main.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: AWS Native Chef Stack v5.1.1

Parameters:
  # Required Parameters
  AutomationBucket:
    Default: 'aws-native-chef-server'
    Type: String
    Description: AWS S3 bucket name that contains all of the cloudformation templates and scripts for this stack
  VPC:
    Description: Choose VPC to use
    Type: AWS::EC2::VPC::Id
  ServerSubnets:
    Description: Provide a list of Subnet IDs for the Chef Servers (must be within the specified VPC)
    Type: List<AWS::EC2::Subnet::Id>
  LoadBalancerSubnets:
    Description: Provide a comma separated list of Subnet IDs for the load balancers (Leave blank to use the ServerSubnets specified above)
    Type: CommaDelimitedList
    Default: ''
  DatabaseSubnets:
    Description: Provide a comma separated list of Subnet IDs for the Postgres database (Leave blank to use the ServerSubnets specified above)
    Type: CommaDelimitedList
    Default: ''
  ElasticSearchSubnets:
    Description: Provide a comma separated list of Subnet IDs for the ElasticSearch cluster (Leave blank to use the ServerSubnets specified above)
    Type: CommaDelimitedList
    Default: ''
  InboundAdminSecurityGroupId:
    Description: Select an existing Security Group in your VPC to define administrative ACLs (SSH, monitoring tools, etc) to the Chef servers
    Type: AWS::EC2::SecurityGroup::Id
  KeyName:
    Description: Name of an existing EC2 KeyPair to enable SSH access to the instance
    Type: AWS::EC2::KeyPair::KeyName
  ContactEmail:
    Description: Contact email for Cloudwatch notifications and instance tagging
    Type: String
  ContactDept:
    Description: Contact department for billing purposes
    Type: String
  ###############################################################################
  # Automate Stack Settings
  ChefAutomateAdminPassword:
    Description: Provide a password for the Chef Automate admin user
    NoEcho: true
    Type: String
    MinLength: 8
    MaxLength: 64
    ConstraintDescription: Must be at least 8 characters
  ChefAutomateToken:
    Description: The secret token used to communicate with the Chef Automate Server, for forwarding Visibility data.  Leave blank to disable.
    Type: String
    Default: 93a49a4f2482c64126f7b6015e6b0f30284287ee4054ff8807fb63d9cbd1c506
    AllowedPattern: ^[a-z0-9]*$
    MinLength: 64
    MaxLength: 64
    ConstraintDescription: Must be 64 alphanumeric characters
  AutomateSSLCertificateARN:
    Description: ARN for SSL Certficate, pre-create this in AWS Certificate Manager
    Type: String
    AllowedPattern: "arn:aws:acm:.*"
  AutomateDnsRecordName:
    Description: The DNS A-record name to automatically create in the Route53 zone (if enabled)
    Type: String
    Default: 'automate'
  AutomateInstanceType:
    Description: EC2 Instance type for Automate server (M5 class recommended)
    Default: m5.large
    Type: String
    AllowedValues: [t3.small, t3.medium, t3.large, t3.xlarge, t3.2xlarge,
      m5.large, m5.xlarge, m5.2xlarge, m5.4xlarge, m5.12xlarge, m5.24xlarge,
      c5.large, c5.xlarge, c5.2xlarge, c5.4xlarge, c5.9xlarge, c5.18xlarge]
  AutomateDataVolumeSize:
    Description: Amount of storage space to allocate on a dedicated data volume (must be between 500 and 16000)
    Type: Number
    Default: 1000
    MinValue: 500
    MaxValue: 16000
  ###############################################################################
  # Chef Server Stack Settings
  ChefSSLCertificateARN:
    Description: ARN for SSL Certficate, pre-create this in AWS Certificate Manager
    Type: String
    AllowedPattern: "arn:aws:acm:.*"
  ChefServerDnsRecordName:
    Description: The DNS A-record name to automatically create in the Route53 zone (if enabled)
    Type: String
    Default: 'chef'
  ChefInstanceType:
    Description: EC2 Instance type for Chef Server Frontends (C5 recommended for performance)
    Default: c5.large
    Type: String
    AllowedValues: [t3.small, t3.medium, t3.large, t3.xlarge, t3.2xlarge,
      m5.large, m5.xlarge, m5.2xlarge, m5.4xlarge, m5.12xlarge, m5.24xlarge,
      c5.large, c5.xlarge, c5.2xlarge, c5.4xlarge, c5.9xlarge, c5.18xlarge]
  ChefDBInstanceClass:
    Description: EC2 Instance type for RDS DBs (M5 class recommended for performance)
    Default: 'db.m5.large'
    Type: String
    AllowedValues: [db.t3.medium, db.t3.large, db.t3.xlarge, db.t3.2xlarge,
      db.m4.large, db.m4.xlarge, db.m4.2xlarge, db.m4.4xlarge, db.m4.10xlarge, db.m4.16xlarge,
      db.r4.large, db.r4.xlarge, db.r4.2xlarge, db.r4.4xlarge, db.r4.8xlarge, db.r4.16xlarge,
      db.m5.large, db.m5.xlarge, db.m5.2xlarge, db.m5.4xlarge, db.m5.12xlarge, db.m5.24xlarge]
  ChefDBStorageType:
    Description: Select gp2 or io1 DB storage. io1 is much higher performing, must select minimum 100GB storage and an IOPS value
    Default: 'io1'
    Type: String
    AllowedValues: [gp2, io1]
  ChefDBAllocatedStorage:
