AWSTemplateFormatVersion: 2010-09-09
Description: Deploy a Gateway Load Balancer, Check Point CloudGuard IaaS Security Gateway Auto Scaling Group, and optionally a Security Management Server, in a new VPC (20230801)
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: VPC Network Configuration
        Parameters:
          - AvailabilityZones
          - NumberOfAZs
          - VPCCIDR
          - PublicSubnet1CIDR
          - PublicSubnet2CIDR
          - PublicSubnet3CIDR
          - PublicSubnet4CIDR
      - Label:
          default: General Settings
        Parameters:
          - KeyName
          - EnableVolumeEncryption
          - VolumeSize
          - VolumeType
          - EnableInstanceConnect
          - TerminationProtection
          - AllowUploadDownload
          - ManagementServer
          - ConfigurationTemplate
          - AdminEmail
          - Shell
      - Label:
          default: Gateway Load Balancer Configuration
        Parameters:
          - GWLBName
          - TargetGroupName
          - AcceptConnectionRequired
          - CrossZoneLoadBalancing
      - Label:
          default: Check Point CloudGuard IaaS Security Gateways Auto Scaling Group Configuration
        Parameters:
          - GatewayName
          - GatewayInstanceType
          - GatewaysMinSize
          - GatewaysMaxSize
          - GatewayVersion
          - GatewayPasswordHash
          - GatewaySICKey
          - ControlGatewayOverPrivateOrPublicAddress
          - AllocatePublicAddress
          - CloudWatch
      - Label:
          default: Check Point CloudGuard IaaS Security Management Server Configuration
        Parameters:
          - ManagementDeploy
          - ManagementInstanceType
          - ManagementVersion
          - ManagementPasswordHash
          - GatewaysPolicy
          - AdminCIDR
          - GatewayManagement
          - GatewaysAddresses
    ParameterLabels:
      AvailabilityZones:
        default: Availability Zones
      NumberOfAZs:
        default: Number of AZs
      VPCCIDR:
        default: VPC CIDR
      PublicSubnet1CIDR:
        default: Auto Scaling Group Public Subnet 1
      PublicSubnet2CIDR:
        default: Auto Scaling Group Public Subnet 2
      PublicSubnet3CIDR:
        default: Auto Scaling Group Public Subnet 3
      PublicSubnet4CIDR:
        default: Auto Scaling Group Public Subnet 4
      KeyName:
        default: Key name
      EnableVolumeEncryption:
        default: Enable environment volume encryption
      VolumeSize:
        default: Root volume size (GB)
      VolumeType:
        default: Volume Type
      EnableInstanceConnect:
        default: Enable AWS Instance Connect
      TerminationProtection:
        default: Termination Protection
      AllowUploadDownload:
        default: Allow upload & download
      ManagementServer:
        default: Management Server
      ConfigurationTemplate:
        default: Configuration template
      AdminEmail:
        default: Email address
      Shell:
        default: Admin shell
      GWLBName:
        default: Gateway Load Balancer Name
      TargetGroupName:
        default: Target Group Name
      AcceptConnectionRequired:
        default:  Connection Acceptance Required
      CrossZoneLoadBalancing:
        default:  Enable Cross Zone Load Balancing
      GatewayName:
        default: Gateways instance name
      GatewayInstanceType:
        default: Gateways instance type
      GatewaysMinSize:
        default: Minimum group size
      GatewaysMaxSize:
        default: Maximum group size
      GatewayVersion:
        default: Gateways version & license
      GatewayPasswordHash:
        default: Gateways Password hash
      GatewaySICKey:
        default: Gateways SIC key
      ControlGatewayOverPrivateOrPublicAddress:
        default: Gateways addresses
      AllocatePublicAddress:
        default: Allocate Public IPs
      CloudWatch:
        default: CloudWatch metrics
      ManagementDeploy:
        default: Deploy Management Server
      ManagementInstanceType:
        default: Management instance type
      ManagementVersion:
        default: Management version & license
      ManagementPasswordHash:
        default: Management password hash
      GatewaysPolicy:
        default: Security Policy
      AdminCIDR:
        default: Administrator addresses
      GatewayManagement:
        default: Manage Gateways
      GatewaysAddresses:
        default: Gateways addresses
Parameters:
  AvailabilityZones:
    Description: List of Availability Zones (AZs) to use for the subnets in the VPC. Select at least two.
