AWSTemplateFormatVersion: "2010-09-09"
Description: awsutopia control-plane role (assume-role only; no long-lived keys)

Parameters:
  ExternalId:
    Type: String
    Description: Confused-deputy protection — must match dashboard connect form
  ControlPlanePrincipalArn:
    Type: String
    Description: IAM principal of the awsutopia control plane that may AssumeRole

Resources:
  UtopiaControlPlaneRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: awsutopia-control-plane
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Ref ControlPlanePrincipalArn
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                sts:ExternalId: !Ref ExternalId
      Policies:
        - PolicyName: UtopiaMvpAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - s3:*
                  - ssm:*
                  - lambda:*
                  - iam:PassRole
                  - iam:GetRole
                  - iam:CreateRole
                  - iam:AttachRolePolicy
                  - iam:PutRolePolicy
                  - iam:TagRole
                  - logs:DescribeLogGroups
                  - logs:FilterLogEvents
                  - ce:GetCostAndUsage
                  - ce:GetCostAndUsageWithResources
                  - ce:GetTags
                  - ce:GetDimensionValues
                  - sts:GetCallerIdentity
                Resource: "*"

Outputs:
  RoleArn:
    Description: Paste into awsutopia dashboard Connect account
    Value: !GetAtt UtopiaControlPlaneRole.Arn
  ExternalId:
    Description: Must match the ExternalId in the dashboard form
    Value: !Ref ExternalId