    Description: Storage size allocated for the database (gp2 minimum 20, maximum 16000) (io1 minimum 100, maximum 32768)
    Default: '100'
    Type: String
  ChefDBIops:
    Description: IOPS reserved for DB storage, only applicable if ChefDBStorageType is io1 (ChefDBAllocatedStorage * 10)
    Default: '1000'
    Type: String
  ChefDBBackupDaystoKeep:
    Description: Number of days of automatic backups to keep
    Default: 7
    Type: Number
    MinValue: 0
    MaxValue: 35
  ChefDBPassword:
    Description: Create a strong RDS admin password
    NoEcho: true
    Type: String
    MinLength: 8
    MaxLength: 64
  ChefElasticSearchInstanceType:
    Description: The Instance type to use for ElasticSearch instances (i3 recommended for performance)
    Type: String
    Default: 'i3.large.elasticsearch'
    AllowedValues: [
      'i3.large.elasticsearch', 'i3.xlarge.elasticsearch', 'i3.2xlarge.elasticsearch', 'i3.4xlarge.elasticsearch', 'i3.8xlarge.elasticsearch', 'i3.16xlarge.elasticsearch',
      'i2.xlarge.elasticsearch', 'i2.2xlarge.elasticsearch',
      'm3.medium.elasticsearch', 'm3.large.elasticsearch', 'm3.xlarge.elasticsearch', 'm3.medium.elasticsearch',
      'r3.large.elasticsearch', 'r3.xlarge.elasticsearch', 'r3.2xlarge.elasticsearch', 'r3.4xlarge.elasticsearch', 'r3.8xlarge.elasticsearch' ]
  ChefElasticSearchVersion:
    Description: Version of ElasticSearch to use. (5.6 recommended for new installs)
    Type: String
    Default: '5.6'
    AllowedValues:
    - '5.3'
    - '5.5'
    - '5.6'
  ChefElasticSearchShardCount:
    Description: Number of ElasticSearch hosts to provision at launch (3 recommended, 2 provides HA)
    Default: 3
    Type: Number
    MinValue: 2
    MaxValue: 3
  ChefServerCustomConfig:
    Default: ''
    Type: String
    Description: The S3 location of a custom chef-server configuration snippet that will be injected into the chef-server.rb (optional)
  ###############################################################################
  # Automate Stack Settings
  SupermarketSSLCertificateARN:
    Description: ARN for SSL Certficate, pre-create this in AWS Certificate Manager
    Type: String
    AllowedPattern: "arn:aws:acm:.*"
  SupermarketDnsRecordName:
    Description: The DNS A-record name to automatically create in the Route53 zone (if enabled)
    Type: String
    Default: 'supermarket'
  SupermarketInstanceType:
    Description: EC2 Instance type for Supermarket server (M5 class recommended)
    Default: m5.large
    Type: String
    AllowedValues: [t3.small, t3.medium, t3.large, t3.xlarge, t3.2xlarge,
      m5.large, m5.xlarge, m5.2xlarge, m5.4xlarge, m5.12xlarge, m5.24xlarge,
      c5.large, c5.xlarge, c5.2xlarge, c5.4xlarge, c5.9xlarge, c5.18xlarge]
  SupermarketDataVolumeSize:
    Description: Amount of storage space to allocate for the Supermarket single OS volume
    Type: Number
    Default: 20
###############################################################################
# Security Settings (these apply to all stacks)
  LoadBalancerScheme:
    Description: Network Scheme for the ELB
    Type: String
    Default: internet-facing
    AllowedValues:
    - 'internet-facing'
    - 'internal'
  LoadBalancerSecurityGroupId:
    Description: Supply a security group for your load balancer (leave blank to have it created for you). Using the default security group is recommended.
    Type: String
    Default: ''
  FrontendSecurityGroupId:
    Description: Supply a security group for your chef frontends (leave blank to have it created for you). Using the default security group is recommended.
    Type: String
    Default: ''
  AssociatePublicIpAddress:
    Description: Assign public IP addresses to the Chef Servers or not
    Type: String
    Default: true
    AllowedValues:
    - true
    - false
  ExistingIamRole:
    Description: Supply an IAM Role for the Chef Servers (leave blank to have it created for you). NOTE If you supply your own role, you must also provide an S3 Bucket which that role can access
    Type: String
    Default: ''
  ExistingSecretsBucket:
    Description: Supply an S3 Bucket name for the Chef Servers to read/write config files to (leave blank to have it created for you)
    Type: String
    Default: ''
  ###############################################################################
  # Other Settings
  TemplateVersion:
    Description: The version of this template to use (do not change this unless directed by support)
    Type: String
    Default: "5.1.1"
  Route53HostedZone:
    Type: String
    Default: ''
    Description: Supply a Route 53 Hosted Zone name (eg. mydomain.com) for auto-creating a DNS record. Do not append a dot at the end. (Leave blank to disable)
  LogsRetentionInDays:
    Description: Specifies the number of days you want to retain cloudwatch log events.
    Type: Number
    Default: 90
    AllowedValues: [1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 3653]