    Type: List<AWS::EC2::AvailabilityZone::Name>
    MinLength: 2
  NumberOfAZs:
    Description: Number of Availability Zones to use in the VPC. This must match your selections in the list of Availability Zones parameter.
    Type: Number
    Default: 2
    MinValue: 2
    MaxValue: 4
  VPCCIDR:
    Description: CIDR block for the VPC.
    Type: String
    Default: 10.0.0.0/16
    AllowedPattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$'
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28.
  PublicSubnet1CIDR:
    Description: CIDR block for public subnet 1 located in the 1st Availability Zone. If you choose to deploy a Security Management Server it will be deployed in this subnet.
    Type: String
    Default: 10.0.10.0/24
    AllowedPattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$'
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28.
  PublicSubnet2CIDR:
    Description: CIDR block for public subnet 2 located in the 2nd Availability Zone.
    Type: String
    Default: 10.0.20.0/24
    AllowedPattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$'
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28.
  PublicSubnet3CIDR:
    Description: CIDR block for public subnet 3 located in the 3rd Availability Zone.
    Type: String
    Default: 10.0.30.0/24
    AllowedPattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$'
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28.
  PublicSubnet4CIDR:
    Description: CIDR block for public subnet 4 located in the 4th Availability Zone.
    Type: String
    Default: 10.0.40.0/24
    AllowedPattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$'
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28.
  KeyName:
    Description: The EC2 Key Pair to allow SSH access to the instances created by this stack.
    Type: AWS::EC2::KeyPair::KeyName
    MinLength: 1
    ConstraintDescription: Must be the name of an existing EC2 KeyPair.
  EnableVolumeEncryption:
    Description: Encrypt Environment instances volume with default AWS KMS key.
    Type: String
    Default: true
    AllowedValues:
      - true
      - false
  VolumeSize:
    Type: Number
    MinValue: 100
    Default: 100
  VolumeType:
    Description: General Purpose SSD Volume Type
    Type: String
    Default: gp3
    AllowedValues:
      - gp3
      - gp2
  EnableInstanceConnect:
    Description: Enable SSH connection over AWS web console.
    Type: String
    Default: false
    AllowedValues:
      - true
      - false
  TerminationProtection:
    Description: Prevents an instance from accidental termination.
    Type: String
    Default: false
    AllowedValues:
      - true
      - false
  AllowUploadDownload:
    Description: Automatically download updates and share statistical data for product improvement purpose.
    Type: String
    Default: true
    AllowedValues:
      - true
      - false
  ManagementServer:
    Description: The name that represents the Security Management Server in the automatic provisioning configuration.
    Type: String
    Default: gwlb-management-server
    MinLength: 1
  ConfigurationTemplate:
    Description: A name of a gateway configuration template in the automatic provisioning configuration.
    Type: String
    Default: gwlb-ASG-configuration
    MinLength: 1
  AdminEmail:
    Description: Notifications about scaling events will be sent to this email address. (optional)
    Type: String
    Default: ''
    AllowedPattern: '^(([a-zA-Z0-9_\-\.]+)@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.)|(([a-zA-Z0-9\-]+\.)+))([a-zA-Z]{2,4}|[0-9]{1,3})(\]?))?$'
  Shell:
    Description: Change the admin shell to enable advanced command line configuration. Applies for Security Gateways and Security Management Server if deployed.
