{
    "AWSTemplateFormatVersion" : "2010-09-09",
    "Description" : "This template creates an Autoscaling Group and Launch Configuration that deploys Windows instances with Watchmaker, which applies the DISA STIG.",
    "Parameters" :
    {
        "AmiId" :
        {
            "Description" : "ID of the AMI to launch",
            "Type" : "String",
            "AllowedPattern" : "^ami-[0-9a-z]{8}$|^ami-[0-9a-z]{17}$"
        },
        "AppScriptParams" :
        {
            "Description" : "Parameter string to pass to the application script. Ignored if \"AppScriptUrl\" is blank",
            "Type" : "String"
        },
        "AppScriptShell" :
        {
            "Description" : "Shell with which to execute the application script. Ignored if \"AppScriptUrl\" is blank",
            "Type" : "String",
            "Default" : "powershell",
            "AllowedValues" :
            [
                "cmd",
                "powershell"
            ]
        },
        "AppScriptUrl" :
        {
            "Description" : "(Optional) URL to the application script. Leave blank to launch without an application script",
            "Type" : "String",
            "Default" : "",
            "AllowedPattern" : "^$|^http[s]?://.*$"
        },
        "AppVolumeDevice" :
        {
            "Description" : "(Optional) Device to mount an extra EBS volume. Leave blank to launch without an extra application volume",
            "Type" : "String",
            "Default" : "",
            "AllowedValues" :
            [
                "",
                "xvdf",
                "xvde",
                "xvdg",
                "xvdh",
                "xvdi"
            ]
        },
        "AppVolumeType" :
        {
            "Description" : "Type of EBS volume to create. Ignored if \"AppVolumeDevice\" is blank",
            "Type" : "String",
            "Default" : "gp2",
            "AllowedValues" :
            [
                "gp2",
                "io1",
                "sc1",
                "st1",
                "standard"
            ]
        },
        "AppVolumeSize" :
        {
            "Description" : "Size in GB of the EBS volume to create. Ignored if \"AppVolumeDevice\" is blank",
            "Type" : "Number",
            "Default" : "1",
            "MinValue": "1",
            "MaxValue": "16384",
            "ConstraintDescription" : "Must be between 1GB and 16384GB."
        },
        "KeyPairName" :
        {
            "Description" : "Public/private key pairs allow you to securely connect to your instance after it launches",
            "Type" : "AWS::EC2::KeyPair::KeyName"
        },
        "InstanceType" :
        {
            "Description" : "Amazon EC2 instance type",
            "Type" : "String",
            "Default" : "t2.micro",
            "AllowedValues" :
            [
                "t2.micro",
                "t2.small",
                "t2.medium",
                "t2.large",
                "c4.large",
                "c4.xlarge",
                "m4.large",
                "m4.xlarge"
            ]
        },
        "InstanceRole" :
        {
            "Description" : "(Optional) IAM instance role to apply to the instance(s)",
            "Type" : "String",
            "Default" : ""
        },
        "MinCapacity" :
        {
            "Description" : "Minimum number of instances in the Autoscaling Group",
            "Type" : "Number",
            "Default" : "1"
        },
        "MaxCapacity" :
        {
            "Description" : "Maximum number of instances in the Autoscaling Group",
            "Type" : "Number",
            "Default" : "2"
        },
        "DesiredCapacity" :
        {
            "Description" : "Desired number of instances in the Autoscaling Group",
            "Type" : "Number",
            "Default" : "1"
        },
        "NoPublicIp" :
        {
            "Description" : "Controls whether to assign the instance a public IP. Recommended to leave at \"true\" _unless_ launching in a public subnet",
            "Type" : "String",
            "Default" : "true",
            "AllowedValues" :
            [
                "false",
                "true"
            ]
        },
        "NoReboot" :
        {
            "Description" : "Controls whether to reboot the instance as the last step of cfn-init execution",
            "Type" : "String",
            "Default" : "false",
            "AllowedValues" :
            [
                "false",
                "true"
            ]
        },
        "SecurityGroupIds" :
        {
            "Description" : "List of security groups to apply to the instance",
            "Type" : "List<AWS::EC2::SecurityGroup::Id>"
        },
        "SubnetIds" :
        {
            "Type" : "List<AWS::EC2::Subnet::Id>",
            "Description" : "List of subnets to associate to the Autoscaling Group"
        },
        "PypiIndexUrl" :
        {
            "Description" : "URL to the PyPi Index",
            "Type" : "String",
            "Default" : "https://pypi.org/simple",
            "AllowedPattern" : "^http[s]?://.*$"
        },
        "PythonInstaller" :
        {
            "Description" : "URL to the Python Installer Executable",
            "Type" : "String",
            "Default" : "https://www.python.org/ftp/python/3.6.0/python-3.6.0-amd64.exe",
            "AllowedPattern" : "^http[s]?://.*\\.exe$"
        },
        "WatchmakerBootstrapper" :
        {