Metadata:
  cfn-lint:
    config:
      ignore_checks:
        - W2507
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "Required Parameters"
        Parameters:
          - VPC
          - ServerSubnets
          - LoadBalancerSubnets
          - DatabaseSubnets
          - ElasticSearchSubnets
          - KeyName
          - InboundAdminSecurityGroupId
          - ContactEmail
          - ContactDept
          - Route53HostedZone
          - ChefAutomateAdminPassword
          - AutomateSSLCertificateARN
          - ChefSSLCertificateARN
          - SupermarketSSLCertificateARN
          - ChefDBPassword
      - Label:
          default: "Chef Automate 2 Settings"
        Parameters:
          - ChefAutomateToken
          - AutomateDnsRecordName
          - AutomateInstanceType
          - AutomateDataVolumeSize
      - Label:
          default: "Chef Server Settings"
        Parameters:
          - ChefServerDnsRecordName
          - ChefInstanceType
          - ChefDBInstanceClass
          - ChefDBStorageType
          - ChefDBAllocatedStorage
          - ChefDBIops
          - ChefDBBackupDaystoKeep
          - ChefElasticSearchInstanceType
          - ChefElasticSearchVersion
          - ChefElasticSearchShardCount
          - ChefServerCustomConfig
      - Label:
          default: "Supermarket Settings"
        Parameters:
          - SupermarketDnsRecordName
          - SupermarketInstanceType
          - SupermarketDataVolumeSize
      - Label:
          default: "Security Settings"
        Parameters:
          - LoadBalancerScheme
          - AssociatePublicIpAddress

