AWSTemplateFormatVersion: "2010-09-09"
Description: >-
  Extended Support Cost Forecaster for AWS - read-only access. Creates a role our service can assume with your External ID.
  It can only list and describe database, Kubernetes, Lambda, ElastiCache, ECS and ECR versions and metadata.
  It cannot read data or secrets and cannot change anything. lambda:GetFunction is used only to read the container
  image URI of image-based functions (the call also returns a short-lived code link, which we never fetch).

Parameters:
  ExternalId:
    Type: String
    MinLength: 8
    Description: External ID shown on your Connect page.
  TrustedAccountId:
    Type: String
    AllowedPattern: "[0-9]{12}"
    Description: AWS account of the forecasting service (pre-filled).

Resources:
  ForecastRole:
    Type: AWS::IAM::Role
    Properties:
      Description: Extended Support Cost Forecaster - read-only version inventory
      MaxSessionDuration: 3600
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal: {AWS: !Sub "arn:${AWS::Partition}:iam::${TrustedAccountId}:root"}
            Action: sts:AssumeRole
            Condition: {StringEquals: {"sts:ExternalId": !Ref ExternalId}}
      Policies:
        - PolicyName: version-inventory-read
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - rds:DescribeDBInstances
                  - rds:DescribeDBMajorEngineVersions
                  - ec2:DescribeInstanceTypes
                  - eks:ListClusters
                  - eks:DescribeCluster
                  - eks:DescribeClusterVersions
                  - lambda:ListFunctions
                  - lambda:GetFunctionConfiguration
                  - elasticache:DescribeCacheClusters
                  - ecs:ListTaskDefinitions
                  - ecs:DescribeTaskDefinition
                  - ecr:DescribeRepositories
                  - ecr:DescribeImages
                  - lambda:GetFunction
                Resource: "*"

Outputs:
  RoleArn:
    Description: Paste this into the Connect page.
    Value: !GetAtt ForecastRole.Arn