AWSTemplateFormatVersion: '2010-09-09'
Description: >
  EG334S VPN #1 BGP migration security rules. Deploy in us-east-1 after the
  parallel Ireland VPN exists. This small stack avoids replacing the Virginia
  router when AWS assigns new managed tunnel endpoints.

Parameters:
  StrongSwanSecurityGroupId:
    Type: AWS::EC2::SecurityGroup::Id
    Description: Existing Virginia strongSwan security group ID.

  BgpTunnel1Cidr:
    Type: String
    Description: AWS-generated outside address for BGP tunnel 1 as an exact /32.
    AllowedPattern: '^((25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])/32$'

  BgpTunnel2Cidr:
    Type: String
    Description: AWS-generated outside address for BGP tunnel 2 as an exact /32.
    AllowedPattern: '^((25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])/32$'

Resources:
  Tunnel1Ike:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref StrongSwanSecurityGroupId
      IpProtocol: udp
      FromPort: 500
      ToPort: 500
      CidrIp: !Ref BgpTunnel1Cidr
      Description: IKE from VPN1 BGP tunnel 1

  Tunnel1NatT:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref StrongSwanSecurityGroupId
      IpProtocol: udp
      FromPort: 4500
      ToPort: 4500
      CidrIp: !Ref BgpTunnel1Cidr
      Description: NAT-T from VPN1 BGP tunnel 1

  Tunnel2Ike:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref StrongSwanSecurityGroupId
      IpProtocol: udp
      FromPort: 500
      ToPort: 500
      CidrIp: !Ref BgpTunnel2Cidr
      Description: IKE from VPN1 BGP tunnel 2

  Tunnel2NatT:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref StrongSwanSecurityGroupId
      IpProtocol: udp
      FromPort: 4500
      ToPort: 4500
      CidrIp: !Ref BgpTunnel2Cidr
      Description: NAT-T from VPN1 BGP tunnel 2

Outputs:
  ControlledPeerCidrs:
    Value: !Join [',', [!Ref BgpTunnel1Cidr, !Ref BgpTunnel2Cidr]]