AWSTemplateFormatVersion: 2010-09-09
Description: ScaleOps IAM Permission Stack for AWS Marketplace Integration

Parameters:
  roleName:
    Type: String
    Description: Name of the new IAM role to be used by ScaleOps for Marketplace Integration access
    Default: scaleops-marketplace-integration-access-role
  policyName:
    Type: String
    Description: Name of the new policy
    Default: scaleops-marketplace-integration-access-policy
  externalID:
    Type: String
    Description: The external ID is not configurable and can be found in the ScaleOps settings page.
    MinLength: 36
    MaxLength: 36

Resources:
  ScaleOpsMarketplaceIntegrationAccessRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Ref roleName
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: arn:aws:iam::427621738444:role/ScaleOps-AssumeRoleDelegator
            Action:
              - 'sts:AssumeRole'
              - 'sts:TagSession'
            Condition:
              StringEquals:
                "sts:ExternalId": !Sub '${externalID}'
      Policies:
        - PolicyName: !Ref policyName
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: SimulateIAM
                Effect: Allow
                Action:
                  - iam:SimulatePrincipalPolicy
                Resource:
                  - '*'
              - Sid: MarketplaceTagging
                Effect: Allow
                Action:
                  - ec2:CreateTags
                Resource: 'arn:aws:ec2:*:*:volume/*'