ExecutionRole:
  Metadata:
    'aws:copilot:description': 'An IAM Role {{- if .PermissionsBoundary}} with permissions boundary {{.PermissionsBoundary}} {{- end}} for the Fargate agent to make AWS API calls on your behalf'
  Type: AWS::IAM::Role
  Properties:
    AssumeRolePolicyDocument:
      Version: '2012-10-17'
      Statement:
        - Effect: Allow
          Principal:
            Service: ecs-tasks.amazonaws.com
          Action: 'sts:AssumeRole'
    {{- if .PermissionsBoundary}}
    PermissionsBoundary: !Sub 'arn:${AWS::Partition}:iam::${AWS::AccountId}:policy/{{.PermissionsBoundary}}'
    {{- end}}
    Policies:
      - PolicyName: !Join ['', [!Ref AppName, '-', !Ref EnvName, '-', !Ref WorkloadName, SecretsPolicy]]
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: 'Allow'
              Action:
                - 'ssm:GetParameters'
              Resource:
                - !Sub 'arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/*'
              Condition:
                StringEquals:
                  'ssm:ResourceTag/copilot-application': !Sub '${AppName}'
                  'ssm:ResourceTag/copilot-environment': !Sub '${EnvName}'
            - Effect: 'Allow'
              Action:
                - 'secretsmanager:GetSecretValue'
              Resource:
                - !Sub 'arn:${AWS::Partition}:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:*'
              Condition:
                StringEquals:
                  'secretsmanager:ResourceTag/copilot-application': !Sub '${AppName}'
                  'secretsmanager:ResourceTag/copilot-environment': !Sub '${EnvName}'
            - Effect: 'Allow'
              Action:
                - 'kms:Decrypt'
              Resource:
                - !Sub 'arn:${AWS::Partition}:kms:${AWS::Region}:${AWS::AccountId}:key/*'
      # Optional IAM permission required by ECS task def env file
      # https://docs.aws.amazon.com/AmazonECS/latest/developerguide/taskdef-envfiles.html#taskdef-envfiles-iam
      # Example EnvFileARN: arn:aws:s3:::stackset-demo-infrastruc-pipelinebuiltartifactbuc-11dj7ctf52wyf/manual/1638391936/env
      - !If
        - HasEnvFile
        - PolicyName: !Join ['', [!Ref AppName, '-', !Ref EnvName, '-', !Ref WorkloadName, GetEnvFilePolicy]]
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: 'Allow'
                Action:
                  - 's3:GetObject'
                Resource:
                  - !Ref EnvFileARN
              - Effect: 'Allow'
                Action:
                  - 's3:GetBucketLocation'
                Resource:
                  - !Join
                    - ''
                    - - 'arn:'
                      - !Ref AWS::Partition
                      - ':s3:::'
                      - !Select [0, !Split ['/', !Select [5, !Split [':', !Ref EnvFileARN]]]]
        - !Ref AWS::NoValue
      {{- if .LogConfig}}
      - !If
        - HasLoggingEnvFile
        - PolicyName: !Join ['', [!Ref AppName, '-', !Ref EnvName, '-', !Ref WorkloadName, GetLoggingEnvFilePolicy]]
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: 'Allow'
                Action:
                  - 's3:GetObject'
                Resource:
                  - !Ref LoggingEnvFileARN
              - Effect: 'Allow'
                Action:
                  - 's3:GetBucketLocation'
                Resource:
                  - !Join
                    - ''
                    - - 'arn:'
                      - !Ref AWS::Partition
                      - ':s3:::'
                      - !Select [0, !Split ['/', !Select [5, !Split [':', !Ref LoggingEnvFileARN]]]]
        - !Ref AWS::NoValue
      {{- end }}
      {{- range $sidecar := .Sidecars}}
      - !If
        - HasEnvFileFor{{ logicalIDSafe $sidecar.Name}}
        - PolicyName: !Join ['', [!Ref AppName, '-', !Ref EnvName, '-', !Ref WorkloadName, GetEnvFilePolicyFor{{ logicalIDSafe $sidecar.Name}}]]
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: 'Allow'
                Action:
                  - 's3:GetObject'
                Resource:
                  - !Ref EnvFileARNFor{{ logicalIDSafe $sidecar.Name}}
              - Effect: 'Allow'
                Action:
                  - 's3:GetBucketLocation'
                Resource:
                  - !Join
                    - ''
                    - - 'arn:'
                      - !Ref AWS::Partition
                      - ':s3:::'
                      - !Select [0, !Split ['/', !Select [5, !Split [':', !Ref EnvFileARNFor{{ logicalIDSafe $sidecar.Name}}]]]]
        - !Ref AWS::NoValue
      {{- end }}
    ManagedPolicyArns:
      - !Sub 'arn:${AWS::Partition}:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy'