AWSTemplateFormatVersion: '2010-09-09'
Conditions:
  GovCloud: !Equals [!Ref AWS::Partition, 'aws-us-gov']
  China: !Equals [!Ref AWS::Partition, 'aws-cn']

Resources:

  CustomLambdaResourcesRoleSlurm:
    Properties:
      Description: Role to be used in 'Iam:Roles:CustomLambdaResources' when the scheduler is Slurm
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
        Version: '2012-10-17'
      Path: /parallelcluster/
      Policies:
        - PolicyName: CustomLambdaResourcesRoleSlurmPolicy
          PolicyDocument:
            Statement:
              - Action:
                  - route53:ListResourceRecordSets
                  - route53:ChangeResourceRecordSets
                Effect: Allow
                Resource: !Sub arn:${AWS::Partition}:route53:::hostedzone/*
              - Action:
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Effect: Allow
                Resource: !Sub arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/pcluster-*
              - Action: ec2:DescribeInstances
                Effect: Allow
                Resource: '*'
              - Action: ec2:TerminateInstances
                Condition:
                  StringEquals:
                    ec2:ResourceTag/parallelcluster:node-type: Compute
                Effect: Allow
                Resource: '*'
              - Action:
                  - s3:DeleteObject
                  - s3:DeleteObjectVersion
                  - s3:ListBucket
                  - s3:ListBucketVersions
                Effect: Allow
                Resource:
                  - !Sub arn:${AWS::Partition}:s3:::parallelcluster-*-v1-do-not-delete
                  - !Sub arn:${AWS::Partition}:s3:::parallelcluster-*-v1-do-not-delete/*
            Version: '2012-10-17'
    Type: AWS::IAM::Role

  HeadNodeRoleSlurm:
    Properties:
      Description: Role to be used in 'HeadNode:Iam:InstanceRole' when the scheduler is Slurm
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: !If [ GovCloud, 'ec2.amazonaws-us-gov.com', !If [ China, 'ec2.amazonaws.cn', 'ec2.amazonaws.com']]
        Version: '2012-10-17'
      Path: /parallelcluster/
      ManagedPolicyArns:
        - !Sub arn:${AWS::Partition}:iam::aws:policy/CloudWatchAgentServerPolicy
        - !Sub arn:${AWS::Partition}:iam::aws:policy/AmazonSSMManagedInstanceCore
      Policies:
        - PolicyName: HeadNodeRoleSlurmPolicy
          PolicyDocument:
            Statement:
              - Action:
                  - s3:GetObject
                  - s3:GetObjectVersion
                Effect: Allow
                Resource:
                  - !Sub arn:${AWS::Partition}:s3:::${AWS::Region}-aws-parallelcluster/*
                  - !Sub arn:${AWS::Partition}:s3:::dcv-license.${AWS::Region}/*
                  - !Sub arn:${AWS::Partition}:s3:::parallelcluster-*-v1-do-not-delete/*
              - Action:
                  - dynamodb:PutItem
                  - dynamodb:GetItem
                  - dynamodb:UpdateItem
                  - dynamodb:BatchWriteItem
                  - dynamodb:BatchGetItem
                Resource: !Sub arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/parallelcluster-*
                Effect: Allow
              - Action: ec2:TerminateInstances
                Condition:
                  StringEquals:
                    ec2:ResourceTag/parallelcluster:node-type: Compute
                Effect: Allow
                Resource: '*'
              - Action:
                  - ec2:RunInstances
                  - ec2:CreateFleet
                Resource: '*'
                Effect: Allow
              - Action:
                  - iam:PassRole
                Resource:
                  - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/parallelcluster/*
                  - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:instance-profile/parallelcluster/*
                Effect: Allow
                Condition:
                  StringEquals:
                    iam:PassedToService:
                      - !If [ GovCloud, 'ec2.amazonaws-us-gov.com', !If [ China, 'ec2.amazonaws.cn', 'ec2.amazonaws.com']]
              - Action:
                  - ec2:DescribeInstances
                  - ec2:DescribeInstanceStatus
                  - ec2:DescribeVolumes
                  - ec2:DescribeInstanceAttribute
                  - ec2:DescribeCapacityReservations
                Effect: Allow
                Resource: '*'
              - Action:
                  - ec2:CreateTags
                  - ec2:AttachVolume
                Effect: Allow
                Resource:
                  - !Sub arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:instance/*
                  - !Sub arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:volume/*
              - Action:
                  - ec2:GetConsoleOutput
                Effect: Allow
                Resource:
                  - !Sub arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:instance/*
              - Action:
                  - cloudformation:DescribeStackResource
                  - cloudformation:SignalResource
                  - cloudformation:DescribeStacks
                Effect: Allow
                Resource: '*'
              - Action:
                  - route53:ChangeResourceRecordSets
                Resource: '*'
                Effect: Allow
            Version: '2012-10-17'
    Type: AWS::IAM::Role