Conditions:
  CreateChefIamRole:
    !Equals [ !Ref ExistingIamRole, '' ]
  CreateChefSecretsBucket:
    !Equals [ !Ref ExistingSecretsBucket, '' ]
  CreateLoadBalancerSecurityGroup:
    !Equals [ !Ref LoadBalancerSecurityGroupId, '' ]
  CreateFrontendSecurityGroup:
    !Equals [ !Ref FrontendSecurityGroupId, '' ]
  UseServerSubnetsForLoadBalancers:
    !Equals [ !Select [ 0, !Ref LoadBalancerSubnets], '' ]
  UseServerSubnetsForDatabase:
    !Equals [ !Select [ 0, !Ref DatabaseSubnets], '' ]
  UseServerSubnetsForElasticSearch:
    !Equals [ !Select [ 0, !Ref ElasticSearchSubnets], '' ]

# STOP:  Do not replace the AMI list unless you 100% know what you're doing
#        and are fully prepared to lose all support. This template now depends
#        on AMIs that are pre-baked with all needed packages and scripts.
Mappings:
  AMI:
    eu-north-1:
      centos: ami-0b90a61689a1959d9
    ap-south-1:
      centos: ami-0030dea64c277379b
    eu-west-3:
      centos: ami-07e0048518fbff782
    eu-west-2:
      centos: ami-02b14e78bbcfed4c3
    eu-west-1:
      centos: ami-00cced3425b8e26c9
    ap-northeast-2:
      centos: ami-06e068bee310906fc
    ap-northeast-1:
      centos: ami-004f6c060d1c18426
    sa-east-1:
      centos: ami-03764a3ef231647f8
    ca-central-1:
      centos: ami-0ccf046a8117357e1
    ap-southeast-1:
      centos: ami-0115d2191f108af7c
    ap-southeast-2:
      centos: ami-00069b48e01775cb4
    eu-central-1:
      centos: ami-0fe8f1c26a7804f6b
    us-east-1:
      centos: ami-010b25d7343c5f95f
    us-east-2:
      centos: ami-090f430a3250bf016
    us-west-1:
      centos: ami-05b0f151b72ff950c
    us-west-2:
      centos: ami-072e83d774bfd95b6

Resources:
  ChefRole:
    Condition: CreateChefIamRole
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action:
          - sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - ec2.amazonaws.com
        Version: '2012-10-17'
      Path: /

  RolePolicies:
    Condition: CreateChefIamRole
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub ${AWS::StackName}-ChefStack-Policy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        # Allow all actions to one bucket (the supplied one, or the one you provided)
        - Action: s3:*
          Effect: Allow
          Resource:
            - !Join ['', [ 'arn:aws:s3:::', !If [CreateChefSecretsBucket, !Ref ChefBucket, !Ref ExistingSecretsBucket] ]]
            - !Join ['', [ 'arn:aws:s3:::', !If [CreateChefSecretsBucket, !Ref ChefBucket, !Ref ExistingSecretsBucket], '/*' ]]
        # Allow ability to list all buckets
        - Action: s3:List*
          Effect: Allow
          Resource: arn:aws:s3:::*
        # Allow instances to set themselves as unhealthy if one of the scripts fail
        - Action: autoscaling:*
          Effect: Allow
          Resource: "*"
        # Allow instance to create a nightly snapshot
        - Action: ["ec2:CreateSnapshot", "ec2:CreateTags", "ec2:DeleteSnapshot", "ec2:DescribeSnapshots", "ec2:DescribeVolumes"]
          Effect: Allow
          Resource: "*"
        # Allow instances to read their own tags (needed for setup script below)
        - Action: ec2:DescribeTags
          Effect: Allow
          Resource: "*"
        - Action: cloudwatch:PutMetricData
          Effect: Allow
          Resource: "*"
        - Action: cloudwatch:GetMetricStatistics
          Effect: Allow
          Resource: "*"
        - Action: cloudwatch:ListMetrics
          Effect: Allow
          Resource: "*"
        # Allow instances to write to cloudwatch logs
        - Action: ["logs:PutLogEvents", "logs:CreateLogStream", "logs:CreateLogGroup"]
          Effect: Allow
          Resource: !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:*
      Roles:
      - !Ref ChefRole

