cloud9-cfn.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: Creates a Cloud9 IDE for the Fis workshop
Parameters:
  CreateVPC:
    Description: Create a VPC for Cloud9 instance
    Type: String
    Default: True
    AllowedValues:
      - True
      - False
  EnvironmentName:
    Description: An environment name that is prefixed to resource names
    Type: String
    Default: "fisworkshop"
  FisWorkshopC9InstanceType:
    Description: Cloud9 instance type
    Type: String
    Default: t3.medium
    AllowedValues:
      - t2.micro
      - t3.micro
      - t3.small
      - t3.medium
    ConstraintDescription: Must be a valid Cloud9 instance type
  FisWorkshopC9EnvType: 
    Description: Environment type.
    Default: self
    Type: String
    AllowedValues: 
      - self
      - 3rdParty
    ConstraintDescription: must specify self or 3rdParty.
  WorkshopOwnerArn:
    Type: String
    Description: The Arn of the Cloud9 Owner to be set if 3rdParty deployment.
    Default: "AWS::NoValue"
  FisWorkshopC9InstanceVolumeSize: 
    Type: Number
    Description: The Size in GB of the Cloud9 Instance Volume. 
    Default: 30
  Cloud9Name: 
    Type: String
    Description: Name of the Cloud9 instance
    Default: "FisWorkshop"
  ResourcesPrecreated: 
    Type: String
    Description: Whether lab infrastructure has been pre-provisioned
    Default: "false"
    AllowedValues: 
      - "false"
      - "true"
  UpdateTrigger:
    Type: String
    Description: Triggers the Cloud9 to update itself
    Default: "0"

  Cloud9VPC:
    Description: If VPC is not created by the template, must provide the VPC Id to deploy the instance
    Type: String
    Default: AWS::NoValue

  Cloud9Subnet:
    Description: If VPC is not created by the template, must provide the subnet ID to deploy the instance.
    Type: String
    Default: AWS::NoValue

  VpcCIDR:
    Description: Please enter the IP range (CIDR notation) for this VPC
    Type: String
    Default: 10.10.0.0/16

  PublicSubnet1CIDR:
    Description: Please enter the IP range (CIDR notation) for the public subnet in the first Availability Zone
    Type: String
    Default: 10.10.10.0/24

  PublicSubnet2CIDR:
    Description: Please enter the IP range (CIDR notation) for the public subnet in the second Availability Zone
    Type: String
    Default: 10.10.20.0/24

  PrivateSubnet1CIDR:
    Description: Please enter the IP range (CIDR notation) for the private subnet in the first Availability Zone
    Type: String
    Default: 10.10.30.0/24

  PrivateSubnet2CIDR:
    Description: Please enter the IP range (CIDR notation) for the private subnet in the second Availability Zone
    Type: String
    Default: 10.10.40.0/24

Conditions: 
  Create3rdPartyResources: !Equals [ !Ref FisWorkshopC9EnvType, 3rdParty ]
  SkipOwnerArn: !Equals
    - !Ref WorkshopOwnerArn
    - AWS::NoValue
  CreateVPC: !Equals
    - !Ref CreateVPC
    - True
    
Metadata: 
  AWS::CloudFormation::Interface: 
    ParameterGroups:
      - 
        Label: 
          default: "Network Configuration"
        Parameters:
          - CreateVPC
          - VpcCIDR
          - PublicSubnet1CIDR
          - PublicSubnet2CIDR
          - PrivateSubnet1CIDR
          - PrivateSubnet2CIDR
      - 
        Label: 
          default: "Cloud9 Configuration"
        Parameters: 
          - Cloud9VPC
          - Cloud9Subnet
          - C9InstanceType
          - C9InstanceVolumeSize
          - C9Image
          - PatchC9Instance

Resources:
  VPC:
    Type: AWS::EC2::VPC
    Condition: CreateVPC
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W60
            reason: "No need for Flow logs in this workshop"
      cdk_nag:
        rules_to_suppress:
          - id: AwsSolutions-VPC7
            reason: "No need for Flow logs in this workshop"
    Properties:
      CidrBlock: !Ref VpcCIDR
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: !Ref EnvironmentName

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Condition: CreateVPC
    Properties:
      Tags:
        - Key: Name
          Value: !Ref EnvironmentName

  InternetGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Condition: CreateVPC
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref VPC

