Description: 'CloudFormation stack for Dashbird delegation'
Resources:
  DashbirdCFCallback:
    Type: 'Custom::DashbirdCFCallback'
    DependsOn: DashbirdDelegationRole
    Version: '1.0'
    Properties:
      ServiceToken: !Join [
          ':',
          [
            'arn:aws:sns',
            !Ref 'AWS::Region',
            !Ref DashbirdAWSAccount,
            !Ref DashbirdSNSTopic
          ]
      ]
      RoleArn: !GetAtt DashbirdDelegationRole.Arn
      ExternalId: !Ref ExternalId
      DashbirdAccountId: !Ref DashbirdAccountId
      DashbirdDelegationName: !Ref DashbirdDelegationName
      Version: '2022-09-19'
  DashbirdDelegationRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS:
              - arn:aws:iam::458024764010:root
            Action:
              - 'sts:AssumeRole'
            Condition:
              StringEquals:
                'sts:ExternalId': !Ref ExternalId
      Path: /
      RoleName: !Sub 'DashbirdDelegationRole-${DashbirdAccountId}'
      Policies:
        - PolicyName: Resources
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: 'apigateway:GET'
                Resource: '*'
              - Effect: Allow
                Action: 'apigateway:HEAD'
                Resource: '*'
              - Effect: Allow
                Action: 'apigateway:OPTIONS'
                Resource: '*'
              - Effect: Allow
                Action: 'appsync:get*'
                Resource: '*'
              - Effect: Allow
                Action: 'appsync:list*'
                Resource: '*'
              - Effect: Allow
                Action: 'athena:list*'
                Resource: '*'
              - Effect: Allow
                Action: 'athena:batchGet*'
                Resource: '*'
              - Effect: Allow
                Action: 'athena:getNamedQuery'
                Resource: '*'
              - Effect: Allow
                Action: 'athena:getQueryExecution'
                Resource: '*'
              - Effect: Allow
                Action: 'athena:getQueryExecution'
                Resource: '*'
              - Effect: Allow
                Action: 'autoscaling:describe*'
                Resource: '*'
              - Effect: Allow
                Action: 'batch:describe*'
                Resource: '*'
              - Effect: Allow
                Action: 'cloudformation:describe*'
                Resource: '*'
              - Effect: Allow
                Action: 'cloudformation:get*'
                Resource: '*'
              - Effect: Allow
                Action: 'cloudformation:list*'
                Resource: '*'
              - Effect: Allow
                Action: 'cloudfront:get*'
                Resource: '*'
              - Effect: Allow
                Action: 'cloudfront:list*'
                Resource: '*'
              - Effect: Allow
                Action: 'cloudwatch:describe*'
                Resource: '*'
              - Effect: Allow
                Action: 'cloudwatch:list*'
                Resource: '*'
              - Effect: Allow
                Action: 'cognito-idp:describe*'
                Resource: '*'
              - Effect: Allow
                Action: 'cognito-idp:listResourceServers'
                Resource: '*'
              - Effect: Allow
                Action: 'cognito-idp:listTagsForResource'
                Resource: '*'
              - Effect: Allow
                Action: 'cognito-idp:listUserPoolClients'
                Resource: '*'
              - Effect: Allow
                Action: 'cognito-idp:listUserPools'
                Resource: '*'
              - Effect: Allow
                Action: 'dax:describe*'
                Resource: '*'
              - Effect: Allow
                Action: 'dax:list*'
                Resource: '*'
              - Effect: Allow
                Action: 'discovery:describe*'
                Resource: '*'
              - Effect: Allow
                Action: 'discovery:list*'
                Resource: '*'
              - Effect: Allow
                Action: 'dynamodb:describe*'
                Resource: '*'
              - Effect: Allow
                Action: 'dynamodb:list*'
                Resource: '*'
              - Effect: Allow
                Action: 'ec2:describe*'
                Resource: '*'
              - Effect: Allow
                Action: 'ecs:describe*'
                Resource: '*'
              - Effect: Allow
                Action: 'ecs:list*'
                Resource: '*'
              - Effect: Allow
                Action: 'ecr:describe*'
                Resource: '*'
              - Effect: Allow
                Action: 'ecr:get*'
                Resource: '*'
              - Effect: Allow
                Action: 'ecr:list*'
                Resource: '*'
              - Effect: Allow
                Action: 'eks:describe*'
                Resource: '*'
              - Effect: Allow
                Action: 'eks:list*'
                Resource: '*'
              - Effect: Allow
                Action: 'elasticache:describe*'
                Resource: '*'
              - Effect: Allow
                Action: 'elasticache:list*'
                Resource: '*'
              - Effect: Allow
                Action: 'elasticloadbalancing:describe*'
                Resource: '*'
              - Effect: Allow
                Action: 'es:describe*'
                Resource: '*'
              - Effect: Allow
                Action: 'es:list*'
                Resource: '*'
              - Effect: Allow
                Action: 'events:describe*'
                Resource: '*'
              - Effect: Allow
                Action: 'events:list*'
                Resource: '*'
              - Effect: Allow
                Action: 'firehose:describe*'
                Resource: '*'
              - Effect: Allow
                Action: 'firehose:list*'
                Resource: '*'
              - Effect: Allow
                Action: 'glacier:describe*'
                Resource: '*'
              - Effect: Allow
                Action: 'glacier:getDataRetrievalPolicy'
                Resource: '*'
              - Effect: Allow
