AWSTemplateFormatVersion: 2010-09-09
Description: Create the Heeler role in single account deployment.
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      -
        Label:
          default: Assume Role Information
        Parameters:
          - MemberRoleName
          - ExternalId
          - HeelerSecurityRoleArn
    ParameterLabels:
      MemberRoleName:
        default: "Heeler Role Name (Required)"
      ExternalId:
        default: "External Id (Recommended)"
      HeelerSecurityRoleArn:
        default: "Role ARN provided by Heeler Security"

Parameters:
  MemberRoleName:
    Type: String
    Default: heeler-member
    AllowedPattern: ^[a-zA-Z0-9\-]*$
    Description: The name of the role that Heeler will assume (limited to alphanumeric and hyphen characters).
  ExternalId:
    Type: String
    Description: ExternalId to use when assuming the role in the parent account.
  HeelerSecurityRoleArn:
    Type: String
    Default: arn:aws:iam::168777450829:role/prod-1-role
    Description: The role ARN provided by Heeler Security, which will be included in the Management Role trust policy.

Resources:
  HeelerMemberReadOnlyPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: Heeler
      Description: Heeler policy that denies access to certain actions and allows Lambda GetFunction and SSM SendCommand
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Deny
            Resource: "*"
            Action:
              - "cloudformation:GetTemplate"
              - "dynamodb:GetItem"
              - "dynamodb:BatchGetItem"
              - "dynamodb:Query"
              - "dynamodb:Scan"
              - "ec2:GetConsoleOutput"
              - "ec2:GetConsoleScreenshot"
              - "kinesis:Get*"
              - "logs:GetLogEvents"
              - "s3:GetObject"
              - "sdb:Select*"
              - "sqs:ReceiveMessage"
          - Effect: Allow
            Resource: "*"
            Action:
              - "lambda:GetFunction"
              - "ssm:SendCommand"

  HeelerMember:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: !Ref MemberRoleName
      Description: Role that the Heeler Security role will assume to fetch resources and allow API access to EKS clusters
      MaxSessionDuration: 28800
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/ReadOnlyAccess"
        - !GetAtt HeelerMemberReadOnlyPolicy.PolicyArn
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Ref HeelerSecurityRoleArn
            Action:
              - "sts:AssumeRole"
            Condition:
              StringEquals:
                sts:ExternalId: !Ref ExternalId
            Sid: AssumeRolewithCondition
          - Effect: Allow
            Principal:
              AWS: !Ref HeelerSecurityRoleArn
            Action: "sts:TagSession"
            Sid: TagSession

  HeelerMemberEKSPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: HeelerEKS
      Description: Heeler policy that allows configuring API access to EKS clusters
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - "eks:TagResource"
            Resource: "*"
          - Effect: Allow
            Action:
              - "eks:CreateAccessEntry"
            Resource: "*"
            Condition:
              ArnEquals:
                "eks:principalArn": !GetAtt HeelerMember.Arn
          - Effect: "Allow"
            Action:
              - "eks:AssociateAccessPolicy"
            Resource: "*"
            Condition:
              ArnEquals:
                "eks:policyArn": "arn:aws:eks::aws:cluster-access-policy/AmazonEKSAdminViewPolicy"
      Roles:
        - !Ref HeelerMember

Outputs:
  MemberRoleName:
    Value: !Ref MemberRoleName
    Description: The ARN of the Heeler member role.