AWSTemplateFormatVersion: '2010-09-09'
Description: Vectra HostID Federated Assume Role version 1
Outputs:
  ChildAccountRole:
    Description: The role name that will be assumed in all child AWS accounts
    Value: !Ref 'ChildAccountRole'
  ParentAccount:
    Description: The AWS account ID of the parent account
    Value: !Ref 'ParentAccount'
  ParentAccountUser:
    Description: The user name in the parent AWS account
    Value: !Ref 'ParentAccountUser'
Parameters:
  ChildAccountRole:
    Default: VectraCognitoHostID
    Description: The role name that will be assumed in all child AWS accounts
    MaxLength: '64'
    MinLength: '6'
    Type: String
  ParentAccount:
    AllowedPattern: '[0-9]{12}'
    Description: The AWS account ID of the parent account
    Type: String
  ParentAccountUser:
    Default: VectraCognitoHostIDFederated
    Description: The user name in the parent AWS account
    MaxLength: '64'
    MinLength: '6'
    Type: String
Resources:
  role:
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              AWS:
                - !Join
                  - ''
                  - - 'arn:'
                    - !Ref 'AWS::Partition'
                    - ':iam::'
                    - !Ref 'ParentAccount'
                    - :user/
                    - !Ref 'ParentAccountUser'
      MaxSessionDuration: 7200
      Path: /
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - iam:ListAccountAliases
                  - iam:SimulatePrincipalPolicy
                  - ec2:DescribeInstances
                  - ec2:DescribeRegions
                  - ec2:DescribeSubnets
                  - ec2:DescribeTrafficMirrorTargets
                  - ec2:DescribeTrafficMirrorSessions
                  - ec2:DescribeVpcPeeringConnections
                  - ec2:DescribeVpcs
                  - sts:GetCallerIdentity
                Effect: Allow
                Resource:
                  - '*'
            Version: '2012-10-17'
          PolicyName: VectraCognitoHostIDPolicy
      RoleName: !Ref 'ChildAccountRole'
    Type: AWS::IAM::Role
