AWSTemplateFormatVersion: '2010-09-09'
Description: 'Template for AMS Access infrastructure management'

Resources:
  AWSManagedServicesAccessManagement:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: ams-access-management
      AssumeRolePolicyDocument:
            {
                "Version": "2012-10-17",
                "Statement": [
                    {
                        "Effect": "Allow",
                        "Principal": {
                            "Service": "access.managedservices.amazonaws.com"
                        },
                        "Action": "sts:AssumeRole",
                        "Condition": {
                            "StringEquals": {
                                "sts:ExternalId": !Sub "${AWS::AccountId}"
                            }
                        }
                    },
                    {
                        "Effect": "Allow",
                        "Principal": {
                            "Service": "access.managedservices.amazonaws.com"
                        },
                        "Action": "sts:TagSession"
                    }
                ]
            }
      Policies:
        - PolicyName: ams-access-management-policy
          PolicyDocument:
            {
              "Version": "2012-10-17",
              "Statement": [
              {
                "Effect": "Allow",
                "Action": [
                  "iam:*",
                ],
                "Resource": [!Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/ams*",
                             !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:policy/ams*"],
                "Sid": "AllowIAMActions"
              },
              {
                "Effect": "Deny",
                "Action": [
                  "iam:AttachRolePolicy",
                  "iam:DeleteRolePolicy",
                  "iam:DetachRolePolicy",
                  "iam:PutRolePolicy",
                  "iam:UpdateAssumeRolePolicy",
                ],
                "Resource": [!Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/ams-access-management"],
                "Sid": "DenyManagementRoleIAMUpdates"
              },
              {
                "Effect": "Allow",
                "Action": [
                  "cloudformation:*"
                ],
                "Resource": [!Sub "arn:${AWS::Partition}:cloudformation:*:${AWS::AccountId}:*/ams-cdk*",
                             !Sub "arn:${AWS::Partition}:cloudformation:*:${AWS::AccountId}:*/ams-access*"],
                "Sid": "AllowCFNActions"
              },
              {
                "Effect": "Allow",
                "Action": "s3:*",
                "Resource": !Sub "arn:${AWS::Partition}:s3:::ams-cdk*",
                "Sid": "AllowS3Actions"
              },
              {
                "Action": "iam:CreateServiceLinkedRole",
                "Resource": [!Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/aws-service-role/*managedservices.amazonaws.com/*",
                             !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/aws-service-role/triage.security-ir.amazonaws.com/AWSServiceRoleForSecurityIncidentResponse_Triage"],
                "Effect": "Allow",
                "Condition": {
                  "StringLike": {
                    "iam:AWSServiceName": ["*managedservices.amazonaws.com", "triage.security-ir.amazonaws.com"]
                  }
                }
              },
              {
                "Action": "iam:DeleteServiceLinkedRole",
                "Resource": [!Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/aws-service-role/*managedservices.amazonaws.com/*",
                             !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/aws-service-role/triage.security-ir.amazonaws.com/AWSServiceRoleForSecurityIncidentResponse_Triage"],
                "Effect": "Allow"
              },
              {
                "Effect": "Allow",
                "Action": "sts:GetCallerIdentity",
                "Resource": "*",
                "Sid": "AllowSTSActions"
              }
              ]
            }
      Tags:
        - Key: "ams:resourceOwner"
          Value: "AMS"
        - Key: "ams:resourceOwnerService"
          Value: "Access"
        - Key: "ams:stackRegion"
          Value: !Sub "${AWS::Region}"