AWSTemplateFormatVersion: 2010-09-09
Description: IAM role for updating the PantherDeploymentRole

Parameters:
  IdentityAccountId:
    Type: String
    Description: The account ID for the account the deployment role will be assumed from
    Default: ''
  OpsAccountId:
    Type: String
    Description: The second account ID for the account the deployment role will be assumed from.  Used with new deployment tooling
    Default: ''
  DeploymentRoleStackName:
    Type: String
    Description: Name of the CloudFormation stack for the deployment role
    Default: PantherDeploymentRoleStack

Conditions:
  IdentityAccountSpecified: !Not [!Equals [!Ref IdentityAccountId, '']]
  OpsAccountSpecified: !Not [!Equals [!Ref OpsAccountId, '']]

Resources:
  PantherDeploymentUpdaterRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: PantherDeploymentUpdaterRole
      Description: IAM role for updating the PantherDeploymentRole
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS: !If
                - IdentityAccountSpecified
                - !Sub arn:${AWS::Partition}:iam::${IdentityAccountId}:root
                - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:root
            Action: sts:AssumeRole
            Condition:
              Bool:
                aws:SecureTransport: true
          - !If
            - OpsAccountSpecified
            - Effect: Allow
              Principal:
                AWS: !Sub arn:${AWS::Partition}:iam::${OpsAccountId}:role/PulumiCodeBuild
              Action: sts:AssumeRole
              Condition:
                Bool:
                  aws:SecureTransport: true
            - !Ref AWS::NoValue
          - Effect: Allow
            Principal:
              Service: cloudformation.amazonaws.com
            Action: sts:AssumeRole
            Condition:
              Bool:
                aws:SecureTransport: true
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/ReadOnlyAccess
      Tags:
        - Key: panther:app
          Value: panther

  PantherDeploymentRoleUpdaterPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: PantherDeploymentRoleUpdater
      Roles:
        - !Ref PantherDeploymentUpdaterRole
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - cloudformation:ContinueUpdateRollback
              - cloudformation:CreateChangeSet
              - cloudformation:CreateStack
              - cloudformation:DeleteChangeSet
              - cloudformation:DescribeStacks
              - cloudformation:ExecuteChangeSet
              - cloudformation:ListStacks
            Resource:
              - !Sub arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${DeploymentRoleStackName}/*
          - Effect: Allow
            Action:
              - iam:AttachRolePolicy
              - iam:CreatePolicy
              - iam:CreatePolicyVersion
              - iam:DeletePolicy
              - iam:DeletePolicyVersion
              - iam:DeleteRolePolicy
              - iam:DetachRolePolicy
              - iam:GetPolicy
              - iam:GetPolicyVersion
              - iam:ListPolicyVersions
              - iam:ListRoleTags
              - iam:PutRolePolicy
              - iam:TagRole
              - iam:UpdateAssumeRolePolicy
              - iam:UntagRole
            Resource:
              - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/PantherDeploymentRole*
              - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:policy/Panther*

Outputs:
  PantherDeploymentUpdaterRoleArn:
    Value: !GetAtt PantherDeploymentUpdaterRole.Arn
