#  Copyright 2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
#  Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with
#  the License. A copy of the License is located at
#      http://aws.amazon.com/apache2.0/
#  or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
#  CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and
#  limitations under the License.

AWSTemplateFormatVersion: '2010-09-09'
Description: Creates a CMK in KMS and grants access to other accounts
Parameters:
  ServiceName:
    Description: Name of the microservice
    Type : String
    Default: "admin-resources"
  ProductionAccount:
    Description: AWS AccountNumber for production
    Type : 'AWS::SSM::Parameter::Value<String>'
    Default: ProductionAccount
  TemplateBucket:
    Description: Name of S3 bucket that contains the admin templates
    Type : 'AWS::SSM::Parameter::Value<String>'
    Default: TemplateBucket
Resources:
  KMSKey:
    Type: AWS::KMS::Key
    Properties:
      Description: Used by Assumed Roles in Dev/Test/Prod accounts to Encrypt/Decrypt code
      EnableKeyRotation: true
      KeyPolicy:
        Version: "2012-10-17"
        Id: !Ref AWS::StackName
        Statement:
          -
            Sid: Allows admin of the key
            Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
            Action:
              - "kms:Create*"
              - "kms:Describe*"
              - "kms:Enable*"
              - "kms:List*"
              - "kms:Put*"
              - "kms:Update*"
              - "kms:Revoke*"
              - "kms:Disable*"
              - "kms:Get*"
              - "kms:Delete*"
              - "kms:ScheduleKeyDeletion"
              - "kms:CancelKeyDeletion"
            Resource: "*"
          -
            Sid: Allow use of the key for CryptoGraphy Lambda
            Effect: Allow
            Principal:
              AWS:
                - !Sub arn:aws:iam::${ProductionAccount}:root
                - !Sub arn:aws:iam::${AWS::AccountId}:root
            Action:
              - kms:Encrypt
              - kms:Decrypt
              - kms:ReEncrypt*
              - kms:GenerateDataKey*
              - kms:DescribeKey
            Resource: "*"
  KMSAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: !Sub alias/codepipeline-admin-crossaccounts
      TargetKeyId: !Ref KMSKey
  ArtifactBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${ServiceName}-lambda-role
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          Effect: Allow
          Principal:
            Service: lambda.amazonaws.com
          Action: sts:AssumeRole
      Path: "/"
      Policies:
      - PolicyName: root
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            Resource: arn:aws:logs:*:*:*
  CFDeployerRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${ServiceName}-cfdeployer-role
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - cloudformation.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
  CFDeployerPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub ${ServiceName}-cfdeployer-policy
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Action:
              - lambda:AddPermission
              - lambda:CreateFunction
              - lambda:DeleteFunction
              - lambda:InvokeFunction
              - lambda:RemovePermission
              - lambda:UpdateFunctionCode
              - lambda:GetFunctionConfiguration
              - lambda:GetFunction
              - lambda:UpdateFunctionConfiguration
              - events:* # Required for the sample lambda function to work
              - apigateway:*              
              - cloudformation:*
              - ecs:*
              - ecr:*
              - iam:*
              - ec2:*
              - codebuild:*
              - codepipeline:*
              - elasticloadbalancing:*
              - autoscaling:*
              - s3:*
              - kms:*
              - ssm:GetParameters
            Resource: "*"
          -
            Effect: Allow
            Action:
              - s3:PutObject
              - s3:GetBucketPolicy
              - s3:GetObject
              - s3:GetObjectVersion
              - s3:GetBucketVersioning
              - s3:ListBucket
            Resource:
             - !Join ['',['arn:aws:s3:::',!Ref ArtifactBucket, '/*']]
             - !Join ['',['arn:aws:s3:::',!Ref ArtifactBucket]]
      Roles:
        -
          !Ref CFDeployerRole
  PipeLineRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${ServiceName}-pipeline-role
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - codepipeline.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
  PipelinePolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub ${ServiceName}-pipeline-policy
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Action:
              - codepipeline:*
              - iam:ListRoles
              - cloudformation:Describe*
              - cloudFormation:List*
              - codecommit:List*
              - codecommit:Get*
              - codecommit:GitPull
              - codecommit:UploadArchive
              - codecommit:CancelUploadArchive
              - codebuild:BatchGetBuilds
              - codebuild:StartBuild
              - cloudformation:CreateStack
              - cloudformation:DeleteStack
              - cloudformation:DescribeStacks
              - cloudformation:UpdateStack
              - cloudformation:CreateChangeSet
              - cloudformation:DeleteChangeSet
              - cloudformation:DescribeChangeSet
              - cloudformation:ExecuteChangeSet
              - cloudformation:SetStackPolicy
              - cloudformation:ValidateTemplate
              - iam:PassRole
              - s3:ListAllMyBuckets
              - s3:GetBucketLocation
              - lambda:*
              - logs:*
            Resource:
              - "*"
          -
            Effect: Allow
            Action:              
              - kms:Encrypt
              - kms:Decrypt
              - kms:ReEncrypt*
              - kms:GenerateDataKey*
              - kms:DescribeKey
            Resource: !GetAtt [KMSKey,Arn]
          -
            Effect: Allow
            Action:
              - s3:PutObject
              - s3:GetBucketPolicy
              - s3:GetObject
              - s3:ListBucket
              - s3:GetObjectVersion
              - s3:GetBucketVersioning
            Resource:
             - !Join ['',['arn:aws:s3:::',!Ref ArtifactBucket, '/*']]
             - !Join ['',['arn:aws:s3:::',!Ref ArtifactBucket]]
             - !Join ['',['arn:aws:s3:::',!Ref TemplateBucket, '/*']]
             - !Join ['',['arn:aws:s3:::',!Ref TemplateBucket]]

          -
            Effect: Allow
            Action:
              - sts:AssumeRole
            Resource:              
              - !Sub arn:aws:iam::${ProductionAccount}:role/${ServiceName}-cc-role
              - !Sub arn:aws:iam::${ProductionAccount}:role/${ServiceName}-cfdeployer-role
              - !Sub arn:aws:iam::${AWS::AccountId}:role/${ServiceName}-codecommit-role
      Roles:
        -
          !Ref PipeLineRole
  BuildProjectRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${ServiceName}-cb-role
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - codebuild.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
  BuildProjectPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub ${ServiceName}-cb-policy
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Resource: "*"
            Effect: Allow
            Action:
              - cloudformation:Describe*
              - elasticloadbalancing:Describe*
              - codebuild:BatchGetBuilds
              - ecs:*
              - ecr:*
              - ec2:*
              - elasticloadbalancing:*
              - autoscaling:*
              - s3:*
              - kms:*
              - codepipeline:*
              - cloudformation:*
              - codecommit:List*
              - codecommit:Get*
              - codecommit:GitPull
              - codecommit:UploadArchive
              - codecommit:CancelUploadArchive
              - codebuild:BatchGetBuilds
              - codebuild:StartBuild
              - iam:*
              - lambda:*
              - logs:*
            Resource:
              - "*"
          -
            Effect: Allow
            Action:
              - kms:*
            Resource: !GetAtt [KMSKey,Arn]
          -
            Effect: Allow
            Action:
              - logs:CreateLogGroup
              - logs:CreateLogStream
              - logs:PutLogEvents
            Resource: arn:aws:logs:*:*:*
      Roles:
        -
          !Ref BuildProjectRole
  ArtifactBucketParam:
    Type: "AWS::SSM::Parameter"
    Properties:
      Name: "ArtifactBucket"
      Type: "String"
      Value: !Ref ArtifactBucket
  AdminStackNameParam:
    Type: "AWS::SSM::Parameter"
    Properties:
      Name: "AdminStackName"
      Type: "String"
      Value: !Ref ServiceName
  CMKARNParam:
    Type: "AWS::SSM::Parameter"
    Properties:
      Name: "CMKARN"
      Type: "String"
      Value: !GetAtt [KMSKey,Arn]
Outputs:
  CMK:
    Value: !GetAtt [KMSKey,Arn]
  ArtifactBucket:
    Value: !Ref ArtifactBucket
  PipeLineRole:
    Value: !GetAtt PipeLineRole.Arn
  CFDeployerRole:
    Value: !GetAtt CFDeployerRole.Arn