AWSTemplateFormatVersion: 2010-09-09
Description: Create an IAM role that Clazar will use to access your AWS marketplace.

Parameters:
  ClazarAccountId:
    Description: Clazar AWS Account ID which will assume the IAM role
    Type: String
  ClazarRoleName:
    Description: Clazar Role Name
    Type: String
  ClazarExternalId:
    Description: Assume Role External Id
    Type: String

Mappings:
  Role:
    ClazarRolePolicyAccessPolicyName:
      Value: ClazarRolePolicyAccess

Resources:
  ClazarRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref ClazarRoleName
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${ClazarAccountId}:root
            Action:
              - sts:AssumeRole
            Condition:
              StringEquals:
                sts:ExternalId: !Ref ClazarExternalId

  RoleAccessPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !FindInMap [Role, ClazarRolePolicyAccessPolicyName, Value]
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - 'iam:GetRole'
              - 'iam:ListRolePolicies'
              - 'iam:GetRolePolicy'
            Resource: !GetAtt ClazarRole.Arn
      Roles:
        - !Ref ClazarRoleName

Outputs:
  ClazarRoleArn:
    Description: 'ARN for the IAM Role used by Clazar to access your AWS marketplace'
    Value: !GetAtt ClazarRole.Arn
  ClazarRoleName:
    Description: Clazar Role Name
    Value: ClazarRole
