tgw-gwlb.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: Deploy a Gateway Load Balancer, Check Point CloudGuard NS Gateway Auto Scaling Group, and optionally a Security Management Server, Gateway Load Balancer Endpoints and NAT Gateways for each AZ, in an existing VPC for Transit Gateway (20210525)
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Template & Lambda Code in S3
        Parameters:
          - S3Bucket
          - LambdaS3Key
      - Label:
          default: TGW Info
        Parameters:
          - TgwID
      - Label:
          default: Security VPC Network Configuration
        Parameters:
          - SecVPC
          - SecIGWID
          - AvailabilityZones
          - NumberOfAZs
          - GatewaysSubnets
          - TgwSubnet1Id
          - TgwSubnet2Id
          - TgwSubnet3Id
          - TgwSubnet4Id
          - SecSubnet1Id
          - SecSubnet2Id
          - SecSubnet3Id
          - SecSubnet4Id
      - Label:
          default: Internet VPC Network Configuration
        Parameters:
          - InetVPC
          - InetIGWID
          - InetTgwSubnet1Id
          - InetTgwSubnet2Id
          - InetTgwSubnet3Id
          - InetTgwSubnet4Id
          - NatGwSubnet1Id
          - NatGwSubnet2Id
          - NatGwSubnet3Id
          - NatGwSubnet4Id
          - InetPublicRt
      - Label:
          default: General Settings
        Parameters:
          - KeyName
          - EnableVolumeEncryption
          - EnableInstanceConnect
          - AllowUploadDownload
          - ManagementServer
          - ConfigurationTemplate
          - AdminEmail
          - Shell
      - Label:
          default: Check Point CloudGuard IaaS Security Gateways Auto Scaling Group Configuration
        Parameters:
          - GatewayName
          - GatewayInstanceType
          - GatewaysMinSize
          - GatewaysMaxSize
          - GatewayVersion
          - GatewayPasswordHash
          - GatewaySICKey
          - ControlGatewayOverPrivateOrPublicAddress
          - CloudWatch
      - Label:
          default: Gateway Load Balancer Configuration
        Parameters:
          - GWLBName
          - TargetGroupName
          - CrossZoneLoadBalancing
      - Label:
          default: Check Point CloudGuard IaaS Security Management Server Configuration
        Parameters:
          - ManagementDeploy
          - ManagementInstanceType
          - ManagementVersion
          - ManagementPasswordHash
          - GatewaysPolicy
          - AdminCIDR
          - GatewayManagement
          - GatewaysAddresses
    ParameterLabels:
      S3Bucket:
        default: S3 Bucket where CFTs are located
      LambdaS3Key:
        default: S3 Bucket Key for TGW Attachment Lambda zip file
      TgwID:
        default: TGW ID for attaching Security and Internet VPCs
      SecVPC:
        default: Security VPC
      SecIGWID:
        default: Security VPC Internet Gateway ID
      AvailabilityZones:
        default: Availability Zones
      NumberOfAZs:
        default: Number of AZs
      GatewaysSubnets:
        default: Gateways subnets
      TgwSubnet1Id:
        default: Transit Gateway Attachment subnet 1 Id
      TgwSubnet2Id:
        default: Transit Gateway Attachment subnet 2 Id
      TgwSubnet3Id:
        default: Transit Gateway Attachment subnet 3 Id
      TgwSubnet4Id:
        default: Transit Gateway Attachment subnet 4 Id
      SecSubnet1Id:
        default: Security subnet 1 Id
      SecSubnet2Id:
        default: Security subnet 2 Id
      SecSubnet3Id:
        default: Security subnet 3 Id
      SecSubnet4Id:
        default: Security subnet 4 Id
      InetVPC:
        default: Internet VPC
      InetIGWID:
        default: Internet VPC Internet Gateway ID
      NatGwSubnet1Id:
        default: NAT subnet 1 Id
      NatGwSubnet2Id:
        default: NAT subnet 2 Id
      NatGwSubnet3Id:
        default: NAT subnet 3 Id
      NatGwSubnet4Id:
        default: NAT subnet 4 Id
      InetTgwSubnet1Id:
        default: Inet Transit Gateway Attachment subnet 1 Id
      InetTgwSubnet2Id:
        default: Inet Transit Gateway Attachment subnet 2 Id
      InetTgwSubnet3Id:
        default: Inet Transit Gateway Attachment subnet 3 Id
