cid-admin-policies.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: This template is for an Organization Admin who needs to delegate management of the Cloud Intelligence Dashboards Stacks. This stack adds a set of policies to an Existing Role to allow full autonomy in deployment.
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: 'Role'
        Parameters:
          - RoleName
      - Label:
          default: Permissions for the Data Collection Account (where the Dashboards will be deployed)
        Parameters:
          - CloudIntelligenceDashboardsCFNManagement
          - CloudIntelligenceDashboardsManagement
          - CURDestination
          - QuickSightManagement
          - QuickSightAdmin
      - Label:
          default: Permissions for the CUR Source Account (typically a Payer Account)
        Parameters:
          - CURReplication
  cfn-lint:
    config:
      ignore_checks:
        - W2001
Parameters:
  RoleName:
    Type: String
    Description: Name of the Existing IAM Role to grant the permissions to
  QuickSightManagement:
    Type: String
    Description: "Choose Yes only when deploying this stack in the account where your Dashboards will be deployed. This grants the specified role above rights to all QuickSight Enterprise actions as per: https://docs.aws.amazon.com/quicksight/latest/user/iam-policy-examples.html#security_iam_id-based-policy-examples-all-access-enterprise-edition"
    Default: 'no'
    AllowedValues: ["yes", "no"]
  QuickSightAdmin:
    Type: String
    Description: "(OPTIONAL) Choose Yes only when deploying this stack in the account where your Dashboards will be deployed. Grant all QuickSight permissions (QuickSight:*)"
    Default: 'no'
    AllowedValues: ["yes", "no"]
  CloudIntelligenceDashboardsCFNManagement:
    Type: String
    Description: "Choose Yes only when deploying this stack in the account where your Dashboards will be deployed. This grants the specified role above rights to deploy the Cloud Intelligence Dashboards via CloudFormation"
    Default: 'no'
    AllowedValues: ["yes", "no"]
  CloudIntelligenceDashboardsManagement:
    Type: String
    Description: "Choose Yes only when deploying this stack in the account where your Dashboards will be deployed. This grants the specified role above rights to deploy Athena, Glue, QuickSight resources via CloudFormation"
    Default: 'no'
    AllowedValues: ["yes", "no"]
  CURDestination:
    Type: String
    Description: "Choose Yes only when deploying this stack in the account where your Dashboards will be deployed. This grants the specified role above rights to create an S3 bucket for replicated CUR data Data Collection Account"
    Default: 'no'
    AllowedValues: ["yes", "no"]
  CURReplication:
    Type: String
    Description: "Choose Yes only when deploying this stack in a Source/Payer account. This grants the specified role rights to create CUR & define Replication Rule in the Source Account"
    Default: 'no'
    AllowedValues: ["yes", "no"]

Conditions:
  CreateQuickSightManagementPolicy: !Equals [ !Ref QuickSightManagement, "yes" ]
  CreateCloudIntelligenceDashboardsCFNManagementPolicy: !Equals [ !Ref CloudIntelligenceDashboardsCFNManagement, "yes" ]
  CreateCloudIntelligenceDashboardsManagementPolicy: !Equals [ !Ref CloudIntelligenceDashboardsManagement, "yes" ]
  CreateQuickSightAdminPolicy: !Equals [ !Ref QuickSightAdmin, "yes" ]
  CreateCURDestinationPolicy: !Equals [ !Ref CURDestination, "yes" ]
  CreateCURReplicationPolicy: !Equals [ !Ref CURReplication, "yes" ]

Resources:

  QuickSightAdminPolicy:
    Type: AWS::IAM::ManagedPolicy
    Condition: CreateQuickSightAdminPolicy
    Properties:
      ManagedPolicyName: CidQuickSightAdminPolicy
      Description: 'CloudIntelligenceDashboards Policy for QuickSight Full Admin'
      Roles:
        - !Ref RoleName
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Sid: DirectoryService
          Effect: Allow
          Action:
          - QuickSight:*
          Resource: '*' #Explicitly allow all on QuickSight for QuickSight Admin
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: F5
            reason: "Explicitly allow all on QuickSight for QuickSight Admin."
          - id: W13
            reason: "Explicitly allow all on QuickSight for QuickSight Admin."
          - id: W28
            reason: "No Replacement needed"

  QuickSightManagementPolicy:
    Type: AWS::IAM::ManagedPolicy
    Condition: CreateQuickSightManagementPolicy
    Properties:
      ManagedPolicyName: CidQuickSightManagementPolicy
      Description: 'CloudIntelligenceDashboards Policy for QuickSight initial setup'
      Roles:
        - !Ref RoleName
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Sid: DirectoryService
          Effect: Allow
          Action:
          - ds:AuthorizeApplication
          - ds:CreateAlias
          - ds:CreateIdentityPoolDirectory
          - ds:DeleteDirectory
          - ds:UnauthorizeApplication
          Resource: '*' # as per doc https://docs.aws.amazon.com/quicksight/latest/user/iam-policy-examples.html#security_iam_id-based-policy-examples-all-access-enterprise-edition

