openvidu-deployment: HA AWS - optional LoadBalancerSubnets and SSM on the master role

Add an optional LoadBalancerSubnets parameter (CommaDelimitedList, empty by
default) to the Pro HA CloudFormation template. When set, the internet-facing
Network Load Balancer is placed in those public subnets via a new
HasLoadBalancerSubnets condition, so OpenViduMasterNodeSubnets can be private
subnets with NAT egress. When empty it falls back to the master subnets, so
existing public-subnet deployments are unaffected.

Also attach AmazonSSMManagedInstanceCore to the master node role (the media
role already has it) so master nodes register with Systems Manager and can be
reached through Session Manager without a public IP.


Assisted-by: claude-code - Anthropic - Claude Opus 4.8

openvidu-deployment/pro/ha/aws/cf-openvidu-ha.yaml

@@ -1042,6 +1042,11 @@ Parameters:
     AllowedPattern: ^.+$
     ConstraintDescription: You must specify a list of subnet IDs
 
+  LoadBalancerSubnets:
+    Description: "(Optional) Public subnets for the internet-facing Load Balancer. Leave empty to place the Load Balancer in the OpenViduMasterNodeSubnets (default behavior). Set it to dedicated public subnets to keep the Master Nodes in private subnets with NAT egress."
+    Type: CommaDelimitedList
+    Default: ""
+
   MasterNodesDiskSize:
     Description: Size of the disk in GB
     Type: Number
@@ -1092,6 +1097,7 @@ Metadata:
           - OpenViduVPC
           - OpenViduMasterNodeSubnets
           - OpenViduMediaNodeSubnets
+          - LoadBalancerSubnets
       - Label:
           default: Volumes configuration
         Parameters:
@@ -1104,6 +1110,7 @@ Metadata:
 Conditions:
   CreateRecordingsBucket: !Equals [!Ref S3AppDataBucketName, ""]
   CreateClusterDataBucket: !Equals [!Ref S3ClusterDataBucketName, ""]
+  HasLoadBalancerSubnets: !Not [!Equals [!Join ["", !Ref LoadBalancerSubnets], ""]]
   IsMasterGraviton: !Or
     - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 't4g']
     - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'c6g']
@@ -1391,6 +1398,8 @@ Resources:
             Action:
               - 'sts:AssumeRole'
       Path: "/"
+      ManagedPolicyArns:
+           - !Sub arn:${AWS::Partition}:iam::aws:policy/AmazonSSMManagedInstanceCore
       Policies:
         - PolicyName: !Sub openvidu-master-policy-${AWS::Region}-${AWS::StackName}
           PolicyDocument:
@@ -3293,7 +3302,7 @@ Resources:
           - ''
           - - OpenViduHA-
             - !Select [4, !Split ['-', !Select [2, !Split ['/', !Ref AWS::StackId]]]]
-      Subnets: !Ref OpenViduMasterNodeSubnets
+      Subnets: !If [HasLoadBalancerSubnets, !Ref LoadBalancerSubnets, !Ref OpenViduMasterNodeSubnets]
       SecurityGroups:
         - !Ref OpenViduLoadBalancerSG
       Type: network