Skip to content

Commit 78c9c01

Browse files
cgns-gitlab-mirror-app[bot]chkp-avivmchkp-michaeltzchkp-liavbchkp-nimrodgab
authored
feat(VSECPC-12074): Added support for AWS Local Zones (#571)
Co-authored-by: Aviv Meydan <avivm@checkpoint.com> Co-authored-by: michaeltz <michaeltz@checkpoint.com> Co-authored-by: liavb <liavb@checkpoint.com> Co-authored-by: nimrodgab <nimrodgab@checkpoint.com>
1 parent a85b691 commit 78c9c01

4 files changed

Lines changed: 257 additions & 49 deletions

File tree

‎aws/templates/cluster/cluster-master.yaml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
AWSTemplateFormatVersion: 2010-09-09
33
Description: |
4-
Deploy a Check Point Cluster in a new VPC (20260302).
4+
Deploy a Check Point Cluster in a new VPC (20260407).
55
See CloudGuard Network for AWS Single Availability Zone Cluster Deployment guide for detailed deployment and configuration steps.
66
Metadata:
77
AWS::CloudFormation::Interface:
@@ -102,7 +102,7 @@ Metadata:
102102
default: Secondary NTP server
103103
Parameters:
104104
AvailabilityZone:
105-
Description: The availability zone in which to deploy the cluster.
105+
Description: The availability zone in which to deploy the cluster. Pick a regional AZ (e.g. ap-southeast-2a) or a Local Zone (e.g. ap-southeast-2-per-1a) .
106106
Type: AWS::EC2::AvailabilityZone::Name
107107
MinLength: 1
108108
VPCCIDR:
@@ -526,6 +526,7 @@ Resources:
526526
VPC: !GetAtt VPCStack.Outputs.VPCID
527527
PublicSubnet: !GetAtt VPCStack.Outputs.PublicSubnet1ID
528528
PrivateSubnet: !GetAtt VPCStack.Outputs.PrivateSubnet1ID
529+
LocalZoneAz: !Ref AvailabilityZone
529530
InternalRouteTable: !Ref InternalRouteTable
530531
GatewayName: !Ref GatewayName
531532
GatewayInstanceType: !Ref GatewayInstanceType

‎aws/templates/cluster/cluster.yaml‎

Lines changed: 147 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,68 @@
11
---
22
AWSTemplateFormatVersion: 2010-09-09
33
Description: |
4-
Deploys a Check Point Cluster into an existing VPC (20260302).
4+
Deploys a Check Point Cluster into an existing VPC (20260407).
55
See CloudGuard Network for AWS Single Availability Zone Cluster Deployment guide for detailed deployment and configuration steps.
6+
Mappings:
7+
# Maps Local Zone AZ names to their NetworkBorderGroup.
8+
# The NBG is the AZ name with the trailing AZ letter removed (e.g. ap-southeast-2-per-1a -> ap-southeast-2-per-1).
9+
# Add new Local Zone AZs here as needed.
10+
LocalZoneNetworkBorderGroups:
11+
# Australia
12+
ap-southeast-2-per-1a:
13+
NBG: ap-southeast-2-per-1
14+
# US East 1 Local Zones
15+
us-east-1-atl-1a:
16+
NBG: us-east-1-atl-1
17+
us-east-1-bos-1a:
18+
NBG: us-east-1-bos-1
19+
us-east-1-chi-1a:
20+
NBG: us-east-1-chi-1
21+
us-east-1-dfw-1a:
22+
NBG: us-east-1-dfw-1
23+
us-east-1-iah-1a:
24+
NBG: us-east-1-iah-1
25+
us-east-1-mci-1a:
26+
NBG: us-east-1-mci-1
27+
us-east-1-mia-1a:
28+
NBG: us-east-1-mia-1
29+
us-east-1-msp-1a:
30+
NBG: us-east-1-msp-1
31+
us-east-1-nyc-1a:
32+
NBG: us-east-1-nyc-1
33+
us-east-1-phl-1a:
34+
NBG: us-east-1-phl-1
35+
# US West 2 Local Zones
36+
us-west-2-den-1a:
37+
NBG: us-west-2-den-1
38+
us-west-2-las-1a:
39+
NBG: us-west-2-las-1
40+
us-west-2-lax-1a:
41+
NBG: us-west-2-lax-1
42+
us-west-2-lax-1b:
43+
NBG: us-west-2-lax-1
44+
us-west-2-phx-1a:
45+
NBG: us-west-2-phx-1
46+
us-west-2-sea-1a:
47+
NBG: us-west-2-sea-1
48+
# EU Local Zones
49+
eu-central-1-ham-1a:
50+
NBG: eu-central-1-ham-1
51+
eu-central-1-waw-1a:
52+
NBG: eu-central-1-waw-1
53+
eu-west-2-man-1a:
54+
NBG: eu-west-2-man-1
55+
# AP Local Zones
56+
ap-northeast-1-tpe-1a:
57+
NBG: ap-northeast-1-tpe-1
58+
ap-northeast-2-sel-1a:
59+
NBG: ap-northeast-2-sel-1
60+
ap-southeast-1-kul-1a:
61+
NBG: ap-southeast-1-kul-1
62+
ap-southeast-1-sin-1a:
63+
NBG: ap-southeast-1-sin-1
64+
ap-southeast-4-mel-1a:
65+
NBG: ap-southeast-4-mel-1
666
Metadata:
767
AWS::CloudFormation::Interface:
868
ParameterGroups:
@@ -19,6 +79,7 @@ Metadata:
1979
- VPC
2080
- PublicSubnet
2181
- PrivateSubnet
82+
- LocalZoneAz
2283
- Label:
2384
default: Advanced Settings
2485
Parameters:
@@ -51,6 +112,8 @@ Metadata:
51112
default: Public subnet
52113
PrivateSubnet:
53114
default: Private subnet
115+
LocalZoneAz:
116+
default: Local Zone availability zone
54117
InternalRouteTable:
55118
default: Internal route table
56119
GatewayName:
@@ -116,6 +179,10 @@ Parameters:
116179
Description: The private subnet of the cluster. The cluster's private IPs will be generated from this subnet.
117180
Type: AWS::EC2::Subnet::Id
118181
MinLength: 1
182+
LocalZoneAz:
183+
Description: Use only for Local Zone subnets. This value must match the Local Zone AZ of the selected subnets and is used only to derive the correct NetworkBorderGroup for EIP allocation. Leave empty for regional subnets. This parameter does not control resource placement.
184+
Type: String
185+
Default: ''
119186
InternalRouteTable:
120187
Description: The route table ID in which to set 0.0.0.0/0 route to the Active Cluster member instance in this route table (e.g. rtb-12a34567). Route table cannot have an existing 0.0.0.0/0 route. If empty - traffic will not be routed through the Security Cluster, this requires manual configuration in the route table. (optional)
121188
Type: String
@@ -355,7 +422,7 @@ Parameters:
355422
MinLength: 1
356423
ConstraintDescription: must be the name of an existing EC2 KeyPair.
357424
AllocatePublicAddress:
358-
Description: Allocate an Elastic IP for each cluster member, in addition to the shared cluster Elastic IP.
425+
Description: Allocate Elastic IPs for cluster members and the shared cluster IP. When false, no public IP addresses will be allocated.