  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Condition: CreateVPC
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 0, !GetAZs '' ]
      CidrBlock: !Ref PublicSubnet1CIDR
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName} Public Subnet (AZ1)

  PublicSubnet2:
    Type: AWS::EC2::Subnet
    Condition: CreateVPC
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 1, !GetAZs  '' ]
      CidrBlock: !Ref PublicSubnet2CIDR
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName} Public Subnet (AZ2)

  PrivateSubnet1:
    Type: AWS::EC2::Subnet
    Condition: CreateVPC
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 0, !GetAZs  '' ]
      CidrBlock: !Ref PrivateSubnet1CIDR
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName} Private Subnet (AZ1)

  PrivateSubnet2:
    Type: AWS::EC2::Subnet
    Condition: CreateVPC
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [ 1, !GetAZs  '' ]
      CidrBlock: !Ref PrivateSubnet2CIDR
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName} Private Subnet (AZ2)

  NatGateway1EIP:
    Type: AWS::EC2::EIP
    Condition: CreateVPC
    DependsOn: InternetGatewayAttachment
    Properties:
      Domain: vpc

  NatGateway2EIP:
    Type: AWS::EC2::EIP
    Condition: CreateVPC
    DependsOn: InternetGatewayAttachment
    Properties:
      Domain: vpc

  NatGateway1:
    Type: AWS::EC2::NatGateway
    Condition: CreateVPC
    Properties:
      AllocationId: !GetAtt NatGateway1EIP.AllocationId
      SubnetId: !Ref PublicSubnet1

  NatGateway2:
    Type: AWS::EC2::NatGateway
    Condition: CreateVPC
    Properties:
      AllocationId: !GetAtt NatGateway2EIP.AllocationId
      SubnetId: !Ref PublicSubnet2

  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Condition: CreateVPC
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName} Public Routes

  DefaultPublicRoute:
    Type: AWS::EC2::Route
    Condition: CreateVPC
    DependsOn: InternetGatewayAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  PublicSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Condition: CreateVPC
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref PublicSubnet1

  PublicSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Condition: CreateVPC
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref PublicSubnet2


  PrivateRouteTable1:
    Type: AWS::EC2::RouteTable
    Condition: CreateVPC
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName} Private Routes (AZ1)

  DefaultPrivateRoute1:
    Type: AWS::EC2::Route
    Condition: CreateVPC
    Properties:
      RouteTableId: !Ref PrivateRouteTable1
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway1

  PrivateSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Condition: CreateVPC
    Properties:
      RouteTableId: !Ref PrivateRouteTable1
      SubnetId: !Ref PrivateSubnet1

  PrivateRouteTable2:
    Type: AWS::EC2::RouteTable
    Condition: CreateVPC
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName} Private Routes (AZ2)

  DefaultPrivateRoute2:
    Type: AWS::EC2::Route
    Condition: CreateVPC
    Properties:
      RouteTableId: !Ref PrivateRouteTable2
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway2

  PrivateSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Condition: CreateVPC
    Properties:
      RouteTableId: !Ref PrivateRouteTable2
      SubnetId: !Ref PrivateSubnet2

  NoIngressSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W5
            reason: "Outbound access to the world is needed to download dependencies in C9"
    Properties:
      GroupDescription: "Security group with no ingress rule"
      VpcId: !If [CreateVPC, !Ref VPC, !Ref Cloud9VPC ] 
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
          Description: "HTTP Outbound traffic"
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0
          Description: "HTTPS Outbound traffic"

  FisWorkshopC9Role:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${EnvironmentName}-admin"
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - ec2.amazonaws.com
            - ssm.amazonaws.com
          Action:
          - sts:AssumeRole
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/AdministratorAccess
      - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
      Path: "/"

  FisWorkshopC9LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: "/"
      Policies:
      - PolicyName:
          Fn::Join:
          - ''
          - - FisWorkshopC9LambdaPolicy-
            - Ref: AWS::Region
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            Resource: arn:aws:logs:*:*:*
          - Effect: Allow
            Action:
            - cloudformation:DescribeStacks
            - cloudformation:DescribeStackEvents
            - cloudformation:DescribeStackResource
            - cloudformation:DescribeStackResources
            - ec2:DescribeInstances
            - ec2:AssociateIamInstanceProfile
            - ec2:ModifyInstanceAttribute
            - ec2:ReplaceIamInstanceProfileAssociation
            - ec2:DescribeIamInstanceProfileAssociations
            - ec2:DescribeVolumes
            - ec2:ModifyVolume
            - ec2:DescribeVolumesModifications
            - ec2:RebootInstances
            - iam:ListInstanceProfiles
            - iam:PassRole
            - ssm:DescribeInstanceInformation
            - ssm:SendCommand
            - ssm:GetCommandInvocation
            Resource: "*"