    Type: String
    Default: /etc/cli.sh
    AllowedValues:
      - /etc/cli.sh
      - /bin/bash
      - /bin/csh
      - /bin/tcsh
  GWLBName:
    Description: Gateway Load Balancer name. This name must be unique within your AWS account and can have a maximum of 32 alphanumeric characters and hyphens. A name cannot begin or end with a hyphen.
    Type: String
    AllowedPattern: '^([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])$'
    Default: gwlb1
    MaxLength: 32
    ConstraintDescription: Must be a valid GWLB Name.
  TargetGroupName:
    Description: Target Group Name. This name must be unique within your AWS account and can have a maximum of 32 alphanumeric characters and hyphens. A name cannot begin or end with a hyphen.
    Type: String
    AllowedPattern: '^([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])$'
    Default: tg1
    MaxLength: 32
    ConstraintDescription: Must be a valid target group name.
  AcceptConnectionRequired:
    Description: Indicate whether requests from service consumers to create an endpoint to your service must be accepted. Default is set to false(acceptance not required).
    Default: "false"
    AllowedValues: ["true", "false"]
    Type: String
    ConstraintDescription: Must be true or false.
  CrossZoneLoadBalancing:
    Description: Select 'true' to enable cross-az load balancing. NOTE! this may cause a spike in cross-az charges.
    Type: String
    Default: true
    AllowedValues:
      - true
      - false
  GatewayName:
    Description: The name tag of the Security Gateway instances. (optional)
    Type: String
    Default: Check-Point-Gateway
  GatewayInstanceType:
    Description: The EC2 instance type for the Security Gateways.
    Type: String
    Default: c5.xlarge
    AllowedValues:
      - c5.large
      - c5.xlarge
      - c5.2xlarge
      - c5.4xlarge
      - c5.9xlarge
      - c5.12xlarge
      - c5.18xlarge
      - c5.24xlarge
      - c5n.large
      - c5n.xlarge
      - c5n.2xlarge
      - c5n.4xlarge
      - c5n.9xlarge
      - c5n.18xlarge
      - m5.large
      - m5.xlarge
      - m5.2xlarge
      - m5.4xlarge
      - m5.8xlarge
      - m5.12xlarge
      - m5.16xlarge
      - m5.24xlarge
      - m6i.large
      - m6i.xlarge
      - m6i.2xlarge
      - m6i.4xlarge
      - m6i.8xlarge
      - m6i.12xlarge
      - m6i.16xlarge
      - m6i.24xlarge
      - m6i.32xlarge
      - c6i.large
      - c6i.xlarge
      - c6i.2xlarge
      - c6i.4xlarge
      - c6i.8xlarge
      - c6i.12xlarge
      - c6i.16xlarge
      - c6i.24xlarge
      - c6i.32xlarge
      - c6in.large
      - c6in.xlarge
      - c6in.2xlarge
      - c6in.4xlarge
      - c6in.8xlarge
      - c6in.12xlarge
      - c6in.16xlarge
      - c6in.24xlarge
      - c6in.32xlarge
      - r5.large
      - r5.xlarge
      - r5.2xlarge
      - r5.4xlarge
      - r5.8xlarge
      - r5.12xlarge
      - r5.16xlarge
      - r5.24xlarge
      - r5a.large
      - r5a.xlarge
      - r5a.2xlarge
      - r5a.4xlarge
      - r5a.8xlarge
      - r5a.12xlarge
      - r5a.16xlarge
      - r5a.24xlarge
      - r5b.large
      - r5b.xlarge
      - r5b.2xlarge
      - r5b.4xlarge
      - r5b.8xlarge
      - r5b.12xlarge
      - r5b.16xlarge
      - r5b.24xlarge
      - r5n.large
      - r5n.xlarge
      - r5n.2xlarge
      - r5n.4xlarge
      - r5n.8xlarge
      - r5n.12xlarge
      - r5n.16xlarge
      - r5n.24xlarge
      - r6i.large
      - r6i.xlarge
      - r6i.2xlarge
      - r6i.4xlarge
      - r6i.8xlarge
      - r6i.12xlarge
      - r6i.16xlarge
      - r6i.24xlarge
      - r6i.32xlarge
      - m6a.large
      - m6a.xlarge
      - m6a.2xlarge
      - m6a.4xlarge
      - m6a.8xlarge
      - m6a.12xlarge
      - m6a.16xlarge
      - m6a.24xlarge
      - m6a.32xlarge
      - m6a.48xlarge
    ConstraintDescription: Must be a valid EC2 instance type
  GatewaysMinSize:
    Description: The minimal number of Security Gateways.
