AWSTemplateFormatVersion: '2010-09-09'

Description: 'UaaS Support Role'

Parameters:
  UaaSStackName:
    Type: String
    Description: Name of the existing UaaS stack

Resources:
  UaaSSupportRole:
    Type: AWS::IAM::Role
    Properties:
      Policies:
          -
            PolicyName: "UaaSSupport"
            PolicyDocument:
              Version: "2012-10-17"
              Statement:
                -
                  Condition:
                    StringLikeIfExists:
                      aws:RequestTag/aws:cloudformation:stack-name: !Ref UaaSStackName
                  Effect: "Allow"
                  Action:
                    - "sqs:ReceiveMessage"
                    - "sqs:GetQueueAttributes"
                  Resource: !Sub "arn:aws:sqs:${AWS::Region}:${AWS::AccountId}:${UaaSStackName}-*"
                -
                  Condition:
                    StringLikeIfExists:
                      aws:RequestTag/aws:cloudformation:stack-name: !Ref UaaSStackName
                  Effect: "Allow"
                  Action:
                    - "s3:GetObject"
                    - "s3:ListBucket"
                  Resource: !Sub "arn:aws:s3:::${UaaSStackName}-*"
                -
                  Action:
                    - "dynamodb:GetItem"
                    - "dynamodb:Query"
                    - "dynamodb:Scan"
                    - "dynamodb:DescribeTable"
                  Effect: "Allow"
                  Resource: !Sub "arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${UaaSStackName}-*"
                -
                  Action:
                    - "dynamodb:GetItem"
                    - "dynamodb:Query"
                    - "dynamodb:Scan"
                  Effect: "Allow"
                  Resource: !Sub "arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${UaaSStackName}-*/index/GSI2"
                -
                  Condition:
                    StringLikeIfExists:
                      aws:RequestTag/aws:cloudformation:stack-name: !Ref UaaSStackName
                  Effect: "Allow"
                  Action:
                    - "logs:Describe*"
                    - "logs:Get*"
                    - "logs:List*"
                    - "logs:StartQuery"
                    - "logs:StopQuery"
                    - "logs:TestMetricFilter"
                  Resource: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${UaaSStackName}-*"
                -
                  Condition:
                    StringLikeIfExists:
                      aws:RequestTag/aws:cloudformation:stack-name: !Ref UaaSStackName
                  Effect: "Allow"
                  Action:
                    - "lambda:Get*"
                    - "lambda:List*"
                  Resource: !Sub "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${UaaSStackName}-*"
                -
                  Condition:
                    StringLikeIfExists:
                      aws:RequestTag/aws:cloudformation:stack-name: !Ref UaaSStackName
                  Effect: "Allow"
                  Action:
                    - "cloudwatch:GetDashboard"
                    - "cloudwatch:GetMetric*"
                  Resource: "*"
                -
                  Condition:
                    StringLikeIfExists:
                      aws:RequestTag/aws:cloudformation:stack-name: !Ref UaaSStackName
                  Effect: "Allow"
                  Action:
                    - "cloudformation:List*"
                    - "cloudformation:Describe*"
                    - "cloudformation:Get*"
                  Resource: "*"
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        -
          Effect: Allow
          Principal:
            AWS: arn:aws:iam::599666315938:root
          Action:
            - sts:AssumeRole
          Condition:
            Bool:
              aws:MultiFactorAuthPresent: 'True'
            StringEquals:
              sts:ExternalId: !Select [2, !Split ['/', !Ref AWS::StackId]]


Outputs:
  UaaSSupportRoleARN:
    Description: ARN of UaaS Support Role
    Value: !GetAtt UaaSSupportRole.Arn
  ExternalId:
    Description: Unique external ID for further authentication confirmation.
    Value: !Select [2, !Split ['/', !Ref AWS::StackId]]