                Action: 'glacier:getVaultAccessPolicy'
                Resource: '*'
              - Effect: Allow
                Action: 'glacier:getVaultLock'
                Resource: '*'
              - Effect: Allow
                Action: 'glacier:getVaultNotifications'
                Resource: '*'
              - Effect: Allow
                Action: 'glacier:listTagsForVault'
                Resource: '*'
              - Effect: Allow
                Action: 'glacier:listVaults'
                Resource: '*'
              - Effect: Allow
                Action: 'iot:describe*'
                Resource: '*'
              - Effect: Allow
                Action: 'iot:get*'
                Resource: '*'
              - Effect: Allow
                Action: 'iot:list*'
                Resource: '*'
              - Effect: Allow
                Action: 'kinesis:describe*'
                Resource: '*'
              - Effect: Allow
                Action: 'kinesis:list*'
                Resource: '*'
              - Effect: Allow
                Action: 'kinesisanalytics:describe*'
                Resource: '*'
              - Effect: Allow
                Action: 'kinesisanalytics:list*'
                Resource: '*'
              - Effect: Allow
                Action: 'lambda:listFunctions'
                Resource: '*'
              - Effect: Allow
                Action: 'lambda:listTags'
                Resource: '*'
              - Effect: Allow
                Action: 'memorydb:describe*'
                Resource: '*'
              - Effect: Allow
                Action: 'memorydb:list*'
                Resource: '*'
              - Effect: Allow
                Action: 'neptune-db:describe*'
                Resource: '*'
              - Effect: Allow
                Action: 'neptune-db:list*'
                Resource: '*'
              - Effect: Allow
                Action: 'qldb:list*'
                Resource: '*'
              - Effect: Allow
                Action: 'qldb:describe*'
                Resource: '*'
              - Effect: Allow
                Action: 'rds:describe*'
                Resource: '*'
              - Effect: Allow
                Action: 'rds:list*'
                Resource: '*'
              - Effect: Allow
                Action: 'route53:list*'
                Resource: '*'
              - Effect: Allow
                Action: 'route53:get*'
                Resource: '*'
              - Effect: Allow
                Action: 's3:getBucket*'
                Resource: '*'
              - Effect: Allow
                Action: 's3:list*'
                Resource: '*'
              - Effect: Allow
                Action: 'sdb:domainMetadata'
                Resource: '*'
              - Effect: Allow
                Action: 'sdb:get*'
                Resource: '*'
              - Effect: Allow
                Action: 'sdb:list*'
                Resource: '*'
              - Effect: Allow
                Action: 'sns:get*'
                Resource: '*'
              - Effect: Allow
                Action: 'sns:list*'
                Resource: '*'
              - Effect: Allow
                Action: 'sqs:get*'
                Resource: '*'
              - Effect: Allow
                Action: 'sqs:list*'
                Resource: '*'
              - Effect: Allow
                Action: 'states:*'
                Resource: '*'
              - Effect: Allow
                Action: 'tag:get*'
                Resource: '*'
              - Effect: Allow
                Action: 'timestream:describe*'
                Resource: '*'
              - Effect: Allow
                Action: 'timestream:list*'
                Resource: '*'
        - PolicyName: Logs
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: 'logs:deleteSubscriptionFilter'
                Resource: '*'
              - Effect: Allow
                Action: 'logs:describeLogStreams'
                Resource: '*'
              - Effect: Allow
                Action: 'logs:describeSubscriptionFilters'
                Resource: '*'
              - Effect: Allow
                Action: 'logs:filterLogEvents'
                Resource: '*'
              - Effect: Allow
                Action: 'logs:putSubscriptionFilter'
                Resource: '*'
              - Effect: Allow
                Action: 'logs:startQuery'
                Resource: '*'
              - Effect: Allow
                Action: 'logs:stopQuery'
                Resource: '*'
              - Effect: Allow
                Action: 'logs:getQueryResults'
                Resource: '*'
              - Effect: Allow
                Action: 'logs:getLogRecord'
                Resource: '*'
              - Effect: Allow
                Action: 'logs:describeQueries'
                Resource: '*'
              - Effect: Allow
                Action: 'logs:describeQueryDefinitions'
                Resource: '*'
        - PolicyName: Metrics
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: 'cloudwatch:get*'
                Resource: '*'
        - PolicyName: Traces
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: 'xray:batch*'
                Resource: '*'
              - Effect: Allow
                Action: 'xray:get*'
                Resource: '*'

Parameters:
  ExternalId:
    Description: 'The external ID for the Dashbird delegation role'
    Type: String
  DashbirdSNSTopic:
    Description: 'Dashbird role stack callback (default is delegations-cloudformation-callbacks)'
    Default: delegations-cloudformation-callbacks
    Type: String
  DashbirdAWSAccount:
    Description: 'Dashbird AWS account for stack callback'
    Default: '458024764010'
    Type: String
  DashbirdAccountId:
    Description: 'Customer Dashbird account ID'
    Type: String
  DashbirdDelegationName:
    Description: 'Customer Dashbird delegation name'
    Type: String
    Default: Production

Outputs:
  Version:
    Description: Dashbird CF template version
    Value: '2022-09-19'
  DashbirdDelegationRoleArn:
    Description: 'The ARN for the Dashbird delegation role'
    Value: !GetAtt DashbirdDelegationRole.Arn