            "Description" : "URL to the Watchmaker PowerShell bootstrapper for Windows",
            "Type" : "String",
            "Default" : "https://raw.githubusercontent.com/plus3it/watchmaker/master/docs/files/bootstrap/watchmaker-bootstrap.ps1",
            "AllowedPattern" : "^$|^http[s]?://.*\\.ps1$"
        },
        "WatchmakerConfig" :
        {
            "Description" : "(Optional) URL to a Watchmaker config file",
            "Type" : "String",
            "Default" : "",
            "AllowedPattern" : "^$|^http[s]?://.*$"
        },
        "WatchmakerEnvironment" :
        {
            "Description" : "Environment in which the instance is being deployed",
            "Type" : "String",
            "Default" : "",
            "AllowedValues" :
            [
                "",
                "dev",
                "test",
                "prod"
            ]
        },
        "WatchmakerOuPath" :
        {
            "Description" : "(Optional) DN of the OU to place the instance when joining a domain. If blank and \"WatchmakerEnvironment\" enforces a domain join, the instance will be placed in a default container. Leave blank if not joining a domain, or if \"WatchmakerEnvironment\" is \"$false\"",
            "Type" : "String",
            "Default" : "",
            "AllowedPattern" : "^$|^(OU=.+,)+(DC=.+)+$"
        },
        "WatchmakerAdminGroups" :
        {
            "Description" : "(Optional) Colon-separated list of domain groups that should have admin permissions on the EC2 instance",
            "Type" : "String",
            "Default" : ""
        },
        "CfnEndpointUrl" :
        {
            "Description" : "(Optional) URL to the CloudFormation Endpoint. e.g. https://cloudformation.us-east-1.amazonaws.com",
            "Type" : "String",
            "Default" : "https://cloudformation.us-east-1.amazonaws.com",
            "AllowedPattern" : "^$|^http[s]?://.*$"
        },
        "ToggleCfnInitUpdate" :
        {
            "Description" : "A/B toggle that forces a change to instance metadata, triggering the cfn-init update sequence",
            "Type" : "String",
            "Default" : "A",
            "AllowedValues" :
            [
                "A",
                "B"
            ]
        },
        "ToggleNewInstances" :
        {
            "Description" : "A/B toggle that forces a change to instance userdata, triggering new instances via the Autoscale update policy",
            "Type" : "String",
            "Default" : "A",
            "AllowedValues" :
            [
                "A",
                "B"
            ]
        }
    },
    "Conditions" :
    {
        "ExecuteAppScript" :
        {
            "Fn::Not" : [ { "Fn::Equals" : [ { "Ref" : "AppScriptUrl" }, "" ] } ]
        },
        "CreateAppVolume" :
        {
            "Fn::Not" : [ { "Fn::Equals" : [ { "Ref" : "AppVolumeDevice" }, "" ] } ]
        },
        "UseWamConfig" :
        {
            "Fn::Not" : [ { "Fn::Equals" : [ { "Ref" : "WatchmakerConfig" }, "" ] } ]
        },
        "UseOuPath" :
        {
            "Fn::Not" : [ { "Fn::Equals" : [ { "Ref" : "WatchmakerOuPath" }, "" ] } ]
        },
        "UseAdminGroups" :
        {
            "Fn::Not" : [ { "Fn::Equals" : [ { "Ref" : "WatchmakerAdminGroups" }, "" ] } ]
        },
        "UseEnvironment" :
        {
            "Fn::Not" : [ { "Fn::Equals" : [ { "Ref" : "WatchmakerEnvironment" }, "" ] } ]
        },
        "UseCfnUrl" :
        {
            "Fn::Not" : [ { "Fn::Equals" : [ { "Ref" : "CfnEndpointUrl" }, "" ] } ]
        },
        "Reboot" :
        {
            "Fn::Not" : [ { "Fn::Equals" : [ { "Ref" : "NoReboot" }, "true" ] } ]
        },
        "AssignInstanceRole" :
        {
            "Fn::Not" : [ { "Fn::Equals" : [ { "Ref" : "InstanceRole" }, "" ] } ]
        },
        "AssignPublicIp" :
        {
            "Fn::Not" : [ { "Fn::Equals" : [ { "Ref" : "NoPublicIp" }, "true" ] } ]
        }
    },
    "Mappings" :
    {
        "ShellCommandMap" :
        {
            "powershell" :
            {
                "command" : "powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass"
            },
            "cmd" :
            {
                "command" : "cmd.exe"
            }
        }
    },
    "Metadata" :
    {
        "AWS::CloudFormation::Interface" :
        {
            "ParameterGroups" :
            [
                {
                    "Label" :
                    {
                      "default" : "EC2 Instance Configuration"
                    },
                    "Parameters" :
                    [
                        "AmiId",
                        "InstanceType",
                        "InstanceRole",
                        "KeyPairName",
                        "NoPublicIp",
                        "NoReboot",
                        "NoUpdates",
                        "SecurityGroupIds"
                    ]
                },
                {
                    "Label" :
                    {
                      "default" : "EC2 Watchmaker Configuration"
                    },
                    "Parameters" :
                    [
                        "PythonInstaller",
                        "PypiIndexUrl",
                        "WatchmakerBootstrapper",
                        "WatchmakerConfig",
                        "WatchmakerEnvironment",
                        "WatchmakerOuPath",
                        "WatchmakerAdminGroups"