359426
Type: String
360427
Default: true
361428
AllowedValues:
@@ -506,6 +573,12 @@ Conditions:
506573
EmptyHostName: !Equals [!Ref GatewayHostname, '']
507574
EnableCloudWatch: !Equals [!Ref CloudWatch, true]
508575
EnableMetaDataToken: !Equals [!Ref MetaDataToken, true]
576+
# Detect Local Zone by checking if AZ name has 4+ hyphens (e.g., us-east-1-bos-1a has 4 hyphens)
577+
# Regular AZs have 2-3 hyphens (e.g., us-east-1a has 2 hyphens). Empty string also resolves to false.
578+
IsLocalZone: !Not [!Equals [!Select [4, !Split ['-', !Join ['-', [!Ref LocalZoneAz, '----']]]], '']]
579+
IsRegionalZone: !Not [!Condition IsLocalZone]
580+
AllocateAddressLocalZone: !And [!Condition AllocateAddress, !Condition IsLocalZone]
581+
AllocateAddressRegional: !And [!Condition AllocateAddress, !Condition IsRegionalZone]
509582
Resources:
510583
ClusterRole:
511584
Condition: CreateRole
@@ -530,7 +603,7 @@ Resources:
530603
Properties:
531604
TemplateURL: https://cgi-cfts.s3.amazonaws.com/utils/amis.yaml
532605
Parameters:
533-
Version: !Join [-, [!Ref GatewayVersion, GW]]
606+
Version: !Join ["-", [!Ref GatewayVersion, GW]]
534607
PermissiveSecurityGroup:
535608
Type: AWS::EC2::SecurityGroup
536609
Properties:
@@ -630,15 +703,22 @@ Resources:
630703
- Key: x-chkp-member-ips
631704
Value: !Join
632705
- ':'
633-
- [!Join ['=', ['public-ip', !If [AllocateAddress, !Ref MemberAPublicAddress, '']]],
634-
!Join ['=', ['external-private-ip', !GetAtt MemberAExternalInterface.PrimaryPrivateIpAddress]],
635-
!Join ['=', ['internal-private-ip', !GetAtt MemberAInternalInterface.PrimaryPrivateIpAddress]]]
706+
- - !Join ['=', ['public-ip', !If [AllocateAddress, !If [IsLocalZone, !Ref MemberAPublicAddressLocalZone, !Ref MemberAPublicAddressRegional], '']]]
707+
- !Join ['=', ['external-private-ip', !GetAtt MemberAExternalInterface.PrimaryPrivateIpAddress]]
708+
- !Join ['=', ['internal-private-ip', !GetAtt MemberAInternalInterface.PrimaryPrivateIpAddress]]
636709
- Key: x-chkp-cluster-ips
637-
Value: !Join
638-
- ':'
639-
- [!Join ['=', ['cluster-ip', !Ref ClusterPublicAddress]],
640-
!Join ['=', ['cluster-eth0-private-ip', !Select [0, !GetAtt MemberAExternalInterface.SecondaryPrivateIpAddresses]]],
641-
!Join ['=', ['cluster-eth1-private-ip', !Select [0, !GetAtt MemberAInternalInterface.SecondaryPrivateIpAddresses]]]]
710+
Value: !If
711+
- AllocateAddress
712+
- !Join
713+
- ':'
714+
- - !Join ['=', ['cluster-ip', !If [IsLocalZone, !Ref ClusterPublicAddressLocalZone, !Ref ClusterPublicAddressRegional]]]
715+
- !Join ['=', ['cluster-eth0-private-ip', !Select [0, !GetAtt MemberAExternalInterface.SecondaryPrivateIpAddresses]]]
716+
- !Join ['=', ['cluster-eth1-private-ip', !Select [0, !GetAtt MemberAInternalInterface.SecondaryPrivateIpAddresses]]]
717+
- !Join
718+
- ':'
719+
- - !Join ['=', ['cluster-ip', '']]
720+
- !Join ['=', ['cluster-eth0-private-ip', !Select [0, !GetAtt MemberAExternalInterface.SecondaryPrivateIpAddresses]]]
721+
- !Join ['=', ['cluster-eth1-private-ip', !Select [0, !GetAtt MemberAInternalInterface.SecondaryPrivateIpAddresses]]]
642722
MemberBInstance:
643723
Type: AWS::EC2::Instance
