AWSTemplateFormatVersion: '2010-09-09'
Description: >
  Read-only IAM role for FinOps Dash to inventory and analyze this AWS
  account's resources via sts:AssumeRole. Generated dynamically from the
  permissions declared by the active collectors — do not edit by hand.

Parameters:
  TrustedPrincipalArn:
    Type: String
    Description: >
      ARN of the IAM user or role in the FinOps Dash account that will
      assume this role (e.g. arn:aws:iam::111122223333:role/finops-dash-app).
    AllowedPattern: '^arn:aws:iam::\d{12}:(role|user)/.+$'
    ConstraintDescription: Must be a valid IAM role or user ARN.
    Default: arn:aws:sts::413467635781:assumed-role/finops-pro-app/botocore-session-1785611394

  RoleName:
    Type: String
    Default: FinOpsDashReadOnlyRole
    Description: Name of the IAM role to create in this account.

Resources:
  FinOpsDashRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref RoleName
      Description: Role assumed by FinOps Dash to read this account's inventory and costs.
      MaxSessionDuration: 3600
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Ref TrustedPrincipalArn
            Action: sts:AssumeRole
      Policies:
        - PolicyName: FinOpsDashReadOnlyPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: CloudwatchReadOnly
                Effect: Allow
                Action:
                  - cloudwatch:GetMetricStatistics
                Resource: '*'
              - Sid: DynamodbReadOnly
                Effect: Allow
                Action:
                  - dynamodb:DescribeTable
                  - dynamodb:ListTables
                  - dynamodb:ListTagsOfResource
                Resource: '*'
              - Sid: Ec2ReadOnly
                Effect: Allow
                Action:
                  - ec2:DescribeAddresses
                  - ec2:DescribeInstances
                  - ec2:DescribeInternetGateways
                  - ec2:DescribeNatGateways
                  - ec2:DescribeReservedInstances
                  - ec2:DescribeSecurityGroups
                  - ec2:DescribeSnapshots
                  - ec2:DescribeSubnets
                  - ec2:DescribeVolumes
                  - ec2:DescribeVpcEndpoints
                  - ec2:DescribeVpcs
                Resource: '*'
              - Sid: ElasticacheReadOnly
                Effect: Allow
                Action:
                  - elasticache:DescribeCacheClusters
                  - elasticache:DescribeReplicationGroups
                  - elasticache:DescribeReservedCacheNodes
                  - elasticache:ListTagsForResource
                Resource: '*'
              - Sid: ElasticfilesystemReadOnly
                Effect: Allow
                Action:
                  - elasticfilesystem:DescribeFileSystems
                  - elasticfilesystem:DescribeLifecycleConfiguration
                  - elasticfilesystem:DescribeTags
                Resource: '*'
              - Sid: ElasticloadbalancingReadOnly
                Effect: Allow
                Action:
                  - elasticloadbalancing:DescribeLoadBalancers
                  - elasticloadbalancing:DescribeTags
                  - elasticloadbalancing:DescribeTargetGroups
                Resource: '*'
              - Sid: EsReadOnly
                Effect: Allow
                Action:
                  - es:DescribeDomains
                  - es:DescribeReservedInstances
                  - es:ListDomainNames
                  - es:ListTags
                Resource: '*'
              - Sid: KmsReadOnly
                Effect: Allow
                Action:
                  - kms:DescribeKey
                  - kms:GetKeyRotationStatus
                  - kms:ListAliases
                  - kms:ListKeys
                  - kms:ListResourceTags
                Resource: '*'
              - Sid: LambdaReadOnly
                Effect: Allow
                Action:
                  - lambda:GetFunctionConfiguration
                  - lambda:ListFunctions
                  - lambda:ListTags
                Resource: '*'
              - Sid: LogsReadOnly
                Effect: Allow
                Action:
                  - logs:DescribeLogGroups
                  - logs:ListTagsForResource
                  - logs:ListTagsLogGroup
                Resource: '*'
              - Sid: RdsReadOnly
                Effect: Allow
                Action:
                  - rds:DescribeDBClusters
                  - rds:DescribeDBInstances
                  - rds:DescribeReservedDBInstances
                  - rds:ListTagsForResource
                Resource: '*'
              - Sid: Route53ReadOnly
                Effect: Allow
                Action:
                  - route53:ListHostedZones
                  - route53:ListResourceRecordSets
                  - route53:ListTagsForResource
                Resource: '*'
              - Sid: S3ReadOnly
                Effect: Allow
                Action:
                  - s3:GetBucketLocation
                  - s3:GetBucketTagging
                  - s3:GetObject
                  - s3:ListAllMyBuckets
                  - s3:ListBucket
                Resource: '*'
              - Sid: SavingsplansReadOnly
                Effect: Allow
                Action:
                  - savingsplans:DescribeSavingsPlans
                Resource: '*'
              - Sid: SecretsmanagerReadOnly
                Effect: Allow
                Action:
                  - secretsmanager:ListSecrets
                Resource: '*'
              - Sid: SnsReadOnly
                Effect: Allow
                Action:
                  - sns:GetTopicAttributes
                  - sns:ListTagsForResource
                  - sns:ListTopics
                Resource: '*'
              - Sid: SqsReadOnly
                Effect: Allow
                Action:
                  - sqs:GetQueueAttributes
                  - sqs:ListQueueTags
                  - sqs:ListQueues
                Resource: '*'

Outputs:
  RoleArn:
    Description: ARN of the role to paste into the "Assume Role ARN" field in FinOps Dash.
    Value: !GetAtt FinOpsDashRole.Arn
  RoleName:
    Description: Name of the created role.
    Value: !Ref RoleName