                    ]
                },
                {
                    "Label" :
                    {
                        "default" : "EC2 Application Configuration"
                    },
                    "Parameters" :
                    [
                        "AppScriptUrl",
                        "AppScriptParams",
                        "AppScriptShell"
                    ]
                },
                {
                    "Label" :
                    {
                        "default" : "EC2 Application EBS Volume"
                    },
                    "Parameters" :
                    [
                        "AppVolumeDevice",
                        "AppVolumeSize",
                        "AppVolumeType"
                    ]
                },
                {
                    "Label" :
                    {
                        "default" : "AutoScale Configuration"
                    },
                    "Parameters" :
                    [
                        "DesiredCapacity",
                        "MinCapacity",
                        "MaxCapacity"
                    ]
                },
                {
                    "Label" :
                    {
                        "default" : "Network Configuration"
                    },
                    "Parameters" :
                    [
                        "SubnetIds"
                    ]
                },
                {
                    "Label" :
                    {
                        "default" : "CloudFormation Configuration"
                    },
                    "Parameters" :
                    [
                        "CfnEndpointUrl",
                        "ToggleCfnInitUpdate",
                        "ToggleNewInstances"
                    ]
                }
            ],
            "ParameterLabels" :
            {
                "ToggleCfnInitUpdate" :
                {
                    "default" : "Force Cfn Init Update"
                },
                "ToggleNewInstances" :
                {
                    "default" : "Force New Instances"
                }
            }
        }
    },
    "Resources" :
    {
        "WatchmakerAutoScalingGroup" :
        {
            "Type" : "AWS::AutoScaling::AutoScalingGroup",
            "UpdatePolicy" : {
                "AutoScalingRollingUpdate" : {
                    "MinInstancesInService" : "1",
                    "MaxBatchSize" : "2",
                    "WaitOnResourceSignals" : "true",
                    "PauseTime" : "PT60M"
                }
            },
            "CreationPolicy" :
            {
                "ResourceSignal" :
                {
                    "Count" : { "Ref" : "DesiredCapacity" },
                    "Timeout" : "PT60M"
                }
            },
            "Properties" :
            {
                "VPCZoneIdentifier" : { "Ref" : "SubnetIds" },
                "LaunchConfigurationName" : { "Ref" : "WatchmakerLaunchConfig" },
                "MinSize" : { "Ref" : "MinCapacity" },
                "MaxSize" : { "Ref" : "MaxCapacity" },
                "DesiredCapacity" : { "Ref" : "DesiredCapacity" },
                "Tags" :
                [
                    {
                        "Key" : "Name",
                        "Value" :
                        { "Fn::Join" : [ "", [
                            { "Ref" : "AWS::StackName" }
                        ] ] },
                        "PropagateAtLaunch" : "true"
                    }
                ]
            }
        },
        "WatchmakerLaunchConfig" :
        {
            "Type" : "AWS::AutoScaling::LaunchConfiguration",
            "Metadata" : {
                "ToggleCfnInitUpdate" : { "Ref" : "ToggleCfnInitUpdate" },
                "AWS::CloudFormation::Init" :
                {
                    "configSets" :
                    {
                        "launch" :
                        [
                            "setup",
                            "watchmaker-launch",
                            {
                                "Fn::If" :
                                [
                                    "ExecuteAppScript",
                                    "make-app",
                                    { "Ref" : "AWS::NoValue" }
                                ]
                            },
                            {
                                "Fn::If" :
                                [
                                    "Reboot",
                                    "reboot",
                                    { "Ref" : "AWS::NoValue" }
                                ]
                            },
                            "finalize"
                        ],
                        "update" :
                        [
                            "setup",
                            "watchmaker-update",
                            {
                                "Fn::If" :
                                [
                                    "ExecuteAppScript",
                                    "make-app",
                                    { "Ref" : "AWS::NoValue" }
                                ]
                            },
                            {
                                "Fn::If" :
                                [
                                    "Reboot",
