AWSTemplateFormatVersion: '2010-09-09'
Description: Vectra Security Hub User version 1.2
Resources:
  user:
    Properties:
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - securityhub:BatchImportFindings
                  - securityhub:GetFindings
                  - securityhub:UpdateFindings
                Effect: Allow
                Resource:
                  - '*'
                Sid: CreateDeleteAndRetrieveSecurityHubFindings
              - Action:
                  - sts:GetCallerIdentity
                  - iam:SimulatePrincipalPolicy
                  - securityhub:DescribeProducts
                  - securityhub:ListEnabledProductsForImport
                Effect: Allow
                Resource:
                  - '*'
                Sid: GetCallerIdentity
              - Action:
                  - securityhub:EnableImportFindingsForProduct
                  - securityhub:DisableImportFindingsForProduct
                Effect: Allow
                Resource:
                  - !Join
                    - ''
                    - - 'arn:'
                      - !Ref 'AWS::Partition'
                      - ':securityhub:*:'
                      - !Ref 'AWS::AccountId'
                      - :hub/default
                Sid: EnableVectraProduct
            Version: '2012-10-17'
          PolicyName: vectra_security_hub_permissions
      UserName: VectraCognitoSecurityHubv1
    Type: AWS::IAM::User