644724
Properties:
@@ -652,15 +732,22 @@ Resources:
652732
- Key: x-chkp-member-ips
653733
Value: !Join
654734
- ':'
655-
- [!Join ['=', ['public-ip', !If [AllocateAddress, !Ref MemberBPublicAddress, '']]],
656-
!Join ['=', ['external-private-ip', !GetAtt MemberBExternalInterface.PrimaryPrivateIpAddress]],
657-
!Join ['=', ['internal-private-ip', !GetAtt MemberBInternalInterface.PrimaryPrivateIpAddress]]]
735+
- - !Join ['=', ['public-ip', !If [AllocateAddress, !If [IsLocalZone, !Ref MemberBPublicAddressLocalZone, !Ref MemberBPublicAddressRegional], '']]]
736+
- !Join ['=', ['external-private-ip', !GetAtt MemberBExternalInterface.PrimaryPrivateIpAddress]]
737+
- !Join ['=', ['internal-private-ip', !GetAtt MemberBInternalInterface.PrimaryPrivateIpAddress]]
658738
- Key: x-chkp-cluster-ips
659-
Value: !Join
660-
- ':'
661-
- [!Join ['=', ['cluster-ip', !Ref ClusterPublicAddress]],
662-
!Join ['=', ['cluster-eth0-private-ip', !Select [0, !GetAtt MemberAExternalInterface.SecondaryPrivateIpAddresses]]],
663-
!Join ['=', ['cluster-eth1-private-ip', !Select [0, !GetAtt MemberAInternalInterface.SecondaryPrivateIpAddresses]]]]
739+
Value: !If
740+
- AllocateAddress
741+
- !Join
742+
- ':'
743+
- - !Join ['=', ['cluster-ip', !If [IsLocalZone, !Ref ClusterPublicAddressLocalZone, !Ref ClusterPublicAddressRegional]]]
744+
- !Join ['=', ['cluster-eth0-private-ip', !Select [0, !GetAtt MemberAExternalInterface.SecondaryPrivateIpAddresses]]]
745+
- !Join ['=', ['cluster-eth1-private-ip', !Select [0, !GetAtt MemberAInternalInterface.SecondaryPrivateIpAddresses]]]
746+
- !Join
747+
- ':'
748+
- - !Join ['=', ['cluster-ip', '']]
749+
- !Join ['=', ['cluster-eth0-private-ip', !Select [0, !GetAtt MemberAExternalInterface.SecondaryPrivateIpAddresses]]]
750+
- !Join ['=', ['cluster-eth1-private-ip', !Select [0, !GetAtt MemberAInternalInterface.SecondaryPrivateIpAddresses]]]
664751
MemberAGatewayLaunchTemplate:
665752
Type: AWS::EC2::LaunchTemplate
666753
Properties:
@@ -694,14 +781,15 @@ Resources:
694781
- ' - |'
695782
- ' set -e'
696783
- !Sub ' admin_shell=${Shell} ; allow_info=${AllowUploadDownload} ; cw=${CloudWatch} ; eic=${EnableInstanceConnect} ; ntp1=${NTPPrimary} ; ntp2=${NTPSecondary} ; tokenA=''${MemberAToken}'''
784+
# Removed wait_handle reference as ClusterReadyHandle resource is no longer present
697785
- !If [EmptyHostName, ' hostname=""', !Sub ' hostname=${GatewayHostname}-member-a']
698-
- !Join ['', [' eip="', !If [AllocateAddress, !Ref MemberAPublicAddress, ''], '"']]
786+
- !Join ['', [' eip="', !If [AllocateAddress, !If [IsLocalZone, !Ref MemberAPublicAddressLocalZone, !Ref MemberAPublicAddressRegional], ''], '"']]
699787
- !Join ['', [' sic="$(echo ', 'Fn::Base64': !Ref GatewaySICKey, ')"']]
700788
- !Join ['', [' pwd_hash="$(echo ', 'Fn::Base64': !Ref GatewayPasswordHash, ')"']]
701789
- !Join ['', [' maintenance_pwd_hash="$(echo ', 'Fn::Base64': !Ref GatewayMaintenancePasswordHash, ')"']]
702790
- !Join ['', [' bootstrap="$(echo ', 'Fn::Base64': !Ref GatewayBootstrapScript, ')"']]
703791
- !Sub [' version=${Version}', {Version: !Select [0, !Split ['-', !Ref GatewayVersion]]}]