                                    "reboot",
                                    { "Ref" : "AWS::NoValue" }
                                ]
                            },
                            "finalize"
                        ]
                    },
                    "setup" :
                    {
                        "files" :
                        {
                            "c:\\cfn\\cfn-hup.conf" :
                            {
                                "content" :
                                { "Fn::Join" : ["", [
                                    "[main]\n",
                                    "stack=", { "Ref" : "AWS::StackId" }, "\n",
                                    "region=", { "Ref" : "AWS::Region" }, "\n",
                                    {
                                        "Fn::If" :
                                        [
                                            "AssignInstanceRole",
                                            { "Fn::Join" : [ "", [
                                                "role=",
                                                { "Ref" : "InstanceRole" },
                                                "\n"
                                            ] ] },
                                            ""
                                        ]
                                    },
                                    {
                                        "Fn::If" :
                                        [
                                            "UseCfnUrl",
                                            { "Fn::Join" : [ "", [
                                                "url=",
                                                { "Ref" : "CfnEndpointUrl" },
                                                "\n"
                                            ] ] },
                                            ""
                                        ]
                                    },
                                    "interval=1", "\n",
                                    "verbose=true", "\n"
                                ]]}
                            },
                            "c:\\cfn\\hooks.d\\cfn-auto-reloader.conf" :
                            {
                                "content" :
                                { "Fn::Join" : ["", [
                                    "[cfn-auto-reloader-hook]\n",
                                    "triggers=post.update\n",
                                    "path=Resources.WatchmakerLaunchConfig.Metadata\n",
                                    "action=cfn-init.exe -v -c update",
                                    " --stack ", { "Ref" : "AWS::StackName" },
                                    " --resource WatchmakerLaunchConfig",
                                    {
                                        "Fn::If" :
                                        [
                                            "AssignInstanceRole",
                                            { "Fn::Join" : [ "", [
                                                " --role ",
                                                { "Ref" : "InstanceRole" }
                                            ] ] },
                                            ""
                                        ]
                                    },
                                    {
                                        "Fn::If" :
                                        [
                                            "UseCfnUrl",
                                            { "Fn::Join" : [ "", [
                                                " --url ",
                                                { "Ref" : "CfnEndpointUrl" }
                                            ] ] },
                                            ""
                                        ]
                                    },
                                    " --region ", { "Ref" : "AWS::Region" }, "\n"
                                ]]}
                            },
                            "c:\\cfn\\scripts\\watchmaker-install.ps1" :
                            {
                                "content" :
                                { "Fn::Join" : ["", [
                                    "$BootstrapUrl = \"", { "Ref" : "WatchmakerBootstrapper" }, "\"\n",
                                    "$PythonUrl = \"", { "Ref" : "PythonInstaller" }, "\"\n",
                                    "$PypiUrl = \"", { "Ref" : "PypiIndexUrl" }, "\"\n\n",

                                    "# Get the host\n",
                                    "$PypiHost=\"$(([System.Uri]$PypiUrl).Host)\"\n\n",

                                    "# Download bootstrap file\n",
                                    "$BootstrapFile = \"${Env:Temp}\\$(${BootstrapUrl}.split('/')[-1])\"\n",
                                    "(New-Object System.Net.WebClient).DownloadFile(\"$BootstrapUrl\", \"$BootstrapFile\")\n\n",

                                    "# Install python\n",
                                    "& \"$BootstrapFile\" -PythonUrl \"$PythonUrl\" -Verbose -ErrorAction Stop\n\n",

                                    "# Install watchmaker\n",
                                    "pip install --index-url=\"$PypiUrl\" --trusted-host=\"$PypiHost\" --allow-all-external --upgrade pip setuptools watchmaker\n\n"
                                ]]}
