AWSTemplateFormatVersion: '2010-09-09'
Description: >-
  IAM Role for Openbridge to access the customer account for CloudFormation deployments 
  and Amazon Notifications API integration, including SQS queue creation with customer read access

Parameters:
  RoleName:
    Type: String
    Default: openbridge-customer-cloudformation-notifications
    Description: Name of the IAM role to be created

Resources:
  CustomerCloudFormationRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref RoleName
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: AllowAssumeRole
            Effect: Allow
            Principal:
              AWS:
                - arn:aws:iam::791778434480:role/customer-cloudformation-production
            Action: sts:AssumeRole
          - Sid: AllowNotificationsAPIAssumeRole
            Effect: Allow
            Principal:
              AWS: arn:aws:iam::437568002678:root
            Action: sts:AssumeRole

  CustomerCloudFormationRolePolicies:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: cloudformation-and-notifications
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - cloudformation:CreateStack
              - cloudformation:DescribeStacks
              - cloudformation:DescribeStackEvents
              - cloudformation:DescribeStackResources
              - cloudformation:GetTemplate
              - cloudformation:ListStackResources
              - cloudformation:ValidateTemplate
              - cloudformation:UpdateStack
              - sqs:*
            Resource: '*'
          - Effect: Allow
            Action:
              - kms:GenerateDataKey
              - kms:Decrypt
            Resource: !GetAtt NotificationsAPIKMSKey.Arn
      Roles:
        - !Ref CustomerCloudFormationRole

  NotificationsAPISQSQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: !Sub ${AWS::StackName}-notifications-api-queue
      KmsMasterKeyId: !Ref NotificationsAPIKMSKey

  NotificationsAPISQSQueuePolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      Queues: 
        - !Ref NotificationsAPISQSQueue
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: '437568002678'
            Action: 
              - sqs:SendMessage
              - sqs:GetQueueAttributes
            Resource: !GetAtt NotificationsAPISQSQueue.Arn
          - Effect: Allow
            Principal:
              AWS: arn:aws:iam::791778434480:root
            Action:
              - sqs:ReceiveMessage
              - sqs:DeleteMessage
              - sqs:GetQueueAttributes
              - sqs:ChangeMessageVisibility
            Resource: !GetAtt NotificationsAPISQSQueue.Arn

  NotificationsAPIKMSKey:
    Type: AWS::KMS::Key
    Properties:
      Description: !Sub KMS key for ${AWS::StackName} Notifications API SQS encryption
      KeyPolicy:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
            Action: kms:*
            Resource: '*'
          - Effect: Allow
            Principal:
              AWS: arn:aws:iam::437568002678:root
            Action:
              - kms:GenerateDataKey
              - kms:Decrypt
            Resource: '*'
          - Effect: Allow
            Principal:
              AWS: arn:aws:iam::791778434480:root
            Action:
              - kms:Decrypt
            Resource: '*'

Outputs:
  RoleArn:
    Description: IAM Role ARN
    Value: !GetAtt CustomerCloudFormationRole.Arn
  SQSQueueUrl:
    Description: SQS Queue URL
    Value: !Ref NotificationsAPISQSQueue
  SQSQueueArn:
    Description: SQS Queue ARN
    Value: !GetAtt NotificationsAPISQSQueue.Arn
  KMSKeyId:
    Description: KMS Key ID
    Value: !Ref NotificationsAPIKMSKey
  KMSKeyArn:
    Description: KMS Key ARN
    Value: !GetAtt NotificationsAPIKMSKey.Arn