      InetTgwSubnet4Id:
        default: Inet Transit Gateway Attachment subnet 4 Id
      InetPublicRt:
        default: Inet VPC Public RT Id
      KeyName:
        default: Key name
      EnableVolumeEncryption:
        default: Enable environment volume encryption
      EnableInstanceConnect:
        default: Enable AWS Instance Connect
      AllowUploadDownload:
        default: Allow upload & download
      ManagementServer:
        default: Management Server
      ConfigurationTemplate:
        default: Configuration template
      AdminEmail:
        default: Email address
      Shell:
        default: Admin shell
      GatewayName:
        default: Gateways instance name
      GatewayInstanceType:
        default: Gateways instance type
      GatewaysMinSize:
        default: Minimum group size
      GatewaysMaxSize:
        default: Maximum group size
      GatewayVersion:
        default: Gateways version & license
      GatewayPasswordHash:
        default: Gateways Password hash
      GatewaySICKey:
        default: Gateways SIC key
      ControlGatewayOverPrivateOrPublicAddress:
        default: Gateways addresses
      CloudWatch:
        default: CloudWatch metrics
      GWLBName:
        default: Gateway Load Balancer Name
      TargetGroupName:
        default: Target Group Name
      CrossZoneLoadBalancing:
        default:  Enable Cross Zone Load Balancing
      ManagementDeploy:
        default: Deploy Management Server
      ManagementInstanceType:
        default: Management instance type
      ManagementVersion:
        default: Management version & license
      ManagementPasswordHash:
        default: Management password hash
      GatewaysPolicy:
        default: Security Policy
      AdminCIDR:
        default: Administrator addresses
      GatewayManagement:
        default: Manage Gateways
      GatewaysAddresses:
        default: Gateways addresses
Parameters:
  S3Bucket:
    Description: S3 Bucket name where the nested CFT's are stored
    Type: String
    Default: chkp-gwlb
  LambdaS3Key:
    Description: S3 Key for lambda zip file
    Type: String
    Default:  lambda.zip
  TgwID:
    Description: TGW ID Security VPC and Inet VPC Attachment.  Leave Blank to skip automated attachment & RT creation
    Type: String
  SecVPC:
    Description: Select an existing SecVPC
    Type: AWS::EC2::VPC::Id
    MinLength: 1
    ConstraintDescription: You must select a SecVPC
  SecIGWID:
    Description: Security VPC's Internet Gateway Id (e.g. igw-123a4567)
    Type: String
    MinLength: 1
    ConstraintDescription: You must insert an Internet Gateway Id
  AvailabilityZones:
    Description: The Availability Zones (AZs) to use for the subnets in the VPC. Select two (the logical order is preserved)
    Type: List<AWS::EC2::AvailabilityZone::Name>
    MinLength: 2
  NumberOfAZs:
    Description: Number of Availability Zones to use in the VPC. This must match your selections in the list of Availability Zones parameter
    Type: Number
    Default: 2
    MinValue: 2
    MaxValue: 4
  GatewaysSubnets:
    Description: Select at least 2 public subnets in the VPC. If you choose to deploy a Security Management Server it will be deployed in the first subnet
    Type: List<AWS::EC2::Subnet::Id>
    MinLength: 2
  TgwSubnet1Id:
    Description: The TGW attachment subnet ID located in the 1st Availability Zone
    Type: String
    MinLength: 1
    ConstraintDescription: You must insert Tgw Subnet Id for Availability Zone 1
  TgwSubnet2Id:
    Description: The TGW attachment subnet ID located in the 2nd Availability Zone
    Type: String
    MinLength: 1
    ConstraintDescription: You must insert Tgw Subnet Id for Availability Zone 2
  TgwSubnet3Id:
    Description: The TGW attachment subnet ID located in the 3rd Availability Zone
    Type: String
  TgwSubnet4Id:
    Description: The TGW attachment subnet ID located in the 4th Availability Zone
    Type: String
  SecSubnet1Id:
    Description: The Security GW subnet ID located in the 1st Availability Zone
    Type: String
    MinLength: 1
    ConstraintDescription: You must insert Security GW Subnet Id for Availability Zone 1