  ComputeNodeRoleSlurm:
    Properties:
      Description: Role to be used in 'Scheduling:SlurmQueues:Iam:InstanceRole' when the scheduler is Slurm
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: !If [ GovCloud, 'ec2.amazonaws-us-gov.com', !If [ China, 'ec2.amazonaws.cn', 'ec2.amazonaws.com']]
        Version: '2012-10-17'
      Path: /parallelcluster/
      ManagedPolicyArns:
        - !Sub arn:${AWS::Partition}:iam::aws:policy/CloudWatchAgentServerPolicy
        - !Sub arn:${AWS::Partition}:iam::aws:policy/AmazonSSMManagedInstanceCore
      Policies:
        - PolicyName: ComputeNodeRoleSlurmPolicy
          PolicyDocument:
            Statement:
              - Action:
                  - dynamodb:Query
                Resource: !Sub arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/parallelcluster-*
                Effect: Allow
              - Action: s3:GetObject
                Effect: Allow
                Resource:
                  - !Sub arn:${AWS::Partition}:s3:::${AWS::Region}-aws-parallelcluster/*
              - Action: ec2:DescribeInstanceAttribute
                Effect: Allow
                Resource: '*'
            Version: '2012-10-17'
    Type: AWS::IAM::Role

  ComputeNodeInstanceProfileSlurm:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /parallelcluster/
      Roles:
        - !Ref ComputeNodeRoleSlurm

  CustomLambdaResourcesRoleBatch:
    Properties:
      Description: Role to be used in 'Iam:Roles:CustomLambdaResources' when the scheduler is AwsBatch
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
        Version: '2012-10-17'
      Path: /parallelcluster/
      Policies:
        - PolicyName: CustomLambdaResourcesRoleBatchPolicy
          PolicyDocument:
            Statement:
              - Action:
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Effect: Allow
                Resource: !Sub arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/pcluster-*
              - Action:
                  - s3:DeleteObject
                  - s3:DeleteObjectVersion
                  - s3:ListBucket
                  - s3:ListBucketVersions
                Effect: Allow
                Resource:
                  - !Sub arn:${AWS::Partition}:s3:::parallelcluster-*-v1-do-not-delete
                  - !Sub arn:${AWS::Partition}:s3:::parallelcluster-*-v1-do-not-delete/*
              - Action:
                  - ecr:BatchDeleteImage
                  - ecr:ListImages
                Effect: Allow
                Resource: !Sub arn:${AWS::Partition}:ecr:${AWS::Region}:${AWS::AccountId}:repository/*parallelcluster*
              - Action:
                  - codebuild:BatchGetBuilds
                  - codebuild:StartBuild
                Effect: Allow
                Resource: !Sub arn:${AWS::Partition}:codebuild:${AWS::Region}:${AWS::AccountId}:project/pcluster-*
            Version: '2012-10-17'
    Type: AWS::IAM::Role

