AWSTemplateFormatVersion: 2010-09-09
Parameters:
  ExternalID:
    Type: String
    Default: YourExternalID
    Description: External ID secret
Resources:
  iotRole:
    Type: 'AWS::IAM::Role'
    Properties:
      Policies:
        - PolicyName: iamAttachRolePolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - 'iam:UpdateServiceSpecificCredential'
                  - 'iam:PassRole'
                  - 'iam:ResetServiceSpecificCredential'
                Resource: '*'
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: 'sts:AssumeRole'
          - Effect: Allow
            Principal:
              Service: greengrass.amazonaws.com
            Action: 'sts:AssumeRole'
          - Effect: Allow
            Principal:
              AWS: 'arn:aws:iam::921779095203:user/iot_platform_prod'
            Action: 'sts:AssumeRole'
            Condition:
              StringEquals:
                'sts:ExternalId': !Ref ExternalID
        Version: 2012-10-17
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/AWSLambda_FullAccess'
        - 'arn:aws:iam::aws:policy/service-role/GreengrassOTAUpdateArtifactAccess'
        - 'arn:aws:iam::aws:policy/CloudWatchFullAccess'
        - >-
          arn:aws:iam::aws:policy/service-role/AWSGreengrassResourceAccessRolePolicy
        - 'arn:aws:iam::aws:policy/AWSIoTFullAccess'
        - 'arn:aws:iam::aws:policy/AWSGreengrassFullAccess'
    Metadata:
      'AWS::CloudFormation::Designer':
        id: ee09ff7b-5f50-40a7-b5cd-d41591410b63
  # This role is needed by Greengrass V2 to perform certain actions on AWS
  # Because this role has a fixed name (GreengrassV2TokenExchangeRole) that is referenced
  # by Greengrass, this stack can only be deployed once to your AWS account
  GreengrassV2TokenExchangeRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: 'GreengrassV2TokenExchangeRole'
      Policies:
        - PolicyName: GreengrassV2TokenExchangeRoleAccess
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - 'iot:DescribeCertificate'
                  - 'logs:CreateLogGroup'
                  - 'logs:CreateLogStream'
                  - 'logs:PutLogEvents'
                  - 'logs:DescribeLogStreams'
                  - 's3:GetBucketLocation'
                Resource: '*'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: credentials.iot.amazonaws.com
            Action: 'sts:AssumeRole'
    Metadata:
      'AWS::CloudFormation::Designer':
        id: ee09ff7b-5f50-40a7-b5cd-d41591410b63
Outputs:
  EdgeIQInstallRole:
    Description: Role to pass to EdgeIQ to install Greengrass resources
    Value: !GetAtt iotRole.Arn
    Export:
      Name: EdgeIQInstallRole