{
    "LaunchTemplate": {
        "Type": "AWS::EC2::LaunchTemplate",
        "Properties": {
            "LaunchTemplateData": {
                "BlockDeviceMappings": [
                    {
                        "DeviceName": "/dev/xvda",
                        "Ebs": {
                            "Iops": 3000,
                            "Throughput": 125,
                            "VolumeSize": 80,
                            "VolumeType": "gp3"
                        }
                    }
                ],
                "KeyName": "test-keypair",
                "MetadataOptions": {
                    "HttpPutResponseHopLimit": 2,
                    "HttpTokens": "required"
                },
                "SecurityGroupIds": [
                    {
                        "Fn::ImportValue": "eksctl-lt::ClusterSecurityGroupId"
                    },
                    {
                        "Ref": "SSH"
                    }
                ],
                "TagSpecifications": [
                    {
                        "ResourceType": "instance",
                        "Tags": [
                            {
                                "Key": "Name",
                                "Value": "lt-ssh-enabled-Node"
                            },
                            {
                                "Key": "alpha.eksctl.io/nodegroup-name",
                                "Value": "ssh-enabled"
                            },
                            {
                                "Key": "alpha.eksctl.io/nodegroup-type",
                                "Value": "managed"
                            }
                        ]
                    },
                    {
                        "ResourceType": "volume",
                        "Tags": [
                        {
                            "Key": "Name",
                            "Value": "lt-ssh-enabled-Node"
                        },
                        {
                            "Key": "alpha.eksctl.io/nodegroup-name",
                            "Value": "ssh-enabled"
                        },
                        {
                            "Key": "alpha.eksctl.io/nodegroup-type",
                            "Value": "managed"
                        }
                        ]
                    },
                    {
                        "ResourceType": "network-interface",
                        "Tags": [
                        {
                            "Key": "Name",
                            "Value": "lt-ssh-enabled-Node"
                        },
                        {
                            "Key": "alpha.eksctl.io/nodegroup-name",
                            "Value": "ssh-enabled"
                        },
                        {
                            "Key": "alpha.eksctl.io/nodegroup-type",
                            "Value": "managed"
                        }
                        ]
                    }
                ],
              "UserData": "L2V0Yy9la3MvYm9vdHN0cmFwLnNoIGx0"
            },
            "LaunchTemplateName": {
                "Fn::Sub": "${AWS::StackName}"
            }
        }
    },
    "ManagedNodeGroup": {
        "Type": "AWS::EKS::Nodegroup",
        "Properties": {
            "AmiType": "AL2_x86_64",
            "ClusterName": "lt",
            "Labels": {
                "alpha.eksctl.io/cluster-name": "lt",
                "alpha.eksctl.io/nodegroup-name": "ssh-enabled"
            },
            "InstanceTypes": ["m5.large"],
            "NodeRole": {
                "Fn::GetAtt": [
                    "NodeInstanceRole",
                    "Arn"
                ]
            },
            "NodegroupName": "ssh-enabled",
            "ScalingConfig": {
                "DesiredSize": 2,
                "MaxSize": 2,
                "MinSize": 2
            },
            "Subnets": [
                "subnet-public-us-west-2a"
            ],
            "Tags": {
                "alpha.eksctl.io/nodegroup-name": "ssh-enabled",
                "alpha.eksctl.io/nodegroup-type": "managed"
            },
            "LaunchTemplate": {
                "Id": {
                    "Ref": "LaunchTemplate"
                }
            }
        }
    },
    "NodeInstanceRole": {
        "Type": "AWS::IAM::Role",
        "Properties": {
            "AssumeRolePolicyDocument": {
                "Statement": [
                    {
                        "Action": [
                            "sts:AssumeRole"
                        ],
                        "Effect": "Allow",
                        "Principal": {
                            "Service": [
                                {
                                    "Fn::FindInMap": [
                                        "ServicePrincipalPartitionMap",
                                        {
                                            "Ref": "AWS::Partition"
                                        },
                                        "EC2"
                                    ]
                                }
                            ]
                        }
                    }
                ],
                "Version": "2012-10-17"
            },
            "ManagedPolicyArns": [
                {
                    "Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
                },
                {
                    "Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/AmazonEKSWorkerNodePolicy"
                },
                {
                    "Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/AmazonEKS_CNI_Policy"
                },
                {
                    "Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/AmazonSSMManagedInstanceCore"
                }
            ],
            "Path": "/",
            "Tags": [
                {
                    "Key": "Name",
                    "Value": {
                        "Fn::Sub": "${AWS::StackName}/NodeInstanceRole"
                    }
                }
            ]
        }
    },
    "SSH": {
        "Type": "AWS::EC2::SecurityGroup",
        "Properties": {
            "GroupDescription": "Allow SSH access",
            "GroupName": {
                "Fn::Sub": "${AWS::StackName}-remoteAccess"
            },
            "SecurityGroupIngress": [
                {
                    "CidrIp": "0.0.0.0/0",
                    "FromPort": 22,
                    "IpProtocol": "tcp",
                    "ToPort": 22,
                    "Description": "Allow SSH access to managed worker nodes in group ssh-enabled"
                },
                {
                    "CidrIpv6": "::/0",
                    "FromPort": 22,
                    "IpProtocol": "tcp",
                    "ToPort": 22,
                    "Description": "Allow SSH access to managed worker nodes in group ssh-enabled"
                }
            ],
            "Tags": [
                {
                    "Key": "Name",
                    "Value": {
                        "Fn::Sub": "${AWS::StackName}/SSH"
                    }
                }
            ],
            "VpcId": {
                "Fn::ImportValue": "eksctl-lt::VPC"
            }
        }
    }
}
