stack.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: >
  Keysight CloudLens Stack (vController + KVO + vPB) on AWS from the CloudLens
  Marketplace AMIs. Deploys into a new shared VPC (three purpose-built subnets:
  mgmt, data, tool) OR into any existing customer infrastructure - existing VPC,
  existing subnet(s), existing security group, with or without public IPs. vController
  (control plane, always), KVO (orchestrator, optional), and vPB (data plane,
  optional). Instance types are constrained to what each Marketplace AMI permits:
  vController t3.xlarge or m5.xlarge, KVO c5.2xlarge, vPB t3.xlarge. All three AMIs require
  an active AWS Marketplace subscription before launch. Default vController UI
  credentials are admin / Cl0udLens@dm!n (change on first login).
  Needs 3 free Elastic IPs when AssignPublicIp is yes (AWS default quota is 5
  per region); set it to no if you have none spare.

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Components to deploy
        Parameters:
          - DeployKVO
          - DeployVPB
      - Label:
          default: Access
        Parameters:
          - KeyPairAction
          - KeyPairName
          - AdminIngressCidr
          - AssignPublicIp
      - Label:
          default: Instance sizes
        Parameters:
          - VcontrollerInstanceType
          - KvoInstanceType
          - VpbInstanceType
      - Label:
          default: VM names (optional - blank uses <StackName>-vcontroller / -kvo / -vpb)
        Parameters:
          - VcontrollerName
          - KvoName
          - VpbName
      - Label:
          default: Test workloads (optional - VMs to prove the sensor path)
        Parameters:
          - DeployTestWorkloadUbuntu
          - DeployTestWorkloadRhel
          - DeployTestWorkloadWindows
          - DiscoveryTagKey
          - DiscoveryTagValue
      - Label:
          default: Deploy into existing infrastructure (brownfield)
        Parameters:
          - ExistingVpcId
          - ExistingSubnetId
          - ExistingDataSubnetId
          - ExistingSecurityGroupId
      - Label:
          default: New VPC settings (greenfield - only used when Existing VPC ID is blank)
        Parameters:
          - VpcCidr
          - MgmtSubnetCidr
          - DataSubnetCidr
          - ToolSubnetCidr
    ParameterLabels:
      DeployKVO:
        default: Deploy KVO orchestrator?
      DeployVPB:
        default: Deploy vPB data plane?
      KeyPairAction:
        default: SSH key pair
      KeyPairName:
        default: Existing key pair (dropdown)
      AdminIngressCidr:
        default: Admin source CIDR for SSH, vPB SSH, HTTPS, and VXLAN
      AssignPublicIp:
        default: Assign public Elastic IPs?
      VcontrollerInstanceType:
        default: vController instance type (t3.xlarge or m5.xlarge)
      KvoInstanceType:
        default: KVO instance type (c5.2xlarge only)
      VpbInstanceType:
        default: vPB instance type (t3.xlarge only)
      VcontrollerName:
        default: vController VM name
      KvoName:
        default: KVO VM name
      VpbName:
        default: vPB VM name
      DeployTestWorkloadUbuntu:
        default: Ubuntu 22.04 test VM?
      DeployTestWorkloadRhel:
        default: RHEL 9 test VM?
      DeployTestWorkloadWindows:
        default: Windows Server 2022 test VM?
      DiscoveryTagKey:
        default: Sensor discovery tag key
      DiscoveryTagValue:
        default: Sensor discovery tag value
      ExistingVpcId:
        default: Existing VPC ID (blank to create a shared VPC)
      ExistingSubnetId:
        default: Existing subnet ID (required when using an existing VPC)
      ExistingDataSubnetId:
        default: Existing data subnet ID for vPB (blank to reuse the subnet above)
      ExistingSecurityGroupId:
        default: Existing security group ID (blank to create one)
      VpcCidr:
        default: New shared VPC CIDR
      MgmtSubnetCidr:
        default: Management subnet CIDR
      DataSubnetCidr:
        default: Data (ingress) subnet CIDR
      ToolSubnetCidr:
        default: Tool (egress) subnet CIDR

