AWSTemplateFormatVersion: 2010-09-09
Description: Grant Clazar access to CAS and SDDS S3 buckets and subscribe the Clazar SQS queue to CAS and SDDS SNS topics.

Parameters:
  ClazarRoleName:
    Description: Clazar Role Name
    Type: String
  ClazarSQSArn:
    Description: Clazar SQS Arn
    Type: String
  ClazarSQSUrl:
    Description: Clazar SQS Url
    Type: String
  CasBucketName:
    Description: Bucket Name for CAS Data
    Type: String
  SddsBucketName:
    Description: Bucket Name for SDDS feeds
    Type: String
  CasSnsTopicArn:
    Description: CAS SNS Topic ARN
    Type: String
  SddsSnsTopicArn:
    Description: SDDS SNS Topic ARN
    Type: String

Mappings:
  AnalyticsAccess:
    ClazarGenerateCASPolicyName:
      Value: ClazarGenerateCASDatasetAccess
    ClazarAnalyticsSNSAccessPolicyName:
      Value: ClazarAnalyticsSNSAccess
    ClazarS3AccessPolicyName:
      Value: ClazarS3BucketAccess
    ClazarKMSKeyAccessPolicyName:
      Value: ClazarS3BucketsKMSAccess

Resources:
  ClazarGenerateCASPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !FindInMap [AnalyticsAccess, ClazarGenerateCASPolicyName, Value]
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - 'marketplacecommerceanalytics:GenerateDataSet'
            Resource: '*'
      Roles:
        - !Ref ClazarRoleName

  ClazarAnalyticsSNSAccessPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !FindInMap [AnalyticsAccess, ClazarAnalyticsSNSAccessPolicyName, Value]
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - 'sns:Subscribe'
              - 'sns:Unsubscribe'
              - 'sns:GetTopicAttributes'
              - 'sns:GetSubscriptionAttributes'
              - 'sns:ListSubscriptionsByTopic'
            Resource:
              - !Ref CasSnsTopicArn
              - !Ref SddsSnsTopicArn
              - 'arn:aws:sns:*:*:clazar-*'
      Roles:
        - !Ref ClazarRoleName

  ClazarS3AccessPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !FindInMap [AnalyticsAccess, ClazarS3AccessPolicyName, Value]
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - 's3:GetObject'
              - 's3:ListBucket'
              - 's3:GetBucketRegion'
            Resource:
              - !Join ['', ['arn:aws:s3:::', !Ref CasBucketName, '/*']]
              - !Join ['', ['arn:aws:s3:::', !Ref CasBucketName]]
              - !Join [ '', [ 'arn:aws:s3:::', !Ref SddsBucketName, '/*' ] ]
              - !Join [ '', [ 'arn:aws:s3:::', !Ref SddsBucketName ] ]
      Roles:
        - !Ref ClazarRoleName

  ClazarKMSKeyAccessPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !FindInMap [AnalyticsAccess, ClazarKMSKeyAccessPolicyName, Value]
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - "kms:Encrypt"
              - "kms:Decrypt"
              - "kms:DescribeKey"
              - "kms:GenerateDataKey"
            Resource: "*"
            Condition:
              StringLike:
                "kms:EncryptionContext:aws:s3:arn":
                  - Fn::Sub: "arn:aws:s3:::${SddsBucketName}/*"
                  - Fn::Sub: "arn:aws:s3:::${CasBucketName}/*"
      Roles:
        - !Ref ClazarRoleName

  CasSNSSubscription:
    Type: 'AWS::SNS::Subscription'
    Properties:
      TopicArn: !Ref CasSnsTopicArn
      Region: !Select [3, !Split [ ':', !Ref CasSnsTopicArn ]]
      Endpoint: !Ref ClazarSQSArn
      Protocol: sqs

  SddsSNSSubscription:
    Type: 'AWS::SNS::Subscription'
    Properties:
      TopicArn: !Ref SddsSnsTopicArn
      Region: !Select [3, !Split [ ':', !Ref SddsSnsTopicArn ]]
      Endpoint: !Ref ClazarSQSArn
      Protocol: sqs

  ClazarSQSSendPolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS: "*"
            Action:
              - 'SQS:SendMessage'
            Resource:
              - !Ref ClazarSQSArn
            Condition:
              ArnLike:
                aws:SourceArn: !Ref CasSnsTopicArn
          - Effect: Allow
            Principal:
              AWS: "*"
            Action:
              - 'SQS:SendMessage'
            Resource:
              - !Ref ClazarSQSArn
            Condition:
              ArnLike:
                aws:SourceArn: !Ref SddsSnsTopicArn
      Queues:
        - !Ref ClazarSQSUrl

Outputs:
  CasSNSSubscriptionArn:
    Description: CAS SNS Subscription Arn
    Value: !Ref CasSNSSubscription
  SddsSNSSubscriptionArn:
    Description: SDDS SNS Subscription Arn
    Value: !Ref SddsSNSSubscription
