dms-repl-stack.yml

AWSTemplateFormatVersion: '2010-09-09'
Description: CloudFormation template for VPC with public/private subnets and a
  DMS replication instance.

Resources:
  # VPC
  dmsVPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.11.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: stack
          Value: dms

  # Internet Gateway
  dmsIG:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: stack
          Value: dms

  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref dmsVPC
      InternetGatewayId: !Ref dmsIG

  # Public Subnet
  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref dmsVPC
      CidrBlock: 10.11.1.0/24
      AvailabilityZone: !Select
        - 0
        - !GetAZs ''
      Tags:
        - Key: stack
          Value: dms

  PublicSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref dmsVPC
      CidrBlock: 10.11.2.0/24
      AvailabilityZone: !Select
        - 1
        - !GetAZs ''
      Tags:
        - Key: stack
          Value: dms

  # Private Subnet
  PrivateSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref dmsVPC
      CidrBlock: 10.11.3.0/24
      AvailabilityZone: !Select
        - 0
        - !GetAZs ''
      Tags:
        - Key: stack
          Value: dms

  PrivateSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref dmsVPC
      CidrBlock: 10.11.4.0/24
      AvailabilityZone: !Select
        - 1
        - !GetAZs ''
      Tags:
        - Key: stack
          Value: dms

  # Route Table for Public Subnet with subnet associations
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref dmsVPC
      Tags:
        - Key: stack
          Value: dms

  PublicRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref dmsIG

  PublicSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet1
      RouteTableId: !Ref PublicRouteTable

  PublicSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties: 
      SubnetId: !Ref PublicSubnet2
      RouteTableId: !Ref PublicRouteTable

  # Elastic IP for NAT Gateway
  dmsElasticIP:
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc

  # NAT Gateway
  dmsNATGateway:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt dmsElasticIP.AllocationId
      SubnetId: !Ref PublicSubnet1
      Tags:
        - Key: stack
          Value: dms

  # Private Route Table and subnet associations
  PrivateRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref dmsVPC
      Tags:
        - Key: stack
          Value: dms

  PrivateRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref dmsNATGateway

  PrivateSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateSubnet1
      RouteTableId: !Ref PrivateRouteTable

  PrivateSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateSubnet2
      RouteTableId: !Ref PrivateRouteTable

  # DMS Subnet Group
  DMSSubnetGroup:
    Type: AWS::DMS::ReplicationSubnetGroup
    Properties:
      ReplicationSubnetGroupIdentifier: dms-subnet-group
      ReplicationSubnetGroupDescription: Subnet group for DMS replication instance
      SubnetIds:
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2

  # DMS Replication Instance
  DMSReplicationInstance:
    Type: AWS::DMS::ReplicationInstance
    DependsOn: DmsVpcRole
    Properties:
      ReplicationInstanceIdentifier: dms-replication-instance
      ReplicationInstanceClass: dms.t3.micro
      AllocatedStorage: 10
      AvailabilityZone: !Select
        - 0
        - !GetAZs ''
      ReplicationSubnetGroupIdentifier: !Ref DMSSubnetGroup
      PubliclyAccessible: false
      Tags:
        - Key: stack
          Value: dms
  
  # DMS role
  DmsVpcRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: dms-vpc-role
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: dms.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonDMSVPCManagementRole
        - arn:aws:iam::aws:policy/AmazonRDSFullAccess  # If migrating to/from RDS
      Tags:
        - Key: stack
          Value: dms

Outputs:
  VPCId:
    Description: The VPC ID
    Value: !Ref dmsVPC

  DMSInstanceId:
    Description: The DMS Replication Instance ID
    Value: !Ref DMSReplicationInstance