Parameters:
  DeployKVO:
    Type: String
    Default: "yes"
    AllowedValues:
      - "yes"
      - "no"
    Description: Deploy the KVO orchestrator instance alongside vController.
  DeployVPB:
    Type: String
    Default: "yes"
    AllowedValues:
      - "yes"
      - "no"
    Description: Deploy the vPB data-plane instance alongside vController.
  EnableZoneTapping:
    Type: String
    Default: "no"
    AllowedValues:
      - "yes"
      - "no"
    Description: >-
      Attach an IAM instance profile to KVO so it can run AWS Zone Tapping
      (deploy collector Service VMs and create AWS VPC Traffic Mirror sessions).
      Requires KVO and CAPABILITY_NAMED_IAM at deploy time. Leave "no" if the
      deploying principal cannot create IAM roles; the base suite still deploys,
      and mirroring can be enabled later with scripts/kvo_enable_zonetap_iam.sh.
  KeyPairAction:
    Type: String
    Default: "Use an existing key pair"
    AllowedValues:
      - "Use an existing key pair"
      - "Create a new key pair for me"
    Description: >
      "Use an existing key pair" launches with the key selected in the dropdown
      below. "Create a new key pair for me" instead creates one named
      <StackName>-key and stores its private key in SSM Parameter Store; the
      stack outputs the command to download it. AWS still requires a value in
      the dropdown below even when creating a new key pair: pick any entry, it
      is ignored. If that dropdown is empty the account has no key pairs at all
      - create one in the EC2 console first, or use the CLI installer, which
      creates one for you.
  KeyPairName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: >
      Existing EC2 key pair, picked from the live list of key pairs in this
      region. Used when the action above is "Use an existing key pair"; ignored
      (but still required by AWS) when creating a new one.
  AdminIngressCidr:
    Type: String
    Default: 0.0.0.0/0
    Description: >
      Source CIDR allowed to reach SSH (22), vPB SSH (9022), HTTPS (443), and
      VXLAN (4789, 10800-10801). Narrow this to your admin and sensor network.
      Default 0.0.0.0/0 is open to the internet. Ignored when you supply an
      existing security group.
    AllowedPattern: ^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})$
  AssignPublicIp:
    Type: String
    Default: "yes"
    AllowedValues:
      - "yes"
      - "no"
    Description: >
      yes = attach a public Elastic IP to each instance (default; reach the UIs
      over the internet). no = private IPs only, no Elastic IPs - use this for
      private subnets, no-public-IP SCPs, or when you reach the stack over
      VPN / Direct Connect / VPC peering. When no, the private subnet still needs
      outbound internet (NAT or VPC endpoints) for Marketplace activation and
      first-boot bootstrap.
  VcontrollerInstanceType:
    Type: String
    Default: t3.xlarge
    AllowedValues:
      - t3.xlarge
      - m5.xlarge
    Description: >
      Instance type for vController. The Marketplace AMI permits t3.xlarge
      (burstable, cheapest) and m5.xlarge (dedicated CPU, steadier under load
      for production). Other sizes are rejected by the Marketplace product.
  KvoInstanceType:
    Type: String
    Default: c5.2xlarge
    AllowedValues:
      - c5.2xlarge
    Description: Instance type for KVO. Qualified on c5.2xlarge only.
  VpbInstanceType:
    Type: String
    Default: t3.xlarge
    AllowedValues:
      - t3.xlarge
    Description: Instance type for vPB. Qualified on t3.xlarge only.
  VcontrollerName:
    Type: String
    Default: ""
    Description: >
      Optional. Name tag for the vController instance. Blank = <StackName>-vcontroller.
    AllowedPattern: "^$|^[A-Za-z0-9][A-Za-z0-9 ._-]{0,254}$"
    ConstraintDescription: Blank, or up to 255 characters starting with a letter or digit.
  KvoName:
    Type: String
    Default: ""
    Description: >
      Optional. Name tag for the KVO instance. Blank = <StackName>-kvo.
    AllowedPattern: "^$|^[A-Za-z0-9][A-Za-z0-9 ._-]{0,254}$"
    ConstraintDescription: Blank, or up to 255 characters starting with a letter or digit.
  VpbName:
    Type: String
    Default: ""
    Description: >
      Optional. Name tag for the vPB instance. Blank = <StackName>-vpb.
    AllowedPattern: "^$|^[A-Za-z0-9][A-Za-z0-9 ._-]{0,254}$"
    ConstraintDescription: Blank, or up to 255 characters starting with a letter or digit.
  TestWindowsInstanceProfile:
    Type: String
    Default: ""
    Description: >
      Only used when the Windows test VM is deployed. Ansible reaches Windows
      over AWS Systems Manager, which needs an instance profile granting
      AmazonSSMManagedInstanceCore. This template deliberately creates no IAM
      resources, so that non-admin users can deploy it: have an admin create
      such a profile once (any name, reusable across every stack) and put its
      NAME here. Leave blank and the Windows VM still deploys, but Ansible
      cannot reach it over SSM and its sensor must be installed another way.
  DeployTestWorkloadUbuntu:
    Type: String
    Default: "no"
    AllowedValues: ["no", "yes"]
    Description: >
      Deploy an Ubuntu 22.04 test VM into this stack's subnet, tagged for sensor
      discovery. For proving the sensor path end to end without hand-building a
      workload. Uses t3.small.
  DeployTestWorkloadRhel:
    Type: String
    Default: "no"
    AllowedValues: ["no", "yes"]
    Description: >
      Deploy a RHEL 9 test VM into this stack's subnet, tagged for sensor
      discovery. Uses t3.small.
  DeployTestWorkloadWindows:
    Type: String
    Default: "no"
    AllowedValues: ["no", "yes"]
    Description: >
      Deploy a Windows Server 2022 test VM into this stack's subnet, tagged for
      sensor discovery. Uses t3.medium; Windows needs the extra memory.
  DiscoveryTagKey:
    Type: String
    Default: cloudlens
    Description: >
      Tag key written on the test VMs so the sensor playbook finds them. Must
      match the discovery tag the sensor deployment filters on.
    AllowedPattern: "^[A-Za-z0-9_.:/=+@-]{1,128}$"
  DiscoveryTagValue:
    Type: String
    Default: "yes"
    Description: Tag value paired with the key above.
    AllowedPattern: "^[A-Za-z0-9_.:/=+@ -]{1,256}$"
  TestWorkloadUbuntuAmi:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/canonical/ubuntu/server/22.04/stable/current/amd64/hvm/ebs-gp2/ami-id
    Description: >
      Resolved automatically from Canonical's public SSM parameter, so it always
      tracks the current Ubuntu 22.04 image. Leave as is.
  TestWorkloadWindowsAmi:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ami-windows-latest/Windows_Server-2022-English-Full-Base
    Description: >
      Resolved automatically from the AWS public SSM parameter, so it always
      tracks the current Windows Server 2022 image. Leave as is.
  ExistingVpcId:
    Type: String
    Default: ""
    Description: >
      Optional. ID of an existing VPC to deploy into (for example vpc-0abc123).
      Leave blank to create a new shared VPC. When set, you must also provide an
      existing subnet ID.
  ExistingSubnetId:
    Type: String
    Default: ""
    Description: >
      Optional. ID of an existing subnet to place the instances in. Required when
      Existing VPC ID is set. vController and KVO always land here; vPB lands here
      too unless you set a separate data subnet below. Leave blank when creating a
      new shared VPC.
  ExistingDataSubnetId:
    Type: String
    Default: ""
    Description: >
      Optional. ID of a separate existing subnet for the vPB data plane, if you
      keep management and data traffic in different subnets. Blank = vPB reuses
      the subnet above. Only used with an existing VPC.
  ExistingToolSubnetId:
    Type: String
    Default: ""
    Description: >
      Optional. ID of a separate existing subnet for the vPB egress (tool) plane.
      Supply this AND the data subnet to give the vPB its full three-NIC data
      plane in an existing VPC. Without both, the vPB comes up management-only
      and cannot forward tapped traffic. All three subnets must be in the SAME
      Availability Zone as the instance: AWS cannot attach an interface across
      zones. Only used with an existing VPC.
  ExistingSecurityGroupId:
    Type: String
    Default: ""
    Description: >
      Optional. ID of an existing security group to attach to every instance
      (for example sg-0abc123). Blank = the template creates one scoped to your
      Admin source CIDR. Supply your own when your org requires pre-approved
      security groups. You are responsible for opening SSH (22), vPB SSH (9022),
      HTTPS (443), and VXLAN (4789, 10800-10801).
  VpcCidr:
    Type: String
    Default: 10.99.0.0/16
    Description: CIDR block for the new shared VPC. Only used when Existing VPC ID is blank.
    AllowedPattern: ^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})$
  MgmtSubnetCidr:
    Type: String
    Default: 10.99.1.0/24
    Description: Management subnet CIDR (hosts vController, KVO, and the vPB mgmt interface). Only used when Existing VPC ID is blank.
    AllowedPattern: ^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})$
  DataSubnetCidr:
    Type: String
    Default: 10.99.11.0/24
    Description: Data subnet CIDR (vPB ingress, receives mirrored traffic). Only used when Existing VPC ID is blank.
    AllowedPattern: ^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})$
  ToolSubnetCidr:
    Type: String
    Default: 10.99.12.0/24
    Description: Tool subnet CIDR (vPB egress, forwards to monitoring tools). Only used when Existing VPC ID is blank.
    AllowedPattern: ^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})$

