cloud9-stack.yaml

Parameters:
  AutomaticStopTimeMinutes:
    Description: How many minutes idle before stopping Cloud9. Options, 30min, 1hr, 4hr, 1day, 1week, Never (0)
    Type: Number
    Default: 30
    AllowedValues:
      - 30
      - 60
      - 240
      - 1440
      - 10080
      - 0
  EC2InstanceType:
    Description: EC2 instance type on which IDE runs
    Type: String
    Default: t2.micro
    AllowedValues:
      - t2.nano
      - t2.micro
      - t2.small
      - t2.medium
      - t2.large
      - t2.xlarge
      - t2.2xlarge
      - m3.medium
      - m3.large
      - m3.xlarge
      - m3.2xlarge
      - m4.large
      - m4.xlarge
      - m4.2xlarge
      - m4.4xlarge
      - m4.10xlarge
      - m4.16xlarge
      - c3.large
      - c3.xlarge
      - c3.2xlarge
      - c3.4xlarge
      - c3.8xlarge
      - c4.large
      - c4.xlarge
      - c4.2xlarge
      - c4.4xlarge
      - c4.8xlarge
  SubnetId:
    Description: The ID of a public subnet into which Cloud9 should be launched.
    Type: AWS::EC2::Subnet::Id
Resources:
  Cloud9:
    Type: "AWS::Cloud9::EnvironmentEC2"
    Properties:
      Name:
        Fn::Join:
          - "-"
          - - "Neptune-Cloud9"
            - Fn::Select:
                - 4
                - Fn::Split:
                    - "-"
                    - Fn::Select:
                        - 2
                        - Fn::Split:
                            - /
                            - Ref: AWS::StackId
      Description: Neptune Cloud9
      ConnectionType: CONNECT_SSM
      AutomaticStopTimeMinutes: !Ref "AutomaticStopTimeMinutes"
      SubnetId: !Ref SubnetId
      InstanceType: !Ref "EC2InstanceType"
    DependsOn: CreateCloud9ServiceRoles
  Cloud9InstanceProfile:
    Type: "AWS::IAM::InstanceProfile"
    Properties:
      Path: "/"
      Roles:
        - Ref: "Cloud9InstanceNeptuneRole"
  Cloud9InstanceNeptuneRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: >
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": [
                  "ec2.amazonaws.com",
                  "cloud9.amazonaws.com"
                ]
              },
              "Action": "sts:AssumeRole"
            }
          ]
        }
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSCloud9SSMInstanceProfile
        - arn:aws:iam::aws:policy/ReadOnlyAccess
  Cloud9LambdaHelperRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: >
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": [
                  "lambda.amazonaws.com"
                ]
              },
              "Action": "sts:AssumeRole"
            }
          ]
        }
      Policies:
        - PolicyName: cloudformation
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "cloudformation:DescribeStackResources"
                  - "cloudformation:ListStacks"
                  - "ec2:DisassociateIamInstanceProfile"
                  - "ec2:AssociateIamInstanceProfile"
                  - "ec2:DescribeIamInstanceProfileAssociations"
                  - "iam:PassRole"
                  - "iam:CreateRole"
                  - "iam:CreateInstanceProfile"
                  - "iam:AddRoleToInstanceProfile"
                  - "iam:CreateServiceLinkedRole"
                  - "iam:AttachRolePolicy"
                Resource: "*"
              - Effect: Allow
                Action:
                  - "logs:CreateLogGroup"
                  - "logs:CreateLogStream"
                  - "logs:PutLogEvents"
                Resource: "arn:aws:logs:*:*:*"
  Cloud9HelperLambda:
    Type: AWS::Lambda::Function
    Properties:
      Runtime: python3.9
      Timeout: 15
      Role: !GetAtt "Cloud9LambdaHelperRole.Arn"
      Handler: index.lambda_handler
      Code:
        ZipFile: |
          import boto3
          import jmespath
          import cfnresponse
          import json
          from botocore.exceptions import ClientError