  SecSubnet2Id:
    Description: The Security GW subnet ID located in the 2nd Availability Zone
    Type: String
    MinLength: 1
    ConstraintDescription: You must insert Security GW Subnet Id for Availability Zone 2
  SecSubnet3Id:
    Description: The Security GW subnet ID located in the 3rd Availability Zone
    Type: String
  SecSubnet4Id:
    Description: The Security GW subnet ID located in the 4th Availability Zone
    Type: String
  InetVPC:
    Description: Select an existing Internet VPC
    Type: AWS::EC2::VPC::Id
    MinLength: 1
    ConstraintDescription: You must select an Inet VPC
  InetPublicRt:
    Description: Select the RT ID of the Internet VPC's Public Route Table
    Type: String
    MinLength: 1
    ConstraintDescription: You must select an Inet Public Route Table
  InetIGWID:
    Description: Internet VPC's Internet Gateway Id (e.g. igw-123a4567)
    Type: String
    MinLength: 1
    ConstraintDescription: You must insert an Internet Gateway Id
  InetTgwSubnet1Id:
    Description: The InetTGW attachment subnet ID located in the 1st Availability Zone
    Type: String
    MinLength: 1
    ConstraintDescription: You must insert Inet Tgw Subnet Id for Availability Zone 1
  InetTgwSubnet2Id:
    Description: The InetTGW attachment subnet ID located in the 2nd Availability Zone
    Type: String
    MinLength: 1
    ConstraintDescription: You must insert InetTgw Subnet Id for Availability Zone 2
  InetTgwSubnet3Id:
    Description: The InetTGW attachment subnet ID located in the 3rd Availability Zone
    Type: String
  InetTgwSubnet4Id:
    Description: The InetTGW attachment subnet ID located in the 4th Availability Zone
    Type: String
  NatGwSubnet1Id:
    Description: The NatGW subnet ID located in the 1st Availability Zone
    Type: String
    MinLength: 1
    ConstraintDescription: You must insert Inet Tgw Subnet Id for Availability Zone 1
    Default: subnet-0114ab18ee72b1ba4
  NatGwSubnet2Id:
    Description: The NatGW subnet ID located in the 2nd Availability Zone
    Type: String
    MinLength: 1
    Default: subnet-0567b842c718e1b3c
    ConstraintDescription: You must insert NatGW Subnet Id for Availability Zone 2
  NatGwSubnet3Id:
    Description: The NatGW subnet ID located in the 3rd Availability Zone
    Type: String
    Default: subnet-062d82cae3d485bfa
  NatGwSubnet4Id:
    Description: The NatGW subnet ID located in the 4th Availability Zone
    Type: String
    Default: subnet-052b155a45bb14190
  KeyName:
    Description: The EC2 Key Pair to allow SSH access to the instances created by this stack
    Type: AWS::EC2::KeyPair::KeyName
    MinLength: 1
    ConstraintDescription: Must be the name of an existing EC2 KeyPair
  EnableVolumeEncryption:
    Description: Encrypt Environment instances volume with default AWS KMS key
    Type: String
    Default: true
    AllowedValues:
      - true
      - false
  EnableInstanceConnect:
    Description: Enable SSH connection over AWS web console
    Type: String
    Default: false
    AllowedValues:
      - true
      - false
  AllowUploadDownload:
    Description: Automatically download Blade Contracts and other important data. Improve product experience by sending data to Check Point
    Type: String
    Default: true
    AllowedValues:
      - true
      - false
  ManagementServer:
    Description: The name that represents the Security Management Server in the automatic provisioning configuration
    Type: String
    Default: gwlb-management-server
    MinLength: 1
  ConfigurationTemplate:
    Description: A name of a gateway configuration template in the automatic provisioning configuration
    Type: String
    Default: gwlb-ASG-configuration
    MinLength: 1
  AdminEmail:
    Description: Notifications about scaling events will be sent to this email address (optional)
    Type: String
    Default: ''
    AllowedPattern: '^(([a-zA-Z0-9_\-\.]+)@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.)|(([a-zA-Z0-9\-]+\.)+))([a-zA-Z]{2,4}|[0-9]{1,3})(\]?))?$'
  Shell:
    Description: Change the admin shell to enable advanced command line configuration. Applies for Security Gateways and Security Management Server if deployed.