  FisWorkshopC9BootstrapInstanceLambda:
    Type: Custom::FisWorkshopC9BootstrapInstanceLambda
    DependsOn:
    - FisWorkshopC9LambdaExecutionRole
    Properties:
      ServiceToken:
        Fn::GetAtt:
        - FisWorkshopC9BootstrapInstanceLambdaFunction
        - Arn
      REGION:
        Ref: AWS::Region
      Cloud9Name: !GetAtt FisWorkshopC9Instance.Name
      EnvironmentId:
        Ref: FisWorkshopC9Instance
      LabIdeInstanceProfileName:
        Ref: FisWorkshopC9InstanceProfile
      LabIdeInstanceProfileArn:
        Fn::GetAtt:
        - FisWorkshopC9InstanceProfile
        - Arn
      SsmDocument:
        Ref: FisWorkshopC9SSMDocument
      UpdateTrigger:
        Ref: UpdateTrigger

  FisWorkshopC9BootstrapInstanceLambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      Handler: index.lambda_handler
      Role:
        Fn::GetAtt:
        - FisWorkshopC9LambdaExecutionRole
        - Arn
      Runtime: python3.12
      Environment:
        Variables:
          DiskSize:
            Ref: FisWorkshopC9InstanceVolumeSize
      MemorySize: 256
      Timeout: '900'
      Code:
        ZipFile: |
          from __future__ import print_function
          import boto3
          import json
          import os
          import time
          import traceback
          import cfnresponse
          import logging
          logger = logging.getLogger(__name__)
          
          def lambda_handler(event, context):
              print(event.values())
              print('context: {}'.format(context))
              responseData = {}

              status = cfnresponse.SUCCESS
              
              if event['RequestType'] == 'Delete':
                  responseData = {'Success': 'Custom Resource removed'}
                  cfnresponse.send(event, context, status, responseData, 'CustomResourcePhysicalID')              
              else:
                  try:
                      # Open AWS clients
                      ec2 = boto3.client('ec2')
                      ssm = boto3.client('ssm')
          
                      # Get the InstanceId of the Cloud9 IDE
                      instance = ec2.describe_instances(Filters=[{'Name': 'tag:Name','Values': ['aws-cloud9-'+event['ResourceProperties']['Cloud9Name']+'-'+event['ResourceProperties']['EnvironmentId']]}])['Reservations'][0]['Instances'][0]
                      print('instance: {}'.format(instance))
                      instance_id = instance['InstanceId']
          
                      # Create the IamInstanceProfile request object
                      iam_instance_profile = {
                          'Arn': event['ResourceProperties']['LabIdeInstanceProfileArn'],
                          'Name': event['ResourceProperties']['LabIdeInstanceProfileName']
                      }
                      print('Found IAM instance profile: {}'.format(iam_instance_profile))

                      time.sleep(10)

                      print('Waiting for the instance to be ready...')
          
                      # Wait for Instance to become ready before adding Role
                      instance_state = instance['State']['Name']
                      print('Instance is currently in state'.format(instance_state))
                      while instance_state != 'running':
                          time.sleep(5)
                          di = ec2.describe_instances(InstanceIds=[instance_id])
                          instance_state = di['Reservations'][0]['Instances'][0]['State']['Name']
                          print('Waiting for instance in state: {}'.format(instance_state))

                      print('Instance is ready')

                      reboot = False

                      associations = ec2.describe_iam_instance_profile_associations(
                          Filters=[
                              {
                                  'Name': 'instance-id',
                                  'Values': [instance_id],
                              },
                          ],
                      )

                      if len(associations['IamInstanceProfileAssociations']) > 0:
                        print('Replacing existing IAM profile...')
                        for association in associations['IamInstanceProfileAssociations']:
                          if association['State'] == 'associated':
                            print("{} is active with state {}".format(association['AssociationId'], association['State']))