Mappings:
  RegionMap:
    us-east-1:
      VcontrollerAmi: ami-0bebd5e730315337e
      KvoAmi: ami-017c0db8981569380
      VpbAmi: ami-0d00b42a9748d580c
      TestRhelAmi: ami-037b1265ce539a36b
    us-east-2:
      VcontrollerAmi: ami-085c6b0cf292a110f
      KvoAmi: ami-09ba4a3a96b404131
      VpbAmi: ami-0bdb147359362e451
      TestRhelAmi: ami-00abb3be2c0a00884
    us-west-1:
      VcontrollerAmi: ami-0420c02f2c555a402
      KvoAmi: ami-078dcfe6ef376cbf8
      VpbAmi: ami-0f4c90de5b6218bcb
      TestRhelAmi: ami-01bd9d5a15b53f425
    us-west-2:
      VcontrollerAmi: ami-0f3fba668617b18f1
      KvoAmi: ami-0461fbb90a12fc90d
      VpbAmi: ami-0b21fd86f3ef95d20
      TestRhelAmi: ami-01a0de0b8c3e70f9b
    eu-west-1:
      VcontrollerAmi: ami-0bf7638d1e75aac19
      KvoAmi: ami-073bf2fb4534dbd7a
      VpbAmi: ami-0a326441326d1a1ba
      TestRhelAmi: ami-02568ac5ddcbd31e7
    eu-west-2:
      VcontrollerAmi: ami-0c8189014261e3c7f
      KvoAmi: ami-0f0b3a8233656bee1
      VpbAmi: ami-0c2424fa82af5583d
      TestRhelAmi: ami-069464cbf08dc03ee
    eu-central-1:
      VcontrollerAmi: ami-0e8c6cc855fccfc22
      KvoAmi: ami-0fcc45a154c9e0a9c
      VpbAmi: ami-081212375359e9f18
      TestRhelAmi: ami-070b1015e2969b61e
    ca-central-1:
      VcontrollerAmi: ami-0b4ec2f46fc51cd6d
      KvoAmi: ami-0164ddd77416f2ca2
      VpbAmi: ami-036351ce1ebb5bf52
      TestRhelAmi: ami-04abfc5870b97cb27
    ap-southeast-1:
      VcontrollerAmi: ami-04955ec1c6899170d
      KvoAmi: ami-0c9a3935cfbc53ac8
      VpbAmi: ami-0fd9d87d31db91dbb
      TestRhelAmi: ami-0f88780df278d47eb
    ap-southeast-2:
      VcontrollerAmi: ami-00fb08ffc483a3ea1
      KvoAmi: ami-0b38af1afe0f11695
      VpbAmi: ami-0c35e40887fa8547c
      TestRhelAmi: ami-00db6ff7f6494b853
    ap-northeast-1:
      VcontrollerAmi: ami-05383c85ebe460ee6
      KvoAmi: ami-096430c7ccaba7a2c
      VpbAmi: ami-0cb2da0165c37db78
      TestRhelAmi: ami-0154353c91d5d85fd
    ap-south-1:
      VcontrollerAmi: ami-0de9998616b04343e
      KvoAmi: ami-0e579f93331cd8712
      VpbAmi: ami-0fd34a7cce0d8aaaa
      TestRhelAmi: ami-07965f2ce18015293

