AWSTemplateFormatVersion: '2010-09-09'
Outputs:
  AirbridgeS3BucketName:
    Description: Name of the created or specified S3 bucket
    Value:
      Ref: AirbridgeS3BucketName
  InstanceProfileName:
    Description: IAM Instance Profile Name
    Value:
      Ref: AirbridgeInstanceProfile
  Region:
    Description: AWS Region where this stack is deployed
    Value:
      Ref: AWS::Region
  RoleArn:
    Description: Configured IAM Role ARN
    Value:
      Fn::GetAtt:
      - AirbridgeUser
      - Arn
Parameters:
  AirbridgeS3BucketName:
    AllowedPattern: ^airbridge-.*
    ConstraintDescription: Must begin with 'airbridge-' prefix.
    Default: airbridge-changethistoauniquename
    Description: Name of the S3 bucket with a prefix of 'airbridge-'
    Type: String
  CustomInstanceProfileName:
    Default: AirbridgeInstanceProfile
    Description: Custom name for the IAM Instance Profile
    Type: String
Resources:
  AirbridgeInstanceProfile:
    Properties:
      InstanceProfileName:
        Ref: CustomInstanceProfileName
      Path: /
      Roles:
      - Ref: AirbridgeUser
    Type: AWS::IAM::InstanceProfile
  AirbridgeS3Bucket:
    Properties:
      BucketName:
        Ref: AirbridgeS3BucketName
    Type: AWS::S3::Bucket
  AirbridgeUser:
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            AWS: arn:aws:iam::791778434480:role/customer-cloudformation-production
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service: ec2.amazonaws.com
        Version: '2012-10-17'
      RoleName:
        Fn::Sub: airbridge-user-${AWS::StackName}
    Type: AWS::IAM::Role
  AirbyteUserPolicy:
    Properties:
      PolicyDocument:
        Statement:
        - Action:
          - logs:DescribeLogGroups
          - logs:DescribeLogStreams
          Effect: Allow
          Resource:
          - Fn::Sub: arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:*
        - Action:
          - logs:CreateLogGroup
          - logs:CreateLogStream
          - logs:PutLogEvents
          Effect: Allow
          Resource:
          - Fn::Sub: arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:airbridge-*
        - Action:
          - s3:AbortMultipartUpload
          - s3:CreateBucket
          - s3:DeleteObject
          - s3:GetBucketLocation
          - s3:GetObject
          - s3:ListBucket
          - s3:ListBucketMultipartUploads
          - s3:PutObject
          - s3:PutObjectAcl
          Effect: Allow
          Resource:
          - Fn::Sub: arn:aws:s3:::${AirbridgeS3BucketName}*
          - Fn::Sub: arn:aws:s3:::${AirbridgeS3BucketName}*/*
        Version: '2012-10-17'
      PolicyName: AirbridgeUserAccessPolicy
      Roles:
      - Ref: AirbridgeUser
    Type: AWS::IAM::Policy
