AWSTemplateFormatVersion: '2010-09-09'

Parameters:
  RoleName:
    Type: String
    Description: 'Name of the IAM Role with unique id'
    Default: "OneLens-<10-char-alphanumeric-unique-id>"

Resources:
  OneLensResourceGovernancePolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Properties:
      ManagedPolicyName: !Sub 'OneLensResourceGovernancePolicy-${AWS::StackName}'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: 'VisualEditor0'
            Effect: Allow
            Action: 
              - account:List*
              - account:Get*
              - freetier:Get*
              - compute-optimizer:Get*
              - compute-optimizer:Describe*
              - cost-optimization-hub:List*
              - cost-optimization-hub:Get*
              - savingsplans:List*
              - savingsplans:Describe*
              - trustedadvisor:List*
              - trustedadvisor:Describe*
              - trustedadvisor:Get*
              - cloudwatch:List*
              - cloudwatch:Describe*
              - cloudwatch:Get*
              - ec2:Describe*
              - ec2:Get*
              - elasticloadbalancing:Describe*
              - autoscaling:Describe*
              - application-autoscaling:ListTagsForResource
              - application-autoscaling:Describe*
              - autoscaling-plans:Describe*
              - autoscaling-plans:Get*
              - rds:Describe*
              - rds:ListTagsForResource
              - s3:ListAllMyBuckets
              - s3:ListBucket
              - s3:ListAccessPoints
              - s3:ListMultiRegionAccessPoints
              - s3:GetIntelligentTieringConfiguration
              - s3:GetEncryptionConfiguration
              - s3:GetLifecycleConfiguration
              - s3:GetReplicationConfiguration
              - s3:GetBucket*
              - s3:ListStorageLens*
              - s3:GetStorageLens*
              - s3:GetMetrics*
              - dynamodb:ListStreams
              - dynamodb:ListTagsOfResource
              - es:Describe*
              - es:Get*
              - es:List*
              - logs:Describe*
              - logs:List*
              - logs:GetDataProtectionPolicy
              - logs:FilterLogEvents
              - elasticache:Describe*
              - elasticache:List*
              - cloudfront:List*
              - cloudfront:Get*
              - redshift:Describe*
              - redshift:List*
              - redshift-serverless:List*
              - redshift-serverless:Get*
              - redshift-serverless:Describe*
              - redshift:Get*
              - redshift-data:List*
              - redshift-data:Describe*
              - kafka:Get*
              - kafka:List*
              - kafka:Describe*
              - kafka-cluster:Describe*
              - ebs:Get*
              - ebs:List*
              - ecs:List*
              - ecs:Describe*
              - ecs:GetTaskProtection
              - kinesis:List*
              - kinesis:Describe*
              - kinesisanalytics:List*
              - kinesisanalytics:Describe*
              - kinesisvideo:Describe*
              - kinesisvideo:List*
              - medialive:List*
              - medialive:Describe*
              - sqs:List*
              - sqs:GetQueueAttributes
              - cloudtrail:Describe*
              - cloudtrail:List*
              - cloudtrail:Get*
              - cloudtrail:LookupEvents
              - organizations:List*
              - organizations:Describe*
              - eks:List*
              - eks:Describe*
              - quicksight:List*
              - quicksight:Describe*
              - resource-explorer-2:List*
              - resource-explorer-2:Get*
              - resource-explorer-2:Search
              - firehose:List*
              - firehose:Describe*
              - dynamodb:List*
              - dynamodb:Describe*
              - lambda:List*
              - lambda:Get*
              - elasticmapreduce:List*
              - elasticmapreduce:Describe*
              - elasticmapreduce:ViewEventsFromAllClustersInConsole
              - elasticmapreduce:Get*
              - emr-containers:List*
              - emr-containers:Describe*
              - emr-serverless:List*
              - emr-serverless:Get*
              - macie2:Describe*
              - macie2:Get*
              - macie2:List*
              - glue:List*
              - appconfig:List*
              - appconfig:Get*
              - ecr:DescribeImages
              - ecr:DescribePullThroughCacheRules
              - ecr:ListImages
              - ecr:Describe*
              - ecr:GetLifecyclePolicy
              - ecr:GetLifecyclePolicyPreview
              - ecr:GetRegistryPolicy
              - ecr:GetRegistryScanningConfiguration
              - ecr:GetRepositoryPolicy
              - ecr:ListTagsForResource
              - events:List*
              - events:Describe*
              - pipes:List*
              - pipes:Describe*
              - scheduler:List*
              - scheduler:Get*
              - schemas:List*
              - schemas:SearchSchemas
              - schemas:Describe*
              - schemas:Get*
              - waf:List*
              - waf:Get*
              - wafv2:List*
              - wafv2:Describe*
              - wafv2:CheckCapacity
              - wafv2:Get*
              - waf-regional:List*
              - waf-regional:Get*
              - states:List*
              - states:Describe*
              - states:Get*
              - servicequotas:Get*
              - servicequotas:List*
              - servicecatalog:Describe*
              - servicecatalog:List*
              - servicecatalog:Get*
              - amplify:List*
              - amplify:Get*
              - athena:List*
              - athena:Get*
              - backup:List*
              - backup:Get*
              - backup:Describe*
              - backup-storage:DescribeBackupJob
              - backup-storage:List*
              - acm:ListCertificates
              - acm:DescribeCertificate
              - acm:GetAccountConfiguration
              - applicationinsights:List*
              - applicationinsights:Describe*
              - pi:List*
              - pi:DescribeDimensionKeys
              - pi:Get*
              - config:Describe*
              - config:List*
              - dms:Describe*
              - dms:List*
              - dms:Get*
              - docdb-elastic:List*
              - docdb-elastic:GetCluster
              - resource-groups:List*
              - resource-groups:SearchResources
              - resource-groups:Get*
              - ram:List*
              - ram:Get*
              - tag:Get*
              - ecr-public:Describe*
              - ecr-public:GetRegistryCatalogData
              - ecr-public:GetRepositoryCatalogData
              - ecr-public:GetRepositoryPolicy
              - ecr-public:List*
              - elasticfilesystem:Describe*
              - ssm:Describe*
              - ssm:List*
              - ssm:Get*
              - lightsail:Get*
              - sagemaker:List*
              - sagemaker:Describe*
              - sagemaker:GetDeviceFleetReport
              - sagemaker:GetScalingConfigurationRecommendation
              - sagemaker:GetResourcePolicy
              - sagemaker:GetSagemakerServicecatalogPortfolioStatus
              - batch:List*
              - batch:Describe*
              - secretsmanager:List*
              - secretsmanager:DescribeSecret
              - bedrock:List*
              - quicksight:SearchUsers
              - kendra:List*
              - kendra:Describe*
              - neptune-db:List*
              - neptune-db:Get*
              - glue:Get*
              - glue:Batch*
              - elasticbeanstalk:Describe*
              - elasticbeanstalk:List*
              - elasticbeanstalk:ValidateConfigurationSettings
              - elasticbeanstalk:RetrieveEnvironmentInfo
              - mq:List*
              - mq:Describe*
              - kafkaconnect:Describe*
              - kafkaconnect:List*
              - memorydb:Describe*
              - memorydb:List*
            