Conditions:
  ExistingVPC: !Not [!Equals [!Ref ExistingVpcId, ""]]
  CreateVpc: !Not [Condition: ExistingVPC]
  DeployKVO: !Equals [!Ref DeployKVO, "yes"]
  DeployVPB: !Equals [!Ref DeployVPB, "yes"]
  WithPublicIp: !Equals [!Ref AssignPublicIp, "yes"]
  CreateSecurityGroup: !Equals [!Ref ExistingSecurityGroupId, ""]
  CreateKeyPair: !Equals [!Ref KeyPairAction, "Create a new key pair for me"]
  CustomVcontrollerName: !Not [!Equals [!Ref VcontrollerName, ""]]
  CustomKvoName: !Not [!Equals [!Ref KvoName, ""]]
  CustomVpbName: !Not [!Equals [!Ref VpbName, ""]]
  UseDataSubnet: !Not [!Equals [!Ref ExistingDataSubnetId, ""]]
  UseToolSubnet: !Not [!Equals [!Ref ExistingToolSubnetId, ""]]
  # Brownfield can carry the full data plane too, but only when BOTH data and
  # tool subnets are named: the ENIs need somewhere to land.
  BrownfieldDataPlane: !And [!Condition UseDataSubnet, !Condition UseToolSubnet]
  TestUbuntu: !Equals [!Ref DeployTestWorkloadUbuntu, "yes"]
  TestRhel: !Equals [!Ref DeployTestWorkloadRhel, "yes"]
  TestWindows: !Equals [!Ref DeployTestWorkloadWindows, "yes"]
  HaveWindowsProfile: !Not [!Equals [!Ref TestWindowsInstanceProfile, ""]]
  AnyTestWorkload: !Or [!Condition TestUbuntu, !Condition TestRhel, !Condition TestWindows]
  # Elastic IPs are per-component AND gated on the public-IP toggle.
  VcontrollerHasEip: !Condition WithPublicIp
  KvoHasEip: !And [!Condition DeployKVO, !Condition WithPublicIp]
  VpbHasEip: !And [!Condition DeployVPB, !Condition WithPublicIp]
  WithZoneTapping: !And [!Condition DeployKVO, !Equals [!Ref EnableZoneTapping, "yes"]]
  # A tapping vPB needs 3 NICs (mgmt/ingress/egress). Greenfield always has the
  # dedicated data + tool subnets. Brownfield qualifies when the operator names
  # both. This used to be gated on CreateVpc alone, which silently gave every
  # existing-VPC deploy a management-only vPB: no data plane, nothing for
  # --wire-vpb-path to bind, and the mirror phase cutting zero sessions while
  # the run reported success.
  VpbMultiNic: !And
    - !Condition DeployVPB
    - !Or [!Condition CreateVpc, !Condition BrownfieldDataPlane]

Resources:


  Vpc:
    Type: AWS::EC2::VPC
    Condition: CreateVpc
    Properties:
      CidrBlock: !Ref VpcCidr
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-vpc"

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Condition: CreateVpc
    Properties:
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-igw"

  VpcGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Condition: CreateVpc
    Properties:
      VpcId: !Ref Vpc
      InternetGatewayId: !Ref InternetGateway

  MgmtSubnet:
    Type: AWS::EC2::Subnet
    Condition: CreateVpc
    Properties:
      VpcId: !Ref Vpc
      AvailabilityZone: !Select [0, !GetAZs ""]
      CidrBlock: !Ref MgmtSubnetCidr
      MapPublicIpOnLaunch: !If [WithPublicIp, true, false]
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-mgmt-subnet"

  DataSubnet:
    Type: AWS::EC2::Subnet
    Condition: CreateVpc
    Properties:
      VpcId: !Ref Vpc
      AvailabilityZone: !Select [0, !GetAZs ""]
      CidrBlock: !Ref DataSubnetCidr
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-data-subnet"

  ToolSubnet:
    Type: AWS::EC2::Subnet
    Condition: CreateVpc
    Properties:
      VpcId: !Ref Vpc
      AvailabilityZone: !Select [0, !GetAZs ""]
      CidrBlock: !Ref ToolSubnetCidr
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-tool-subnet"

  RouteTable:
    Type: AWS::EC2::RouteTable
    Condition: CreateVpc
    Properties:
      VpcId: !Ref Vpc
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-rt"

  DefaultRoute:
    Type: AWS::EC2::Route
    Condition: CreateVpc
    DependsOn: VpcGatewayAttachment
    Properties:
      RouteTableId: !Ref RouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  MgmtSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Condition: CreateVpc
    Properties:
      SubnetId: !Ref MgmtSubnet
      RouteTableId: !Ref RouteTable

  DataSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Condition: CreateVpc
    Properties:
      SubnetId: !Ref DataSubnet
      RouteTableId: !Ref RouteTable

  ToolSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Condition: CreateVpc
    Properties:
      SubnetId: !Ref ToolSubnet
      RouteTableId: !Ref RouteTable

  # ---------- Key pair (only when the customer did not name one) ----------
  # EC2 generates the key and stores the PRIVATE key in SSM Parameter Store as
  # a SecureString at /ec2/keypair/<key-pair-id>. The stack outputs the exact
  # command to download it. This is what makes a first-ever deploy possible in
  # an account that has no key pair yet.
  GeneratedKeyPair:
    Type: AWS::EC2::KeyPair
    Condition: CreateKeyPair
    Properties:
      KeyName: !Sub "${AWS::StackName}-key"
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-key"

