${AWS::StackName}-SecVpc-AZ2-TGW-Subnet #-----------------SecVpc创建路由表------------------# # 公有子网路由表及关联 SecVpcAz1PublicRouteTable: Type: "AWS::EC2::RouteTable" Properties: VpcId: !Ref SecVpc Tags: - Key: Name Value: !Sub ${AWS::StackName}-SecVpc-AZ1-Public-RouteTable SecVpcAz1PublicRouteTableAssociation: Type: "AWS::EC2::SubnetRouteTableAssociation" Properties: RouteTableId: !Ref SecVpcAz1PublicRouteTable SubnetId: !Ref SecVpcAz1PublicSubnet SecVpcAz2PublicRouteTable: Type: "AWS::EC2::RouteTable" Properties: VpcId: !Ref SecVpc Tags: - Key: Name Value: !Sub ${AWS::StackName}-SecVpc-AZ2-Public-RouteTable SecVpcAz2PublicRouteTableAssociation: Type: "AWS::EC2::SubnetRouteTableAssociation" Properties: RouteTableId: !Ref SecVpcAz2PublicRouteTable SubnetId: !Ref SecVpcAz2PublicSubnet # Private子网路由表及关联 SecVpcAz1PrivateRouteTable:

复制代码