{
  "AWSTemplateFormatVersion" : "2010-09-09",

  "Description" : "This template enables roles and features of Windows Server. **WARNING** This template creates Amazon EC2 Windows instance and related resources. You will be billed for the AWS resources used if you create a stack from this template.",

  "Parameters" : {
    "KeyName" : {
      "Description" : "Name of an existing EC2 KeyPair",
      "Type" : "AWS::EC2::KeyPair::KeyName",
      "ConstraintDescription" : "must be the name of an existing EC2 KeyPair."
    },

    "InstanceType" : {
      "Description" : "Amazon EC2 instance type",
      "Type" : "String",
      "Default" : "m5.large",
      "AllowedValues" : [ "c5.18xlarge", "c5.2xlarge", "c5.4xlarge", "c5.9xlarge", "c5.large", "c5.xlarge", "d2.2xlarge", "d2.4xlarge", "d2.8xlarge", "d2.xlarge", "i3.16xlarge", "i3.2xlarge", "i3.4xlarge", "i3.8xlarge", "i3.large", "i3.xlarge", "m5.12xlarge", "m5.24xlarge", "m5.2xlarge", "m5.4xlarge", "m5.large", "m5.xlarge", "t3.2xlarge", "t3.large", "t3.medium", "t3.micro", "t3.nano", "t3.small", "t3.xlarge" ]
,
      "ConstraintDescription" : "must be a valid EC2 instance type."
    },
    "Roles" : {
      "Description" : "A SPACE seperated list of roles that you want to enable on this instance. Valid values are AD-Certificate, AD-Domain-Services, ADLDS, DHCP, DNS, Fax, File-Services, NPAS, Print-Services, Web-Server, and WDS.",
      "Type" : "String",
      "Default" : "None",
      "AllowedPattern" : "(((AD\\-Certificate)|(AD\\-Domain\\-Services)|(ADLDS)|(DHCP)|(DNS)|(Fax)|(File\\-Services)|(NPAS)|(Print\\-Services)|(Web\\-Server)|(WDS))( ((AD\\-Certificate)|(AD\\-Domain\\-Services)|(ADLDS)|(DHCP)|(DNS)|(Fax)|(File\\-Services)|(NPAS)|(Print\\-Services)|(Web\\-Server)|(WDS)))*)|(None)"
    },
    "Features" : {
      "Description" : "A SPACE seperated list of features that you want to enable on this instance. Valid values are NET-Framework, BITS, BitLocker, BranchCache, CMAK, Desktop-Experience, DAMC, Failover-Clustering, GPMC, Ink-Handwriting, Internet-Print-Client, ISNS, LPR-Port-Monitor, MSMQ, Multipath-IO, NLB, PNRP, qWave, Remote-Assistance, RDC, RPC-over-HTTP-Proxy, Simple-TCPIP, SMTP-Server, SNMP-Services, Storage-Mgr-SANS, Subsystem-UNIX-Apps, Telnet-Client, Telnet-Server, TFTP-Client, Biometric-Framework, Windows-Internal-DB, PowerShell-ISE, Backup-Features, Migration, WSRM, TIFF-IFilter, WinRM-IIS-Ext, WINS-Server, Wireless-Networking, and XPS-Viewer.",
      "Type" : "String",
      "Default" : "None",
      "AllowedPattern" : "(((NET\\-Framework)|(BITS)|(BitLocker)|(BranchCache)|(CMAK)|(Desktop\\-Experience)|(DAMC)|(Failover\\-Clustering)|(GPMC)|(Ink\\-Handwriting)|(Internet\\-Print\\-Client)|(ISNS)|(LPR\\-Port\\-Monitor)|(MSMQ)|(Multipath\\-IO)|(NLB)|(PNRP)|(qWave)|(Remote\\-Assistance)|(RDC)|(RPC\\-over\\-HTTP\\-Proxy)|(Simple\\-TCPIP)|(SMTP\\-Server)|(SNMP\\-Services)|(Storage\\-Mgr\\-SANS)|(Subsystem\\-UNIX\\-Apps)|(Telnet\\-Client)|(Telnet\\-Server)|(TFTP\\-Client)|(Biometric\\-Framework)|(Windows\\-Internal\\-DB)|(PowerShell\\-ISE)|(Backup\\-Features)|(Migration)|(WSRM)|(TIFF\\-IFilter)|(WinRM\\-IIS\\-Ext)|(WINS\\-Server)|(Wireless\\-Networking)|(XPS\\-Viewer))( ((NET\\-Framework)|(BITS)|(BitLocker)|(BranchCache)|(CMAK)|(Desktop\\-Experience)|(DAMC)|(Failover\\-Clustering)|(GPMC)|(Ink\\-Handwriting)|(Internet\\-Print\\-Client)|(ISNS)|(LPR\\-Port\\-Monitor)|(MSMQ)|(Multipath\\-IO)|(NLB)|(PNRP)|(qWave)|(Remote\\-Assistance)|(RDC)|(RPC\\-over\\-HTTP\\-Proxy)|(Simple\\-TCPIP)|(SMTP\\-Server)|(SNMP\\-Services)|(Storage\\-Mgr\\-SANS)|(Subsystem\\-UNIX\\-Apps)|(Telnet\\-Client)|(Telnet\\-Server)|(TFTP\\-Client)|(Biometric\\-Framework)|(Windows\\-Internal\\-DB)|(PowerShell\\-ISE)|(Backup\\-Features)|(Migration)|(WSRM)|(TIFF\\-IFilter)|(WinRM\\-IIS\\-Ext)|(WINS\\-Server)|(Wireless\\-Networking)|(XPS\\-Viewer)))*( )*)|(None)"
    },
    "SourceCidrForRDP" : {
      "Description" : "IP Cidr from which you are likely to RDP into the instances. You can add rules later by modifying the created security groups e.g. 54.32.98.160/32",
      "Type" : "String",
      "MinLength" : "9",
      "MaxLength" : "18",
      "AllowedPattern" : "^([0-9]+\\.){3}[0-9]+\\/[0-9]+$"
    }
  },