  # ---------- Shared security group (only when one is not supplied) ----------
  SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Condition: CreateSecurityGroup
    Properties:
      GroupDescription: CloudLens stack access (SSH, vPB SSH, HTTPS, VXLAN)
      VpcId: !If [CreateVpc, !Ref Vpc, !Ref ExistingVpcId]
      SecurityGroupIngress:
        - Description: SSH
          IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: !Ref AdminIngressCidr
        - Description: vPB SSH (KCOS)
          IpProtocol: tcp
          FromPort: 9022
          ToPort: 9022
          CidrIp: !Ref AdminIngressCidr
        - Description: HTTPS UI
          IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: !Ref AdminIngressCidr
        - Description: VXLAN standard
          IpProtocol: udp
          FromPort: 4789
          ToPort: 4789
          CidrIp: !Ref AdminIngressCidr
        - Description: VXLAN Keysight
          IpProtocol: udp
          FromPort: 10800
          ToPort: 10801
          CidrIp: !Ref AdminIngressCidr
        - Description: L2GRE tunnel from CloudLens collector (IP protocol 47, no ports)
          IpProtocol: "47"
          CidrIp: !Ref AdminIngressCidr
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-sg"

  # ---------- vController (always) ----------
  VcontrollerInstance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !FindInMap [RegionMap, !Ref "AWS::Region", VcontrollerAmi]
      InstanceType: !Ref VcontrollerInstanceType
      KeyName: !If [CreateKeyPair, !Ref GeneratedKeyPair, !Ref KeyPairName]
      SubnetId: !If [CreateVpc, !Ref MgmtSubnet, !Ref ExistingSubnetId]
      SecurityGroupIds:
        - !If [CreateSecurityGroup, !Ref SecurityGroup, !Ref ExistingSecurityGroupId]
      Tags:
        - Key: Name
          Value: !If [CustomVcontrollerName, !Ref VcontrollerName, !Sub "${AWS::StackName}-vcontroller"]

  # Allocated with no InstanceId so it has no dependency on the instance and
  # CloudFormation claims it immediately. If the account is short on Elastic IP
  # quota the stack fails within seconds, before any instance launches, instead
  # of several minutes in with instance hours already burned.
  VcontrollerEip:
    Type: AWS::EC2::EIP
    Condition: VcontrollerHasEip
    Properties:
      Domain: vpc
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-vcontroller-eip"

  VcontrollerEipAssociation:
    Type: AWS::EC2::EIPAssociation
    Condition: VcontrollerHasEip
    Properties:
      AllocationId: !GetAtt VcontrollerEip.AllocationId
      InstanceId: !Ref VcontrollerInstance

  # ---------- KVO (optional) ----------
  KvoInstance:
    Type: AWS::EC2::Instance
    Condition: DeployKVO
    Properties:
      ImageId: !FindInMap [RegionMap, !Ref "AWS::Region", KvoAmi]
      InstanceType: !Ref KvoInstanceType
      KeyName: !If [CreateKeyPair, !Ref GeneratedKeyPair, !Ref KeyPairName]
      SubnetId: !If [CreateVpc, !Ref MgmtSubnet, !Ref ExistingSubnetId]
      SecurityGroupIds:
        - !If [CreateSecurityGroup, !Ref SecurityGroup, !Ref ExistingSecurityGroupId]
      IamInstanceProfile: !If [WithZoneTapping, !Ref KvoZoneTapInstanceProfile, !Ref "AWS::NoValue"]
      Tags:
        - Key: Name
          Value: !If [CustomKvoName, !Ref KvoName, !Sub "${AWS::StackName}-kvo"]

