AWSTemplateFormatVersion: '2010-09-09'
Description: AWS CloudFormation to deploy SageMaker annotations and modeling resources
Resources:
  AnnotationS3Bucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      BucketName: !Sub sagemaker-groundtruth-dicom-${AWS::AccountId}
      BucketEncryption: 
        ServerSideEncryptionConfiguration: 
        - ServerSideEncryptionByDefault:
            SSEAlgorithm: AES256
      VersioningConfiguration:
        Status: Enabled
  SMGTLabelingExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub SMGTLabelingExecutionRole-${AWS::AccountId}
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - sagemaker.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonS3FullAccess
        - arn:aws:iam::aws:policy/AmazonSageMakerFullAccess
        - arn:aws:iam::aws:policy/AWSLambda_FullAccess
      Path: /
Outputs:
  SMGTLabelingExecutionRole:
    Description: SageMaker GroundTruth Labeling IAM Role
    Value: !GetAtt 'SMGTLabelingExecutionRole.Arn'
  SageMakerAnnotationS3Bucket:
    Value: !Ref AnnotationS3Bucket