  HeadNodeRoleBatch:
    Properties:
      Description: Role to be used in 'HeadNode:Iam:InstanceRole' when the scheduler is AwsBatch
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: !If [ GovCloud, 'ec2.amazonaws-us-gov.com', !If [ China, 'ec2.amazonaws.cn', 'ec2.amazonaws.com']]
        Version: '2012-10-17'
      Path: /parallelcluster/
      ManagedPolicyArns:
        - !Sub arn:${AWS::Partition}:iam::aws:policy/CloudWatchAgentServerPolicy
        - !Sub arn:${AWS::Partition}:iam::aws:policy/AmazonSSMManagedInstanceCore
      Policies:
        - PolicyName: HeadNodeRoleBatchPolicy
          PolicyDocument:
            Statement:
              - Action:
                  - s3:GetObject
                  - s3:PutObject
                  - s3:GetObjectVersion
                Effect: Allow
                Resource:
                  - !Sub arn:${AWS::Partition}:s3:::parallelcluster-*-v1-do-not-delete/*
              - Action: s3:GetObject
                Effect: Allow
                Resource:
                  - !Sub arn:${AWS::Partition}:s3:::dcv-license.${AWS::Region}/*
                  - !Sub arn:${AWS::Partition}:s3:::${AWS::Region}-aws-parallelcluster/*
              - Action:
                  - iam:PassRole
                Resource:
                  - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/parallelcluster/*
                  - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:instance-profile/parallelcluster/*
                Effect: Allow
                Condition:
                  StringEquals:
                    iam:PassedToService:
                      - batch.amazonaws.com
              - Action:
                  - batch:DescribeJobQueues
                  - batch:DescribeJobs
                  - batch:ListJobs
                  - batch:DescribeComputeEnvironments
                Effect: Allow
                Resource: '*'
              - Action:
                  - batch:SubmitJob
                  - batch:TerminateJob
                  - logs:GetLogEvents
                  - ecs:ListContainerInstances
                  - ecs:DescribeContainerInstances
                Effect: Allow
                Resource:
                  - !Sub arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/batch/job:log-stream:PclusterJobDefinition*
                  - !Sub arn:${AWS::Partition}:ecs:${AWS::Region}:${AWS::AccountId}:container-instance/AWSBatch-PclusterComputeEnviron*
                  - !Sub arn:${AWS::Partition}:ecs:${AWS::Region}:${AWS::AccountId}:cluster/AWSBatch-Pcluster*
                  - !Sub arn:${AWS::Partition}:batch:${AWS::Region}:${AWS::AccountId}:job-queue/PclusterJobQueue*
                  - !Sub arn:${AWS::Partition}:batch:${AWS::Region}:${AWS::AccountId}:job-definition/PclusterJobDefinition*:*
                  - !Sub arn:${AWS::Partition}:batch:${AWS::Region}:${AWS::AccountId}:job/*
              - Action:
                  - ec2:DescribeInstances
                  - ec2:DescribeInstanceStatus
                  - ec2:DescribeVolumes
                  - ec2:DescribeInstanceAttribute
                Effect: Allow
                Resource: '*'
              - Action:
                  - ec2:CreateTags
                  - ec2:AttachVolume
                Effect: Allow
                Resource:
                  - !Sub arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:instance/*
                  - !Sub arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:volume/*
              - Action:
                  - cloudformation:DescribeStackResource
                  - cloudformation:DescribeStacks
                  - cloudformation:SignalResource
                Effect: Allow
                Resource: '*'
            Version: '2012-10-17'
    Type: AWS::IAM::Role

  ### INTEG-TESTS POLICIES

  IntegTestsPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Roles:
        - !Ref HeadNodeRoleSlurm
        - !Ref ComputeNodeRoleSlurm
        - !Ref HeadNodeRoleBatch
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          # Required to use test bucket (e.g. to test pre/post_install scripts)
          - Action:
              - s3:Get*
              - s3:List*
            Resource:
              - !Sub arn:${AWS::Partition}:s3:::aws-parallelcluster-*
            Effect: Allow

Outputs:
  HeadNodeRoleSlurm:
    Value: !GetAtt HeadNodeRoleSlurm.Arn
  ComputeNodeRoleSlurm:
    Value: !GetAtt ComputeNodeRoleSlurm.Arn
  ComputeNodeInstanceProfileSlurm:
    Value: !GetAtt ComputeNodeInstanceProfileSlurm.Arn
  CustomLambdaResourcesRoleSlurm:
    Value: !GetAtt CustomLambdaResourcesRoleSlurm.Arn
  HeadNodeRoleBatch:
    Value: !GetAtt HeadNodeRoleBatch.Arn
  CustomLambdaResourcesRoleBatch:
    Value: !GetAtt CustomLambdaResourcesRoleBatch.Arn