  # ---------- KVO Zone Tapping IAM (optional, EnableZoneTapping=yes) ----------
  # Least-privilege policy from the KVO 3.0.1 User Guide, Ch.10 (Clusters). Lets
  # KVO deploy collector Service VMs and create AWS VPC Traffic Mirror sessions.
  # Every create is scoped by the cloudlens:monitored:vpcid tag KVO applies, and
  # the Deny statements block anything untagged. Gated so the base suite still
  # deploys for principals without IAM rights (leave EnableZoneTapping=no).
  KvoZoneTapRole:
    Type: AWS::IAM::Role
    Condition: WithZoneTapping
    Properties:
      RoleName: !Sub "${AWS::StackName}-kvo-zonetap"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: CloudLensZoneTap
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - ec2:DescribeInstanceTypes
                  - ec2:DescribeKeyPairs
                  - ec2:DescribeVpcs
                  - ec2:DescribeSecurityGroups
                  - ec2:DescribeSubnets
                  - account:ListRegions
                Resource: "*"
              - Effect: Allow
                Action:
                  - ec2:DescribeInstances
                  # DescribeTags is a deliberate addition beyond the KVO UG
                  # Ch.10 policy (tag-key enumeration for the collection
                  # selector); keep in sync with
                  # deploy/iam/cloudlens-zonetap-policy.json.
                  - ec2:DescribeTags
                  - ec2:DescribeTrafficMirrorSessions
                  - ec2:DescribeTrafficMirrorTargets
                  - ec2:DescribeTrafficMirrorFilters
                  - ec2:DescribeAvailabilityZones
                  - ec2:DescribeLaunchTemplateVersions
                  - ec2:DescribeNetworkInterfaces
                  - autoscaling:DescribeAutoScalingGroups
                  - autoscaling:DescribeScalingActivities
                Resource: "*"
              - Effect: Allow
                Action:
                  - ec2:TerminateInstances
                  - ec2:DeleteLaunchTemplate
                  - ec2:DeleteLaunchTemplateVersions
                  - ec2:DeleteTrafficMirrorFilter
                  - ec2:DeleteTrafficMirrorTarget
                  - ec2:DeleteTrafficMirrorSession
                  - ec2:DeleteNetworkInterface
                  - autoscaling:DeleteTags
                  - autoscaling:DeleteAutoScalingGroup
                  - ec2:AttachNetworkInterface
                  - ec2:ModifyLaunchTemplate
                  - autoscaling:CreateOrUpdateTags
                  - autoscaling:UpdateAutoScalingGroup
                  - autoscaling:SetDesiredCapacity
                  - autoscaling:StartInstanceRefresh
                  - ec2:CreateLaunchTemplateVersion
                Resource: "*"
                Condition:
                  StringLike:
                    "aws:ResourceTag/cloudlens:monitored:vpcid": "*"
              - Effect: Allow
                Action:
                  - ec2:CreateTrafficMirrorFilter
                  - ec2:CreateLaunchTemplate
                  - autoscaling:CreateAutoScalingGroup
                Resource: "*"
                Condition:
                  StringLike:
                    "aws:RequestTag/cloudlens:monitored:vpcid": "*"
              - Effect: Allow
                Action:
                  - ec2:CreateTags
                Resource: "*"
                Condition:
                  StringLike:
                    "aws:RequestTag/cloudlens:monitored:vpcid": "*"
                  StringEquals:
                    "ec2:CreateAction":
                      - CreateTrafficMirrorFilterRule
                      - CreateTrafficMirrorFilter
                      - CreateTrafficMirrorSession
                      - CreateTrafficMirrorTarget
                      - CreateNetworkInterface
                      - CreateLaunchTemplate
                      - RunInstances
              - Effect: Allow
                Action:
                  - ec2:CreateTrafficMirrorFilterRule
                  - ec2:CreateTrafficMirrorTarget
                  - ec2:CreateTrafficMirrorSession
                  - ec2:CreateNetworkInterface
                  - ec2:RunInstances
                  - ec2:ModifyNetworkInterfaceAttribute
                Resource: "*"
              - Effect: Deny
                Action: ec2:CreateTrafficMirrorFilterRule
                Resource: "arn:aws:ec2:*:*:traffic-mirror-filter-rule/*"
                Condition:
                  StringNotLike:
                    "aws:RequestTag/cloudlens:monitored:vpcid": "*"
              - Effect: Deny
                Action: ec2:CreateTrafficMirrorTarget
                Resource: "arn:aws:ec2:*:*:traffic-mirror-target/*"
                Condition:
                  StringNotLike:
                    "aws:RequestTag/cloudlens:monitored:vpcid": "*"
              - Effect: Deny
                Action: ec2:CreateTrafficMirrorSession
                Resource: "arn:aws:ec2:*:*:traffic-mirror-session/*"
                Condition:
                  StringNotLike:
                    "aws:RequestTag/cloudlens:monitored:vpcid": "*"
              - Effect: Deny
                Action: ec2:CreateNetworkInterface
                Resource: "arn:aws:ec2:*:*:network-interface/*"
                Condition:
                  StringNotLike:
                    "aws:RequestTag/cloudlens:monitored:vpcid": "*"
              - Effect: Deny
                Action: ec2:RunInstances
                Resource: "arn:aws:ec2:*:*:instance/*"
                Condition:
                  StringNotLike:
                    "aws:RequestTag/cloudlens:monitored:vpcid": "*"
              - Effect: Deny
                Action: ec2:ModifyNetworkInterfaceAttribute
                Resource:
                  - "arn:aws:ec2:*:*:network-interface/*"
                  - "arn:aws:ec2:*:*:instance/*"
                Condition:
                  StringNotLike:
                    "aws:ResourceTag/cloudlens:monitored:vpcid": "*"

  KvoZoneTapInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Condition: WithZoneTapping
    Properties:
      Roles:
        - !Ref KvoZoneTapRole

  # Allocated with no InstanceId so it has no dependency on the instance and
  # CloudFormation claims it immediately. If the account is short on Elastic IP
  # quota the stack fails within seconds, before any instance launches, instead
  # of several minutes in with instance hours already burned.
  KvoEip:
    Type: AWS::EC2::EIP
    Condition: KvoHasEip
    Properties:
      Domain: vpc
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-kvo-eip"

  KvoEipAssociation:
    Type: AWS::EC2::EIPAssociation
    Condition: KvoHasEip
    Properties:
      AllocationId: !GetAtt KvoEip.AllocationId
      InstanceId: !Ref KvoInstance

  # ---------- vPB (optional) ----------
  VpbInstance:
    Type: AWS::EC2::Instance
    Condition: DeployVPB
    Properties:
      ImageId: !FindInMap [RegionMap, !Ref "AWS::Region", VpbAmi]
      InstanceType: !Ref VpbInstanceType
      KeyName: !If [CreateKeyPair, !Ref GeneratedKeyPair, !Ref KeyPairName]
      SourceDestCheck: false
      # eth0 is the MANAGEMENT interface. With a full brownfield data plane the
      # ingress/egress ENIs carry the traffic, so eth0 belongs in the management
      # subnet; putting it in the data subnet would collide with eth1. Only the
      # single-NIC brownfield case falls back to the data subnet, preserving the
      # previous behaviour for anyone who supplied a data subnet and no tool one.
      SubnetId: !If
        - CreateVpc
        - !Ref MgmtSubnet
        - !If
          - BrownfieldDataPlane
          - !Ref ExistingSubnetId
          - !If [UseDataSubnet, !Ref ExistingDataSubnetId, !Ref ExistingSubnetId]
      SecurityGroupIds:
        - !If [CreateSecurityGroup, !Ref SecurityGroup, !Ref ExistingSecurityGroupId]
      Tags:
        - Key: Name
          Value: !If [CustomVpbName, !Ref VpbName, !Sub "${AWS::StackName}-vpb"]
      UserData:
        Fn::Base64: |
          #!/bin/bash
          # Auto-bootstrap (mirrors the Azure CustomScript extension): waits for
          # KCOS, installs system-wide KUBECONFIG and the sudo vpb wrapper so
          # SSH-in just works. Log: /var/log/cloudlens-bootstrap.log
          set -euo pipefail
          curl -fsSL https://raw.githubusercontent.com/Keysight-Tech/cloudlens-ansible-aws/main/scripts/bootstrap-vpb.sh -o /tmp/bootstrap-vpb.sh
          bash /tmp/bootstrap-vpb.sh > /var/log/cloudlens-bootstrap.log 2>&1

