AWSTemplateFormatVersion: "2010-09-09"
Description: >-
  India Cloud Compliance Checks for AWS - read-only access. Creates a role our service can assume with your External ID,
  with the AWS-managed SecurityAudit and ViewOnlyAccess policies (configuration metadata only: no access to object contents or database data).

Parameters:
  ExternalId:
    Type: String
    MinLength: 8
    Description: External ID shown on your Connect page.
  TrustedAccountId:
    Type: String
    AllowedPattern: "[0-9]{12}"
    Description: AWS account of the compliance service (pre-filled).

Resources:
  ComplianceRole:
    Type: AWS::IAM::Role
    Properties:
      Description: India Cloud Compliance Checks - read-only configuration audit
      MaxSessionDuration: 3600
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal: {AWS: !Sub "arn:${AWS::Partition}:iam::${TrustedAccountId}:root"}
            Action: sts:AssumeRole
            Condition: {StringEquals: {"sts:ExternalId": !Ref ExternalId}}
      ManagedPolicyArns:
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/SecurityAudit"
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/job-function/ViewOnlyAccess"
      Policies:
        - PolicyName: extra-reads
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: [account:GetAlternateContact, macie2:GetMacieSession, iam:GenerateCredentialReport, iam:GetCredentialReport]
                Resource: "*"

Outputs:
  RoleArn:
    Description: Paste this into the Connect page.
    Value: !GetAtt ComplianceRole.Arn