Skip to content

Commit d5f2dd7

Browse files
author
Mohjeet Singh
committed
Merge branch 'res-ad-optional' into 'develop'
Updating RES BI and Demo stacks to make AD optional See merge request mwvaughn/aws-hpc-recipes!160
2 parents 0e523a6 + a23876a commit d5f2dd7

File tree

2 files changed

+65
-24
lines changed

2 files changed

+65
-24
lines changed

‎recipes/res/res_demo_env/assets/bi.yaml‎

Lines changed: 36 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ Metadata:
66
- Label:
77
default: "AD Configuration"
88
Parameters:
9+
- CreateActiveDirectory
910
- DomainName
1011
- SubDomain
1112
- AdminPassword
@@ -21,10 +22,10 @@ Metadata:
2122

2223
Parameters:
2324
DomainName:
24-
Description: Active Directory Domain Name. The supplied LDIF file which provides bootstrap users uses this domain. A different LDIF file needs to be provided for a different domain.
25+
Description: (Optional) Active Directory Domain Name. The supplied LDIF file which provides bootstrap users uses this domain. A different LDIF file needs to be provided for a different domain.
2526
Type: String
2627
Default: corp.res.com
27-
AllowedPattern: ^([a-zA-Z0-9]+[\\.-])+([a-zA-Z0-9])+$
28+
AllowedPattern: ^$|^([a-zA-Z0-9]+[\\.-])+([a-zA-Z0-9])+$
2829
SubDomain:
2930
Description: (Optional, but required for GovCloud regions) SubDomain for the Active Directory Domain Name. If provided, Active Directory Domain Name will be {SubDomain}.{DomainName}
3031
Type: String
@@ -37,21 +38,20 @@ Parameters:
3738
Description: (Optional) EnvironmentName must start with "res-"and should be less than or equal to 11 characters. Required to generate certificates.
3839
Type: String
3940
AllowedPattern: ^$|^res-[A-Za-z\-\_0-9]{0,7}$
40-
4141
Default: res-demo
4242
AdminPassword:
43-
Description: Provide the Active Directory Administrator Account Password Directly or Resource ARN to Secret Containing Password.
43+
Description: (Optional) Provide the Active Directory Administrator Account Password Directly or Resource ARN to Secret Containing Password.
4444
Type: String
45-
MinLength: 8
45+
MinLength: 0
4646
MaxLength: 2048
47-
AllowedPattern: (arn:(aws(-cn|-us-gov)?):secretsmanager:(us(-gov)?|ap|ca|cn|eu|il|sa)-(central|(north|south)?(east|west)?)-\d:\d{12}:secret:[a-zA-Z0-9/_+=.@-]+)|(?=^.{8,64}$)((?=.*\d)(?=.*[A-Z])(?=.*[a-z])|(?=.*\d)(?=.*[^A-Za-z0-9\s])(?=.*[a-z])|(?=.*[^A-Za-z0-9\s])(?=.*[A-Z])(?=.*[a-z])|(?=.*\d)(?=.*[A-Z])(?=.*[^A-Za-z0-9\s]))^.*
47+
AllowedPattern: ^$|(arn:(aws(-cn|-us-gov)?):secretsmanager:(us(-gov)?|ap|ca|cn|eu|il|sa)-(central|(north|south)?(east|west)?)-\d:\d{12}:secret:[a-zA-Z0-9/_+=.@-]+)|(?=^.{8,64}$)((?=.*\d)(?=.*[A-Z])(?=.*[a-z])|(?=.*\d)(?=.*[^A-Za-z0-9\s])(?=.*[a-z])|(?=.*[^A-Za-z0-9\s])(?=.*[A-Z])(?=.*[a-z])|(?=.*\d)(?=.*[A-Z])(?=.*[^A-Za-z0-9\s]))^.*
4848
NoEcho: true
4949
ServiceAccountPassword:
50-
Description: Provide the Active Directory Service Account Password Directly or Resource ARN to Secret Containing Password.
50+
Description: (Optional) Provide the Active Directory Service Account Password Directly or Resource ARN to Secret Containing Password.
5151
Type: String
52-
MinLength: 8
52+
MinLength: 0
5353
MaxLength: 2048
54-
AllowedPattern: (arn:(aws(-cn|-us-gov)?):secretsmanager:(us(-gov)?|ap|ca|cn|eu|il|sa)-(central|(north|south)?(east|west)?)-\d:\d{12}:secret:[a-zA-Z0-9/_+=.@-]+)|(?=^.{8,64}$)((?=.*\d)(?=.*[A-Z])(?=.*[a-z])|(?=.*\d)(?=.*[^A-Za-z0-9\s])(?=.*[a-z])|(?=.*[^A-Za-z0-9\s])(?=.*[A-Z])(?=.*[a-z])|(?=.*\d)(?=.*[A-Z])(?=.*[^A-Za-z0-9\s]))^.*
54+
AllowedPattern: ^$|(arn:(aws(-cn|-us-gov)?):secretsmanager:(us(-gov)?|ap|ca|cn|eu|il|sa)-(central|(north|south)?(east|west)?)-\d:\d{12}:secret:[a-zA-Z0-9/_+=.@-]+)|(?=^.{8,64}$)((?=.*\d)(?=.*[A-Z])(?=.*[a-z])|(?=.*\d)(?=.*[^A-Za-z0-9\s])(?=.*[a-z])|(?=.*[^A-Za-z0-9\s])(?=.*[A-Z])(?=.*[a-z])|(?=.*\d)(?=.*[A-Z])(?=.*[^A-Za-z0-9\s]))^.*
5555
NoEcho: true
5656
LDIFS3Path:
5757
Description: (Optional) An S3 Path (without the s3://) to an LDIF file that will be used during stack creation.
@@ -65,10 +65,12 @@ Parameters:
6565
- "True"
6666
- "False"
6767
Keypair:
68-
Description: EC2 Keypair to access AD management instances.
69-
Type: AWS::EC2::KeyPair::KeyName
68+
Description: (Optional) EC2 Keypair to access AD management instances.
69+
Type: String
70+
MinLength: 0
71+
MaxLength: 2048
7072
ClientIpCidr:
71-
Description: CIDR controlling incoming traffic to AD management instances.
73+
Description: (Optional) CIDR controlling incoming traffic to AD management instances.
7274
Default: ""
7375
Type: String
7476
AllowedPattern: ^((\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2}))?$
@@ -93,13 +95,21 @@ Parameters:
9395
AllowedValues:
9496
- "True"
9597
- "False"
98+
CreateActiveDirectory:
99+
Description: Create a demo Active Directory for RES to connect to. If `True` is selected, the following parameters are required DomainName, AdminPassword, ServiceAccountPassword, and Keypair.
100+
Type: String
101+
Default: "False"
102+
AllowedValues:
103+
- "True"
104+
- "False"
96105