    Type: Number
    Default: 2
    MinValue: 1
  GatewaysMaxSize:
    Description: The maximal number of Security Gateways.
    Type: Number
    Default: 10
    MinValue: 1
  GatewayVersion:
    Description: The version and license to install on the Security Gateways.
    Type: String
    Default: R81.20-BYOL
    AllowedValues:
      - R81.20-BYOL
      - R82-BYOL
  GatewayPasswordHash:
    Description: Admin user's password hash (use command "openssl passwd -6 PASSWORD" to get the PASSWORD's hash). (optional)
    Type: String
    Default: ''
    AllowedPattern: '^[\$\./a-zA-Z0-9]*$'
    NoEcho: true
  GatewaySICKey:
    Description: The Secure Internal Communication key creates trusted connections between Check Point components. Choose a random string consisting of at least 8 alphanumeric characters.
    Type: String
    AllowedPattern: '^[a-zA-Z0-9]{8,}$'
    ConstraintDescription: Secure Internal Communication activation key should contain only alpha numeric characters and be at least 8 characters long.
    NoEcho: true
  ControlGatewayOverPrivateOrPublicAddress:
    Description: Determines if the gateways are provisioned using their private or public address.
    Type: String
    Default: private
    AllowedValues:
      - private
      - public
  AllocatePublicAddress:
    Description: Allocate a Public IP for gateway members.
    Type: String
    Default: false
    AllowedValues:
      - true
      - false
  CloudWatch:
    Description: Report Check Point specific CloudWatch metrics.
    Type: String
    Default: false
    AllowedValues:
      - true
      - false
  ManagementDeploy:
    Description: Select 'false' to use an existing Security Management Server or to deploy one later and to ignore the other parameters of this section.
    Type: String
    Default: true
    AllowedValues:
      - true
      - false
  ManagementInstanceType:
    Description: The EC2 instance type of the Security Management Server.
    Type: String
    Default: m5.xlarge
    AllowedValues:
      - c5.large
      - c5.xlarge
      - c5.2xlarge
      - c5.4xlarge
      - c5.9xlarge
      - c5.12xlarge
      - c5.18xlarge
      - c5.24xlarge
      - c5n.large
      - c5n.xlarge
      - c5n.2xlarge
      - c5n.4xlarge
      - c5n.9xlarge
      - c5n.18xlarge
      - m5.large
      - m5.xlarge
      - m5.2xlarge
      - m5.4xlarge
      - m5.8xlarge
      - m5.12xlarge
      - m5.16xlarge
      - m5.24xlarge
      - m6i.large
      - m6i.xlarge
      - m6i.2xlarge
      - m6i.4xlarge
      - m6i.8xlarge
      - m6i.12xlarge
      - m6i.16xlarge
      - m6i.24xlarge
      - m6i.32xlarge
      - c6i.large
      - c6i.xlarge
      - c6i.2xlarge
      - c6i.4xlarge
      - c6i.8xlarge
      - c6i.12xlarge
      - c6i.16xlarge
      - c6i.24xlarge
      - c6i.32xlarge
      - c6in.large
      - c6in.xlarge
      - c6in.2xlarge
      - c6in.4xlarge
      - c6in.8xlarge
      - c6in.12xlarge
      - c6in.16xlarge
      - c6in.24xlarge
      - c6in.32xlarge
      - r5.large
      - r5.xlarge
      - r5.2xlarge
      - r5.4xlarge
      - r5.8xlarge
      - r5.12xlarge
      - r5.16xlarge
      - r5.24xlarge
      - r5a.large
      - r5a.xlarge
      - r5a.2xlarge
      - r5a.4xlarge
      - r5a.8xlarge
