AWSTemplateFormatVersion: "2010-09-09"
Description: >
  Cloud Cost Clinic read-only scanner role. This stack creates a customer-owned
  IAM role that Cloud Cost Clinic can assume with an external ID to collect
  cost, metric, and resource metadata. It does not grant write, delete, stop,
  start, resize, secrets, or application-data permissions.

Parameters:
  ScannerAwsAccountId:
    Type: String
    Description: AWS account ID that runs the Cloud Cost Clinic scanner backend.
    AllowedPattern: "^[0-9]{12}$"
    ConstraintDescription: Enter a 12-digit AWS account ID.

  ExternalId:
    Type: String
    Description: External ID generated by Cloud Cost Clinic for this connection.
    MinLength: 8
    MaxLength: 256
    AllowedPattern: "^[A-Za-z0-9+=,.@:_/-]+$"
    ConstraintDescription: Use only letters, numbers, and common IAM external ID characters.

  RoleName:
    Type: String
    Default: CloudCostClinicReadOnlyScannerRole
    Description: Name for the read-only role created in this AWS account.
    MinLength: 1
    MaxLength: 64
    AllowedPattern: "^[A-Za-z0-9+=,.@_-]+$"

Resources:
  CloudCostClinicReadOnlyRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref RoleName
      Description: Read-only role for Cloud Cost Clinic cost and resource review scans.
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub "arn:${AWS::Partition}:iam::${ScannerAwsAccountId}:root"
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                sts:ExternalId: !Ref ExternalId
      ManagedPolicyArns:
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/job-function/ViewOnlyAccess"
      Policies:
        - PolicyName: CloudCostClinicCostAndOptimizerReadPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Sid: BillingAndCostGuardrailRead
                Effect: Allow
                Action:
                  - billing:GetBillingViewData
                  - budgets:ViewBudget
                  - ce:GetCostAndUsage
                  - ce:Get*
                  - compute-optimizer:Get*
                  - cloudtrail:DescribeTrails
                  - cloudtrail:GetEventSelectors
                  - cloudtrail:GetTrailStatus
                Resource: "*"
              - Sid: ContainerRegistryLifecycleRead
                Effect: Allow
                Action:
                  - ecr:GetLifecyclePolicy
                Resource: !Sub "arn:${AWS::Partition}:ecr:*:${AWS::AccountId}:repository/*"

Outputs:
  RoleArn:
    Description: Give this role ARN back to Cloud Cost Clinic to enable read-only scans.
    Value: !GetAtt CloudCostClinicReadOnlyRole.Arn

  ExternalIdConfigured:
    Description: Confirms that the stack configured the external ID condition.
    Value: "true"

  ScannerAwsAccountId:
    Description: Cloud Cost Clinic scanner AWS account trusted by this role.
    Value: !Ref ScannerAwsAccountId
