code-server-stack.yaml

#------------------------------------------------------
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: MIT-0 
#------------------------------------------------------
AWSTemplateFormatVersion: "2010-09-09"
Description: deploy a vscode-server on an ec2 
#------------------------------------------------------
# Mappings CloudFront PrefixListId 
#------------------------------------------------------
Mappings: 
  CloudFrontPrefixListIdMappings:
    us-west-2:
      PrefixListId: "pl-82a045eb"
    us-east-1: 
      PrefixListId: "pl-3b927c52"
    ap-southeast-1:
      PrefixListId: "pl-31a34658"
#------------------------------------------------------
# Parameters
#------------------------------------------------------
Parameters:
  VPCID: 
    Description: imported vpc id
    Type: String
    Default: "" 
  SubnetID:
    Description: imported subnet id
    Type: String
    Default: ""
  InstanceType:
    Description: WebServer EC2 instance type
    Type: String
    Default: t2.xlarge
    ConstraintDescription: must be a valid EC2 instance type.
  LatestAmiId:
    Description: latest image id for ubuntu
    Type: "AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>" 
    Default: "/aws/service/canonical/ubuntu/server/22.04/stable/current/amd64/hvm/ebs-gp2/ami-id" 
  InternetCidrBlock:
    Type: String
    Description: UserCidrBlock
    Default: 0.0.0.0/0
  VSCodeServerVersion:
    Type: String
    Description: VSCodeServerVersion
    Default: 4.91.1
  OriginRequestPolicyId: 
    Type: String
    Description: origin request policy id
    Default: 216adef6-5c7f-47e4-b989-5492eafa07d3  
Conditions:
  ImportVPCIDNotEmpty: 
    Fn::Not:
      - Fn::Equals:
          - Ref: VPCID
          - ""
  ImportSubnetIDNotEmpty: 
    Fn::Not:
      - Fn::Equals:
          - Ref: SubnetID
          - ""
#------------------------------------------------------
# Security Group
#------------------------------------------------------
Resources:
  VSCodeServerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W40
            reason: allow ingress from the cloudfront prefix list
          - id: W5
            reason: allow ingress from the cloudfront prefix list
    Properties:
      GroupDescription: allow ingress from cloudfront prefix list
      VpcId:
        Fn::If:
          - ImportVPCIDNotEmpty
          - Ref: VPCID
          - Ref: AWS::NoValue 

  VSCodeServerSecurityGroupIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      Description: open port 8080 for the cloudfront prefix list
      GroupId: 
        Fn::GetAtt:
          - VSCodeServerSecurityGroup
          - GroupId
      IpProtocol: tcp
      FromPort: 8080
      ToPort: 8080
      SourcePrefixListId:
        Fn::FindInMap:
          - CloudFrontPrefixListIdMappings
          - Ref: AWS::Region
          - PrefixListId