      - r5a.12xlarge
      - r5a.16xlarge
      - r5a.24xlarge
      - r5b.large
      - r5b.xlarge
      - r5b.2xlarge
      - r5b.4xlarge
      - r5b.8xlarge
      - r5b.12xlarge
      - r5b.16xlarge
      - r5b.24xlarge
      - r5n.large
      - r5n.xlarge
      - r5n.2xlarge
      - r5n.4xlarge
      - r5n.8xlarge
      - r5n.12xlarge
      - r5n.16xlarge
      - r5n.24xlarge
      - r6i.large
      - r6i.xlarge
      - r6i.2xlarge
      - r6i.4xlarge
      - r6i.8xlarge
      - r6i.12xlarge
      - r6i.16xlarge
      - r6i.24xlarge
      - r6i.32xlarge
      - m6a.large
      - m6a.xlarge
      - m6a.2xlarge
      - m6a.4xlarge
      - m6a.8xlarge
      - m6a.12xlarge
      - m6a.16xlarge
      - m6a.24xlarge
      - m6a.32xlarge
      - m6a.48xlarge
    ConstraintDescription: Must be a valid EC2 instance type
  ManagementVersion:
    Description: The license to install on the Security Management Server.
    Type: String
    Default: R81.20-BYOL
    AllowedValues:
      - R81.20-BYOL
      - R82-BYOL
  ManagementPasswordHash:
    Description: Admin user's password hash (use command "openssl passwd -6 PASSWORD" to get the PASSWORD's hash). (optional)
    Type: String
    Default: ''
    AllowedPattern: '^[\$\./a-zA-Z0-9]*$'
    NoEcho: true
  GatewaysPolicy:
    Description: The name of the Security Policy package to be installed on the gateways in the Security Gateways Auto Scaling group.
    Type: String
    Default: Standard
    MinLength: 1
  AdminCIDR:
    Description: Allow web, SSH, and graphical clients only from this network to communicate with the Security Management Server.
    Type: String
    AllowedPattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$'
  GatewayManagement:
    Description: Select 'Over the internet' if any of the gateways you wish to manage are not directly accessed via their private IP address.
    Type: String
    Default: Locally managed
    AllowedValues:
      - Locally managed
      - Over the internet
  GatewaysAddresses:
    Description: Allow gateways only from this network to communicate with the Security Management Server.
    Type: String
    AllowedPattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$'
Conditions:
  4AZs: !Equals [!Ref NumberOfAZs, 4]
  3AZs: !Or [!Equals [!Ref NumberOfAZs, 3], !Condition 4AZs]
  DeployManagement: !Equals [!Ref ManagementDeploy, true]
Resources:
  VPCStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://cgi-cfts.s3.cn-northwest-1.amazonaws.com.cn/utils/vpc.yaml
      Parameters:
        AvailabilityZones: !Join [',' , !Ref AvailabilityZones]
        NumberOfAZs: !Ref NumberOfAZs
        VPCCIDR: !Ref VPCCIDR
        PublicSubnet1CIDR: !Ref PublicSubnet1CIDR
        PublicSubnet2CIDR: !Ref PublicSubnet2CIDR
        PublicSubnet3CIDR: !Ref PublicSubnet3CIDR
        PublicSubnet4CIDR: !Ref PublicSubnet4CIDR
        CreatePrivateSubnets: false
  GWLBStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://cgi-cfts.s3.cn-northwest-1.amazonaws.com.cn/gwlb/gwlb.yaml
      Parameters:
        VPC: !GetAtt VPCStack.Outputs.VPCID
        GatewaysSubnets: !Join
          - ','
          - - !GetAtt VPCStack.Outputs.PublicSubnet1ID
            - !GetAtt VPCStack.Outputs.PublicSubnet2ID
