turnserver.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: >-
  STUN/TURN Server Installation
Parameters:
  Subnets:
    Type: 'List<AWS::EC2::Subnet::Id>'
    Description: 'You must choose at least 2 subnets from the same VPC network.'
    ConstraintDescription: >-
      must be a list of at least two existing subnets associated with at least
      two different availability zones. They should be residing in the selected
      Virtual Private Cloud.
  VpcId:
    Type: 'AWS::EC2::VPC::Id'
    Description: 'VpcId of your existing Virtual Private Cloud (VPC). The VpcId must be the same as the subnets you choose'
    ConstraintDescription: 'must be the VPC Id of an existing Virtual Private Cloud. The VpcId must be the same as the subnets you choose.'
  TurnServerInstanceType:
    Description: STUN/TURN Server Edge EC2 instance type
    Type: String
    Default: t2.micro
    AllowedValues:
      - t1.micro
      - t2.nano
      - t2.micro
      - t2.small
      - t2.medium
      - t2.large
      - m1.small
      - m1.medium
      - m1.large
      - m1.xlarge
      - m2.xlarge
      - m2.2xlarge
      - m2.4xlarge
      - m3.medium
      - m3.large
      - m3.xlarge
      - m3.2xlarge
      - m4.large
      - m4.xlarge
      - m4.2xlarge
      - m4.4xlarge
      - m4.10xlarge
      - c1.medium
      - c1.xlarge
      - c3.large
      - c3.xlarge
      - c3.2xlarge
      - c3.4xlarge
      - c3.8xlarge
      - c4.large
      - c4.xlarge
      - c4.2xlarge
      - c4.4xlarge
      - c4.8xlarge
      - c5.large
      - c5.xlarge
      - c5.2xlarge
      - c5.4xlarge
      - c5.9xlarge
      - c5.12xlarge
      - c5.18xlarge
      - c5.24xlarge
      - g2.2xlarge
      - g2.8xlarge
      - r3.large
      - r3.xlarge
      - r3.2xlarge
      - r3.4xlarge
      - r3.8xlarge
      - i2.xlarge
      - i2.2xlarge
      - i2.4xlarge
      - i2.8xlarge
      - d2.xlarge
      - d2.2xlarge
      - d2.4xlarge
      - d2.8xlarge
      - hi1.4xlarge
      - hs1.8xlarge
      - cr1.8xlarge
      - cc2.8xlarge
      - cg1.4xlarge
    ConstraintDescription: must be a valid EC2 instance type.
  UserName:
    Description: 'STUN/TURN Server Username'
    Type: String
    Default: ''
  Password:
    Description: 'STUN/TURN Server Password'
    Type: String
    Default: ''
  KeyName:
    Description: Name of an existing EC2 KeyPair to enable SSH access to the instances. If there is no value here, you must create an ssh key (EC2 > Key Pairs).
    Type: 'AWS::EC2::KeyPair::KeyName'
    MinLength: '1'
    MaxLength: '255'
    AllowedPattern: '[\x20-\x7E]*'
    ConstraintDescription: can contain only ASCII characters.

Resources:
  ElasticIP:
    Type: AWS::EC2::EIP
    Properties:
      Domain: "vpc"
  DescribeImagesRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: DescribeImages
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action: ec2:DescribeImages
                Effect: Allow
                Resource: "*"
  GetLatestAMI:
    Type: AWS::Lambda::Function
    Properties:
      Runtime: python3.11
      Handler: index.handler
      Role: !Sub ${DescribeImagesRole.Arn}
      Timeout: 60
      Code:
        ZipFile: |
          import boto3
          import cfnresponse
          import json
          import traceback

          def handler(event, context):
            try:
              response = boto3.client('ec2').describe_images(
                  Owners=[event['ResourceProperties']['Owner']],
                  Filters=[
                    {'Name': 'name', 'Values': [event['ResourceProperties']['Name']]},
                    {'Name': 'architecture', 'Values': [event['ResourceProperties']['Architecture']]},
                    {'Name': 'root-device-type', 'Values': ['ebs']},
                  ],
              )

              amis = sorted(response['Images'],
                            key=lambda x: x['CreationDate'],
                            reverse=True)
              id = amis[0]['ImageId']

              cfnresponse.send(event, context, cfnresponse.SUCCESS, {}, id)
            except:
              traceback.print_last()
              cfnresponse.send(event, context, cfnresponse.FAIL, {}, "ok")

  UbuntuAmi:
    Type: Custom::FindAMI
    Properties:
      ServiceToken: !Sub ${GetLatestAMI.Arn}
      Owner: "099720109477"
      Name: "ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*"
      Architecture: "x86_64"

  TurnServerSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: Enable SSH access and HTTP access on the configured port
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: '22'
          ToPort: '22'
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: '3478'
          ToPort: '3478'
          CidrIp: 0.0.0.0/0
        - IpProtocol: udp
          FromPort: '3478'
          ToPort: '3478'
          CidrIp: 0.0.0.0/0
        - IpProtocol: udp
          FromPort: '49152'
          ToPort: '65535'
          CidrIp: 0.0.0.0/0
      VpcId: !Ref VpcId
  TurnServerInstance:
      Type: 'AWS::EC2::Instance'
      Properties:
        KeyName: !Ref KeyName
        ImageId: !Ref UbuntuAmi
        InstanceType: !Ref TurnServerInstanceType
        SubnetId: !Select [ 0, !Ref Subnets ]
        SecurityGroupIds:
          - !GetAtt "TurnServerSecurityGroup.GroupId"
        Tags:
        - Key: Name
          Value: TurnServer
        UserData:
         Fn::Base64:
          !Sub |
            #!/bin/bash -xe
            apt-get update && apt-get install coturn -y
            sed -i 's/#TURNSERVER.*/TURNSERVER_ENABLED=1/g' /etc/default/coturn
            cat << EOF > /etc/turnserver.conf
            listening-port=3478
            realm=$(curl -s http://checkip.amazonaws.com)
            relay-ip=$(curl -s http://169.254.169.254/latest/meta-data/local-ipv4)
            external-ip=$(curl -s http://checkip.amazonaws.com)/$(curl -s http://169.254.169.254/latest/meta-data/local-ipv4)
            user=${UserName}:${Password}
            lt-cred-mech
            fingerprint
            EOF
            systemctl enable coturn && systemctl restart coturn

  ElasticIPAssignment:
    Type: AWS::EC2::EIPAssociation
    Properties:
      EIP: !Ref ElasticIP
      InstanceId: !Ref TurnServerInstance
Outputs:
  TurnServer:
    Description: "Do not forget to add an A record for your domain address."
    Value: !Join
      - ''
      - - !GetAtt
          - TurnServerInstance
          - PublicIp