AWSTemplateFormatVersion: '2010-09-09'
Description: "DLM Default Policy for AMI management"
Parameters:
  Description:
    Type: String
    Description: Policy description. Allowed characters are a-z, A-Z, 0-9, space, "-" (hyphen) and "_" (underscore)
    Default: "Default Policy for AMI management - created by CloudFormation"
  CreateInterval:
    Type: Number
    Description: 'Number of days between consecutive backups. Min: 1, Max: 7. Must be less than or equal to RetainInterval.'
    Default: 1
    AllowedValues:
      - 1
      - 2
      - 3
      - 4
      - 5
      - 6
      - 7
  RetainInterval:
    Type: Number
    Description: 'Number of days to retain backups before deleting. Min: 2, Max: 14. Must be greater than or equal to CreateInterval.'
    Default: 7
    AllowedValues:
      - 2
      - 3
      - 4
      - 5
      - 6
      - 7
      - 8
      - 9
      - 10
      - 11
      - 12
      - 13
      - 14
  CopyRegion1:
    Type: String
    Description: (optional) Region to copy AMIs to
    Default: ""
  CopyRegion2:
    Type: String
    Description: (optional) Region to copy AMIs to
    Default: ""
  CopyRegion3:
    Type: String
    Description: (optional) Region to copy AMIs to
    Default: ""
  CopyTags:
    Type: String
    Description: (optional) Whether to copy tags from the source instance to the AMIs created
    AllowedValues:
      - true
      - false
    Default: false
  ExtendDeletion:
    Type: String
    Description: (optional) Whether to continue deleting AMIs after the policy is errored/deleted/disabled, and delete the last AMI of a given instance
    AllowedValues:
      - true
      - false
    Default: false
  State:
    Type: String
    Description: Specify whether to enable the policy immediately after creation or modification. If you do not enable the policy now, then it will not begin creating snapshots or AMIs until you manually set its activation status to enabled.
    AllowedValues:
      - 'ENABLED'
      - 'DISABLED'
    Default: 'ENABLED'

Conditions:
  HasCopyRegion1: !Not [!Equals [!Ref CopyRegion1, '']]
  HasCopyRegion2: !Not [!Equals [!Ref CopyRegion2, '']]
  HasCopyRegion3: !Not [!Equals [!Ref CopyRegion3, '']]
    
Resources:
  DefaultSnapshotPolicy:
    Type: "AWS::DLM::LifecyclePolicy"
    Properties:
      DefaultPolicy: "INSTANCE"
      PolicyDetails:
        PolicyLanguage: "SIMPLIFIED"
        PolicyType: "IMAGE_MANAGEMENT"
        ResourceType: "INSTANCE"
        CreateInterval: !Ref CreateInterval
        RetainInterval: !Ref RetainInterval
        CopyTags: !Ref CopyTags
        CrossRegionCopyTargets:
          - !If [HasCopyRegion1, TargetRegion: !Ref CopyRegion1, !Ref 'AWS::NoValue']
          - !If [HasCopyRegion2, TargetRegion: !Ref CopyRegion2, !Ref 'AWS::NoValue']
          - !If [HasCopyRegion3, TargetRegion: !Ref CopyRegion3, !Ref 'AWS::NoValue']
        # To exclude instances with specific tags, uncomment the following block and add the tags to exclude
        # Exclusions:
        #   ExcludeTags:
        #     - Key: "exclude-key1"
        #       Value: "exclude-value1"
        #     - Key: "exclude-key2"
        #       Value: "exclude-value2"
        ExtendDeletion: !Ref ExtendDeletion
      Description: !Ref Description
      State: !Ref State
      ExecutionRoleArn:
        Fn::GetAtt: [ExecutionRole, Arn]

  ExecutionRole:
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: ['sts:AssumeRole']
            Effect: Allow
            Principal:
              Service: [dlm.amazonaws.com]
            Condition:
              StringEquals:
                "aws:SourceAccount": !Ref AWS::AccountId
              ArnLike:
                "aws:SourceArn": !Sub "arn:${AWS::Partition}:dlm:*:${AWS::AccountId}:policy/*"
        Version: '2012-10-17'
      ManagedPolicyArns: [{"Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSDataLifecycleManagerServiceRoleForAMIManagement"}]
    Type: AWS::IAM::Role

