AWSTemplateFormatVersion: 2010-09-09
Description: ScaleOps IAM Permission Stack

Parameters:
  roleName:
    Type: String
    Description: Name of the new IAM role to be used by ScaleOps for Node Integration access
    Default: scaleops-node-integration-access-role
  policyName:
    Type: String
    Description: Name of the new policy
    Default: scaleops-node-integration-access-policy
  externalID:
    Type: String
    Description: The external ID is not configurable and can be found in the ScaleOps settings page.
    MinLength: 36
    MaxLength: 36

Resources:
  ScaleOpsNodeIntegrationAccessRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Ref roleName
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: arn:aws:iam::427621738444:role/ScaleOps-AssumeRoleDelegator
            Action:
              - 'sts:AssumeRole'
              - 'sts:TagSession'
            Condition:
              StringEquals:
                "sts:ExternalId": !Sub '${externalID}'
      Policies:
        - PolicyName: !Ref policyName
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: SimulateIAM
                Effect: Allow
                Action:
                  - iam:SimulatePrincipalPolicy
                  - iam:GetRole
                  - iam:ListAttachedRolePolicies
                Resource:
                  - '*'
              - Sid: NodeIntegrationReadAccess
                Effect: Allow
                Action:
                  - athena:Get*
                  - athena:List*
                  - autoscaling:Describe*
                  - autoscaling:Get*
                  - autoscaling:UpdateAutoScalingGroup
                  - autoscaling:CreateAutoScalingGroup
                  - autoscaling:DeleteAutoScalingGroup
                  - autoscaling:SetDesiredCapacity
                  - autoscaling:TerminateInstanceInAutoScalingGroup
                  - bedrock:Get*
                  - bedrock:List*
                  - ce:Describe*
                  - ce:Get*
                  - ce:List*
                  - cloudwatch:GetMetricData
                  - cloudwatch:GetMetricStatistics
                  - cloudwatch:ListMetrics
                  - compute-optimizer:Describe*
                  - compute-optimizer:Get*
                  - dynamodb:Describe*
                  - dynamodb:List*
                  - ec2:CreateLaunchTemplate
                  - ec2:DeleteLaunchTemplate
                  - ec2:RunInstances
                  - ec2:Describe*
                  - ec2:Get*
                  - ec2:List*
                  - ecs:Describe*
                  - ecs:List*
                  - eks:Describe*
                  - eks:List*
                  - eks:UpdateNodegroupConfig
                  - eks:CreateNodegroup
                  - eks:DeleteNodegroup
                  - eks:TagResource
                  - elasticache:Describe*
                  - elasticache:List*
                  - elasticloadbalancing:Describe*
                  - glue:Get*
                  - glue:List*
                  - lambda:GetFunction
                  - lambda:GetFunctionConfiguration
                  - lambda:List*
                  - organizations:DescribeAccount
                  - organizations:DescribeOrganization
                  - rds:Describe*
                  - rds:List*
                  - s3:GetBucketLocation
                  - s3:GetBucketTagging
                  - s3:ListAllMyBuckets
                  - sagemaker:Describe*
                  - sagemaker:List*
                  - tag:GetResources
                  - tag:GetTagKeys
                  - tag:GetTagValues
                  - glue:Get*
                  - glue:List*
                Resource: '*'
              - Sid: PassNodeRole
                Effect: Allow
                Action:
                  - iam:PassRole
                Resource: '*'
                Condition:
                  StringEquals:
                    iam:PassedToService:
                      - eks.amazonaws.com
                      - ec2.amazonaws.com