AWSTemplateFormatVersion: '2010-09-09'
Description: >
  Orgoscope Read-Only Access Role.
  This template creates an IAM role that grants Orgoscope
  read-only access to your AWS resources for cost analysis.
  No write, modify, or delete permissions are included.

Metadata:
  # OrgoscopeVersion is the role version this template deploys. Orgoscope reads
  # it to know which scanners a connected account can run. The template always
  # contains ALL permissions up to the latest version, organized by version so
  # an existing customer updating the stack sees a clean diff of only what's new.
  OrgoscopeVersion: "1.2"

Parameters:
  ExternalId:
    Type: String
    Description: Unique identifier provided by Orgoscope (do not modify)
    MinLength: 1
  OrgoscopeAccountId:
    Type: String
    Description: Orgoscope's AWS Account ID (do not modify)
    MinLength: 12
    MaxLength: 12

Resources:
  OrgoscopeReadOnlyRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: OrgoscopeReadOnly
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::${OrgoscopeAccountId}:root'
            Action: 'sts:AssumeRole'
            Condition:
              StringEquals:
                'sts:ExternalId': !Ref ExternalId
      MaxSessionDuration: 3600
      Policies:
        - PolicyName: OrgoscopeReadOnlyPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              # === v1.0 Permissions ===
              - Sid: ComputeV1
                Effect: Allow
                Action:
                  - 'ec2:Describe*'
                  - 'elasticloadbalancing:Describe*'
                  - 'lambda:List*'
                  - 'lambda:GetFunction*'
                  - 'lambda:GetPolicy'
                Resource: '*'
              - Sid: DatabaseV1
                Effect: Allow
                Action:
                  - 'rds:Describe*'
                  - 'rds:ListTagsForResource'
                Resource: '*'
              - Sid: StorageV1
                Effect: Allow
                Action:
                  - 's3:GetBucket*'
                  - 's3:GetLifecycle*'
                  - 's3:GetObject'
                  - 's3:ListAllMyBuckets'
                  - 's3:ListBucket'
                Resource: '*'
              - Sid: MonitoringV1
                Effect: Allow
                Action:
                  - 'cloudwatch:GetMetricData'
                  - 'cloudwatch:GetMetricStatistics'
                  - 'cloudwatch:ListMetrics'
                Resource: '*'
              - Sid: CostV1
                Effect: Allow
                Action:
                  - 'ce:Get*'
                  - 'ce:List*'
                  - 'ce:Describe*'
                  - 'cur:Describe*'
                  - 'cur:Get*'
                  - 'savingsplans:Describe*'
                  - 'pricing:GetProducts'
                Resource: '*'
              - Sid: CoreV1
                Effect: Allow
                Action:
                  - 'tag:Get*'
                  - 'organizations:List*'
                  - 'organizations:Describe*'
                  - 'iam:ListAccountAliases'
                  - 'sts:GetCallerIdentity'
                Resource: '*'

              # === v1.1 Permissions ===
              # New customers get these immediately. Existing v1.0 customers who
              # update the stack see only these two Sids being added.
              - Sid: ComputeOptimizerV11
                Effect: Allow
                Action:
                  - 'compute-optimizer:Get*'
                  - 'compute-optimizer:Describe*'
                Resource: '*'
              - Sid: TrustedAdvisorV11
                Effect: Allow
                Action:
                  - 'trustedadvisor:List*'
                  - 'trustedadvisor:Describe*'
                  - 'trustedadvisor:Get*'
                Resource: '*'

              # === v1.2 Permissions ===
              # New customers get these immediately. Existing v1.1 customers who
              # update the stack see only these two Sids being added. Glue dev
              # endpoints + job runs; Step Functions machine listing (execution
              # volume comes from CloudWatch, already granted by MonitoringV1).
              - Sid: GlueV12
                Effect: Allow
                Action:
                  - 'glue:GetJobs'
                  - 'glue:GetJobRuns'
                  - 'glue:GetDevEndpoints'
                Resource: '*'
              - Sid: StepFunctionsV12
                Effect: Allow
                Action:
                  - 'states:ListStateMachines'
                Resource: '*'

Outputs:
  RoleARN:
    Description: Paste this ARN into Orgoscope to complete the connection
    Value: !GetAtt OrgoscopeReadOnlyRole.Arn
  ExternalId:
    Description: External ID used for this connection
    Value: !Ref ExternalId
  RoleVersion:
    Description: The Orgoscope role version this stack grants
    Value: "1.2"