704-
- ' python3 /etc/cloud_config.py enableCloudWatch=\"${cw}\" sicKey=\"${sic}\" "smart1CloudToken=\"${tokenA}\"" installationType=\"cluster\" osVersion=\"${version}\" allowUploadDownload=\"${allow_info}\" templateVersion=\"20260302\" templateName=\"cluster\" shell=\"${admin_shell}\" enableInstanceConnect=\"${eic}\" hostName=\"${hostname}\" ntpPrimary=\"${ntp1}\" ntpSecondary=\"${ntp2}\" passwordHash=\"${pwd_hash}\" MaintenanceModePassword=\"${maintenance_pwd_hash}\" elasticIp=\"${eip}\" bootstrapScript64=\"${bootstrap}\"'
792+
- ' python3 /etc/cloud_config.py enableCloudWatch=\"${cw}\" sicKey=\"${sic}\" "smart1CloudToken=\"${tokenA}\"" installationType=\"cluster\" osVersion=\"${version}\" allowUploadDownload=\"${allow_info}\" templateVersion=\"20260407\" templateName=\"cluster\" shell=\"${admin_shell}\" enableInstanceConnect=\"${eic}\" hostName=\"${hostname}\" ntpPrimary=\"${ntp1}\" ntpSecondary=\"${ntp2}\" passwordHash=\"${pwd_hash}\" MaintenanceModePassword=\"${maintenance_pwd_hash}\" elasticIp=\"${eip}\" bootstrapScript64=\"${bootstrap}\"'
705793
VersionDescription: Initial template version
706794
MemberBGatewayLaunchTemplate:
707795
Type: AWS::EC2::LaunchTemplate
@@ -737,67 +825,88 @@ Resources:
737825
- ' set -e'
738826
- !Sub ' admin_shell=${Shell} ; allow_info=${AllowUploadDownload} ; cw=${CloudWatch} ; eic=${EnableInstanceConnect} ; ntp1=${NTPPrimary} ; ntp2=${NTPSecondary} ; tokenB=''${MemberBToken}'''
739827
- !If [EmptyHostName, ' hostname=""', !Sub ' hostname=${GatewayHostname}-member-b']
740-
- !Join ['', [' eip="', !If [AllocateAddress, !Ref MemberBPublicAddress, ''], '"']]
828+
- !Join ['', [' eip="', !If [AllocateAddress, !If [IsLocalZone, !Ref MemberBPublicAddressLocalZone, !Ref MemberBPublicAddressRegional], ''], '"']]
741829
- !Join ['', [' sic="$(echo ', 'Fn::Base64': !Ref GatewaySICKey, ')"']]
742830
- !Join ['', [' pwd_hash="$(echo ', 'Fn::Base64': !Ref GatewayPasswordHash, ')"']]
743831
- !Join ['', [' maintenance_pwd_hash="$(echo ', 'Fn::Base64': !Ref GatewayMaintenancePasswordHash, ')"']]
744832
- !Join ['', [' bootstrap="$(echo ', 'Fn::Base64': !Ref GatewayBootstrapScript, ')"']]
745833
- !Sub [' version=${Version}', {Version: !Select [0, !Split ['-', !Ref GatewayVersion]]}]
746-
- ' python3 /etc/cloud_config.py enableCloudWatch=\"${cw}\" sicKey=\"${sic}\" "smart1CloudToken=\"${tokenB}\"" installationType=\"cluster\" osVersion=\"${version}\" allowUploadDownload=\"${allow_info}\" templateVersion=\"20260302\" templateName=\"cluster\" shell=\"${admin_shell}\" enableInstanceConnect=\"${eic}\" hostName=\"${hostname}\" ntpPrimary=\"${ntp1}\" ntpSecondary=\"${ntp2}\" passwordHash=\"${pwd_hash}\" MaintenanceModePassword=\"${maintenance_pwd_hash}\" elasticIp=\"${eip}\" bootstrapScript64=\"${bootstrap}\"'
834+
- ' python3 /etc/cloud_config.py enableCloudWatch=\"${cw}\" sicKey=\"${sic}\" "smart1CloudToken=\"${tokenB}\"" installationType=\"cluster\" osVersion=\"${version}\" allowUploadDownload=\"${allow_info}\" templateVersion=\"20260407\" templateName=\"cluster\" shell=\"${admin_shell}\" enableInstanceConnect=\"${eic}\" hostName=\"${hostname}\" ntpPrimary=\"${ntp1}\" ntpSecondary=\"${ntp2}\" passwordHash=\"${pwd_hash}\" MaintenanceModePassword=\"${maintenance_pwd_hash}\" elasticIp=\"${eip}\" bootstrapScript64=\"${bootstrap}\"'