97106
Conditions:
98107
GenerateCerts: !Not [!Equals [!Ref PortalDomainName, ""]]
99108
UseEnvironmentName: !Not [!Equals [!Ref EnvironmentName, ""]]
100109
SubDomainNotProvided: !Equals [!Ref SubDomain, ""]
101110
InGovCloud: !Equals [!Ref 'AWS::Partition', "aws-us-gov"]
102111
RetainStorageAndNetworking: !Equals [!Ref RetainStorageResources, "True"]
112+
CreateAD: !Equals [!Ref CreateActiveDirectory, "True"]
103113

104114
Resources:
105115

@@ -114,6 +124,7 @@ Resources:
114124
TemplateURL: https://aws-hpc-recipes.s3.us-east-1.amazonaws.com/main/recipes/net/hpc_large_scale/assets/main.yaml
115125

116126
DirectoryService:
127+
Condition: CreateAD
117128
Type: AWS::CloudFormation::Stack
118129
Properties:
119130
Parameters:
@@ -135,6 +146,7 @@ Resources:
135146
TemplateURL: https://aws-hpc-recipes.s3.us-east-1.amazonaws.com/main/recipes/dir/demo_managed_ad/assets/main.yaml
136147

137148
WindowsManagementHost:
149+
Condition: CreateAD
138150
Type: AWS::CloudFormation::Stack
139151
Properties:
140152
Parameters:
@@ -532,47 +544,59 @@ Outputs:
532544
Keypair:
533545
Description: Keypair used for management instances
534546
Value: !Ref Keypair
547+
Condition: CreateAD
535548
ActiveDirectoryName:
536549
Description: Fully Qualified Domain Name (FQDN) for your Active Directory
537550
Value: !If [ SubDomainNotProvided, !Ref DomainName, !Join [ ".", [ !Ref SubDomain, !Ref DomainName] ] ]
551+
Condition: CreateAD
538552
ADShortName:
539553
Description: Please provide the short name in Active directory
540554
Value: !GetAtt [ DirectoryService, Outputs.DomainShortName ]
555+
Condition: CreateAD
541556
LDAPConnectionURI:
542557
Value: !Sub
543558
- ldap://${DomainName}
544559
- { DomainName: !If [ SubDomainNotProvided, !Ref DomainName, !Join [ ".", [ !Ref SubDomain, !Ref DomainName] ] ] }
560+
Condition: CreateAD
545561
SudoersGroupName:
546562
Value: RESAdministrators
563+
Condition: CreateAD
547564
LDAPBase:
548565
Value: !Sub
549566
- dc=${dc}
550567
- { dc: !Join [",dc=", !Split [".", !If [ SubDomainNotProvided, !Ref DomainName, !Join [ ".", [ !Ref SubDomain, !Ref DomainName] ] ] ]] }
568+
Condition: CreateAD
551569
ServiceAccountCredentialsSecretArn:
552570
Value: !GetAtt [ DirectoryService, Outputs.CredentialsSecretArn ]
571+
Condition: CreateAD
553572
ServiceAccountUserDN:
554573
Description: The Distinguished Name (DN) of the ServiceAccount user in your Active Directory
555574
Value: !Sub
556575
- CN=ServiceAccount,OU=Users,OU=${ou},DC=${dc}
557576
- {dc: !Join [",DC=", !Split [".", !If [ SubDomainNotProvided, !Ref DomainName, !Join [ ".", [ !Ref SubDomain, !Ref DomainName]]]]], ou: !GetAtt [ DirectoryService, Outputs.DomainShortName ]}
577+
Condition: CreateAD
558578