    Type: String
    Default: /etc/cli.sh
    AllowedValues:
      - /etc/cli.sh
      - /bin/bash
      - /bin/csh
      - /bin/tcsh
  GatewayName:
    Description: The name tag of the Security Gateway instances (optional)
    Type: String
    Default: Check-Point-Gateway
  GatewayInstanceType:
    Description: The EC2 instance type for the Security Gateways
    Type: String
    Default: c5.xlarge
    AllowedValues:
      - c5.large
      - c5.xlarge
      - c5.2xlarge
      - c5.4xlarge
      - c5.9xlarge
      - c5.18xlarge
      - c5n.large
      - c5n.xlarge
      - c5n.2xlarge
      - c5n.4xlarge
      - c5n.9xlarge
      - c5n.18xlarge
    ConstraintDescription: Must be a valid EC2 instance type
  GatewaysMinSize:
    Description: The minimal number of Security Gateways
    Type: Number
    Default: 2
    MinValue: 1
  GatewaysMaxSize:
    Description: The maximal number of Security Gateways
    Type: Number
    Default: 10
    MinValue: 1
  GatewayVersion:
    Description: The version and license to install on the Security Gateways
    Type: String
    Default: R80.40-BYOL
    AllowedValues:
      - R80.40-BYOL
      - R80.40-PAYG-NGTP
      - R80.40-PAYG-NGTX
  GatewayPasswordHash:
    Description: Admin user's password hash (use command "openssl passwd -6 PASSWORD" to get the PASSWORD's hash) (optional)
    Type: String
    Default: ''
    AllowedPattern: '^[\$\./a-zA-Z0-9]*$'
    NoEcho: true
  GatewaySICKey:
    Description: The Secure Internal Communication key creates trusted connections between Check Point components. Choose a random string consisting of at least 8 alphanumeric characters
    Type: String
    AllowedPattern: '^[a-zA-Z0-9]{8,}$'
    ConstraintDescription: Secure Internal Communication activation key should contain only alpha numeric characters and be at least 8 characters long
    NoEcho: true
  ControlGatewayOverPrivateOrPublicAddress:
    Description: Determines if the gateways are provisioned using their private or public address
    Type: String
    Default: private
    AllowedValues:
      - private
      - public
  CloudWatch:
    Description: Report Check Point specific CloudWatch metrics
    Type: String
    Default: false
    AllowedValues:
      - true
      - false
  GWLBName:
    Description: Gateway Load Balancer name. This name must be unique within your AWS account and can have a maximum of 32 alphanumeric characters and hyphens. A name cannot begin or end with a hyphen.
    Type: String
    Default: gwlb1
    ConstraintDescription: Must be a valid GWLB Name
  TargetGroupName:
    Description: Target Group Name. This name must be unique within your AWS account and can have a maximum of 32 alphanumeric characters and hyphens. A name cannot begin or end with a hyphen.
    Type: String
    Default: tg1
    ConstraintDescription: Must be a valid target group name
  CrossZoneLoadBalancing:
    Description: Select 'true' to enable cross-az load balancing. NOTE! this may cause a spike in cross-az charges, WHILE ensuring proper HA for any Security GW Appliance Failures
    Type: String
    Default: true
    AllowedValues:
      - true
      - false
  ManagementDeploy:
    Description: Select 'false' to use an existing Security Management Server or to deploy one later and to ignore the other parameters of this section
    Type: String
    Default: true
    AllowedValues:
      - true
      - false
  ManagementInstanceType:
    Description: The EC2 instance type of the Security Management Server
    Type: String
    Default: m5.xlarge
    AllowedValues:
      - m5.large
      - m5.xlarge
      - m5.2xlarge
      - m5.4xlarge
      - m5.12xlarge
      - m5.24xlarge
    ConstraintDescription: Must be a valid EC2 instance type
  ManagementVersion:
    Description: The license to install on the Security Management Server
