AWSTemplateFormatVersion: '2010-09-09'
Description: >
  This template deploys the IAM Policies and Roles
  needed for DoiT. It takes a parameter to define
  if we need the payer roles as well.
Parameters:
  AccountNumberParameter:
    Type: String
    Description: Account number DoiT AWS Ops runs in
  AccountTypeParameter:
    Type: String
    Default: customer
    AllowedValues:
      - customer
      - payer
    Description: Specifies type of account to have roles made for
  NotificationUrl:
    Type: String
    Description: URL used for notification (must end in /api/)
  S3Bucket:
    Type: String
    Description: Bucket containing this Cloudformation Template
Conditions:
  CreateOrganizationRole: !Equals [ !Ref AccountTypeParameter, payer ]
Resources:
  NotificationFunction:
    Type: AWS::Lambda::Function
    Properties:
      Role: !GetAtt NotificationFunctionRole.Arn
      Handler: main
      Runtime: go1.x
      Environment:
        Variables:
          NOTIFICATION_URL: !Ref NotificationUrl
      Code:
        S3Bucket: !Ref S3Bucket
        S3Key: main.zip
  NotificationFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Path: /
  AssumeableRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: DoiT_Management_Role_DO-NOT-DELETE
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS:
              - !Ref AccountNumberParameter
            Action:
              - 'sts:AssumeRole'
  PayerPolicy:
    Type: AWS::IAM::Policy
    Condition: CreateOrganizationRole
    Properties:
      PolicyName: DoiT_Payer_Policy_DO-NOT-DELETE
      PolicyDocument:
          Version: 2012-10-17
          Statement:
            - Effect: Allow
              Action: 'organizations:*'
              Resource: '*'
      Roles: 
        - !Ref AssumeableRole
  CustomerPolicy:
    Type: AWS::IAM::Policy
    Properties: 
      PolicyName: DoiT_Customer_Policy_DO-NOT-DELETE
      PolicyDocument: 
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - 'iam:AttachRolePolicy'
              - 'iam:CreateOpenIDConnectProvider'
              - 'iam:CreatePolicy'
              - 'iam:CreatePolicyVersion'
              - 'iam:CreateRole'
              - 'iam:CreateSAMLProvider'
              - 'iam:DeleteOpenIDConnectProvider'
              - 'iam:DeletePolicy'
              - 'iam:DeletePolicyVersion'
              - 'iam:DeleteRole'
              - 'iam:DeleteSAMLProvider'
              - 'iam:DetachRolePolicy'
              - 'iam:GetOpenIDConnectProvider'
              - 'iam:GetPolicy'
              - 'iam:GetPolicyVersion'
              - 'iam:GetRole'
              - 'iam:GetSAMLProvider'
              - 'iam:ListAttachedRolePolicies'
              - 'iam:ListEntitiesForPolicy'
              - 'iam:ListOpenIDConnectProviders'
              - 'iam:ListPolicies'
              - 'iam:ListPoliciesGrantingServiceAccess'
              - 'iam:ListPolicyVersions'
              - 'iam:ListRolePolicies'
              - 'iam:ListRoleTags'
              - 'iam:ListRoles'
              - 'iam:ListSAMLProviders'
              - 'iam:PutRolePermissionsBoundary'
              - 'iam:PutRolePolicy'
              - 'iam:SetDefaultPolicyVersion'
              - 'iam:TagRole'
              - 'iam:UntagRole'
              - 'iam:UpdateOpenIDConnectProviderThumbprint'
              - 'iam:UpdateRole'
              - 'iam:UpdateRoleDescription'
            Resource: '*'
      Roles: 
        - !Ref AssumeableRole
  NotificationCall:
    Type: Custom::Notification
    Properties:
      ServiceToken: !GetAtt NotificationFunction.Arn
      ManagementArn: !GetAtt AssumeableRole.Arn
    DependsOn:
      - CustomerPolicy
Outputs:
  RoleName:
    Value: !Ref AssumeableRole
  RoleArn:
    Value: !GetAtt AssumeableRole.Arn