SharedHomeFilesystemId:
559579
Value: !GetAtt [ Storage, Outputs.EFSFilesystemId ]
560580
UsersOU:
561581
Description: The OU for all users who might join the system. The value provided here is based off of a supplied LDIF file.
562582
Value: !Sub
563583
- OU=Users,OU=RES,OU=${ou},DC=${dc}
564584
- { dc: !Join [",DC=", !Split [".", !If [ SubDomainNotProvided, !Ref DomainName, !Join [ ".", [ !Ref SubDomain, !Ref DomainName]]]]], ou: !GetAtt [ DirectoryService, Outputs.DomainShortName ]}
585+
Condition: CreateAD
565586
GroupsOU:
566587
Description: The OU for groups that users belong to who might join the system. The value provided here is based off of a supplied LDIF file.
567588
Value: !Sub
568589
- OU=Users,OU=RES,OU=${ou},DC=${dc}
569590
- { dc: !Join [",DC=", !Split [".", !If [ SubDomainNotProvided, !Ref DomainName, !Join [ ".", [ !Ref SubDomain, !Ref DomainName]]]]], ou: !GetAtt [ DirectoryService, Outputs.DomainShortName ]}
591+
Condition: CreateAD
570592
ComputersOU:
571593
Description: The OU for computers that join the AD. The value provided here is based off of a supplied LDIF file.
572594
Value: !Sub
573595
- OU=Computers,OU=RES,OU=${ou},DC=${dc}
574596
- { dc: !Join [",DC=", !Split [".", !If [ SubDomainNotProvided, !Ref DomainName, !Join [ ".", [ !Ref SubDomain, !Ref DomainName]]]]], ou: !GetAtt [ DirectoryService, Outputs.DomainShortName ]}
597+
Condition: CreateAD
575598
ActiveDirectoryDNSIPs:
576599
Description: The DNS IPs of your Active Directory
577600
Value: !Join [ ",", [ !GetAtt [ DirectoryService, Outputs.DnsIpAddress1 ], !GetAtt [ DirectoryService, Outputs.DnsIpAddress2 ] ] ]
601+
Condition: CreateAD
578602

‎recipes/res/res_demo_env/assets/res-demo-stack.yaml‎

Lines changed: 29 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ Metadata:
88
Parameters:
99
- EnvironmentName
1010
- AdministratorEmail
11+
- CreateActiveDirectory
1112
- Label:
1213
default: Access Management
1314
Parameters:
@@ -46,12 +47,22 @@ Parameters:
4647
AllowedPattern: ^(pl-[a-z0-9]{8,20})?$
4748
ConstraintDescription: Must be a valid VPC Prefix List ID, which begins with `pl-` or be empty.
4849

50+
CreateActiveDirectory:
51+
Description: Create a demo Active Directory for RES to connect to.
52+
Type: String
53+
Default: "False"
54+
AllowedValues:
55+
- "True"
56+
- "False"
57+
4958
Conditions:
5059
UseEnvironmentName: !Not [!Equals [!Ref EnvironmentName, ""]]
60+
CreateAD: !Equals [!Ref CreateActiveDirectory, "True"]
5161

5262
Resources:
5363

5464
AdminPassword:
65+
Condition: CreateAD
5566
Type: AWS::SecretsManager::Secret
5667
Properties:
5768
Description: Active Directory Administrator Account Password.
@@ -67,6 +78,7 @@ Resources:
6778
Value: !Ref EnvironmentName
6879