            Resource: '*'
         
          - Sid: 'Statement1'
            Effect: Deny
            Action:
              - lambda:GetFunction
              - waf:GetChangeToken
              - waf:GetChangeTokenStatus
              - wafv2:ListAPIKeys
              - wafv2:GetDecryptedAPIKey
              - waf-regional:GetChangeToken
              - waf-regional:GetChangeTokenStatus
              - amplify:GetArtifactUrl
              - amplify:GetBackendEnvironment
              - amplify:GetWebHook
              - amplify:GetDomainAssociation
              - athena:GetQueryResults
              - athena:GetSession
              - athena:GetSessionStatus
              - ssm:GetParameter*
              - lightsail:GetContainerLog
              - lightsail:GetContainerImages
              - lightsail:GetBucketAccessKeys
              - lightsail:GetKeyPair*
              - lightsail:GetRelationalDatabaseLog*
              - neptune-db:GetStreamRecords
              
            
            Resource: '*'

  OneLensBillingGovernancePolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Properties:
      ManagedPolicyName: !Sub 'OneLensBillingGovernancePolicy-${AWS::StackName}'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: 'VisualEditor0'
            Effect: Allow
            Action: 
              - billing:Get*
              - billing:List*
              - cur:Get*
              - cur:ValidateReportDestination
              - cur:DescribeReportDefinitions
              - invoicing:Get*
              - invoicing:List*
              - consolidatedbilling:Get*
              - consolidatedbilling:List*
              - payments:Get*
              - tax:List*
              - tax:Get*
              - purchase-orders:List*
              - purchase-orders:View*
              - purchase-orders:Get*
              - budgets:Describe*
              - budgets:View*
              - ce:List*
              - ce:Get*
              - ce:Describe*
              - bcm-data-exports:List*
              - bcm-data-exports:Get*
              - aws-portal:View*
              - aws-portal:Get*
              - payments:List*
              - pricing:*

            Resource: '*'
   
  OneLens:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Ref RoleName
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            #Astuto Account ID to assume role
            Principal:
              AWS: !Sub 'arn:aws:iam::471112871310:root'
            Action: 
              - "sts:AssumeRole"
              - "sts:TagSession"
      ManagedPolicyArns:
        - !Ref OneLensResourceGovernancePolicy
        - !Ref OneLensBillingGovernancePolicy


Outputs:
  IAMRoleArn:
    Description: 'IAM Role ARN for the specified account'
    Value: !GetAtt OneLens.Arn