                            }
                        },
                        "services" :
                        {
                            "windows" :
                            {
                                "cfn-hup" :
                                {
                                    "enabled" : "true",
                                    "ensureRunning" : "true",
                                    "files" :
                                    [
                                        "c:\\cfn\\cfn-hup.conf",
                                        "c:\\cfn\\hooks.d\\cfn-auto-reloader.conf"
                                    ]
                                }
                            }
                        }
                    },
                    "watchmaker-launch" :
                    {
                        "commands" :
                        {
                            "10-watchmaker-launch" :
                            {
                                "command" :
                                { "Fn::Join" : [ "", [
                                    { "Fn::FindInMap" :
                                        [
                                            "ShellCommandMap",
                                            "powershell",
                                            "command"
                                        ]
                                    },
                                    " \"& {",
                                    " c:\\cfn\\scripts\\watchmaker-install.ps1;",
                                    " watchmaker -vv",
                                    " --log-dir C:\\Watchmaker\\Logs",
                                    " --no-reboot",
                                    {
                                        "Fn::If" :
                                        [
                                            "UseWamConfig",
                                            { "Fn::Join" : [ "", [
                                                " --config \\\"",
                                                { "Ref" : "WatchmakerConfig" },
                                                "\\\""
                                            ]]},
                                            ""
                                        ]
                                    },
                                    {
                                        "Fn::If" :
                                        [
                                            "UseEnvironment",
                                            { "Fn::Join" : [ "", [
                                                " --env \\\"",
                                                { "Ref" : "WatchmakerEnvironment" },
                                                "\\\""
                                            ]]},
                                            ""
                                        ]
                                    },
                                    {
                                        "Fn::If" :
                                        [
                                            "UseOuPath",
                                            { "Fn::Join" : [ "", [
                                                " --ou-path \\\"",
                                                { "Ref" : "WatchmakerOuPath" },
                                                "\\\""
                                            ]]},
                                            ""
                                        ]
                                    },
                                    {
                                        "Fn::If" :
                                        [
                                            "UseAdminGroups",
                                            { "Fn::Join" : [ "", [
                                                " --admin-groups \\\"",
                                                { "Ref" : "WatchmakerAdminGroups" },
                                                "\\\""
                                            ]]},
                                            ""
                                        ]
                                    },
                                    " }\""
                                ]]}
                            }
                        }
                    },
                    "watchmaker-update" :
                    {
                        "commands" :
                        {
                            "10-watchmaker-update" :
                            {
                                "command" :
                                { "Fn::Join" : [ "", [
                                    { "Fn::FindInMap" :
                                        [
                                            "ShellCommandMap",
                                            "powershell",
                                            "command"
                                        ]
                                    },
                                    " \"& {",
                                    " c:\\cfn\\scripts\\watchmaker-install.ps1;",
                                    " watchmaker -vv",
                                    " --log-dir C:\\Watchmaker\\Logs",
                                    " --salt-states None",
                                    " --no-reboot",
                                    {