            - !If [3AZs, !GetAtt VPCStack.Outputs.PublicSubnet3ID, !Ref 'AWS::NoValue']
            - !If [4AZs, !GetAtt VPCStack.Outputs.PublicSubnet4ID, !Ref 'AWS::NoValue']
        KeyName: !Ref KeyName
        EnableVolumeEncryption: !Ref EnableVolumeEncryption
        VolumeType: !Ref VolumeType
        VolumeSize: !Ref VolumeSize
        EnableInstanceConnect: !Ref EnableInstanceConnect
        TerminationProtection: !Ref TerminationProtection
        AllowUploadDownload: !Ref AllowUploadDownload
        ManagementServer: !Ref ManagementServer
        ConfigurationTemplate: !Ref ConfigurationTemplate
        AdminEmail: !Ref AdminEmail
        Shell: !Ref Shell
        GWLBName: !Ref GWLBName
        TargetGroupName: !Ref TargetGroupName
        AcceptConnectionRequired: !Ref AcceptConnectionRequired
        CrossZoneLoadBalancing: !Ref CrossZoneLoadBalancing
        GatewayName: !Ref GatewayName
        GatewayInstanceType: !Ref GatewayInstanceType
        GatewaysMinSize: !Ref GatewaysMinSize
        GatewaysMaxSize: !Ref GatewaysMaxSize
        GatewayVersion: !Ref GatewayVersion
        GatewayPasswordHash: !Ref GatewayPasswordHash
        GatewaySICKey: !Ref GatewaySICKey
        ControlGatewayOverPrivateOrPublicAddress: !Ref ControlGatewayOverPrivateOrPublicAddress
        AllocatePublicAddress: !Ref AllocatePublicAddress
        CloudWatch: !Ref CloudWatch
        ManagementDeploy: !Ref ManagementDeploy
        ManagementInstanceType: !Ref ManagementInstanceType
        ManagementVersion: !Ref ManagementVersion
        ManagementPasswordHash: !Ref ManagementPasswordHash
        GatewaysPolicy: !Ref GatewaysPolicy
        AdminCIDR: !Ref AdminCIDR
        GatewayManagement: !Ref GatewayManagement
        GatewaysAddresses: !Ref GatewaysAddresses
Outputs:
  VPCID:
    Description: VPC ID.
    Value: !GetAtt VPCStack.Outputs.VPCID
  ManagementPublicAddress:
    Description: The public address of the management server.
    Value: !GetAtt GWLBStack.Outputs.ManagementPublicAddress
    Condition: DeployManagement
  ConfigurationTemplateName:
    Description: The name that represents the configuration template. Configurations required to automatically provision the Gateways in the Auto Scaling Group, such as what Security Policy to install and which Blades to enable, will be placed under this template name.
    Value: !GetAtt GWLBStack.Outputs.ConfigurationTemplateName
  ControllerName:
    Description: The name that represents the controller. Configurations required to connect to your AWS environment, such as credentials and regions, will be placed under this controller name
    Value: !GetAtt GWLBStack.Outputs.ControllerName
  GWLBName:
    Description: Gateway Load Balancer Name.
    Value: !Ref GWLBName
  GWLBServiceName:
    Description: Gateway Load Balancer Service Name.
    Value: !GetAtt GWLBStack.Outputs.GWLBServiceName
Rules:
  GatewayAddressAllocationRule:
    RuleCondition: !Equals [!Ref ControlGatewayOverPrivateOrPublicAddress, 'public'] 
    Assertions:  
      - AssertDescription: "Gateway's selected to be provisioned by public IP, but ['AllocatePublicAddress'] parameter is false"
        Assert: !Equals [!Ref AllocatePublicAddress, 'true']
