AWSTemplateFormatVersion: '2010-09-09'
Description: >
  EG334S VPN #2 parallel BGP migration. Creates two Azure customer gateways
  and two route-based AWS Site-to-Site VPN connections (four tunnels total)
  against the existing Ireland VGW. Deploy in eu-west-1 only. The existing
  static VPN remains separate until BGP acceptance succeeds.

Parameters:
  ExistingVgwId:
    Type: String
    Description: Existing Ireland virtual private gateway (AWS ASN 64512).
    AllowedPattern: '^vgw-[0-9a-f]+$'

  AzurePrimaryPublicIp:
    Type: String
    Description: Public IP of Azure VPN gateway instance 0.
    AllowedPattern: '^([0-9]{1,3}\.){3}[0-9]{1,3}$'

  AzureSecondaryPublicIp:
    Type: String
    Description: Public IP of Azure VPN gateway instance 1.
    AllowedPattern: '^([0-9]{1,3}\.){3}[0-9]{1,3}$'

  AzureBgpAsn:
    Type: Number
    Default: 65515
    MinValue: 1
    MaxValue: 4294967295

Resources:
  VpnTunnelLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub '/aws/vendedlogs/vpn/${AWS::StackName}-tunnels'
      RetentionInDays: 7

  AzurePrimaryCustomerGateway:
    Type: AWS::EC2::CustomerGateway
    Properties:
      Type: ipsec.1
      BgpAsn: !Ref AzureBgpAsn
      IpAddress: !Ref AzurePrimaryPublicIp
      DeviceName: eg334s-team2-azure-vpngw-instance-0
      Tags:
        - { Key: Name, Value: eg334s-team2-azure-cgw-bgp-primary }
        - { Key: Project, Value: EG334S }
        - { Key: Environment, Value: SCHOOL-DEMO }
        - { Key: RoutingMode, Value: Dynamic-BGP }

  AzureSecondaryCustomerGateway:
    Type: AWS::EC2::CustomerGateway
    Properties:
      Type: ipsec.1
      BgpAsn: !Ref AzureBgpAsn
      IpAddress: !Ref AzureSecondaryPublicIp
      DeviceName: eg334s-team2-azure-vpngw-instance-1
      Tags:
        - { Key: Name, Value: eg334s-team2-azure-cgw-bgp-secondary }
        - { Key: Project, Value: EG334S }
        - { Key: Environment, Value: SCHOOL-DEMO }
        - { Key: RoutingMode, Value: Dynamic-BGP }

  AzurePrimaryVpnConnection:
    Type: AWS::EC2::VPNConnection
    Properties:
      Type: ipsec.1
      StaticRoutesOnly: false
      CustomerGatewayId: !Ref AzurePrimaryCustomerGateway
      VpnGatewayId: !Ref ExistingVgwId
      # Route-based BGP connections use any/any selectors; BGP advertisements
      # constrain reachability to the Azure and Ireland prefixes.
      LocalIpv4NetworkCidr: 0.0.0.0/0
      RemoteIpv4NetworkCidr: 0.0.0.0/0
      VpnTunnelOptionsSpecifications:
        - TunnelInsideCidr: 169.254.21.0/30
          IKEVersions: [{ Value: ikev2 }]
          Phase1EncryptionAlgorithms: [{ Value: AES256 }]
          Phase1IntegrityAlgorithms: [{ Value: SHA2-256 }]
          Phase1DHGroupNumbers: [{ Value: 14 }]
          Phase2EncryptionAlgorithms: [{ Value: AES256 }]
          Phase2IntegrityAlgorithms: [{ Value: SHA2-256 }]
          Phase2DHGroupNumbers: [{ Value: 14 }]
          StartupAction: start
          DPDTimeoutAction: restart
          DPDTimeoutSeconds: 30
          LogOptions:
            CloudwatchLogOptions:
              LogEnabled: true
              LogGroupArn: !GetAtt VpnTunnelLogGroup.Arn
              LogOutputFormat: json
        - TunnelInsideCidr: 169.254.22.0/30
          IKEVersions: [{ Value: ikev2 }]
          Phase1EncryptionAlgorithms: [{ Value: AES256 }]
          Phase1IntegrityAlgorithms: [{ Value: SHA2-256 }]
          Phase1DHGroupNumbers: [{ Value: 14 }]
          Phase2EncryptionAlgorithms: [{ Value: AES256 }]
          Phase2IntegrityAlgorithms: [{ Value: SHA2-256 }]
          Phase2DHGroupNumbers: [{ Value: 14 }]
          StartupAction: start
          DPDTimeoutAction: restart
          DPDTimeoutSeconds: 30
          LogOptions:
            CloudwatchLogOptions:
              LogEnabled: true
              LogGroupArn: !GetAtt VpnTunnelLogGroup.Arn
              LogOutputFormat: json
      Tags:
        - { Key: Name, Value: eg334s-team2-vpn2-bgp-primary }
        - { Key: Project, Value: EG334S }
        - { Key: Environment, Value: SCHOOL-DEMO }
        - { Key: RoutingMode, Value: Dynamic-BGP }
        - { Key: Migration, Value: Parallel }