        - Sid: IAMRole
          Action:
          - iam:AttachRolePolicy
          - iam:DetachRolePolicy
          - iam:CreateRole
          - iam:PassRole
          Effect: Allow
          Resource:
            - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/service-role/aws-quicksight-service-role-v0
            - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/service-role/CidQuickSightDataSourceRole

        - Sid: IAMPolicy
          Action:
          - iam:CreatePolicy
          - iam:DeletePolicy
          - iam:CreatePolicyVersion
          - iam:DeletePolicyVersion
          Effect: Allow
          Resource:
            - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:policy/cid*
            - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:policy/CID*

        - Sid: QuickSight
          Action:
          - quicksight:CreateAccountSubscription
          - quicksight:CreateAdmin
          - quicksight:CreateUser
          - quicksight:CreateNamespace
          - quicksight:SearchDirectoryGroups
          - quicksight:SetGroupMapping
          - quicksight:Subscribe
          - quicksight:Unsubscribe
          - quicksight:UpdateAccountSettings
          Effect: Allow
          Resource: '*' # as per doc https://docs.aws.amazon.com/quicksight/latest/user/iam-policy-examples.html#security_iam_id-based-policy-examples-all-access-enterprise-edition

        - Sid: S3
          Action:
          - s3:ListBucket
          - s3:GetObject
          - s3:GetObjectVersion
          - s3:PutObject
          - s3:ListBucketMultipartUploads
          - s3:GetBucketLocation
          - s3:AbortMultipartUpload
          - s3:ListMultipartUploadParts
          Effect: Allow
          Resource:
          - !Sub arn:${AWS::Partition}:s3:::cid-${AWS::AccountId}-shared
          - !Sub arn:${AWS::Partition}:s3:::aws-athena-query-results-cid-${AWS::AccountId}-${AWS::Region}
          - !Sub arn:${AWS::Partition}:s3:::aws-athena-query-results-cidcmd-${AWS::AccountId}-${AWS::Region}
          - !Sub arn:${AWS::Partition}:s3:::athena-query-result-${AWS::AccountId}-${AWS::Region}
          - !Sub arn:${AWS::Partition}:s3:::cid-${AWS::AccountId}-shared/*
          - !Sub arn:${AWS::Partition}:s3:::aws-athena-query-results-cid-${AWS::AccountId}-${AWS::Region}/*
          - !Sub arn:${AWS::Partition}:s3:::aws-athena-query-results-cidcmd-${AWS::AccountId}-${AWS::Region}/*
          - !Sub arn:${AWS::Partition}:s3:::athena-query-result-${AWS::AccountId}-${AWS::Region}/*
        - Sid: ReadOnly
          Action:
          - ds:CheckAlias
          - ds:DescribeDirectories
          - ds:DescribeTrusts
          - iam:GetPolicy
          - iam:GetPolicyVersion
          - iam:GetRole
          - iam:ListAccountAliases
          - iam:ListAttachedRolePolicies
          - iam:ListEntitiesForPolicy
          - iam:ListPolicyVersions
          - iam:ListRoles
          - quicksight:DescribeAccountSettings
          - quicksight:DescribeAccountSubscription
          - quicksight:GetGroupMapping
          - quicksight:ListUsers
          - s3:ListAllMyBuckets
          Effect: Allow
          Resource: '*' # as per doc https://docs.aws.amazon.com/quicksight/latest/user/iam-policy-examples.html#security_iam_id-based-policy-examples-all-access-enterprise-edition
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W13
            reason: "Some resources are not possible to restrict. See comments."
          - id: W28
            reason: "No Replacement needed"

  CloudIntelligenceDashboardsCFNManagementPolicy:
    Type: AWS::IAM::ManagedPolicy
    Condition: CreateCloudIntelligenceDashboardsCFNManagementPolicy
    Properties:
      ManagedPolicyName: CidCloudIntelligenceDashboardsCFNManagementPolicy
      Description: 'CloudIntelligenceDashboards Policy for CFN deployment'
      Roles:
        - !Ref RoleName
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Sid: CloudFormation
          Action:
          - cloudformation:CreateStack
          - cloudformation:DeleteStack
          - cloudformation:DescribeStackEvents
          - cloudformation:DescribeStackResource
          - cloudformation:DescribeStacks
          - cloudformation:GetStackPolicy
          - cloudformation:ListChangeSets
          - cloudformation:ListStackResources
          - cloudformation:RollbackStack
          - cloudformation:UpdateStack
          Effect: Allow
          Resource:
          - !Sub arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/Cloud-Intelligence-Dashboards/*

