AWSTemplateFormatVersion: 2010-09-09
Description: Deploys a Check Point Security Gateway into a new VPC (20230801)
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: VPC Network Configuration
        Parameters:
          - AvailabilityZone
          - VPCCIDR
          - PublicSubnetCIDR
          - PrivateSubnetCIDR
      - Label:
          default: EC2 Instance Configuration
        Parameters:
          - GatewayName
          - GatewayInstanceType
          - KeyName
          - AllocatePublicAddress
          - VolumeSize
          - VolumeType
          - VolumeEncryption
          - EnableInstanceConnect
          - TerminationProtection
      - Label:
          default: Check Point Settings
        Parameters:
          - GatewayVersion
          - Shell
          - GatewaySICKey
          - GatewayPasswordHash
      - Label:
          default: Quick connect to Smart-1 Cloud (Recommended)
        Parameters:
          - GatewayToken
      - Label:
          default: Advanced Settings
        Parameters:
          - ResourcesTagName
          - GatewayHostname
          - AllowUploadDownload
          - CloudWatch
          - GatewayBootstrapScript
          - NTPPrimary
          - NTPSecondary
      - Label:
          default: Automatic Provisioning with Security Management Server Settings (optional)
        Parameters:
          - ControlGatewayOverPrivateOrPublicAddress
          - ManagementServer
          - ConfigurationTemplate
    ParameterLabels:
      AvailabilityZone:
        default: Availability zone
      VPCCIDR:
        default: VPC CIDR
      PublicSubnetCIDR:
        default: Public subnet CIDR
      PrivateSubnetCIDR:
        default: Private subnet CIDR
      GatewayName:
        default: Gateway Name
      GatewayInstanceType:
        default: Gateway Instance type
      KeyName:
        default: Key name
      AllocatePublicAddress:
        default: Allocate an Elastic IP
      VolumeSize:
        default: Root volume size (GB)
      VolumeType:
        default: Volume Type
      VolumeEncryption:
        default: Volume encryption KMS key identifier
      EnableInstanceConnect:
        default: Enable AWS Instance Connect
      TerminationProtection:
        default: Termination Protection
      GatewayVersion:
        default: Gateway Version & license
      Shell:
        default: Admin shell
      GatewaySICKey:
        default: Gateway SIC key
      GatewayToken:
        default: Smart-1 Cloud Token
      GatewayPasswordHash:
        default: Gateway Password hash
      ResourcesTagName:
        default: Resources prefix tag
      GatewayHostname:
        default: Gateway Hostname
      AllowUploadDownload:
        default: Allow upload & download
      CloudWatch:
        default: CloudWatch metrics
      GatewayBootstrapScript:
        default: Bootstrap Script
      NTPPrimary:
        default: Primary NTP server
      NTPSecondary:
        default: Secondary NTP server
      ControlGatewayOverPrivateOrPublicAddress:
        default: Gateway address
      ManagementServer:
        default: Management Server
      ConfigurationTemplate:
        default: Configuration template
Parameters:
  AvailabilityZone:
    Description: The availability zone in which to deploy the instance.
    Type: AWS::EC2::AvailabilityZone::Name
    MinLength: 1
  VPCCIDR:
    Description: The CIDR block of the VPC.
    Type: String
    Default: 10.0.0.0/16
    AllowedPattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$'
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28.
  PublicSubnetCIDR:
    Description: The public subnet of the Security Gateway.
    Type: String
    Default: 10.0.10.0/24
  PrivateSubnetCIDR:
    Description: The private subnet of the Security Gateway.
    Type: String
    Default: 10.0.11.0/24
  GatewayName:
    Type: String
    Default: Check-Point-Gateway
  GatewayInstanceType:
    Description: The instance type of the Secutiry Gateways.
