From d716ee15ec1068424040b8364e43d5b2665953f9 Mon Sep 17 00:00:00 2001
From: cruizba <carlos.ruizbal@gmail.com>
Date: Fri, 18 Sep 2026 02:21:15 +0200
Subject: [PATCH] openvidu-deployment: HA AWS - optional LoadBalancerSubnets
 and SSM on the master role

Add an optional LoadBalancerSubnets parameter (CommaDelimitedList, empty by
default) to the Pro HA CloudFormation template. When set, the internet-facing
Network Load Balancer is placed in those public subnets via a new
HasLoadBalancerSubnets condition, so OpenViduMasterNodeSubnets can be private
subnets with NAT egress. When empty it falls back to the master subnets, so
existing public-subnet deployments are unaffected.

Also attach AmazonSSMManagedInstanceCore to the master node role (the media
role already has it) so master nodes register with Systems Manager and can be
reached through Session Manager without a public IP.


Assisted-by: claude-code - Anthropic - Claude Opus 4.8
---
 openvidu-deployment/pro/ha/aws/cf-openvidu-ha.yaml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/openvidu-deployment/pro/ha/aws/cf-openvidu-ha.yaml b/openvidu-deployment/pro/ha/aws/cf-openvidu-ha.yaml
index 79229b1ed..1c77b04f1 100644
--- a/openvidu-deployment/pro/ha/aws/cf-openvidu-ha.yaml
+++ b/openvidu-deployment/pro/ha/aws/cf-openvidu-ha.yaml
@@ -1042,6 +1042,11 @@ Parameters:
     AllowedPattern: ^.+$
     ConstraintDescription: You must specify a list of subnet IDs
 
+  LoadBalancerSubnets:
+    Description: "(Optional) Public subnets for the internet-facing Load Balancer. Leave empty to place the Load Balancer in the OpenViduMasterNodeSubnets (default behavior). Set it to dedicated public subnets to keep the Master Nodes in private subnets with NAT egress."
+    Type: CommaDelimitedList
+    Default: ""
+
   MasterNodesDiskSize:
     Description: Size of the disk in GB
     Type: Number
@@ -1092,6 +1097,7 @@ Metadata:
           - OpenViduVPC
           - OpenViduMasterNodeSubnets
           - OpenViduMediaNodeSubnets
+          - LoadBalancerSubnets
       - Label:
           default: Volumes configuration
         Parameters:
@@ -1104,6 +1110,7 @@ Metadata:
 Conditions:
   CreateRecordingsBucket: !Equals [!Ref S3AppDataBucketName, ""]
   CreateClusterDataBucket: !Equals [!Ref S3ClusterDataBucketName, ""]
+  HasLoadBalancerSubnets: !Not [!Equals [!Join ["", !Ref LoadBalancerSubnets], ""]]
   IsMasterGraviton: !Or
     - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 't4g']
     - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'c6g']
@@ -1391,6 +1398,8 @@ Resources:
             Action:
               - 'sts:AssumeRole'
       Path: "/"
+      ManagedPolicyArns:
+           - !Sub arn:${AWS::Partition}:iam::aws:policy/AmazonSSMManagedInstanceCore
       Policies:
         - PolicyName: !Sub openvidu-master-policy-${AWS::Region}-${AWS::StackName}
           PolicyDocument:
@@ -3293,7 +3302,7 @@ Resources:
           - ''
           - - OpenViduHA-
             - !Select [4, !Split ['-', !Select [2, !Split ['/', !Ref AWS::StackId]]]]
-      Subnets: !Ref OpenViduMasterNodeSubnets
+      Subnets: !If [HasLoadBalancerSubnets, !Ref LoadBalancerSubnets, !Ref OpenViduMasterNodeSubnets]
       SecurityGroups:
         - !Ref OpenViduLoadBalancerSG
       Type: network