  "Mappings" : {
    "AWSRegion2AMI" : {
      "us-gov-west-1"    : {"Windows2008r2" : "NOT_SUPPORTED", "Windows2012r2" : "ami-01c697318f45c4623"},
      "us-gov-east-1"    : {"Windows2008r2" : "NOT_SUPPORTED", "Windows2012r2" : "ami-050db32c97155b31c"}
    }

  },

  "Resources" : {

    "InstanceSecurityGroup" : {
      "Type" : "AWS::EC2::SecurityGroup",
      "Properties" : {
        "GroupDescription" : "Enable RDP",
        "SecurityGroupIngress" : [
          {"IpProtocol" : "tcp", "FromPort" : "3389", "ToPort" : "3389", "CidrIp" : { "Ref" : "SourceCidrForRDP" }}
        ]
      }
    },

    "WindowsServer": {
      "Type" : "AWS::EC2::Instance",
      "Metadata" : {
        "AWS::CloudFormation::Init" : {
          "config" : {
            "files" : {
              "c:\\cfn\\cfn-hup.conf" : {
                "content" : { "Fn::Join" : ["", [
                  "[main]\n",
                  "stack=", { "Ref" : "AWS::StackId" }, "\n",
                  "region=", { "Ref" : "AWS::Region" }, "\n"
                  ]]}
              },
              "c:\\cfn\\hooks.d\\cfn-auto-reloader.conf" : {
                "content": { "Fn::Join" : ["", [
                  "[cfn-auto-reloader-hook]\n",
                  "triggers=post.update\n",
                  "path=Resources.WindowsServer.Metadata.AWS::CloudFormation::Init\n",
                  "action=cfn-init.exe -v -s ", { "Ref" : "AWS::StackId" },
                      " -r WindowsServer",
                      " --region ", { "Ref" : "AWS::Region" }, "\n"
                ]]}
              }
            },
            
            "commands" : {
              "1-install-roles" : {
                "command" : { "Fn::Join" : [ "", [
                  "if not \"None\" EQU \"",
                  { "Ref" : "Roles" },
                  "\" (servermanagercmd -install ",
                  { "Ref" : "Roles" },
                  " -restart)"]]
                }
              },
              "2-install-features" : {
                "command" : { "Fn::Join" : [ "", [
                  "if not \"None\" EQU \"",
                  { "Ref" : "Features" },
                  "\" (servermanagercmd -install ",
                  { "Ref" : "Features" },
                  " -restart)"]]
                }
              },
              "3-signal-success" : {
                "command" : { "Fn::Join" : [ "", [
                  "cfn-signal.exe -e %ERRORLEVEL% \"",
                  { "Fn::Base64" : { "Ref" : "WindowsServerWaitHandle" }},
                  "\""]]
                }
              }
            },
            
            "services" : {
              "windows" : {
                "cfn-hup" : {
                  "enabled" : "true",
                  "ensureRunning" : "true",
                  "files" : ["c:\\cfn\\cfn-hup.conf", "c:\\cfn\\hooks.d\\cfn-auto-reloader.conf"]
                }
              }
            }
          }
        }
      },
      
      "Properties": {
        "InstanceType" : { "Ref" : "InstanceType" },
        "ImageId" : { "Fn::FindInMap" : [ "AWSRegion2AMI", { "Ref" : "AWS::Region" }, "Windows2012r2" ]},
        "SecurityGroups" : [ {"Ref" : "InstanceSecurityGroup"} ],
        "KeyName" : { "Ref" : "KeyName" },
        "UserData" : { "Fn::Base64" : { "Fn::Join" : ["", [
            "<script>\n",

            "cfn-init.exe -v -s ", { "Ref" : "AWS::StackId" }, 
            " -r WindowsServer",
            " --region ", { "Ref" : "AWS::Region" }, "\n",
          
            "</script>"
        ]]}}
      }
    },

    "WindowsServerWaitHandle" : {
      "Type" : "AWS::CloudFormation::WaitConditionHandle"
    },

    "WindowsServerWaitCondition" : {
      "Type" : "AWS::CloudFormation::WaitCondition",
      "DependsOn" : "WindowsServer",
      "Properties" : {
        "Handle" : {"Ref" : "WindowsServerWaitHandle"},
        "Timeout" : "1800"
      }
    }
  },
  
  "Outputs" : {
    "RolesEnabled" : {
      "Value" : { "Ref" : "Roles" },
      "Description" : "Roles enabled on this instance."
    },
    "FeaturesEnabled" : {
      "Value" : { "Ref" : "Features" },
      "Description" : "Features enabled on this instance."
    }
  }  
}