    Type: String
    Default: R80.40-BYOL
    AllowedValues:
      - R80.40-BYOL
      - R80.40-PAYG
  ManagementPasswordHash:
    Description: Admin user's password hash (use command "openssl passwd -6 PASSWORD" to get the PASSWORD's hash) (optional)
    Type: String
    Default: ''
    AllowedPattern: '^[\$\./a-zA-Z0-9]*$'
    NoEcho: true
  GatewaysPolicy:
    Description: The name of the Security Policy package to be installed on the gateways in the Security Gateways Auto Scaling group
    Type: String
    Default: Standard
    MinLength: 1
  AdminCIDR:
    Description: Allow web, SSH, and graphical clients only from this network to communicate with the Security Management Server
    Type: String
    AllowedPattern: '^([0-9]{1,3}\.){3}[0-9]{1,3}/([0-9]|[1-2][0-9]|3[0-2])$'
  GatewayManagement:
    Description: Select 'Over the internet' if any of the gateways you wish to manage are not directly accessed via their private IP address
    Type: String
    Default: Locally managed
    AllowedValues:
      - Locally managed
      - Over the internet
  GatewaysAddresses:
    Description: Allow gateways only from this network to communicate with the Security Management Server
    Type: String
    AllowedPattern: '^([0-9]{1,3}\.){3}[0-9]{1,3}/([0-9]|[1-2][0-9]|3[0-2])$'
Conditions:
  4AZs: !Equals [!Ref NumberOfAZs, 4]
  3AZs: !Or [!Equals [!Ref NumberOfAZs, 3], !Condition 4AZs]
  DeployManagement: !Equals [!Ref ManagementDeploy, true]
  VolumeEncryption: !Equals [!Ref EnableVolumeEncryption, true]
  TGWAttach: !Not [!Equals [!Ref TgwID, '']]
Resources:
  GWLBStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://cgi-cfts.s3.amazonaws.com/gwlb/gwlb.yaml
      Parameters:
        VPC: !Ref SecVPC
        GatewaysSubnets: !Join [',', !Ref GatewaysSubnets]
        KeyName: !Ref KeyName
        EnableVolumeEncryption: !Ref EnableVolumeEncryption
        EnableInstanceConnect: !Ref EnableInstanceConnect
        AllowUploadDownload: !Ref AllowUploadDownload
        ManagementServer: !Ref ManagementServer
        ConfigurationTemplate: !Ref ConfigurationTemplate
        AdminEmail: !Ref AdminEmail
        Shell: !Ref Shell
        GWLBName: !Ref GWLBName
        TargetGroupName: !Ref TargetGroupName
        AcceptConnectionRequired: false
        CrossZoneLoadBalancing: !Ref CrossZoneLoadBalancing
        GatewayName: !Ref GatewayName
        GatewayInstanceType: !Ref GatewayInstanceType
        GatewaysMinSize: !Ref GatewaysMinSize
        GatewaysMaxSize: !Ref GatewaysMaxSize
        GatewayVersion: !Ref GatewayVersion
        GatewayPasswordHash: !Ref GatewayPasswordHash
        GatewaySICKey: !Ref GatewaySICKey
        ControlGatewayOverPrivateOrPublicAddress: !Ref ControlGatewayOverPrivateOrPublicAddress
        CloudWatch: !Ref CloudWatch
        ManagementDeploy: !Ref ManagementDeploy
        ManagementInstanceType: !Ref ManagementInstanceType
        ManagementVersion: !Ref ManagementVersion
        ManagementPasswordHash: !Ref ManagementPasswordHash
        GatewaysPolicy: !Ref GatewaysPolicy
        AdminCIDR: !Ref AdminCIDR
        GatewayManagement: !Ref GatewayManagement
        GatewaysAddresses: !Ref GatewaysAddresses
  GWLBe1:
    DependsOn: [GWLBStack]
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref SecVPC
      VpcEndpointType: GatewayLoadBalancer
      SubnetIds:
        - !Ref SecSubnet1Id
      ServiceName: !GetAtt GWLBStack.Outputs.GWLBServiceName
  GWLBe2:
    DependsOn: [GWLBStack]
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref SecVPC
      VpcEndpointType: GatewayLoadBalancer
      SubnetIds:
        - !Ref SecSubnet2Id
      ServiceName: !GetAtt GWLBStack.Outputs.GWLBServiceName
  GWLBe3:
    DependsOn: [GWLBStack]
    Type: AWS::EC2::VPCEndpoint
    Condition: 3AZs