  # Allocated with no InstanceId so it has no dependency on the instance and
  # CloudFormation claims it immediately. If the account is short on Elastic IP
  # quota the stack fails within seconds, before any instance launches, instead
  # of several minutes in with instance hours already burned.
  VpbEip:
    Type: AWS::EC2::EIP
    Condition: VpbHasEip
    Properties:
      Domain: vpc
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-vpb-eip"

  VpbEipAssociation:
    Type: AWS::EC2::EIPAssociation
    Condition: VpbHasEip
    Properties:
      AllocationId: !GetAtt VpbEip.AllocationId
      InstanceId: !Ref VpbInstance

  # ---------- vPB data-plane NICs (greenfield) ----------
  # eth1 = ingress (data subnet): receives tapped/mirrored traffic.
  # eth2 = egress  (tool subnet): forwards filtered traffic to tools.
  # SourceDestCheck is off because a packet broker forwards traffic it does not own.
  # This is what makes the vPB usable as a KVO-managed tap/tool target.
  VpbIngressEni:
    Type: AWS::EC2::NetworkInterface
    Condition: VpbMultiNic
    Properties:
      SubnetId: !If [CreateVpc, !Ref DataSubnet, !Ref ExistingDataSubnetId]
      GroupSet:
        - !If [CreateSecurityGroup, !Ref SecurityGroup, !Ref ExistingSecurityGroupId]
      SourceDestCheck: false
      Description: vPB ingress (tapped traffic in)
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-vpb-ingress"

  VpbEgressEni:
    Type: AWS::EC2::NetworkInterface
    Condition: VpbMultiNic
    Properties:
      SubnetId: !If [CreateVpc, !Ref ToolSubnet, !Ref ExistingToolSubnetId]
      GroupSet:
        - !If [CreateSecurityGroup, !Ref SecurityGroup, !Ref ExistingSecurityGroupId]
      SourceDestCheck: false
      Description: vPB egress (to tools)
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-vpb-egress"

  VpbIngressAttachment:
    Type: AWS::EC2::NetworkInterfaceAttachment
    Condition: VpbMultiNic
    Properties:
      InstanceId: !Ref VpbInstance
      NetworkInterfaceId: !Ref VpbIngressEni
      DeviceIndex: 1

  VpbEgressAttachment:
    Type: AWS::EC2::NetworkInterfaceAttachment
    Condition: VpbMultiNic
    Properties:
      InstanceId: !Ref VpbInstance
      NetworkInterfaceId: !Ref VpbEgressEni
      DeviceIndex: 2

  # ---------- Optional test workloads ----------
  # Plain VMs that exist only to prove the sensor path. They land in THIS
  # stack's subnet, not a separate VPC, so sensors reach vController over the
  # private network and VPC Traffic Mirroring between them and the vPB is
  # actually possible. A fixture in its own VPC cannot demonstrate either.
  TestWorkloadSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Condition: AnyTestWorkload
    Properties:
      GroupDescription: CloudLens test workload VMs
      VpcId: !If [CreateVpc, !Ref Vpc, !Ref ExistingVpcId]
      SecurityGroupIngress:
        - Description: SSH from the admin network
          IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: !Ref AdminIngressCidr
        - Description: RDP from the admin network (Windows)
          IpProtocol: tcp
          FromPort: 3389
          ToPort: 3389
          CidrIp: !Ref AdminIngressCidr
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-testworkload-sg"

  TestUbuntuInstance:
    Type: AWS::EC2::Instance
    Condition: TestUbuntu
    Properties:
      ImageId: !Ref TestWorkloadUbuntuAmi
      InstanceType: t3.small
      KeyName: !If [CreateKeyPair, !Ref GeneratedKeyPair, !Ref KeyPairName]
      SubnetId: !If [CreateVpc, !Ref MgmtSubnet, !Ref ExistingSubnetId]
      SecurityGroupIds:
        - !Ref TestWorkloadSecurityGroup
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-test-ubuntu"
        - Key: !Ref DiscoveryTagKey
          Value: !Ref DiscoveryTagValue
        - Key: os
          Value: ubuntu
        - Key: env
          Value: test

  TestRhelInstance:
    Type: AWS::EC2::Instance
    Condition: TestRhel
    Properties:
      ImageId: !FindInMap [RegionMap, !Ref "AWS::Region", TestRhelAmi]
      InstanceType: t3.small
      KeyName: !If [CreateKeyPair, !Ref GeneratedKeyPair, !Ref KeyPairName]
      SubnetId: !If [CreateVpc, !Ref MgmtSubnet, !Ref ExistingSubnetId]
      SecurityGroupIds:
        - !Ref TestWorkloadSecurityGroup
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-test-rhel"
        - Key: !Ref DiscoveryTagKey
          Value: !Ref DiscoveryTagValue
        - Key: os
          Value: rhel
        - Key: env
          Value: test

