AWSTemplateFormatVersion: '2010-09-09'
Description: >
  Read-only role for the CloudTing cost and security review.
  It can view the account's configuration and billing. It cannot create,
  change or delete resources, or read the contents of S3 files or secret
  values. To remove the access, delete this stack.

Parameters:
  CloudTingAccountId:
    Type: String
    AllowedPattern: '^\d{12}$'
    Description: CloudTing's AWS account ID (we send it with the NDA)
  ExternalId:
    Type: String
    MinLength: 8
    NoEcho: true
    Description: Shared code we agree on separately; it stops any other account from using this role

Resources:
  RolRevision:
    Type: AWS::IAM::Role
    Properties:
      RoleName: CloudTingRevisionSoloLectura
      Description: Read-only access for the CloudTing review
      MaxSessionDuration: 3600
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::${CloudTingAccountId}:root'
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                sts:ExternalId: !Ref ExternalId
      ManagedPolicyArns:
        # View service configuration without access to data.
        - arn:aws:iam::aws:policy/job-function/ViewOnlyAccess
        # Security configuration (IAM, CloudTrail, security groups...).
        - arn:aws:iam::aws:policy/SecurityAudit
        # Read-only billing.
        - arn:aws:iam::aws:policy/AWSBillingReadOnlyAccess
      Policies:
        - PolicyName: MetricasYCostos
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - ce:Get*
                  - ce:Describe*
                  - ce:List*
                  - savingsplans:Describe*
                  - compute-optimizer:Get*
                  - compute-optimizer:Describe*
                  - cloudwatch:GetMetricData
                  - cloudwatch:GetMetricStatistics
                  - budgets:ViewBudget
                  - support:DescribeTrustedAdvisor*
                  - cost-optimization-hub:ListRecommendationSummaries
                  - cost-optimization-hub:ListRecommendations
                  - cost-optimization-hub:GetPreferences
                Resource: '*'
        - PolicyName: InventarioServicios
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              # Configuration describe/list/get only. No action reads the
              # contents of databases, images, objects or secrets.
              - Effect: Allow
                Action:
                  - ec2:Describe*
                  - ec2:GetEbsEncryptionByDefault
                  - elasticloadbalancing:Describe*
                  - rds:Describe*
                  - rds:ListTagsForResource
                  - eks:List*
                  - eks:Describe*
                  - ecs:List*
                  - ecs:Describe*
                  - ecr:DescribeRepositories
                  - ecr:DescribeImages
                  - ecr:GetLifecyclePolicy
                  - lambda:ListFunctions
                  - s3:ListAllMyBuckets
                  - s3:GetLifecycleConfiguration
                  - s3:GetAccountPublicAccessBlock
                  - guardduty:ListDetectors
                  - config:DescribeConfigurationRecorders
                  - dynamodb:ListTables
                  - dynamodb:DescribeTable
                Resource: '*'

Outputs:
  RolArn:
    Description: Send us this value to start the review
    Value: !GetAtt RolRevision.Arn