    Properties:
      VpcId: !Ref SecVPC
      VpcEndpointType: GatewayLoadBalancer
      SubnetIds:
        - !Ref SecSubnet3Id
      ServiceName: !GetAtt GWLBStack.Outputs.GWLBServiceName
  GWLBe4:
    DependsOn: [GWLBStack]
    Type: AWS::EC2::VPCEndpoint
    Condition: 4AZs
    Properties:
      VpcId: !Ref SecVPC
      VpcEndpointType: GatewayLoadBalancer
      SubnetIds:
        - !Ref SecSubnet4Id
      ServiceName: !GetAtt GWLBStack.Outputs.GWLBServiceName
  TGWAttachmentSubnet1RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref SecVPC
      Tags:
        - Key: Name
          Value: TGW Attachment Subnet 1 Route Table
        - Key: Network
          Value: Private
  TGWAttachmentSubnet1GWLBeDefaultRoute:
    Type: AWS::EC2::Route
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      VpcEndpointId: !Ref GWLBe1
      RouteTableId: !Ref TGWAttachmentSubnet1RouteTable
  TGWAttachmentSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref TGWAttachmentSubnet1RouteTable
      SubnetId: !Ref TgwSubnet1Id
  TGWAttachmentSubnet2RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref SecVPC
      Tags:
        - Key: Name
          Value: TGW Attachment Subnet 2 Route Table
        - Key: Network
          Value: Private
  TGWAttachmentSubnet2GWLBeDefaultRoute:
    Type: AWS::EC2::Route
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      VpcEndpointId: !Ref GWLBe2
      RouteTableId: !Ref TGWAttachmentSubnet2RouteTable
  TGWAttachmentSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref TGWAttachmentSubnet2RouteTable
      SubnetId: !Ref TgwSubnet2Id
  TGWAttachmentSubnet3RouteTable:
    Type: AWS::EC2::RouteTable
    Condition: 3AZs
    Properties:
      VpcId: !Ref SecVPC
      Tags:
        - Key: Name
          Value: TGW Attachment Subnet 3 Route Table
        - Key: Network
          Value: Private
  TGWAttachmentSubnet3GWLBeDefaultRoute:
    Type: AWS::EC2::Route
    Condition: 3AZs
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      VpcEndpointId: !Ref GWLBe3
      RouteTableId: !Ref TGWAttachmentSubnet3RouteTable
  TGWAttachmentSubnet3RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Condition: 3AZs
    Properties:
      RouteTableId: !Ref TGWAttachmentSubnet3RouteTable
      SubnetId: !Ref TgwSubnet3Id
  TGWAttachmentSubnet4RouteTable:
    Type: AWS::EC2::RouteTable
    Condition: 4AZs
    Properties:
      VpcId: !Ref SecVPC
      Tags:
        - Key: Name
          Value: TGW Attachment Subnet 4 Route Table
        - Key: Network
          Value: Private
  TGWAttachmentSubnet4GWLBeDefaultRoute:
    Type: AWS::EC2::Route
    Condition: 4AZs
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      VpcEndpointId: !Ref GWLBe4
      RouteTableId: !Ref TGWAttachmentSubnet4RouteTable
  TGWAttachmentSubnet4RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Condition: 4AZs
    Properties:
      RouteTableId: !Ref TGWAttachmentSubnet4RouteTable
      SubnetId: !Ref TgwSubnet4Id
  NatGwPublicAddress1:
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
  NatGwPublicAddress2:
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
  NatGwPublicAddress3:
    Type: AWS::EC2::EIP
    Condition: 3AZs
    Properties:
      Domain: vpc
  NatGwPublicAddress4:
    Type: AWS::EC2::EIP
    Condition: 4AZs
    Properties:
      Domain: vpc
  NatGateway1:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt NatGwPublicAddress1.AllocationId
      SubnetId: !Ref NatGwSubnet1Id
      Tags:
        - Key: Name
          Value: NatGW1
  NatGateway2:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt NatGwPublicAddress2.AllocationId
      SubnetId: !Ref NatGwSubnet2Id
      Tags:
        - Key: Name
          Value: NatGW2
  NatGateway3:
    Type: AWS::EC2::NatGateway
    Condition: 3AZs
