AWSTemplateFormatVersion: "2010-09-09"

Description: >-
  Customer-account prerequisites for the Openbridge SP-API notification routes.
  Creates the role assumed by the Openbridge API, the Firehose S3 delivery role,
  and the EventBridge-to-Firehose invocation role. The management role can also
  provision the per-subscription SQS, EventBridge Pipe, Firehose, IAM, and log
  resources used by SQS notifications.

Parameters:
  ManagementRoleName:
    Type: String
    Default: openbridge-spapi-cf-manager
    Description: Name of the customer role returned as role_arn to the API.

  EventBridgeToFirehoseRoleName:
    Type: String
    Default: openbridge-eventbridge-to-firehose-role
    Description: Name of the role returned as eb_to_fh_role_arn to the API.

Resources:
  FirehoseDeliveryRole:
    Type: AWS::IAM::Role
    Properties:
      # ServiceSPAPINotificationsEventBridgeView currently requires this exact name.
      RoleName: openbridge-spapi-firehose-role
      Description: Allows Openbridge SP-API Firehose streams to deliver records to S3.
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: AllowFirehoseAssumeRole
            Effect: Allow
            Principal:
              Service: firehose.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: deliver-spapi-notifications-to-s3
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Sid: AccessNotificationBucket
                Effect: Allow
                Action:
                  - s3:AbortMultipartUpload
                  - s3:GetBucketLocation
                  - s3:GetObject
                  - s3:ListBucket
                  - s3:ListBucketMultipartUploads
                  - s3:PutObject
                Resource:
                  - !Sub arn:${AWS::Partition}:s3:::ob-sp-notifications-${AWS::AccountId}-${AWS::Region}
                  - !Sub arn:${AWS::Partition}:s3:::ob-sp-notifications-${AWS::AccountId}-${AWS::Region}/*

  EventBridgeToFirehoseRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref EventBridgeToFirehoseRoleName
      Description: Allows SP-API partner EventBridge rules to invoke Firehose.
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: AllowEventBridgeAssumeRole
            Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: put-spapi-notifications-to-firehose
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Sid: PutRecords
                Effect: Allow
                Action:
                  - firehose:PutRecord
                  - firehose:PutRecordBatch
                Resource: !Sub >-
                  arn:${AWS::Partition}:firehose:${AWS::Region}:${AWS::AccountId}:deliverystream/ob-sp-notifications-fh-*

  ApiManagementRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref ManagementRoleName
      Description: Allows the Openbridge API to manage SP-API EventBridge and SQS notification routes.
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: AllowOpenbridgeApiAssumeRole
            Effect: Allow
            Principal:
              AWS:
                - arn:aws:iam::791778434480:role/customer-cloudformation-production
                - arn:aws:iam::360832902187:role/customer-cloudformation-dev
            Action: sts:AssumeRole
      Policies:
        - PolicyName: manage-spapi-eventbridge-route
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Sid: ValidateFirehoseRole
                Effect: Allow
                Action: iam:GetRole
                Resource: !GetAtt FirehoseDeliveryRole.Arn

              - Sid: PassFirehoseDeliveryRole
                Effect: Allow
                Action: iam:PassRole
                Resource: !GetAtt FirehoseDeliveryRole.Arn
                Condition:
                  StringEquals:
                    iam:PassedToService: firehose.amazonaws.com

              - Sid: PassEventBridgeInvocationRole
                Effect: Allow
                Action: iam:PassRole
                Resource: !GetAtt EventBridgeToFirehoseRole.Arn
                Condition:
                  StringEquals:
                    iam:PassedToService: events.amazonaws.com

              - Sid: CreatePartnerEventBus
                Effect: Allow
                Action: events:CreateEventBus
                Resource: !Sub >-
                  arn:${AWS::Partition}:events:${AWS::Region}:${AWS::AccountId}:event-bus/aws.partner/sellingpartnerapi.amazon.com/${AWS::AccountId}/*

