# * Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.
# *
# * Permission is hereby granted, free of charge, to any person obtaining a copy of this
# * software and associated documentation files (the "Software"), to deal in the Software
# * without restriction, including without limitation the rights to use, copy, modify,
# * merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
# * permit persons to whom the Software is furnished to do so.
# *
# * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
# * INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
# * PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
# * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
# * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
# * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

AWSTemplateFormatVersion: 2010-09-09
Description: Create Service Catalog Product Role
Parameters:
  ProductRoleName:
    Description: Product IAM Role Name
    Type: String
  ProductPolicyName:
    Description: Product IAM Role Name
    Type: String

Resources:
  ProductRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Ref ProductRoleName
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - servicecatalog.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /
      ManagedPolicyArns:
        - !Sub 'arn:aws:iam::${AWS::AccountId}:policy/${ProductPolicyName}'
      Policies:
        -
          PolicyName: "S3"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              -
                Effect: "Allow"
                Action:
                  - "s3:GetLifecycleConfiguration"
                  - "s3:GetInventoryConfiguration"
                  - "s3:PutAnalyticsConfiguration"
                  - "s3:PutAccelerateConfiguration"
                  - "s3:ListBucketVersions"
                  - "s3:GetBucketLogging"
                  - "s3:CreateBucket"
                  - "s3:GetAccelerateConfiguration"
                  - "s3:PutEncryptionConfiguration"
                  - "s3:GetEncryptionConfiguration"
                  - "s3:PutLifecycleConfiguration"
                  - "s3:GetMetricsConfiguration"
                  - "s3:DeleteBucket"
                  - "s3:PutBucketVersioning"
                  - "s3:GetBucketPublicAccessBlock"
                  - "s3:PutBucketPublicAccessBlock"
                  - "s3:PutAccountPublicAccessBlock"
                  - "s3:PutMetricsConfiguration"
                  - "s3:GetBucketVersioning"
                  - "s3:GetBucketNotification"
                  - "s3:PutInventoryConfiguration"
                  - "s3:PutBucketNotification"
                  - "s3:GetAccountPublicAccessBlock"
                  - "s3:PutBucketLogging"
                  - "s3:GetAnalyticsConfiguration"
                Resource: "*"

Outputs:
  ProductRoleArn:
    Value: !GetAtt ProductRole.Arn