    Properties:
      AllocationId: !GetAtt NatGwPublicAddress3.AllocationId
      SubnetId: !Ref NatGwSubnet3Id
      Tags:
        - Key: Name
          Value: NatGW3
  NatGateway4:
    Type: AWS::EC2::NatGateway
    Condition: 4AZs
    Properties:
      AllocationId: !GetAtt NatGwPublicAddress4.AllocationId
      SubnetId: !Ref NatGwSubnet4Id
      Tags:
        - Key: Name
          Value: NatGW4
  InetTGWAttachmentSubnet1RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref InetVPC
      Tags:
        - Key: Name
          Value: InetTGW Attachment Subnet 1 Route Table
        - Key: Network
          Value: Private
  InetTGWAttachmentSubnet1NatGWDefaultRoute:
    DependsOn: [NatGateway1]
    Type: AWS::EC2::Route
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway1
      RouteTableId: !Ref InetTGWAttachmentSubnet1RouteTable
  InetTGWAttachmentSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref InetTGWAttachmentSubnet1RouteTable
      SubnetId: !Ref InetTgwSubnet1Id
  InetTGWAttachmentSubnet2RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref InetVPC
      Tags:
        - Key: Name
          Value: Inet TGW Attachment Subnet 2 Route Table
        - Key: Network
          Value: Private
  InetTGWAttachmentSubnet2NatGWDefaultRoute:
    DependsOn: [NatGateway2]
    Type: AWS::EC2::Route
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway2
      RouteTableId: !Ref InetTGWAttachmentSubnet2RouteTable
  InetTGWAttachmentSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref InetTGWAttachmentSubnet2RouteTable
      SubnetId: !Ref InetTgwSubnet2Id
  InetTGWAttachmentSubnet3RouteTable:
    Type: AWS::EC2::RouteTable
    Condition: 3AZs
    Properties:
      VpcId: !Ref InetVPC
      Tags:
        - Key: Name
          Value: Inet TGW Attachment Subnet 3 Route Table
        - Key: Network
          Value: Private
  InetTGWAttachmentSubnet3NatGWDefaultRoute:
    DependsOn: [NatGateway3]
    Condition: 3AZs
    Type: AWS::EC2::Route
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway3
      RouteTableId: !Ref InetTGWAttachmentSubnet3RouteTable
  InetTGWAttachmentSubnet3RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Condition: 3AZs
    Properties:
      RouteTableId: !Ref InetTGWAttachmentSubnet3RouteTable
      SubnetId: !Ref InetTgwSubnet3Id
  InetTGWAttachmentSubnet4RouteTable:
    Type: AWS::EC2::RouteTable
    Condition: 4AZs
    Properties:
      VpcId: !Ref InetVPC
      Tags:
        - Key: Name
          Value: Inet TGW Attachment Subnet 4 Route Table
        - Key: Network
          Value: Private
  InetTGWAttachmentSubnet4NatGWDefaultRoute:
    DependsOn: [NatGateway4]
    Condition: 4AZs
    Type: AWS::EC2::Route
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway4
      RouteTableId: !Ref InetTGWAttachmentSubnet4RouteTable
  InetTGWAttachmentSubnet4RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Condition: 4AZs
    Properties:
      RouteTableId: !Ref InetTGWAttachmentSubnet4RouteTable
      SubnetId: !Ref InetTgwSubnet4Id
  SecSubnet1RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref SecVPC
      Tags:
        - Key: Name
          Value: Security Subnet 1 Route Table
        - Key: Network
          Value: Public
  SecSubnet1TGW10Route:
    DependsOn: [TgwAttachLambda]
    Type: AWS::EC2::Route
    Properties:
      DestinationCidrBlock: 10.0.0.0/8
      TransitGatewayId: !Ref TgwID
      RouteTableId: !Ref SecSubnet1RouteTable
  SecSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref SecSubnet1RouteTable
      SubnetId: !Ref SecSubnet1Id
  SecSubnet2RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref SecVPC
      Tags:
        - Key: Name
          Value: Security Subnet 2 Route Table
        - Key: Network
          Value: Public
  SecSubnet2TGW10Route:
