cfn-resources-iam-roles.template

AWSTemplateFormatVersion: "2010-09-09"
Description: Template to activate ConfluentCloud::IAM::ServiceAccount resource type in the account.

Parameters:
  PublicTypeArn:
    Type: String
    AllowedPattern: "none|^arn:aws[A-Za-z0-9-]{0,64}:cloudformation:[A-Za-z0-9-]{1,64}::type/.+/[0-9a-zA-Z]{12,40}/.+"
    Default: none
    Description: The Public Resource ARN to activate.

  PermissionsBoundaryArn:
    Type: String
    Default: none
    Description: Whether the IAM roles should have an IAM Policy as Permissions Boundary

Conditions:
  NoBoundary: !Equals [!Ref PermissionsBoundaryArn, "none"]
  PublicTypeArnOverride: !Not [ !Equals [ !Ref PermissionsBoundaryArn, "none" ] ]

Resources:
  ExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      PermissionsBoundary: !If
        - NoBoundary
        - !Ref AWS::NoValue
        - !Ref PermissionsBoundaryArn
      MaxSessionDuration: 8400
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: !Sub "resources.cloudformation.${AWS::URLSuffix}"
            Action: sts:AssumeRole
      Path: "/cfn-resources/"
      Policies:
        - PolicyName: ResourceTypePolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: "SecretsManagerAccess"
                Action:
                  - "secretsmanager:GetSecretValue"
                Resource: "*"
                Effect: Allow

  LogAndMetricsDeliveryRole:
    Type: AWS::IAM::Role
    Properties:
      PermissionsBoundary: !If
        - NoBoundary
        - !Ref AWS::NoValue
        - !Ref PermissionsBoundaryArn
      MaxSessionDuration: 43200
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Effect: Allow
          Principal:
            Service:
              - !Sub "resources.cloudformation.${AWS::URLSuffix}"
              - !Sub "hooks.cloudformation.${AWS::URLSuffix}"
          Action: sts:AssumeRole
          Condition:
            StringEquals:
              aws:SourceAccount:
                Ref: AWS::AccountId
      Path: "/cfn-resources/"
      Policies:
        - PolicyName: LogAndMetricsDeliveryRolePolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                - logs:CreateLogGroup
                - logs:CreateLogStream
                - logs:DescribeLogGroups
                - logs:DescribeLogStreams
                - logs:PutLogEvents
                - cloudwatch:ListMetrics
                - cloudwatch:PutMetricData
                Resource: "*"

Outputs:
  ExecutionRoleArn:
    Value: !GetAtt ExecutionRole.Arn

  CloudWatchRoleArn:
    Value: !GetAtt LogAndMetricsDeliveryRole.Arn