  ChefBucket:
    Condition: CreateChefSecretsBucket
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      AccessControl: Private
      VersioningConfiguration:
        Status: Enabled

  FrontendSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Condition: CreateFrontendSecurityGroup
    Properties:
      GroupDescription: Setup Ingress/Egress for Automate Server
      SecurityGroupEgress:
      - CidrIp: 0.0.0.0/0
        FromPort: 0
        IpProtocol: tcp
        ToPort: 65535
      SecurityGroupIngress:
      - FromPort: 80
        IpProtocol: tcp
        SourceSecurityGroupId: !If [CreateLoadBalancerSecurityGroup, !Ref LoadBalancerSecurityGroup, !Ref LoadBalancerSecurityGroupId]
        ToPort: 80
      - FromPort: 443
        IpProtocol: tcp
        SourceSecurityGroupId: !If [CreateLoadBalancerSecurityGroup, !Ref LoadBalancerSecurityGroup, !Ref LoadBalancerSecurityGroupId]
        ToPort: 443
      Tags:
      - Key: Name
        Value: !Sub ${AWS::StackName}-FE-SG
      VpcId: !Ref VPC

  LoadBalancerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Condition: CreateLoadBalancerSecurityGroup
    Properties:
      GroupDescription: Setup Ingress/Egress for Automate Load Balancer
      SecurityGroupEgress:
      - CidrIp: 0.0.0.0/0
        FromPort: 0
        IpProtocol: tcp
        ToPort: 65535
      SecurityGroupIngress:
      - CidrIp: 0.0.0.0/0
        FromPort: 80
        IpProtocol: tcp
        ToPort: 80
      - CidrIp: 0.0.0.0/0
        FromPort: 443
        IpProtocol: tcp
        ToPort: 443
      Tags:
      - Key: Name
        Value: !Sub ${AWS::StackName}-ELB-SG
      VpcId: !Ref VPC

  AlertNotificationTopic:
    Type: AWS::SNS::Topic
    Properties:
      Subscription:
        - Endpoint:
            !Ref ContactEmail
          Protocol: email

# Logging Groups (Cloudwatch Logs)
#########################################################################################
  SystemLogs:
    Type: AWS::Logs::LogGroup
    Properties:
      RetentionInDays: !Ref LogsRetentionInDays

  ChefAppLogs:
    Type: AWS::Logs::LogGroup
    Properties:
      RetentionInDays: !Ref LogsRetentionInDays

  SupermarketAppLogs:
    Type: AWS::Logs::LogGroup
    Properties:
      RetentionInDays: !Ref LogsRetentionInDays

  AutomateAppLogs:
    Type: AWS::Logs::LogGroup
    Properties:
      RetentionInDays: !Ref LogsRetentionInDays