    DependsOn: [TgwAttachLambda]
    Type: AWS::EC2::Route
    Properties:
      DestinationCidrBlock: 10.0.0.0/8
      TransitGatewayId: !Ref TgwID
      RouteTableId: !Ref SecSubnet2RouteTable
  SecSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref SecSubnet2RouteTable
      SubnetId: !Ref SecSubnet2Id
  SecSubnet3RouteTable:
    Type: AWS::EC2::RouteTable
    Condition: 3AZs
    Properties:
      VpcId: !Ref SecVPC
      Tags:
        - Key: Name
          Value: Security Subnet 3 Route Table
        - Key: Network
          Value: Public
  SecSubnet3TGW10Route:
    DependsOn: [TgwAttachLambda]
    Type: AWS::EC2::Route
    Condition: 3AZs
    Properties:
      DestinationCidrBlock: 10.0.0.0/8
      TransitGatewayId: !Ref TgwID
      RouteTableId: !Ref SecSubnet3RouteTable
  SecSubnet3RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Condition: 3AZs
    Properties:
      RouteTableId: !Ref SecSubnet3RouteTable
      SubnetId: !Ref SecSubnet3Id
  SecSubnet4RouteTable:
    Type: AWS::EC2::RouteTable
    Condition: 4AZs
    Properties:
      VpcId: !Ref SecVPC
      Tags:
        - Key: Name
          Value: Security Subnet 4 Route Table
        - Key: Network
          Value: Public
  SecSubnet4TGW10Route:
    DependsOn: [TgwAttachLambda]
    Type: AWS::EC2::Route
    Condition: 4AZs
    Properties:
      DestinationCidrBlock: 10.0.0.0/8
      TransitGatewayId: !Ref TgwID
      RouteTableId: !Ref SecSubnet4RouteTable
  SecSubnet4RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Condition: 4AZs
    Properties:
      RouteTableId: !Ref SecSubnet4RouteTable
      SubnetId: !Ref SecSubnet4Id
  InetVPC10SpokeRoute:
    DependsOn: [TgwAttachLambda]
    Type: AWS::EC2::Route
    Properties:
      DestinationCidrBlock: 10.0.0.0/8
      TransitGatewayId: !Ref TgwID
      RouteTableId: !Ref InetPublicRt
  TgwAttachLambda:
    Type: AWS::CloudFormation::Stack
    Condition: TGWAttach
    Properties:
      TemplateURL: !Join
        - ''
        - - https://
          - !Ref S3Bucket
          - .s3.amazonaws.com/tgw-attach.yaml
      Parameters:
        pTransitGatewayId: !Ref TgwID
        pSecVpcId: !Ref SecVPC
        pInetVpcId: !Ref InetVPC
        pSecTgwAttachSubnets: !Join
          - ','
          - - !Ref TgwSubnet1Id
            - !Ref TgwSubnet2Id
            - !If [3AZs, !Ref TgwSubnet3Id, !Ref 'AWS::NoValue']
            - !If [4AZs, !Ref TgwSubnet4Id, !Ref 'AWS::NoValue']
        pInetTgwAttachSubnets: !Join
          - ','
          - - !Ref InetTgwSubnet1Id
            - !Ref InetTgwSubnet2Id
            - !If [3AZs, !Ref InetTgwSubnet3Id, !Ref 'AWS::NoValue']
            - !If [4AZs, !Ref InetTgwSubnet4Id, !Ref 'AWS::NoValue']
        S3Bucket: !Ref S3Bucket
        LambdaS3Key: !Ref LambdaS3Key



Outputs:
  ManagementPublicAddress:
    Description: The public address of the management server
    Value: !GetAtt GWLBStack.Outputs.ManagementPublicAddress
    Condition: DeployManagement
  ConfigurationTemplateName:
    Description: The name that represents the configuration template. Configurations required to automatically provision the Gateways in the Auto Scaling Group, such as what Security Policy to install and which Blades to enable, will be placed under this template name
    Value: !GetAtt GWLBStack.Outputs.ConfigurationTemplateName
  ControllerName:
    Description: The name that represents the controller. Configurations required to connect to your AWS environment, such as credentials and regions, will be placed under this controller name
    Value: !GetAtt GWLBStack.Outputs.ControllerName
  GWLBName:
    Description: Gateway Load Balancer Name
    Value: !Ref GWLBName
  GWLBServiceName:
    Description: Gateway Load Balancer Service Name
    Value: !GetAtt GWLBStack.Outputs.GWLBServiceName