  TestWindowsInstance:
    Type: AWS::EC2::Instance
    Condition: TestWindows
    Properties:
      ImageId: !Ref TestWorkloadWindowsAmi
      InstanceType: t3.medium
      # Ansible reaches Windows over SSM, which needs this profile on the
      # instance. Omitted entirely when neither created nor supplied.
      IamInstanceProfile: !If
        - HaveWindowsProfile
        - !Ref TestWindowsInstanceProfile
        - !Ref "AWS::NoValue"
      KeyName: !If [CreateKeyPair, !Ref GeneratedKeyPair, !Ref KeyPairName]
      SubnetId: !If [CreateVpc, !Ref MgmtSubnet, !Ref ExistingSubnetId]
      SecurityGroupIds:
        - !Ref TestWorkloadSecurityGroup
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-test-windows"
        - Key: !Ref DiscoveryTagKey
          Value: !Ref DiscoveryTagValue
        - Key: os
          Value: windows
        - Key: env
          Value: test

Outputs:
  SharedVpcId:
    Description: VPC the stack deployed into.
    Value: !If [CreateVpc, !Ref Vpc, !Ref ExistingVpcId]
  KeyPairUsed:
    Description: EC2 key pair the instances were launched with.
    Value: !If [CreateKeyPair, !Ref GeneratedKeyPair, !Ref KeyPairName]
  DownloadPrivateKeyCommand:
    Condition: CreateKeyPair
    Description: >
      The stack created a key pair for you. Run this to download the private
      key, then chmod 400 it before using it with ssh.
    Value: !Sub
      - "aws ssm get-parameter --name /ec2/keypair/${KeyId} --region ${AWS::Region} --with-decryption --query Parameter.Value --output text > ${AWS::StackName}-key.pem && chmod 400 ${AWS::StackName}-key.pem"
      - KeyId: !GetAtt GeneratedKeyPair.KeyPairId
  AccessMode:
    Description: How the instances are reachable.
    Value: !If
      - WithPublicIp
      - "Public Elastic IPs assigned. Reach the UIs over the internet."
      - "Private IPs only. Reach the UIs over VPN / Direct Connect / VPC peering."
  VcontrollerAddress:
    Description: Reachable address of the vController (public EIP if assigned, else private IP).
    Value: !If [VcontrollerHasEip, !Ref VcontrollerEip, !GetAtt VcontrollerInstance.PrivateIp]
  VcontrollerPrivateIp:
    Description: Private IP of the vController instance.
    Value: !GetAtt VcontrollerInstance.PrivateIp
  VcontrollerUiUrl:
    Description: vController web UI URL. Default login admin / Cl0udLens@dm!n (change on first login).
    Value: !If
      - VcontrollerHasEip
      - !Sub "https://${VcontrollerEip}"
      - !Sub
        - "https://${Ip}"
        - Ip: !GetAtt VcontrollerInstance.PrivateIp
  KvoAddress:
    Condition: DeployKVO
    Description: Reachable address of the KVO (public EIP if assigned, else private IP).
    Value: !If [KvoHasEip, !Ref KvoEip, !GetAtt KvoInstance.PrivateIp]
  KvoPrivateIp:
    Condition: DeployKVO
    Description: Private IP of the KVO instance.
    Value: !GetAtt KvoInstance.PrivateIp
  KvoUiUrl:
    Condition: DeployKVO
    Description: KVO web UI URL.
    Value: !If
      - KvoHasEip
      - !Sub "https://${KvoEip}"
      - !Sub
        - "https://${Ip}"
        - Ip: !GetAtt KvoInstance.PrivateIp
  VpbAddress:
    Condition: DeployVPB
    Description: Reachable address of the vPB (public EIP if assigned, else private IP).
    Value: !If [VpbHasEip, !Ref VpbEip, !GetAtt VpbInstance.PrivateIp]
  VpbPrivateIp:
    Condition: DeployVPB
    Description: Private IP of the vPB instance.
    Value: !GetAtt VpbInstance.PrivateIp
  VpbUiUrl:
    Condition: DeployVPB
    Description: vPB web UI URL.
    Value: !If
      - VpbHasEip
      - !Sub "https://${VpbEip}"
      - !Sub
        - "https://${Ip}"
        - Ip: !GetAtt VpbInstance.PrivateIp
  VpbSshCommand:
    Condition: DeployVPB
    Description: SSH command for the vPB instance (port 9022).
    Value: !If
      - VpbHasEip
      - !Sub "ssh -i <your-key>.pem -p 9022 admin@${VpbEip}"
      - !Sub
        - "ssh -i <your-key>.pem -p 9022 admin@${Ip}  (reachable over VPN/peering)"
        - Ip: !GetAtt VpbInstance.PrivateIp
  TestWorkloadsDeployed:
    Condition: AnyTestWorkload
    Description: Test VMs created by this stack, tagged for sensor discovery.
    Value: !Sub
      - "tag ${K}=${V} | ubuntu:${U} rhel:${R} windows:${W}"
      - K: !Ref DiscoveryTagKey
        V: !Ref DiscoveryTagValue
        U: !If [TestUbuntu, !GetAtt TestUbuntuInstance.PrivateIp, "-"]
        R: !If [TestRhel, !GetAtt TestRhelInstance.PrivateIp, "-"]
        W: !If [TestWindows, !GetAtt TestWindowsInstance.PrivateIp, "-"]
  NextSteps:
    Description: What to do after the stack finishes.
    Value: >
      Allow about 15 minutes for full initialization. Open the vController UI,
      log in with admin / Cl0udLens@dm!n, create a Project, and copy the project
      key. Then run the sensor installer from the repo quickstart to register
      workloads. Marketplace subscription to all CloudLens AMIs is required. When
      deployed with private IPs, ensure the subnet has outbound internet (NAT or
      VPC endpoints) or first-boot Marketplace activation and bootstrap will hang.