AWSTemplateFormatVersion: 2010-09-09
Description: ScaleOps IAM Permission Stack

Parameters:
  roleName:
    Type: String
    Description: Name of the new IAM role to be used by ScaleOps for CUR access
    Default: scaleops-cur-access-role
  policyName:
    Type: String
    Description: Name of the new policy
    Default: scaleops-cur-access-policy
  externalID:
    Type: String
    Description: The external ID is not configurable and can be found in the ScaleOps settings page.
    MinLength: 36
    MaxLength: 36
  s3BucketName:
    Type: String
    Description: Name of the S3 bucket to receive CUR data

Resources:
  ScaleOpsCurAccessRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Ref roleName
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: arn:aws:iam::427621738444:role/ScaleOps-AssumeRoleDelegator
            Action:
              - 'sts:AssumeRole'
              - 'sts:TagSession'
            Condition:
              StringEquals:
                "sts:ExternalId": !Sub '${externalID}'
      Policies:
        - PolicyName: !Ref policyName
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: CurS3ReadAccess
                Effect: Allow
                Action:
                  - s3:Get*
                  - s3:List*
                Resource:
                  - !Sub 'arn:aws:s3:::${s3BucketName}*'
              - Sid: ReadCost
                Effect: Allow
                Action:
                  - savingsplans:DescribeSavingsPlans
                  - ec2:DescribeReservedInstances
                  - ce:GetCostAndUsage
                  - ce:GetReservationUtilization
                  - ce:GetReservationCoverage
                  - ce:GetSavingsPlansCoverage
                  - ce:GetSavingsPlansUtilization
                  - ce:GetSavingsPlansUtilizationDetails
                  - ce:ListCostAllocationTags
                Resource:
                  - '*'
              - Sid: SimulateIAM
                Effect: Allow
                Action:
                  - iam:SimulatePrincipalPolicy
                Resource:
                  - '*'
              - Sid: ReadOrganization
                Effect: Allow
                Action:
                  - organizations:DescribeAccount
                  - organizations:DescribeOrganization
                Resource:
                  - '*'