747835
VersionDescription: Initial template version
748-
ClusterPublicAddress:
836+
ClusterPublicAddressLocalZone:
749837
Type: AWS::EC2::EIP
838+
Condition: AllocateAddressLocalZone
750839
Properties:
751840
Domain: vpc
752-
MemberAPublicAddress:
841+
NetworkBorderGroup: !FindInMap [LocalZoneNetworkBorderGroups, !Ref LocalZoneAz, NBG]
842+
ClusterPublicAddressRegional:
753843
Type: AWS::EC2::EIP
754-
Condition: AllocateAddress
844+
Condition: AllocateAddressRegional
755845
Properties:
756846
Domain: vpc
757-
MemberBPublicAddress:
847+
MemberAPublicAddressLocalZone:
758848
Type: AWS::EC2::EIP
759-
Condition: AllocateAddress
849+
Condition: AllocateAddressLocalZone
850+
Properties:
851+
Domain: vpc
852+
NetworkBorderGroup: !FindInMap [LocalZoneNetworkBorderGroups, !Ref LocalZoneAz, NBG]
853+
MemberAPublicAddressRegional:
854+
Type: AWS::EC2::EIP
855+
Condition: AllocateAddressRegional
856+
Properties:
857+
Domain: vpc
858+
MemberBPublicAddressLocalZone:
859+
Type: AWS::EC2::EIP
860+
Condition: AllocateAddressLocalZone
861+
Properties:
862+
Domain: vpc
863+
NetworkBorderGroup: !FindInMap [LocalZoneNetworkBorderGroups, !Ref LocalZoneAz, NBG]
864+
MemberBPublicAddressRegional:
865+
Type: AWS::EC2::EIP
866+
Condition: AllocateAddressRegional
760867
Properties:
761868
Domain: vpc
762869
ClusterAddressAssoc:
763870
Type: AWS::EC2::EIPAssociation
871+
Condition: AllocateAddress
764872
DependsOn: MemberAInstance
765873
Properties:
766874
NetworkInterfaceId: !Ref MemberAExternalInterface
767-
AllocationId: !GetAtt ClusterPublicAddress.AllocationId
875+
AllocationId: !If [IsLocalZone, !GetAtt ClusterPublicAddressLocalZone.AllocationId, !GetAtt ClusterPublicAddressRegional.AllocationId]
768876
PrivateIpAddress: !Select [0, !GetAtt MemberAExternalInterface.SecondaryPrivateIpAddresses]
769877
MemberAAddressAssoc:
770878
Type: AWS::EC2::EIPAssociation
771879
Condition: AllocateAddress
772880
DependsOn: MemberAInstance
773881
Properties:
774882
NetworkInterfaceId: !Ref MemberAExternalInterface
775-
AllocationId: !GetAtt MemberAPublicAddress.AllocationId
883+
AllocationId: !If [IsLocalZone, !GetAtt MemberAPublicAddressLocalZone.AllocationId, !GetAtt MemberAPublicAddressRegional.AllocationId]
776884
PrivateIpAddress: !GetAtt MemberAExternalInterface.PrimaryPrivateIpAddress
777885
MemberBAddressAssoc:
778886
Type: AWS::EC2::EIPAssociation
779887
Condition: AllocateAddress
780888
DependsOn: MemberBInstance
781889
Properties:
782890
NetworkInterfaceId: !Ref MemberBExternalInterface
783-
AllocationId: !GetAtt MemberBPublicAddress.AllocationId
891+
AllocationId: !If [IsLocalZone, !GetAtt MemberBPublicAddressLocalZone.AllocationId, !GetAtt MemberBPublicAddressRegional.AllocationId]
784892
PrivateIpAddress: !GetAtt MemberBExternalInterface.PrimaryPrivateIpAddress
785893
Outputs:
786894
ClusterPublicAddress:
895+
Condition: AllocateAddress
787896
Description: The public address of the cluster.