# Automate Stack
#########################################################################################
  AutomateStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Sub https://${AutomationBucket}.s3.amazonaws.com/${TemplateVersion}/automate.yaml
      Parameters:
        VPC: !Ref VPC
        AutomateSubnet: !Select [ "0", !Ref ServerSubnets ]
        SSLCertificateARN: !Ref AutomateSSLCertificateARN
        AutomateAdminPassword: !Ref ChefAutomateAdminPassword
        InboundAdminSecurityGroupId: !Ref InboundAdminSecurityGroupId
        ImageId: !FindInMap [AMI, !Ref "AWS::Region", centos]
        KeyName: !Ref KeyName
        ContactEmail: !Ref ContactEmail
        ContactDept: !Ref ContactDept
        AlertNotificationTopic: !Ref AlertNotificationTopic
        InstanceType: !Ref AutomateInstanceType
        DataVolumeSize: !Ref AutomateDataVolumeSize
        AutomateDataCollectorToken: !Ref ChefAutomateToken
        LoadBalancerScheme: !Ref LoadBalancerScheme
        LoadBalancerSecurityGroupId: !If [CreateLoadBalancerSecurityGroup, !Ref LoadBalancerSecurityGroup, !Ref LoadBalancerSecurityGroupId]
        LoadBalancerSubnets: !If [UseServerSubnetsForLoadBalancers, !Join [ ",", !Ref ServerSubnets ], !Join [ ",", !Ref LoadBalancerSubnets ] ]
        FrontendSecurityGroupId: !If [CreateFrontendSecurityGroup, !Ref FrontendSecurityGroup, !Ref FrontendSecurityGroupId]
        AutomateIamRole: !If [CreateChefIamRole, !Ref ChefRole, !Ref ExistingIamRole]
        Route53HostedZone: !Ref Route53HostedZone
        Route53RecordName: !Ref AutomateDnsRecordName
        SystemLogsGroup: !Ref SystemLogs
        AppLogsGroup: !Ref AutomateAppLogs

# Chef Server Stack
#########################################################################################
  ChefServerStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Sub https://${AutomationBucket}.s3.amazonaws.com/${TemplateVersion}/chef_server_ha.yaml
      Parameters:
        AutomationBucket: !Ref AutomationBucket
        VPC: !Ref VPC
        ChefServerSubnets: !Join [ ",", !Ref ServerSubnets ]
        SSLCertificateARN: !Ref ChefSSLCertificateARN
        InboundAdminSecurityGroupId: !Ref InboundAdminSecurityGroupId
        ImageId: !FindInMap [AMI, !Ref "AWS::Region", centos]
        KeyName: !Ref KeyName
        DBPassword: !Ref ChefDBPassword
        ContactEmail: !Ref ContactEmail
        ContactDept: !Ref ContactDept
        AlertNotificationTopic: !Ref AlertNotificationTopic
        InstanceType: !Ref ChefInstanceType
        DBInstanceClass: !Ref ChefDBInstanceClass
        DBStorageType: !Ref ChefDBStorageType
        DBAllocatedStorage: !Ref ChefDBAllocatedStorage
        DBIops: !Ref ChefDBIops
        DBBackupDaystoKeep: !Ref ChefDBBackupDaystoKeep
        DatabaseSubnets: !If [UseServerSubnetsForDatabase, !Join [",", !Ref ServerSubnets], !Join [",", !Ref DatabaseSubnets]]
        ElasticSearchInstanceType: !Ref ChefElasticSearchInstanceType
        ElasticSearchVersion: !Ref ChefElasticSearchVersion
        ElasticSearchShardCount: !Ref ChefElasticSearchShardCount
        ElasticSearchSubnets: !If [UseServerSubnetsForElasticSearch, !Join [ ",", !Ref ServerSubnets ], !Join [ ",", !Ref ElasticSearchSubnets ] ]
        LoadBalancerScheme: !Ref LoadBalancerScheme
        LoadBalancerSecurityGroupId: !If [CreateLoadBalancerSecurityGroup, !Ref LoadBalancerSecurityGroup, !Ref LoadBalancerSecurityGroupId]
        LoadBalancerSubnets: !If [UseServerSubnetsForLoadBalancers, !Join [ ",", !Ref ServerSubnets ], !Join [ ",", !Ref LoadBalancerSubnets ] ]
        FrontendSecurityGroupId: !If [CreateFrontendSecurityGroup, !Ref FrontendSecurityGroup, !Ref FrontendSecurityGroupId]
        ChefServerAssociatePublicIpAddress: !Ref AssociatePublicIpAddress
        ChefServerIamRole: !If [CreateChefIamRole, !Ref ChefRole, !Ref ExistingIamRole]
        ChefServerCustomConfig: !Ref ChefServerCustomConfig
        ChefSecretsBucket: !If [CreateChefSecretsBucket, !Ref ChefBucket, !Ref ExistingSecretsBucket]
        ChefAutomateServerUrl: !Sub "https://${AutomateStack.Outputs.DNSName}"
        ChefAutomateToken: !Ref ChefAutomateToken
        SupermarketUrl: !Sub "https://${SupermarketDnsRecordName}.${Route53HostedZone}"
        Route53HostedZone: !Ref Route53HostedZone
        Route53RecordName: !Ref ChefServerDnsRecordName
        SystemLogsGroup: !Ref SystemLogs
        AppLogsGroup: !Ref ChefAppLogs
        TemplateVersion: !Ref TemplateVersion

# Supermarket Stack
#########################################################################################
  SupermarketStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Sub https://${AutomationBucket}.s3.amazonaws.com/${TemplateVersion}/supermarket.yaml
      Parameters:
        VPC: !Ref VPC
        SupermarketSubnet: !Select [ "0", !Ref ServerSubnets ]
        SSLCertificateARN: !Ref SupermarketSSLCertificateARN
        InboundAdminSecurityGroupId: !Ref InboundAdminSecurityGroupId
        ImageId: !FindInMap [AMI, !Ref "AWS::Region", centos]
        KeyName: !Ref KeyName
        ContactEmail: !Ref ContactEmail
        ContactDept: !Ref ContactDept
        AlertNotificationTopic: !Ref AlertNotificationTopic
        ChefUrl: !Sub "https://${ChefServerStack.Outputs.DNSName}"
        InstanceType: !Ref SupermarketInstanceType
        DataVolumeSize: !Ref SupermarketDataVolumeSize
        LoadBalancerScheme: !Ref LoadBalancerScheme
        LoadBalancerSecurityGroupId: !If [CreateLoadBalancerSecurityGroup, !Ref LoadBalancerSecurityGroup, !Ref LoadBalancerSecurityGroupId]
        LoadBalancerSubnets: !If [UseServerSubnetsForLoadBalancers, !Join [ ",", !Ref ServerSubnets ], !Join [ ",", !Ref LoadBalancerSubnets ] ]
        FrontendSecurityGroupId: !If [CreateFrontendSecurityGroup, !Ref FrontendSecurityGroup, !Ref FrontendSecurityGroupId]
        SupermarketIamRole: !If [CreateChefIamRole, !Ref ChefRole, !Ref ExistingIamRole]
        ChefSecretsBucket: !If [CreateChefSecretsBucket, !Ref ChefBucket, !Ref ExistingSecretsBucket]
        ChefStackName: !GetAtt ChefServerStack.Outputs.StackName
        Route53HostedZone: !Ref Route53HostedZone
        Route53RecordName: !Ref SupermarketDnsRecordName
        SystemLogsGroup: !Ref SystemLogs
        AppLogsGroup: !Ref SupermarketAppLogs

Outputs:
  AutomateUrl:
    Description: The URL of the Chef Automate Server
    Value: !Sub "https://${AutomateStack.Outputs.DNSName}"
    Export:
      Name: !Sub "${AWS::StackName}-AutomateURL"
  ChefServerUrl:
    Description: The URL of the Chef Automate Server
    Value: !Sub "https://${ChefServerStack.Outputs.DNSName}"
    Export:
      Name: !Sub "${AWS::StackName}-ChefServerURL"
  SupermarketUrl:
    Description: The URL of the Chef Automate Server
    Value: !Sub "https://${SupermarketStack.Outputs.DNSName}"
    Export:
      Name: !Sub "${AWS::StackName}-SupermarketURL"