                                        "Fn::If" :
                                        [
                                            "UseWamConfig",
                                            { "Fn::Join" : [ "", [
                                                " --config \\\"",
                                                { "Ref" : "WatchmakerConfig" },
                                                "\\\""
                                            ]]},
                                            ""
                                        ]
                                    },
                                    {
                                        "Fn::If" :
                                        [
                                            "UseEnvironment",
                                            { "Fn::Join" : [ "", [
                                                " --env \\\"",
                                                { "Ref" : "WatchmakerEnvironment" },
                                                "\\\""
                                            ]]},
                                            ""
                                        ]
                                    },
                                    {
                                        "Fn::If" :
                                        [
                                            "UseOuPath",
                                            { "Fn::Join" : [ "", [
                                                " --ou-path \\\"",
                                                { "Ref" : "WatchmakerOuPath" },
                                                "\\\""
                                            ]]},
                                            ""
                                        ]
                                    },
                                    {
                                        "Fn::If" :
                                        [
                                            "UseAdminGroups",
                                            { "Fn::Join" : [ "", [
                                                " --admin-groups \\\"",
                                                { "Ref" : "WatchmakerAdminGroups" },
                                                "\\\""
                                            ]]},
                                            ""
                                        ]
                                    },
                                    " }\""
                                ]]}
                            }
                        }
                    },
                    "make-app" :
                    {
                        "files" :
                        {
                            "c:\\cfn\\scripts\\make-app" :
                            {
                                "source" : { "Ref" : "AppScriptUrl" }
                            }
                        },
                        "commands" :
                        {
                            "10-make-app" :
                            {
                                "command" :
                                { "Fn::Join" : [ "", [
                                    { "Fn::FindInMap" :
                                        [
                                            "ShellCommandMap",
                                            { "Ref" : "AppScriptShell" },
                                            "command"
                                        ]
                                    },
                                    " c:\\cfn\\scripts\\make-app ",
                                    { "Ref" : "AppScriptParams" }
                                ]]},
                                "waitAfterCompletion" : "0"
                            }
                        }
                    },
                    "reboot" :
                    {
                        "commands" :
                        {
                            "10-reboot" :
                            {
                                "command" : "powershell.exe \"Restart-Computer -Force -Verbose\"",
                                "waitAfterCompletion" : "forever"
                            }
                        }
                    },
                    "finalize" :
                    {
                        "commands" :
                        {
                            "10-signal-success" :
                            {
                                "command" :
                                { "Fn::Join" : [ "", [
                                    "cfn-signal.exe -e 0",
                                    " --stack ", { "Ref" : "AWS::StackName" },
                                    " --resource WatchmakerAutoScalingGroup",
                                    {
                                        "Fn::If" :
                                        [
                                            "AssignInstanceRole",
                                            { "Fn::Join" : [ "", [
                                                " --role ",
                                                { "Ref" : "InstanceRole" }
                                            ] ] },
                                            ""
                                        ]
                                    },
                                    {
