AWSTemplateFormatVersion: '2010-09-09'
Description: >
  Sentasity Access Roles — Single Account Deployment.
  Creates IAM roles granting Sentasity read access for cost optimization
  and security scanning in this AWS account.

Resources:

  SentasityViewOnlySecurityRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: SentasityViewOnlySecurityRole
      Description: "Sentasity ViewOnly access for cost optimization and security scanning"
      MaxSessionDuration: 43200
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: "arn:aws:iam::886557787053:root"
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess"
        - "arn:aws:iam::aws:policy/SecurityAudit"
      Policies:
        - PolicyName: SecurityScanReadOnly
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: AllowAdditionalSecurityReads
                Effect: Allow
                Action:
                  - "account:Get*"
                  - "appstream:Describe*"
                  - "appstream:List*"
                  - "backup:List*"
                  - "bedrock:List*"
                  - "bedrock:Get*"
                  - "cloudtrail:GetInsightSelectors"
                  - "codeartifact:List*"
                  - "codebuild:BatchGet*"
                  - "codebuild:ListReportGroups"
                  - "cognito-idp:GetUserPoolMfaConfig"
                  - "dlm:Get*"
                  - "drs:Describe*"
                  - "ds:Get*"
                  - "ds:Describe*"
                  - "ds:List*"
                  - "dynamodb:GetResourcePolicy"
                  - "ec2:GetEbsEncryptionByDefault"
                  - "ec2:GetSnapshotBlockPublicAccessState"
                  - "ec2:GetInstanceMetadataDefaults"
                  - "ecr:Describe*"
                  - "ecr:GetRegistryScanningConfiguration"
                  - "elasticfilesystem:DescribeBackupPolicy"
                  - "glue:GetConnections"
                  - "glue:GetSecurityConfiguration*"
                  - "glue:SearchTables"
                  - "lambda:GetFunction*"
                  - "logs:FilterLogEvents"
                  - "lightsail:GetRelationalDatabases"
                  - "macie2:GetMacieSession"
                  - "macie2:GetAutomatedDiscoveryConfiguration"
                  - "s3:GetAccountPublicAccessBlock"
                  - "shield:DescribeProtection"
                  - "shield:GetSubscriptionState"
                  - "securityhub:BatchImportFindings"
                  - "securityhub:GetFindings"
                  - "servicecatalog:Describe*"
                  - "servicecatalog:List*"
                  - "ssm:GetDocument"
                  - "ssm-incidents:List*"
                  - "states:ListTagsForResource"
                  - "support:Describe*"
                  - "tag:GetTagKeys"
                  - "wellarchitected:List*"
                Resource: "*"
              - Sid: AllowAPIGatewayReadOnly
                Effect: Allow
                Action:
                  - "apigateway:GET"
                Resource:
                  - "arn:*:apigateway:*::/restapis/*"
                  - "arn:*:apigateway:*::/apis/*"
      Tags:
        - Key: "ManagedBy"
          Value: "Sentasity-CloudFormation"
        - Key: "Purpose"
          Value: "Cost optimization and security scanning"

  SentasityReadOnlyRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: SentasityReadOnlyRole
      Description: "Sentasity ReadOnly role for cost data and CUR access"
      MaxSessionDuration: 43200
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: "arn:aws:iam::886557787053:root"
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/ReadOnlyAccess"
      Policies:
        - PolicyName: SentasityCURDiscovery
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: CURDiscovery
                Effect: Allow
                Action:
                  - cur:DescribeReportDefinitions
                  - bcm-data-exports:ListExports
                  - bcm-data-exports:GetExport
                Resource: "*"
      Tags:
        - Key: "ManagedBy"
          Value: "Sentasity-CloudFormation"
        - Key: "Purpose"
          Value: "Cost and usage data access"

Outputs:
  ViewOnlyRoleArn:
    Description: "ARN of the Sentasity ViewOnly security scanning role"
    Value: !GetAtt SentasityViewOnlySecurityRole.Arn

  ReadOnlyRoleArn:
    Description: "ARN of the Sentasity ReadOnly cost data role"
    Value: !GetAtt SentasityReadOnlyRole.Arn