                            if association['IamInstanceProfile']['Arn'] == event['ResourceProperties']['LabIdeInstanceProfileArn']:
                              print("IAM instance profile is already set")
                            else:
                              print("Replacing IAM instance profile")
                              reboot = True
                              ec2.replace_iam_instance_profile_association(AssociationId=association['AssociationId'], IamInstanceProfile=iam_instance_profile)
                      else:
                        print('Associating IAM profile...')
                        ec2.associate_iam_instance_profile(IamInstanceProfile=iam_instance_profile, InstanceId=instance_id)

                      block_volume_id = instance['BlockDeviceMappings'][0]['Ebs']['VolumeId']

                      block_device = ec2.describe_volumes(VolumeIds=[block_volume_id])['Volumes'][0]

                      DiskSize = int(os.environ['DiskSize'])
                      if block_device['Size'] < DiskSize:
                        reboot = True

                        print('Modifying block volume: {}'.format(block_volume_id))
                        ec2.modify_volume(VolumeId=block_volume_id,Size=DiskSize)
                        
                        time.sleep(10)

                        for i in range(1, 30):
                          response = ec2.describe_volumes_modifications(
                            VolumeIds=[
                              block_volume_id
                            ]
                          )
                          modify_state = response['VolumesModifications'][0]['ModificationState']
                          if modify_state != 'modifying':
                            print('Volume has been resized')
                            break
                          time.sleep(10)
                      else:
                        print('Volume is already sized')

                      if reboot:
                        # Reboot is required to avoid weird race condition with IAM role and SSM agent
                        # It also causes the file system to expand in the OS
                        print('Rebooting instance')

                        ec2.reboot_instances(
                            InstanceIds=[
                                instance_id,
                            ],
                        )

                        time.sleep(60)

                        print('Waiting for instance to come online in SSM...')

                        for i in range(1, 60):
                          response = ssm.describe_instance_information(Filters=[{'Key': 'InstanceIds', 'Values': [instance_id]}])
                          if len(response["InstanceInformationList"]) == 0:
                            print('No instances in SSM')
                          elif len(response["InstanceInformationList"]) > 0 and \
                                response["InstanceInformationList"][0]["PingStatus"] == "Online" and \
                                response["InstanceInformationList"][0]["InstanceId"] == instance_id:
                            print('Instance is online in SSM')
                            break
                          time.sleep(10)

                      ssm_document = event['ResourceProperties']['SsmDocument']

                      print('Sending SSM command...')

                      response = ssm.send_command(
                        InstanceIds=[instance_id],
                        DocumentName=ssm_document)

                      command_id = response['Command']['CommandId']

                      waiter = ssm.get_waiter('command_executed')

                      waiter.wait(
                        CommandId=command_id,
                        InstanceId=instance_id,
                        WaiterConfig={
                          'Delay': 10,
                          'MaxAttempts': 30
                        }
                      )
  
                      responseData = {'Success': 'Started bootstrapping for instance: '+instance_id}
                      cfnresponse.send(event, context, status, responseData, 'CustomResourcePhysicalID')
                      
                  except Exception as e:
                      status = cfnresponse.FAILED
                      print(traceback.format_exc())
                      responseData = {'Error': traceback.format_exc(e)}
                  finally:
                      cfnresponse.send(event, context, status, responseData, 'CustomResourcePhysicalID')