    Type: String
    Default: c5.xlarge
    AllowedValues:
      - c5.large
      - c5.xlarge
      - c5.2xlarge
      - c5.4xlarge
      - c5.9xlarge
      - c5.12xlarge
      - c5.18xlarge
      - c5.24xlarge
      - c5n.large
      - c5n.xlarge
      - c5n.2xlarge
      - c5n.4xlarge
      - c5n.9xlarge
      - c5n.18xlarge
      - m5.large
      - m5.xlarge
      - m5.2xlarge
      - m5.4xlarge
      - m5.8xlarge
      - m5.12xlarge
      - m5.16xlarge
      - m5.24xlarge
      - m6i.large
      - m6i.xlarge
      - m6i.2xlarge
      - m6i.4xlarge
      - m6i.8xlarge
      - m6i.12xlarge
      - m6i.16xlarge
      - m6i.24xlarge
      - m6i.32xlarge
      - c6i.large
      - c6i.xlarge
      - c6i.2xlarge
      - c6i.4xlarge
      - c6i.8xlarge
      - c6i.12xlarge
      - c6i.16xlarge
      - c6i.24xlarge
      - c6i.32xlarge
      - c6in.large
      - c6in.xlarge
      - c6in.2xlarge
      - c6in.4xlarge
      - c6in.8xlarge
      - c6in.12xlarge
      - c6in.16xlarge
      - c6in.24xlarge
      - c6in.32xlarge
      - r5.large
      - r5.xlarge
      - r5.2xlarge
      - r5.4xlarge
      - r5.8xlarge
      - r5.12xlarge
      - r5.16xlarge
      - r5.24xlarge
      - r5a.large
      - r5a.xlarge
      - r5a.2xlarge
      - r5a.4xlarge
      - r5a.8xlarge
      - r5a.12xlarge
      - r5a.16xlarge
      - r5a.24xlarge
      - r5b.large
      - r5b.xlarge
      - r5b.2xlarge
      - r5b.4xlarge
      - r5b.8xlarge
      - r5b.12xlarge
      - r5b.16xlarge
      - r5b.24xlarge
      - r5n.large
      - r5n.xlarge
      - r5n.2xlarge
      - r5n.4xlarge
      - r5n.8xlarge
      - r5n.12xlarge
      - r5n.16xlarge
      - r5n.24xlarge
      - r6i.large
      - r6i.xlarge
      - r6i.2xlarge
      - r6i.4xlarge
      - r6i.8xlarge
      - r6i.12xlarge
      - r6i.16xlarge
      - r6i.24xlarge
      - r6i.32xlarge
      - m6a.large
      - m6a.xlarge
      - m6a.2xlarge
      - m6a.4xlarge
      - m6a.8xlarge
      - m6a.12xlarge
      - m6a.16xlarge
      - m6a.24xlarge
      - m6a.32xlarge
      - m6a.48xlarge
    ConstraintDescription: Must be a valid EC2 instance type
  KeyName:
    Description: The EC2 Key Pair to allow SSH access to the instance.
    Type: AWS::EC2::KeyPair::KeyName
    MinLength: 1
    ConstraintDescription: must be the name of an existing EC2 KeyPair.
  AllocatePublicAddress:
    Type: String
    Default: true
    AllowedValues:
      - true
      - false
  VolumeSize:
    Type: Number
    Default: 100
    MinValue: 100
  VolumeType:
    Description: General Purpose SSD Volume Type
    Type: String
    Default: gp3
    AllowedValues:
      - gp3
      - gp2
  VolumeEncryption:
    Description: KMS or CMK key Identifier - Use key ID, alias or ARN. Key alias should be prefixed with 'alias/' (e.g. for KMS default alias 'aws/ebs' - insert 'alias/aws/ebs').
    Type: String
    Default: alias/aws/ebs
  EnableInstanceConnect:
    Description: Ec2 Instance Connect is not supported with versions prior to R80.40.
    Type: String
    Default: false
    AllowedValues:
      - true
      - false
  TerminationProtection:
    Description: Prevents an instance from accidental termination.
    Type: String
    Default: false
    AllowedValues:
      - true
      - false
  GatewayVersion:
    Type: String
    Default: R81.20-BYOL
    AllowedValues:
      - R82-BYOL
      - R81.10-BYOL
      - R81.20-BYOL
  Shell:
    Description: Change the admin shell to enable advanced command line configuration.
    Type: String
    Default: /etc/cli.sh
    AllowedValues:
      - /etc/cli.sh
      - /bin/bash
      - /bin/csh
      - /bin/tcsh
  GatewaySICKey:
    Description: The Secure Internal Communication key creates trusted connections
      between Check Point components. Choose a random string consisting of at least
      8 alphanumeric characters.
    Type: String
    AllowedPattern: '[a-zA-Z0-9]{8,}'
    NoEcho: true
  GatewayToken:
    Description: Follow the instructions in sk180501 to quickly connect this Gateway to Smart-1 Cloud. Paste here the token copied from the Connect Gateway screen in Smart-1 Cloud portal.
    AllowedPattern: '(^aHR0cHM6Ly9(.+)|(.*)\s[aHR0cHM6Ly9](.+)|^$)'
    Type: String
    NoEcho: true
  GatewayPasswordHash:
    Description: Admin user's password hash (use command "openssl passwd -6 PASSWORD"
      to get the PASSWORD's hash). (optional)
    Type: String
    Default: ''
    AllowedPattern: '[\$\./a-zA-Z0-9]*'
    NoEcho: true
  ResourcesTagName:
    Description: The name tag of the resources. (optional)
    Type: String
    Default: ''
  GatewayHostname:
    Description: The name must not contain reserved words. For details, refer to sk40179. (optional)
    Type: String
    Default: ''
    AllowedPattern: '^([A-Za-z]([-0-9A-Za-z]{0,61}[0-9A-Za-z])?|)$'
    ConstraintDescription: A valid hostname label or an empty string.
  AllowUploadDownload:
    Description: Automatically download updates and share statistical data for product improvement purpose.
    Type: String
    Default: true
    AllowedValues:
      - true
      - false
  CloudWatch:
    Description: Report Check Point specific CloudWatch metrics.
