AWSTemplateFormatVersion: '2010-09-09'
Description: Vectra HostID Federated User version 1
Outputs:
  ChildAccountRole:
    Description: The role name that will be assumed in all child AWS accounts
    Value: !Ref 'ChildAccountRole'
  ParentAccountUser:
    Description: The user name in the parent AWS account
    Value: !Ref 'ParentAccountUser'
Parameters:
  ChildAccountRole:
    Default: VectraCognitoHostID
    Description: The role name that will be assumed in all child AWS accounts
    MaxLength: '64'
    MinLength: '6'
    Type: String
  ParentAccountUser:
    Default: VectraCognitoHostIDFederated
    Description: The user name in the parent AWS account
    MaxLength: '64'
    MinLength: '6'
    Type: String
Resources:
  user:
    Properties:
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - sts:AssumeRole
                Effect: Allow
                Resource:
                  - !Join
                    - ''
                    - - 'arn:'
                      - !Ref 'AWS::Partition'
                      - :iam::*:role/
                      - !Ref 'ChildAccountRole'
            Version: '2012-10-17'
          PolicyName: VectraCognitoHostID
        - PolicyDocument:
            Statement:
              - Action:
                  - iam:SimulatePrincipalPolicy
                  - sts:GetCallerIdentity
                  - iam:ListAccountAliases
                Effect: Allow
                Resource:
                  - '*'
            Version: '2012-10-17'
          PolicyName: VectraCognitoInspectionPolicy
      UserName: !Ref 'ParentAccountUser'
    Type: AWS::IAM::User