  FisWorkshopC9SSMDocument: 
    Type: AWS::SSM::Document
    Properties: 
      DocumentType: Command
      DocumentFormat: YAML
      Content: 
        schemaVersion: '2.2'
        description: Bootstrap Cloud9 Instance
        mainSteps:
        - action: aws:runShellScript
          name: DependencyInstall
          inputs:
            runCommand:
            - apt update -y
            - apt install -y jq gettext bash-completion moreutils
            - pip install --upgrade awscli
            - sudo -i -u ubuntu bash -l -c 'curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash'
            - sudo -i -u ubuntu bash -l -c 'export NVM_DIR="$([ -z "${XDG_CONFIG_HOME-}" ] && printf %s "${HOME}/.nvm" || printf %s "${XDG_CONFIG_HOME}/nvm")"'
            - sudo -i -u ubuntu bash -l -c '[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"'
            - sudo -i -u ubuntu bash -l -c 'nvm install node --default'
            - sudo -i -u ubuntu bash -l -c 'nvm alias default node'
            - sudo -i -u ubuntu bash -l -c 'nvm exec node npm install -g aws-cdk --force'
        - action: aws:runShellScript
          name: KubectlInstall
          inputs:
            runCommand:
            - curl -o kubectl https://s3.us-west-2.amazonaws.com/amazon-eks/1.31.0/2024-09-12/bin/linux/amd64/kubectl
            - chmod +x kubectl && sudo mv kubectl /usr/local/bin/
            - echo "source <(kubectl completion bash)" >> /home/ubuntu/.bashrc
        - action: aws:runShellScript
          name: HelmInstall
          inputs:
            runCommand:
            - curl --location "https://get.helm.sh/helm-v3.13.0-linux-amd64.tar.gz" | tar xz -C /tmp
            - sudo mv /tmp/linux-amd64/helm /usr/local/bin/helm        
        - action: aws:runShellScript
          name: eksctlInstall
          inputs:
            runCommand:
            - curl --location "https://github.com/weaveworks/eksctl/releases/latest/download/eksctl_$(uname -s)_amd64.tar.gz" | tar xz -C /tmp
            - sudo mv /tmp/eksctl /usr/local/bin        
        - action: aws:runShellScript
          name: cloneRepository
          inputs:
            runCommand:
            - su - ubuntu -c 'mkdir -p ~/environment/workshopfiles && git clone https://github.com/aws-samples/aws-fault-injection-simulator-workshop-v2.git ~/environment/workshopfiles/fis-workshop' 

  FisWorkshopC9InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: "/"
      Roles:
      - Ref: FisWorkshopC9Role

  FisWorkshopC9Instance:
    Type: AWS::Cloud9::EnvironmentEC2
    Properties:
      Description: AWS Cloud9 instance for Fis Workshop
      ImageId: ubuntu-22.04-x86_64
      AutomaticStopTimeMinutes: 3600
      InstanceType:
        Ref: FisWorkshopC9InstanceType
      SubnetId: !If [CreateVPC, !Ref PublicSubnet1, !Ref Cloud9Subnet ]
      Name: !Ref Cloud9Name
      OwnerArn: !If [SkipOwnerArn, !Ref "AWS::NoValue", !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:${WorkshopOwnerArn}"]
      Tags: 
        - Key: SSMBootstrap
          Value: Active

Outputs:
  Cloud9RoleArn:
    Description: The ARN of the IAM role assigned to the Cloud9 instance
    Value: !GetAtt FisWorkshopC9Role.Arn
    
  Cloud9InstanceName:
    Description: Name of the Cloud9 EC2 instance
    Value: !Sub 'aws-cloud9-${FisWorkshopC9Instance.Name}-${FisWorkshopC9Instance}'

  Cloud9Url:
    Value: !Sub 'https://${AWS::Region}.console.aws.amazon.com/cloud9/ide/${FisWorkshopC9Instance}?region=${AWS::Region}'
    
  VPC:
    Description: A reference to the created VPC
    Value: !If [ CreateVPC , !Ref VPC, AWS::NoValue ]

  PublicSubnets:
    Description: A list of the public subnets
    Value: !If [ CreateVPC, !Join [ ",", [ !Ref PublicSubnet1, !Ref PublicSubnet2 ]], AWS::NoValue]

  PrivateSubnets:
    Description: A list of the private subnets
    Value: !If [ CreateVPC, !Join [ ",", [ !Ref PrivateSubnet1, !Ref PrivateSubnet2 ]], AWS::NoValue]

  PublicSubnet1:
    Description: A reference to the public subnet in the 1st Availability Zone
    Value: !If [ CreateVPC, !Ref PublicSubnet1, AWS::NoValue ]

  PublicSubnet2:
    Description: A reference to the public subnet in the 2nd Availability Zone
    Value: !If [ CreateVPC, !Ref PublicSubnet2, AWS:NoValue]

  PrivateSubnet1:
    Description: A reference to the private subnet in the 1st Availability Zone
    Value: !If [ CreateVPC, !Ref PrivateSubnet1, AWS:NoValue]

  PrivateSubnet2:
    Description: A reference to the private subnet in the 2nd Availability Zone
    Value: !If [ CreateVPC, !Ref PrivateSubnet2, AWS::NoValue]

  NoIngressSecurityGroup:
    Description: Security group with no ingress rule
    Value: !Ref NoIngressSecurityGroup