              - Sid: ManageNotificationRules
                Effect: Allow
                Action:
                  - events:DeleteRule
                  - events:PutRule
                  - events:PutTargets
                  - events:RemoveTargets
                Resource: !Sub >-
                  arn:${AWS::Partition}:events:${AWS::Region}:${AWS::AccountId}:rule/aws.partner/sellingpartnerapi.amazon.com/${AWS::AccountId}/*/ob-sp-notifications-rule-*

              - Sid: ManageNotificationBucket
                Effect: Allow
                Action:
                  - s3:CreateBucket
                  - s3:GetBucketNotification
                  - s3:PutBucketNotification
                  - s3:PutBucketPolicy
                  - s3:PutBucketPublicAccessBlock
                  - s3:PutEncryptionConfiguration
                  - s3:PutLifecycleConfiguration
                Resource:
                  - !Sub arn:${AWS::Partition}:s3:::ob-sp-notifications-${AWS::AccountId}-${AWS::Region}

              - Sid: ManageNotificationQueues
                Effect: Allow
                Action:
                  - sqs:CreateQueue
                  - sqs:DeleteQueue
                  - sqs:GetQueueAttributes
                  - sqs:GetQueueUrl
                  - sqs:SetQueueAttributes
                Resource: !Sub >-
                  arn:${AWS::Partition}:sqs:${AWS::Region}:${AWS::AccountId}:ob-sp-notifications-*

              - Sid: ManageNotificationDeliveryStreams
                Effect: Allow
                Action:
                  - firehose:CreateDeliveryStream
                  - firehose:DeleteDeliveryStream
                Resource: !Sub >-
                  arn:${AWS::Partition}:firehose:${AWS::Region}:${AWS::AccountId}:deliverystream/ob-sp-notifications-*

              - Sid: ManageSqsNotificationPipes
                Effect: Allow
                Action:
                  - pipes:CreatePipe
                  - pipes:DeletePipe
                  - pipes:UpdatePipe
                Resource: !Sub >-
                  arn:${AWS::Partition}:pipes:${AWS::Region}:${AWS::AccountId}:pipe/ob-sp-notifications-*

              - Sid: ManageSqsNotificationLogGroups
                Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:DeleteLogGroup
                  - logs:PutRetentionPolicy
                Resource:
                  - !Sub arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/kinesisfirehose/ob-sp-notifications-*
                  - !Sub arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/vendedlogs/pipes/ob-sp-notifications-*

              - Sid: ManageSqsNotificationRoles
                Effect: Allow
                Action:
                  - iam:CreateRole
                  - iam:DeleteRole
                  - iam:DeleteRolePolicy
                  - iam:GetRole
                  - iam:PutRolePolicy
                  - iam:UpdateAssumeRolePolicy
                Resource:
                  - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/Amazon_EventBridge_Pipe_ob-sp-notifications-*
                  - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/Amazon_Firehose_ob-sp-notifications-*

              - Sid: PassSqsNotificationPipeRoles
                Effect: Allow
                Action: iam:PassRole
                Resource: !Sub >-
                  arn:${AWS::Partition}:iam::${AWS::AccountId}:role/Amazon_EventBridge_Pipe_ob-sp-notifications-*
                Condition:
                  StringEquals:
                    iam:PassedToService: pipes.amazonaws.com

              - Sid: PassSqsNotificationFirehoseRoles
                Effect: Allow
                Action: iam:PassRole
                Resource: !Sub >-
                  arn:${AWS::Partition}:iam::${AWS::AccountId}:role/Amazon_Firehose_ob-sp-notifications-*
                Condition:
                  StringEquals:
                    iam:PassedToService: firehose.amazonaws.com

Outputs:
  ManagementRoleArn:
    Description: Supply this value as role_arn in the API request.
    Value: !GetAtt ApiManagementRole.Arn

  EventBridgeToFirehoseRoleArn:
    Description: Supply this value as eb_to_fh_role_arn in the API request.
    Value: !GetAtt EventBridgeToFirehoseRole.Arn

  FirehoseDeliveryRoleArn:
    Description: Fixed role discovered and used internally by the API.
    Value: !GetAtt FirehoseDeliveryRole.Arn