  VSCodeServerSecurityGroupEgress:
    Type: AWS::EC2::SecurityGroupEgress
    Properties:
      Description: egress for vscode security group
      GroupId:
        Fn::GetAtt:
          - VSCodeServerSecurityGroup
          - GroupId
      IpProtocol: -1
      CidrIp: !Ref InternetCidrBlock
#------------------------------------------------------
# Role and Instance Profile
#------------------------------------------------------
  VSCodeServerIAMRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM
  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - Ref: VSCodeServerIAMRole
#------------------------------------------------------
# EC2 Instance for VSCode Server
#------------------------------------------------------
  VSCodeServer:
    Type: AWS::EC2::Instance
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W40
            reason: allow tcp 8080 from the cloudfront prefix list
    Properties:
      ImageId: !Ref LatestAmiId
      InstanceType: !Ref InstanceType
      IamInstanceProfile: !Ref InstanceProfile
      Tags:
        - Key: Name
          Value: VSCodeServer 
      NetworkInterfaces:
        - DeviceIndex: "0"
          AssociatePublicIpAddress: "true"
          SubnetId:
            Fn::If:
              - ImportSubnetIDNotEmpty
              - Ref: SubnetID
              - Ref: AWS::NoValue 
          GroupSet:
            - Fn::GetAtt:
                - VSCodeServerSecurityGroup
                - GroupId
      Monitoring: true
      UserData:
        Fn::Base64:
          Fn::Sub:
            - |
              #!/bin/bash
              curl -fOL https://github.com/coder/code-server/releases/download/v${VERSION}/code-server_${VERSION}_amd64.deb
              sudo dpkg -i code-server_${VERSION}_amd64.deb
              sudo systemctl enable --now code-server@ubuntu
              sleep 30
              sed -i.bak 's/auth: password/auth: none/' /home/ubuntu/.config/code-server/config.yaml
              sed -i.bak 's/bind-addr: 127.0.0.1:8080/bind-addr: 0.0.0.0:8080/' /home/ubuntu/.config/code-server/config.yaml
              sudo systemctl restart code-server@ubuntu
            - VERSION: !Ref VSCodeServerVersion
#------------------------------------------------------
# CloudFront Cached Policy
#------------------------------------------------------ 
  VSCodeServerCloudFrontCachePolicy:
    Type: AWS::CloudFront::CachePolicy
    Properties:
      CachePolicyConfig:
        DefaultTTL: 86400
        MaxTTL: 31536000
        MinTTL: 1
        Name: !Join ['-', ['VSCodeServer', !Select [4, !Split ['-', !Select [2, !Split ['/', !Ref AWS::StackId]]]]]]
        ParametersInCacheKeyAndForwardedToOrigin:
          CookiesConfig:
            CookieBehavior: all
          EnableAcceptEncodingGzip: False
          HeadersConfig:
            HeaderBehavior: whitelist
            Headers: 
              - Accept-Charset
              - Authorization
              - Origin
              - Accept
              - Referer
              - Host
              - Accept-Language
              - Accept-Encoding
              - Accept-Datetime
          QueryStringsConfig:
            QueryStringBehavior: all
#------------------------------------------------------
# CloudFront Distribution
#------------------------------------------------------ 
  VSCodeServerCloudFront:
    Type: AWS::CloudFront::Distribution
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W10
            reason: disable access logging for demo purpose 
          - id: W70
            reason: no TLS version for demo purpose 
    Properties:
      DistributionConfig:
        Origins:
          - DomainName: !GetAtt VSCodeServer.PublicDnsName
            Id: !GetAtt VSCodeServer.PublicDnsName
            CustomOriginConfig:
              HTTPPort: 8080
              OriginProtocolPolicy: http-only
        Enabled: true
        DefaultCacheBehavior:
          AllowedMethods:
            - GET
            - HEAD
            - OPTIONS
            - PUT 
            - POST 
            - PATCH 
            - DELETE
          ForwardedValues:
            QueryString: 'false'
          Compress: false
          TargetOriginId: !GetAtt VSCodeServer.PublicDnsName
          ViewerProtocolPolicy: allow-all
          OriginRequestPolicyId: !Ref OriginRequestPolicyId 
          CachePolicyId: !Ref VSCodeServerCloudFrontCachePolicy 
#------------------------------------------------------
# Exported output
#------------------------------------------------------ 
Outputs:
  VSCodeServerCloudFrontDomainName:
    Value: 
      !Sub 
        - "https://${domain}"
        - { domain: !GetAtt VSCodeServerCloudFront.DomainName }
    Export:
      Name: !Sub ${AWS::StackName}-domain-name
  VSCodeServerPrivateIP:
    Value: !GetAtt VSCodeServer.PrivateIp
    Export:
      Name: !Sub ${AWS::StackName}-code-server-private-ip
  VSCodeServerRoleARN:
    Value: !GetAtt VSCodeServerIAMRole.Arn
    Export:
      Name: !Sub ${AWS::StackName}-code-server-role-arn
  VSCodeServerInstanceId:
    Value: !Ref VSCodeServer
    Export:
      Name: !Sub ${AWS::StackName}-code-server-instance-id