        - Sid: CloudFormationListExports
          Action:
          - cloudformation:ListExports
          Effect: Allow
          Resource:
          - "*" # Cannot restrict this

        - Sid: IAMForCFN
          Action:
          - iam:AttachRolePolicy
          - iam:CreateRole
          - iam:DeleteRole
          - iam:DeleteRolePolicy
          - iam:DetachRolePolicy
          - iam:GetRole
          - iam:GetRolePolicy
          - iam:PassRole
          - iam:PutRolePolicy
          Effect: Allow
          Resource:
          - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/CidSpiceRefreshExecutionRole
          - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/Cloud-Intelligence-*-* #Roles created by CFN stack. Name is hardcoded here
          - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/CidQuickSightDataSourceRole
          - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/CidExecRole

        - Sid: IAMPolicy
          Action:
          - iam:CreatePolicy
          - iam:DeletePolicy
          - iam:CreatePolicyVersion
          - iam:DeletePolicyVersion
          Effect: Allow
          Resource:
            - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:policy/cid*
            - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:policy/CID*

        - Sid: LambdaForCFN
          Action:
          - lambda:AddPermission
          - lambda:CreateFunction
          - lambda:DeleteFunction
          - lambda:GetFunction
          - lambda:InvokeFunction
          - lambda:RemovePermission
          - lambda:UpdateFunctionConfiguration
          - lambda:UpdateFunctionCode
          - lambda:PublishLayerVersion
          - lambda:GetLayerVersion
          - lambda:DeleteLayerVersion
          Effect: Allow
          Resource:
          - !Sub arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:Cid*
          - !Sub arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:cid-CID-Analytics-DataExports
          # - !Sub arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:CidProcessPath-DoNotRun
          # - !Sub arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:CidCustomResourceProcessPath-DoNotRun
          # - !Sub arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:CidCustomResourceDashboard
          # - !Sub arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:CidCustomResourceFunctionInit-DoNotRun
          # - !Sub arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:CidInitialSetup-DoNotRun #legacy
          # - !Sub arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:CidSpiceRefreshLambda
          - !Sub arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:layer:CidLambdaLayer*

        - Sid: ReadLambdaLayerS3
          Action:
          - s3:GetObject
          Effect: Allow
          Resource:
          - !Sub arn:${AWS::Partition}:s3:::aws-managed-cost-intelligence-dashboards-${AWS::Region}/cid-resource-lambda-layer/*

        - Sid: ReadOnlyCFN
          Action:
          - cloudformation:GetTemplate
          - cloudformation:GetTemplateSummary
          - cloudformation:ListStacks
          - cloudformation:ValidateTemplate
          Effect: Allow
          Resource: '*' # Read only Rights needed for CFN operator

    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W13
            reason: "Some resources are not possible to restrict. See comments."
          - id: W28
            reason: "No Replacement needed"

  CloudIntelligenceDashboardsManagementPolicy:
    Type: AWS::IAM::ManagedPolicy
    Condition: CreateCloudIntelligenceDashboardsManagementPolicy
    Properties:
      ManagedPolicyName: CidCloudIntelligenceDashboardsManagementPolicy
      Description: 'CloudIntelligenceDashboards Policy for Athena, Glue, Quicksight deployment'
      Roles:
        - !Ref RoleName
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Sid: Athena
          Action:
          - athena:CreateWorkGroup
          - athena:UpdateWorkGroup
          - athena:DeleteWorkGroup
          - athena:GetWorkGroup
          Effect: Allow
          Resource:
          - !Sub arn:${AWS::Partition}:athena:${AWS::Region}:${AWS::AccountId}:workgroup/CID

        - Sid: BCMDataExports
          Action:
          - bcm-data-exports:CreateExport
          - bcm-data-exports:DeleteExport
          - bcm-data-exports:GetExport
          - bcm-data-exports:ListExports
          - bcm-data-exports:ListTagsForResource
          - bcm-data-exports:UpdateExport
          Effect: Allow
          Resource:
          - !Sub arn:${AWS::Partition}:bcm-data-exports:${AWS::Region}:${AWS::AccountId}:export/*
          - !Sub arn:${AWS::Partition}:bcm-data-exports:${AWS::Region}:${AWS::AccountId}:table/*

        - Sid: CurDataAccess
          Action:
          - cur:PutReportDefinition
          Effect: Allow
          Resource:
          - !Sub arn:${AWS::Partition}:cur:${AWS::Region}:${AWS::AccountId}:*     #Required as per https://docs.aws.amazon.com/cur/latest/userguide/bcm-data-exports-access.html#bcm-data-exports-access-examples