  AzureSecondaryVpnConnection:
    Type: AWS::EC2::VPNConnection
    Properties:
      Type: ipsec.1
      StaticRoutesOnly: false
      CustomerGatewayId: !Ref AzureSecondaryCustomerGateway
      VpnGatewayId: !Ref ExistingVgwId
      # Route-based BGP connections use any/any selectors; BGP advertisements
      # constrain reachability to the Azure and Ireland prefixes.
      LocalIpv4NetworkCidr: 0.0.0.0/0
      RemoteIpv4NetworkCidr: 0.0.0.0/0
      VpnTunnelOptionsSpecifications:
        - TunnelInsideCidr: 169.254.21.4/30
          IKEVersions: [{ Value: ikev2 }]
          Phase1EncryptionAlgorithms: [{ Value: AES256 }]
          Phase1IntegrityAlgorithms: [{ Value: SHA2-256 }]
          Phase1DHGroupNumbers: [{ Value: 14 }]
          Phase2EncryptionAlgorithms: [{ Value: AES256 }]
          Phase2IntegrityAlgorithms: [{ Value: SHA2-256 }]
          Phase2DHGroupNumbers: [{ Value: 14 }]
          StartupAction: start
          DPDTimeoutAction: restart
          DPDTimeoutSeconds: 30
          LogOptions:
            CloudwatchLogOptions:
              LogEnabled: true
              LogGroupArn: !GetAtt VpnTunnelLogGroup.Arn
              LogOutputFormat: json
        - TunnelInsideCidr: 169.254.22.4/30
          IKEVersions: [{ Value: ikev2 }]
          Phase1EncryptionAlgorithms: [{ Value: AES256 }]
          Phase1IntegrityAlgorithms: [{ Value: SHA2-256 }]
          Phase1DHGroupNumbers: [{ Value: 14 }]
          Phase2EncryptionAlgorithms: [{ Value: AES256 }]
          Phase2IntegrityAlgorithms: [{ Value: SHA2-256 }]
          Phase2DHGroupNumbers: [{ Value: 14 }]
          StartupAction: start
          DPDTimeoutAction: restart
          DPDTimeoutSeconds: 30
          LogOptions:
            CloudwatchLogOptions:
              LogEnabled: true
              LogGroupArn: !GetAtt VpnTunnelLogGroup.Arn
              LogOutputFormat: json
      Tags:
        - { Key: Name, Value: eg334s-team2-vpn2-bgp-secondary }
        - { Key: Project, Value: EG334S }
        - { Key: Environment, Value: SCHOOL-DEMO }
        - { Key: RoutingMode, Value: Dynamic-BGP }
        - { Key: Migration, Value: Parallel }

Outputs:
  PrimaryCustomerGatewayId:
    Value: !Ref AzurePrimaryCustomerGateway
  SecondaryCustomerGatewayId:
    Value: !Ref AzureSecondaryCustomerGateway
  PrimaryVpnConnectionId:
    Value: !Ref AzurePrimaryVpnConnection
  SecondaryVpnConnectionId:
    Value: !Ref AzureSecondaryVpnConnection