6980
ServiceAccountPassword:
81+
Condition: CreateAD
7082
Type: AWS::SecretsManager::Secret
7183
Properties:
7284
Description: Active Directory Service Account Password.
@@ -88,11 +100,12 @@ Resources:
88100
PortalDomainName: ""
89101
Keypair: !Ref Keypair
90102
EnvironmentName: !If [UseEnvironmentName, !Ref EnvironmentName, ""]
91-
AdminPassword: !Ref AdminPassword
92-
ServiceAccountPassword: !Ref ServiceAccountPassword
103+
AdminPassword: !If [CreateAD, !Ref AdminPassword, ""]
104+
ServiceAccountPassword: !If [CreateAD, !Ref ServiceAccountPassword, ""]
93105
ClientIpCidr: !Ref ClientIpCidr
94106
ClientPrefixList: !Ref InboundPrefixList
95107
RetainStorageResources: "False"
108+
CreateActiveDirectory: !Ref CreateActiveDirectory
96109
TemplateURL: https://aws-hpc-recipes.s3.us-east-1.amazonaws.com/main/recipes/res/res_demo_env/assets/bi.yaml
97110

98111
RES:
@@ -116,27 +129,28 @@ Resources:
116129
InfrastructureHostSubnets: !GetAtt [ RESExternal, Outputs.PrivateSubnets ]
117130
VdiSubnets: !GetAtt [ RESExternal, Outputs.PrivateSubnets ]
118131
IsLoadBalancerInternetFacing: "true"
119-
ActiveDirectoryName: !GetAtt [ RESExternal, Outputs.ActiveDirectoryName ]
120-
ADShortName: !GetAtt [ RESExternal, Outputs.ADShortName ]
121-
LDAPBase: !GetAtt [ RESExternal, Outputs.LDAPBase ]
122-
LDAPConnectionURI: !GetAtt [ RESExternal, Outputs.LDAPConnectionURI ]
123-
SudoersGroupName: RESAdministrators
124-
ServiceAccountCredentialsSecretArn: !GetAtt [ RESExternal, Outputs.ServiceAccountCredentialsSecretArn ]
125-
UsersOU: !GetAtt [ RESExternal, Outputs.UsersOU ]
126-
GroupsOU: !GetAtt [ RESExternal, Outputs.GroupsOU ]
127-
ComputersOU: !GetAtt [ RESExternal, Outputs.ComputersOU ]
132+
ActiveDirectoryName: !If [CreateAD, !GetAtt [ RESExternal, Outputs.ActiveDirectoryName ], ""]
133+
ADShortName: !If [CreateAD, !GetAtt [ RESExternal, Outputs.ADShortName ], ""]
134+
LDAPBase: !If [CreateAD, !GetAtt [ RESExternal, Outputs.LDAPBase ], ""]
135+
LDAPConnectionURI: !If [CreateAD, !GetAtt [ RESExternal, Outputs.LDAPConnectionURI ], ""]
136+
SudoersGroupName: !If [CreateAD, RESAdministrators, ""]
137+
ServiceAccountCredentialsSecretArn: !If [CreateAD, !GetAtt [ RESExternal, Outputs.ServiceAccountCredentialsSecretArn ], ""]
138+
UsersOU: !If [CreateAD, !GetAtt [ RESExternal, Outputs.UsersOU ], ""]
139+
GroupsOU: !If [CreateAD, !GetAtt [ RESExternal, Outputs.GroupsOU ], ""]
140+
ComputersOU: !If [CreateAD, !GetAtt [ RESExternal, Outputs.ComputersOU ], ""]
128141
SharedHomeFileSystemId: !GetAtt [ RESExternal, Outputs.SharedHomeFilesystemId ]
129142
InfrastructureHostAMI: ""
130143
EnableLdapIDMapping: "True"
131144
IAMPermissionBoundary: ""
132145
DisableADJoin: "False"
133-
ServiceAccountUserDN: !GetAtt [ RESExternal, Outputs.ServiceAccountUserDN ]
146+
ServiceAccountUserDN: !If [CreateAD, !GetAtt [ RESExternal, Outputs.ServiceAccountUserDN ], ""]
134147
HttpProxy: ""
135148
HttpsProxy: ""
136149
NoProxy: ""
137150
TemplateURL: https://research-engineering-studio-us-east-1.s3.amazonaws.com/releases/latest/ResearchAndEngineeringStudio.template.json
138151

139152
RESSsoKeycloak:
153+
Condition: CreateAD
140154
Type: AWS::CloudFormation::Stack
141155
DependsOn: RES
142156
Properties:
@@ -362,9 +376,12 @@ Outputs:
362376
KeycloakUrl:
363377
Description: Keycloak Administrator Url
364378
Value: !GetAtt [ RESSsoKeycloak, Outputs.KeycloakUrl ]
379+
Condition: CreateAD
365380
KeycloakAdminPasswordSecretArn:
366381
Description: Keycloak password for admin user
367382
Value: !GetAtt [ RESSsoKeycloak, Outputs.KeycloakAdminPasswordSecretArn ]
383+
Condition: CreateAD
368384
ApplicationUrl:
369385
Description: RES application Url
370386
Value: !GetAtt [ RESSsoKeycloak, Outputs.ApplicationUrl ]
387+
Condition: CreateAD

0 commit comments

Comments
 (0)