Description: This template creates a role to allow DoiT Billing Transfer data ingestion.
Parameters:
  CustomerId:
    Type: String
    Description: Customer ID for Cross-Account-Role
  S3Bucket:
    Type: String
    Description: CUR S3 Bucket URL
  ChannelUid:
    Type: String
    Description: Onboarding channel UID for cancellation support
    Default: ""
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "Cross-Account Role Configuration.  *Do Not Modify*"
        Parameters:
          - CustomerId
          - S3Bucket
Resources:
  CrossAccountRole:
    Type: "AWS::IAM::Role"
    Properties:
      Description: DoiT International Billing Transfer
      RoleName: "doitintl_billing_transfer"
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - "sts:AssumeRole"
            Effect: Allow
            Principal:
              AWS: "arn:aws:iam::068664126052:root"
            Sid: "Management"
          - Action: "sts:AssumeRole"
            Effect: Allow
            Principal:
              AWS: arn:aws:iam::068664126052:role/doitintl_cmp_prod
            Condition:
              StringEquals:
                sts:ExternalId: !Ref CustomerId
        Version: "2012-10-17"
      Path: "/"
  OrgBillingPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: doitintl_billing_transfer
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Sid: DataExports
            Action:
              - bcm-data-exports:CreateExport
              - bcm-data-exports:GetExport
              - bcm-data-exports:ListExports
            Resource: "*"
          - Effect: Allow
            Sid: CostAndUsageReports
            Action:
              - cur:DescribeReportDefinitions
            Resource: "*"
          - Effect: Allow
            Sid: BillingBucketList
            Action:
              - s3:ListBucket
            Resource: !Sub
              - "arn:aws:s3:::${BucketName}"
              - BucketName: !Ref S3Bucket
          - Effect: Allow
            Sid: BillingBucketObject
            Action:
              - s3:GetObject
            Resource: !Sub
              - "arn:aws:s3:::${BucketName}/*"
              - BucketName: !Ref S3Bucket
          - Effect: Allow
            Sid: BillingConductor
            Action:
              - billingconductor:CreateBillingGroup
              - billingconductor:ListBillingGroups
              - billingconductor:ListAccountAssociations
              - billingconductor:ListPricingPlans
            Resource: "*"
          - Effect: Allow
            Sid: Organizations
            Action:
              - organizations:ListHandshakesForOrganization
              - organizations:DescribeHandshake
              - organizations:InviteOrganizationToTransferResponsibility
              - organizations:ListInboundResponsibilityTransfers
              - organizations:ListOutboundResponsibilityTransfers
              - organizations:ListChildren
              - organizations:DescribeOrganizationalUnit
            Resource: "*"
          - Effect: Allow
            Sid: RoleSelfValidation
            Action:
              - iam:GetRole
              - iam:SimulatePrincipalPolicy
              - iam:GetPolicy
              - iam:GetPolicyVersion
            Resource:
              - !Sub "arn:aws:iam::${AWS::AccountId}:role/doitintl_billing_transfer"
              - !Sub "arn:aws:iam::${AWS::AccountId}:policy/doitintl_billing_transfer"
      Roles:
        - !Ref CrossAccountRole
  DoitCmpHook:
    Type: Custom::DoitCmpHook
    DependsOn: OrgBillingPolicy
    Properties:
      ServiceToken: "arn:aws:sns:us-east-1:068664126052:doitintl-aws-billing-transfer"
      RoleArn: !GetAtt CrossAccountRole.Arn
      AccountID: !Ref "AWS::AccountId"
      ExternalID: !Ref CustomerId
      NotificationUrl: "https://console.doit.com/webhooks/v1/billingtransferaws/ingestiononboarding"
      S3Bucket: !Ref S3Bucket
      ChannelUid: !Ref ChannelUid
    Version: "1.0"
Outputs:
  RoleName:
    Value: !Ref CrossAccountRole
  RoleArn:
    Value: !GetAtt CrossAccountRole.Arn