          def create_cloud9_roles(input):
            if "createCloud9Roles" not in input:
              print(f"createCloud9Roles not in {input}")
              return
            iam = boto3.client("iam")
            assume_role_policy = json.dumps({
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Principal": {
                    "Service": [
                      "ec2.amazonaws.com",
                      "cloud9.amazonaws.com"
                    ]
                  },
                  "Action": "sts:AssumeRole"
                }
              ]
            })
            try:
              iam.create_role(
                Path="/service-role/",
                RoleName="AWSCloud9SSMAccessRole",
                AssumeRolePolicyDocument=assume_role_policy
              )
              iam.create_instance_profile(
                InstanceProfileName="AWSCloud9SSMInstanceProfile",
                Path="/cloud9/"
              )
              iam.add_role_to_instance_profile(
                InstanceProfileName="AWSCloud9SSMInstanceProfile",
                RoleName="AWSCloud9SSMAccessRole"
              )
              iam.attach_role_policy(
                RoleName="AWSCloud9SSMAccessRole",
                PolicyArn="arn:aws:iam::aws:policy/AWSCloud9SSMInstanceProfile"
              )
            except ClientError as ex:
              if ex.response['Error']['Code'] == 'EntityAlreadyExists':
                print("No need to create AWSServiceRoleForAWSCloud9, it already exists")
              else:
                raise
            try:
              iam.create_service_linked_role(
                AWSServiceName="cloud9.amazonaws.com",
              )
            except ClientError as ex:
              if ex.response['Error']['Code'] == 'InvalidInput':
                print("No need to create cloud9.amazonaws.com service linked role, it already exists.")
                return
              raise

          def swap_instance_profile(input):
            if "Cloud9Id" not in input:
              print(f"Cloud9Id not found in {input}")
              return
            cfn = boto3.client('cloudformation')
            ec2 = boto3.client('ec2')

            stacks = [stack for page in cfn.get_paginator('list_stacks').paginate() for stack in page['StackSummaries']]
            stack = next(stack for stack in stacks if input['Cloud9Id'] in stack['StackName'])

            result = cfn.describe_stack_resources(StackName=stack['StackName'])
            instance_id = jmespath.search("StackResources[?LogicalResourceId==`Instance`].PhysicalResourceId", result) [0]
            security_group = jmespath.search("StackResources[?LogicalResourceId==`InstanceSecurityGroup`].PhysicalResourceId", result)[0]

            result = ec2.describe_iam_instance_profile_associations(Filters=[{"Name": "instance-id", "Values":[instance_id]}])
            instance_profile_association_id = jmespath.search('IamInstanceProfileAssociations[0].AssociationId', result)

            ec2.disassociate_iam_instance_profile(AssociationId=instance_profile_association_id)
            ec2.associate_iam_instance_profile(InstanceId=instance_id, IamInstanceProfile={"Name": input['CorrectInstanceProfile']})


          def lambda_handler(event, context):
            print(json.dumps(event))
            try:
              create_cloud9_roles(event["ResourceProperties"])
              swap_instance_profile(event["ResourceProperties"])
              cfnresponse.send(event, context, cfnresponse.SUCCESS, {})
            except Exception as ex:
              raise ex
              cfnresponse.send(event, context, cfnresponse.FAILED, {})

      Description: Associate cloud9 instance with correct profile
      TracingConfig:
        Mode: Active
  SwapInstanceProfile:
    Type: Custom::SwapInstanceProfile
    Properties:
      ServiceToken: !GetAtt Cloud9HelperLambda.Arn
      Cloud9Id: !Ref Cloud9
      CorrectInstanceProfile: !Ref Cloud9InstanceProfile
  CreateCloud9ServiceRoles:
    Type: Custom::SwapInstanceProfile
    Properties:
      ServiceToken: !GetAtt Cloud9HelperLambda.Arn
      createCloud9Roles: true
Outputs:
  Cloud9Id:
    Description: The ID of the Cloud9 ide
    Value: !Ref Cloud9