protect-web-applications-with-WAF.yml

ROSTemplateFormatVersion: '2015-09-01'
Description:
  zh-cn: 创建WAF实例保护Web应用，配置ECS实例与LNMP一键安装，自定义网络环境与安全设置。
  en: Create a WAF instance to safeguard web applications, configure ECS instances
    with one-click LNMP installation, and customize network environments along with
    security settings.
Parameters:
  CommonName:
    Type: String
    Default: waf-solution
  VSwitchZoneId:
    Type: String
    Label:
      en: Availability zone
      zh-cn: 可用区
    Description:
      en: Available area id, <a href='https://help.aliyun.com/document_detail/123712.html'
        target='_blank'><b><font color='blue'>View region and zone info</font></b></a>.
      zh-cn: 可用区ID，</font><a href='https://help.aliyun.com/document_detail/123712.html'
        target='_blank'><b> 查看可用区信息</b><font color='blue'></a>。
    AssociationProperty: ALIYUN::ECS::Instance:ZoneId
  EcsInstanceType:
    Type: String
    Label:
      en: Instance type
      zh-cn: 实例规格
    AssociationProperty: ALIYUN::ECS::Instance::InstanceType
    AssociationPropertyMetadata:
      ZoneId: VSwitchZoneId
    Default: ecs.g6.large
  InstancePassword:
    Type: String
    Label:
      en: Instance Password
      zh-cn: 实例密码
    Description:
      en: >-
        Server login password, Length 8-30, must contain three(Capital letters,
        lowercase letters, numbers, ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/ Special
        symbol in)
      zh-cn: >-
        服务器登录密码，长度8-30，必须包含三项（大写字母、小写字母、数字、 ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/
        中的特殊符号），不能以特殊字符开头。
    ConstraintDescription:
      en: >-
        Length 8-30, must contain three(Capital letters, lowercase letters,
        numbers, ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/ Special symbol in)
      zh-cn: '长度8-30，必须包含三项（大写字母、小写字母、数字、 ()`~!@#$%^&*_-+=|{}[]:;''<>,.?/ 中的特殊符号），不能以特殊字符开头。'
    AssociationProperty: 'ALIYUN::ECS::Instance::Password'
    NoEcho: true
Resources:
  EcsVpc:
    Type: ALIYUN::ECS::VPC
    Properties:
      CidrBlock: 192.168.0.0/16
      VpcName:
        Fn::Sub: vpc_${CommonName}
  EcsVSwitch:
    Type: ALIYUN::ECS::VSwitch
    Properties:
      ZoneId:
        Ref: VSwitchZoneId
      VpcId:
        Ref: EcsVpc
      CidrBlock: 192.168.1.0/24
      VSwitchName:
        Fn::Sub: vsw_${CommonName}
  EcsSecurityGroup:
    Type: ALIYUN::ECS::SecurityGroup
    Properties:
      VpcId:
        Ref: EcsVpc
      SecurityGroupIngress:
        - PortRange: 80/80
          IpProtocol: tcp
          NicType: intranet
          SourceCidrIp: 0.0.0.0/0
        - PortRange: 3306/3306
          IpProtocol: tcp
          NicType: intranet
          SourceCidrIp: 0.0.0.0/0
      SecurityGroupName:
        Fn::Sub: sg_${CommonName}
      SecurityGroupType: normal
  EcsInstance:
    Type: ALIYUN::ECS::InstanceGroup
    Properties:
      InstanceName:
        Fn::Sub: ecs_${CommonName}
      InstanceChargeType: PostPaid
      InstanceType:
        Ref: EcsInstanceType
      ImageId: aliyun_3_9_x64_20G_alibase_
      SystemDiskCategory: cloud_essd
      SystemDiskSize: 40
      AllocatePublicIP: true
      InternetChargeType: PayByTraffic
      InternetMaxBandwidthOut: 10
      ZoneId:
        Ref: VSwitchZoneId
      SecurityGroupId:
        Ref: EcsSecurityGroup
      VpcId:
        Ref: EcsVpc
      VSwitchId:
        Ref: EcsVSwitch
      SpotStrategy: SpotAsPriceGo
      MaxAmount: 1
      Password:
        Ref: InstancePassword
  InstallWeb:
    Type: ALIYUN::OOS::Execution
    Properties:
      TemplateName: ACS-ECS-BulkyConfigureOOSPackageWithTemporaryURL
      SafetyCheck: Skip
      Parameters:
        regionId:
          Ref: ALIYUN::Region
        targets:
          ResourceIds:
            Fn::GetAtt:
              - EcsInstance
              - InstanceIds
          RegionId:
            Ref: ALIYUN::Region
          Type: ResourceIds
        action: install
        packageName: ACS-Extension-LNMP-One-Click-1853370294850618
  Waf3:
    Type: ALIYUN::WAF3::Instance
    Properties:
      PayType: PayAsYouGo
      Region: ChineseMainland
      TrafficBillingProtectionThreshold: 10000
      IgnoreExisting: true
Outputs:
  EipAddress:
    Description: Web Address.
    Value:
      Fn::Sub:
        - http://${IP}
        - IP:
            Fn::Select:
              - 0
              - Fn::GetAtt:
                - EcsInstance
                - PublicIps
Metadata:
  ALIYUN::ROS::Interface:
    ParameterGroups:
      - Parameters:
        - VSwitchZoneId
        - EcsInstanceType
        - InstancePassword
    Hidden:
      - CommonName
    TemplateTags:
      - acs:technical-solution:security-and-compliance:高效防护 Web 应用-tech_solu_106
  ALIYUN::ROS::Composer:
    '67932707':
      Res:
        - InstallWeb
      Parent: db5879ae
      Rect:
        - 40
        - 40
        - 385
        - 335
        - 3
        - 0
    d595809b:
      Rect:
        - 460
        - 439
        - 40
        - 100
        - 1
        - 0
      ResT: Composer::ROSParameter::AlibabaCloud
    db5879ae:
      Parent: d595809b
      Rect:
        - 413
        - 354
        - 63
        - 155
        - 2
        - 0
      ResT: Composer::ROSParameter::Region
    c7ff63a3:
      Res:
        - EcsVpc
      Parent: db5879ae
      Rect:
        - 252
        - 269
        - 83
        - 205
        - 3
        - 0
    efc3a3c2:
      Res:
        - Waf3
      Parent: db5879ae
      Rect:
        - 40
        - 40
        - 385
        - 255
        - 3
        - 0
    5201cefb:
      Res:
        - EcsVSwitch
      Parent: c7ff63a3
      Rect:
        - 193
        - 193
        - 103
        - 255
        - 4
        - 0
    59a41d78:
      Res:
        - EcsSecurityGroup
      Parent: c7ff63a3
      Rect:
        - 116
        - 126
        - 134
        - 305
        - 8
        - 0
    7155f1a5:
      Res:
        - EcsInstance
      Parent: 5201cefb
      Rect:
        - 40
        - 40
        - 180
        - 335
        - 9
        - 0
      Layer:
        - 59a41d78
    b710db02:
      Parent: db5879ae
      Edge:
        - '67932707'
        - 7155f1a5
      Line: 0:0:0:gray:0