                                        "Fn::If" :
                                        [
                                            "UseCfnUrl",
                                            { "Fn::Join" : [ "", [
                                                " --url ",
                                                { "Ref" : "CfnEndpointUrl" }
                                            ] ] },
                                            ""
                                        ]
                                    },
                                    " --region ", { "Ref" : "AWS::Region"}, "\n"
                                ]]},
                                "ignoreErrors" : "true",
                                "waitAfterCompletion" : "0"
                            }
                        }
                    }
                }
            },
            "Properties" :
            {
                "ImageId" : { "Ref" : "AmiId" },
                "InstanceType" : { "Ref" : "InstanceType" },
                "IamInstanceProfile" :
                {
                    "Fn::If" :
                    [
                        "AssignInstanceRole",
                        { "Ref" : "InstanceRole" },
                        { "Ref" : "AWS::NoValue" }
                    ]
                },
                "AssociatePublicIpAddress" : "true",
                "BlockDeviceMappings" :
                [
                    {
                        "DeviceName" : "/dev/sda1",
                        "Ebs" :
                        {
                            "VolumeType" : "gp2",
                            "DeleteOnTermination" : "true"
                        }
                    },
                    {
                        "Fn::If" :
                        [
                            "CreateAppVolume",
                            {
                                "DeviceName" : { "Ref" : "AppVolumeDevice" },
                                "Ebs" :
                                {
                                    "VolumeSize" : { "Ref" : "AppVolumeSize" },
                                    "VolumeType" : { "Ref" : "AppVolumeType" },
                                    "DeleteOnTermination" : "true"
                                }
                            },
                            { "Ref" : "AWS::NoValue" }
                        ]
                    }
                ],
                "KeyName" :
                {
                    "Ref" : "KeyPairName"
                },
                "SecurityGroups" :
                {
                    "Ref" : "SecurityGroupIds"
                },
                "UserData" :
                {
                    "Fn::Base64" :
                    { "Fn::Join" : [ "", [
                        "<script>", "\n",

                        "REM CFN LaunchConfig Update Toggle: ",
                        { "Ref" : "ToggleNewInstances" },
                        "\n\n",

                        "cfn-init.exe -v -c launch",
                        " --stack ", { "Ref" : "AWS::StackName" },
                        " --resource WatchmakerLaunchConfig ",
                        {
                            "Fn::If" :
                            [
                                "AssignInstanceRole",
                                { "Fn::Join" : [ "", [
                                    " --role ", { "Ref" : "InstanceRole" }
                                ] ] },
                                ""
                            ]
                        },
                        {
                            "Fn::If" :
                            [
                                "UseCfnUrl",
                                { "Fn::Join" : [ "", [
                                    " --url ", { "Ref" : "CfnEndpointUrl" }
                                ] ] },
                                ""
                            ]
                        },
                        " --region ", { "Ref" : "AWS::Region" }, "\n",

                        "if %ERRORLEVEL% equ 0 goto success\n\n",

                        ":error\n",
                        "cfn-signal.exe -e 1",
                        " --stack ", { "Ref" : "AWS::StackName" },
                        " --resource WatchmakerAutoScalingGroup ",
                        {
                            "Fn::If" :
                            [
                                "AssignInstanceRole",
                                { "Fn::Join" : [ "", [
                                    " --role ", { "Ref" : "InstanceRole" }
                                ] ] },
                                ""
                            ]
                        },
                        {
                            "Fn::If" :
                            [
                                "UseCfnUrl",
                                { "Fn::Join" : [ "", [
                                    " --url ", { "Ref" : "CfnEndpointUrl" }
                                ] ] },
                                ""
                            ]
                        },
                        " --region ", { "Ref" : "AWS::Region" }, "\n",
                        "echo \"ERROR: cfn-init failed! Aborting!\"", "\n",
                        "exit /b 1\n\n",

                        ":success\n",

                        "</script>"
                    ] ] }
                }
            }
        }
    }
}