    Type: String
    Default: false
    AllowedValues:
      - true
      - false
  GatewayBootstrapScript:
    Description: An optional script with semicolon (;) separated commands to run on the initial boot. (optional)
    Type: String
    Default: ''
    NoEcho: true
  NTPPrimary:
    Description: (optional)
    Type: String
    Default: 169.254.169.123
    AllowedPattern: '^[\.a-zA-Z0-9\-]*$'
  NTPSecondary:
    Description: (optional)
    Type: String
    Default: 0.pool.ntp.org
    AllowedPattern: '^[\.a-zA-Z0-9\-]*$'
  ControlGatewayOverPrivateOrPublicAddress:
    Description: Determines if the Security Gateway is provisioned using its private.
      or public address
    Type: String
    Default: private
    AllowedValues:
      - private
      - public
  ManagementServer:
    Description: The name that represents the Security Management Server in the automatic.
      provisioning configuration.
    Type: String
  ConfigurationTemplate:
    Description: A name of a Security Gateway configuration template in the automatic.
      provisioning configuration.
    Type: String
Conditions:
  AllocateAddress: !Equals [!Ref AllocatePublicAddress, true]
  ProvidedResourcesTag: !Not [!Equals [!Ref ResourcesTagName, '']]
Resources:
  Vpc:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://cgi-cfts.s3.cn-northwest-1.amazonaws.com.cn/utils/vpc.yaml
      Parameters:
        AvailabilityZones: !Ref AvailabilityZone
        NumberOfAZs: 1
        VPCCIDR: !Ref VPCCIDR
        PublicSubnet1CIDR: !Ref PublicSubnetCIDR
        CreatePrivateSubnets: true
        PrivateSubnet1CIDR: !Ref PrivateSubnetCIDR
        CreateAttachmentSubnets: false
  InternalRoutingTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !GetAtt Vpc.Outputs.VPCID
      Tags:
        - Key: Name
          Value:
            !Join
            - _
            - - !If [ProvidedResourcesTag, !Ref ResourcesTagName, !Ref 'AWS::StackName']
              - InternalRoutingTable
  InternalNetworkRouteAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref InternalRoutingTable
      SubnetId: !GetAtt Vpc.Outputs.PrivateSubnet1ID
  GatewayStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://cgi-cfts.s3.cn-northwest-1.amazonaws.com.cn/gateway/gateway.yaml
      Parameters:
        VPC: !GetAtt Vpc.Outputs.VPCID
        PublicSubnet: !GetAtt Vpc.Outputs.PublicSubnet1ID
        PrivateSubnet: !GetAtt Vpc.Outputs.PrivateSubnet1ID
        InternalRouteTable: !Ref InternalRoutingTable
        GatewayName: !Ref GatewayName
        GatewayInstanceType: !Ref GatewayInstanceType
        KeyName: !Ref KeyName
        AllocatePublicAddress: !Ref AllocatePublicAddress
        VolumeSize: !Ref VolumeSize
        VolumeType: !Ref VolumeType
        VolumeEncryption: !Ref VolumeEncryption
        EnableInstanceConnect: !Ref EnableInstanceConnect
        TerminationProtection: !Ref TerminationProtection
        GatewayVersion: !Ref GatewayVersion
        Shell: !Ref Shell
        GatewaySICKey: !Ref GatewaySICKey
        GatewayToken: !Ref GatewayToken
        GatewayPasswordHash: !Ref GatewayPasswordHash
        ResourcesTagName: !Ref ResourcesTagName
        GatewayHostname: !Ref GatewayHostname
        AllowUploadDownload: !Ref AllowUploadDownload
        CloudWatch: !Ref CloudWatch
        GatewayBootstrapScript: !Ref GatewayBootstrapScript
        NTPPrimary: !Ref NTPPrimary
        NTPSecondary: !Ref NTPSecondary
        ControlGatewayOverPrivateOrPublicAddress: !Ref ControlGatewayOverPrivateOrPublicAddress
        ManagementServer: !Ref ManagementServer
        ConfigurationTemplate: !Ref ConfigurationTemplate
Outputs:
  CheckPointInstancePublicAddress:
    Condition: AllocateAddress
    Description: The public address of the Check Point instance.
    Value: !GetAtt GatewayStack.Outputs.PublicAddress
  CheckPointInstanceSSH:
    Condition: AllocateAddress
    Description: SSH command to the Check Point instance.
    Value: !GetAtt GatewayStack.Outputs.SSH
  CheckPointInstanceURL:
    Condition: AllocateAddress
    Description: URL to the portal
    Value: !GetAtt GatewayStack.Outputs.URL
  ManagementName:
    Description: The name that represents the Security Management Server.
    Value: !Ref ManagementServer
  ConfigurationTemplateName:
    Description: The name that represents the configuration template. Configurations
      required to automatically provision the Gateways in the Auto Scaling Group,
      such as what Security Policy to install and which Blades to enable, will be
      placed under this template name.
    Value: !Ref ConfigurationTemplate