788-
Value: !Ref ClusterPublicAddress
897+
Value: !If [IsLocalZone, !Ref ClusterPublicAddressLocalZone, !Ref ClusterPublicAddressRegional]
789898
MemberAPublicAddress:
790899
Condition: AllocateAddress
791900
Description: The public address of member A.
792-
Value: !Ref MemberAPublicAddress
901+
Value: !If [IsLocalZone, !Ref MemberAPublicAddressLocalZone, !Ref MemberAPublicAddressRegional]
793902
MemberASSH:
794903
Condition: AllocateAddress
795904
Description: SSH command to member A.
796-
Value: !Join ['', ['ssh -i ', !Ref KeyName, ' admin@', !Ref MemberAPublicAddress]]
905+
Value: !Join ['', ['ssh -i ', !Ref KeyName, ' admin@', !If [IsLocalZone, !Ref MemberAPublicAddressLocalZone, !Ref MemberAPublicAddressRegional]]]
797906
MemberAURL:
798907
Condition: AllocateAddress
799908
Description: URL to the member A portal.
800-
Value: !Join ['', ['https://', !Ref MemberAPublicAddress]]
909+
Value: !Join ['', ['https://', !If [IsLocalZone, !Ref MemberAPublicAddressLocalZone, !Ref MemberAPublicAddressRegional]]]
801910
MemberAExternalInterface:
802911
Description: The external interface of member A.
803912
Value: !Ref MemberAExternalInterface
@@ -810,15 +919,15 @@ Outputs:
810919
MemberBPublicAddress:
811920
Condition: AllocateAddress
812921
Description: The public address of member B.
813-
Value: !Ref MemberBPublicAddress
922+
Value: !If [IsLocalZone, !Ref MemberBPublicAddressLocalZone, !Ref MemberBPublicAddressRegional]
814923
MemberBSSH:
815924
Condition: AllocateAddress
816925
Description: SSH command to member B.
817-
Value: !Join ['', ['ssh -i ', !Ref KeyName, ' admin@', !Ref MemberBPublicAddress]]
926+
Value: !Join ['', ['ssh -i ', !Ref KeyName, ' admin@', !If [IsLocalZone, !Ref MemberBPublicAddressLocalZone, !Ref MemberBPublicAddressRegional]]]
818927
MemberBURL:
819928
Condition: AllocateAddress
820929
Description: URL to the member B portal.
821-
Value: !Join ['', ['https://', !Ref MemberBPublicAddress]]
930+
Value: !Join ['', ['https://', !If [IsLocalZone, !Ref MemberBPublicAddressLocalZone, !Ref MemberBPublicAddressRegional]]]
822931
MemberBPrivateExternalAddress:
823932
Description: The private external address of member B.
824933
Value: !GetAtt MemberBExternalInterface.PrimaryPrivateIpAddress

0 commit comments

Comments
 (0)