AWSTemplateFormatVersion: "2010-09-09"

Description: "IAM Role for Openbridge to access to the customer account for CloudFormation deployments"

Resources:
  CustomerCloudFormationRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: "openbridge-customer-cloudformation"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: "AllowAssumeRole"
            Effect: "Allow"
            Principal:
              AWS:
                - "arn:aws:iam::791778434480:role/customer-cloudformation-production"
            Action: "sts:AssumeRole"

  CustomerCloudFormationRolePolicies:
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyName: "cloudformation"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Action:
              - "cloudformation:CreateStack"
              - "cloudformation:DeleteStack"
              - "cloudformation:DescribeStacks"
              - "cloudformation:DescribeStackEvents"
              - "cloudformation:DescribeStackResources"
              - "cloudformation:GetTemplate"
              - "cloudformation:ListStackResources"
              - "cloudformation:ValidateTemplate"
              - "cloudformation:UpdateStack"
              - "iam:CreatePolicy"
              - "iam:CreatePolicyVersion"
              - "iam:AttachPolicy"
              - "iam:PutRolePolicy"
              - "iam:DeleteRolePolicy"
              - "sqs:*"
              - "firehose:*"
            Resource: "*"
          - Effect: "Allow"
            Action:
              - "s3:CreateBucket"
              - "s3:DeleteBucket"
              - "s3:ListBucket"
              - "s3:PutEncryptionConfiguration"
              - "s3:PutLifecycleConfiguration"
              - "s3:PutBucketPublicAccessBlock"
              - "s3:PutBucketPolicy"
              - "s3:DeleteBucketPolicy"
              - "s3:PutBucketNotification"
              - "s3:DeleteObject"
            Resource:
              - "arn:aws:s3:::ams-*"
              - "arn:aws:s3:::ams-*/*"
          - Effect: "Allow"
            Action:
              - "iam:PassRole"
            Resource:
              - "arn:aws:sqs:*"
              - !GetAtt OpenbridgeFirehoseRole.Arn
      Roles:
        - Ref: "CustomerCloudFormationRole"
    
    # IAM Role for Firehose to access S3 and CloudWatch Logs
  OpenbridgeFirehoseRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: "openbridge-firehose-role"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: firehose.amazonaws.com
            Action: "sts:AssumeRole"
      Policies:
        - PolicyName: FirehoseS3Policy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "s3:AbortMultipartUpload"
                  - "s3:GetBucketLocation"
                  - "s3:GetObject"
                  - "s3:ListBucket"
                  - "s3:ListBucketMultipartUploads"
                  - "s3:PutObject"
                Resource:
                  - !Sub 'arn:${AWS::Partition}:s3:::ams-*'
        - PolicyName: FirehoseCloudWatchLogsPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "logs:CreateLogGroup"
                  - "logs:CreateLogStream"
                  - "logs:PutLogEvents"
                Resource: 
                  - !Sub 'arn:${AWS::Partition}:logs:us-east-1:${AWS::AccountId}:log-group:/aws/kinesisfirehose/*' 
                  - !Sub 'arn:${AWS::Partition}:logs:eu-west-1:${AWS::AccountId}:log-group:/aws/kinesisfirehose/*' 
                  - !Sub 'arn:${AWS::Partition}:logs:us-west-2:${AWS::AccountId}:log-group:/aws/kinesisfirehose/*' 
  FirehoseSubscriptionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: ams-firehose-subscription-role 
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal:
            Service: sns.amazonaws.com
          Action: 'sts:AssumeRole'
        - Effect: Allow
          Principal:
            AWS:
             - arn:aws:iam::926844853897:role/ReviewerRole
          Action: 'sts:AssumeRole'
  FirehoseSubscriptionRolePolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: ams-subscription-role-policy
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
             - firehose:DescribeDeliveryStream
             - firehose:ListTagsForDeliveryStream
             - firehose:ListDeliveryStreams
             - firehose:PutRecord
             - firehose:PutRecordBatch
            Resource: 
             - !Sub 'arn:aws:firehose:eu-west-1:${AWS::AccountId}:deliverystream/ams-*'
             - !Sub 'arn:aws:firehose:us-east-1:${AWS::AccountId}:deliverystream/ams-*'
             - !Sub 'arn:aws:firehose:us-west-2:${AWS::AccountId}:deliverystream/ams-*'
      Roles:
        - !Ref FirehoseSubscriptionRole
  FirehoseSubscriberRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: ams-firehose-subscriber-role
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal:
            AWS:
             - arn:aws:iam::926844853897:role/SubscriberRole
          Action: 
            - sts:AssumeRole
            - sts:TagSession

Outputs:
  RoleArn:
    Description: "IAM Role ARN"
    Value: !GetAtt CustomerCloudFormationRole.Arn