        - Sid: EventBridge
          Action:
          - events:DeleteRule
          - events:DescribeRule
          - events:EnableRule
          - events:PutRule
          - events:PutTargets
          - events:RemoveTargets
          Effect: Allow
          Resource:
          - !Sub arn:${AWS::Partition}:events:${AWS::Region}:${AWS::AccountId}:rule/Cloud-Intelligence-Dashboards-SpiceRefreshRule-*

        - Sid: GlueCrawler
          Action:
          - glue:CreateCrawler
          - glue:DeleteCrawler
          - glue:GetCrawler
          - glue:StopCrawler
          Effect: Allow
          Resource:
          - !Sub arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:crawler/CidCrawler
          - !Sub arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:crawler/cid-DataExport*

        - Sid: GlueDatabase
          Action:
          - glue:CreateDatabase
          - glue:UpdateDatabase
          - glue:DeleteDatabase
          - glue:GetDatabase
          - glue:GetDatabases
          Effect: Allow
          Resource:
          - !Sub arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:database/cid_cur
          - !Sub arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:database/cid_cur/*
          - !Sub arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:table/cid_cur/*
          - !Sub arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:catalog
          - !Sub arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:userDefinedFunction/cid_cur/*
          - !Sub arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:database/cid_data_export
          - !Sub arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:table/cid_data_export/*
          - !Sub arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:userDefinedFunction/cid_data_export/*

        - Sid: GlueTable
          Action:
          - glue:CreateTable
          - glue:UpdateTable
          - glue:DeleteTable
          Effect: Allow
          Resource:
          - !Sub arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:database/cid_cur
          - !Sub arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:table/cid_cur/*
          - !Sub arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:catalog
          - !Sub arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:database/cid_data_export
          - !Sub arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:table/cid_data_export/*

        - Sid: QuickSightDashboard
          Action:
          - quicksight:CreateDashboard
          - quicksight:DeleteDashboard
          - quicksight:UpdateDashboard
          - quicksight:DescribeDashboard
          Effect: Allow
          Resource:
          - !Sub arn:${AWS::Partition}:quicksight:${AWS::Region}:${AWS::AccountId}:dashboard/cudos*
          - !Sub arn:${AWS::Partition}:quicksight:${AWS::Region}:${AWS::AccountId}:dashboard/cost_intelligence_dashboard
          - !Sub arn:${AWS::Partition}:quicksight:${AWS::Region}:${AWS::AccountId}:dashboard/kpi_dashboard
          - !Sub arn:${AWS::Partition}:quicksight:${AWS::Region}:${AWS::AccountId}:dashboard/ta-organizational-view
          - !Sub arn:${AWS::Partition}:quicksight:${AWS::Region}:${AWS::AccountId}:dashboard/trends-dashboard
          - !Sub arn:${AWS::Partition}:quicksight:${AWS::Region}:${AWS::AccountId}:dashboard/compute-optimizer-dashboard

        - Sid: QuickSightCreateDataSource
          Action:
          - quicksight:CreateDataSource
          - quicksight:PassDataSource
          - quicksight:UpdateDataSource
          - quicksight:DeleteDataSource
          - quicksight:DescribeDataSource
          - quicksight:ListTagsForResource
          - quicksight:DescribeDataSourcePermissions
          - quicksight:UpdateDataSourcePermissions
          Effect: Allow
          Resource:
          - !Sub arn:${AWS::Partition}:quicksight:${AWS::Region}:${AWS::AccountId}:datasource/CID-*

        - Sid: QuickSightDataSet
          Action:
          - quicksight:CreateDataSet
          - quicksight:DeleteDataSet
          - quicksight:UpdateDataSet
          - quicksight:PassDataSet
          - quicksight:DescribeDataSet
          - quicksight:DescribeDataSetPermissions
          - quicksight:UpdateDataSetPermissions
          Effect: Allow
          Resource:
          - !Sub arn:${AWS::Partition}:quicksight:${AWS::Region}:${AWS::AccountId}:dataset/* # DataSetIDs are dynamic

        - Sid: QuickSightDataSetSchedule
          Action:
          - quicksight:CreateRefreshSchedule
          - quicksight:UpdateRefreshSchedule
          - quicksight:DeleteRefreshSchedule
          - quicksight:DescribeRefreshSchedule
          - quicksight:ListRefreshSchedules
          - quicksight:CreateDataSetRefreshProperties
          - quicksight:DescribeDataSetRefreshProperties
          - quicksight:UpdateDataSetRefreshProperties
          - quicksight:DeleteDataSetRefreshProperties
          Effect: Allow
          Resource:
          - !Sub arn:${AWS::Partition}:quicksight:${AWS::Region}:${AWS::AccountId}:dataset/*/refresh-schedule/* # DataSetIDs are dynamic as well as schedule ids

        - Sid: CreateQueryResultsBucketS3
          Action:
          - s3:CreateBucket
          - s3:DeleteBucket
          - s3:GetBucketLocation
          - s3:GetObject
          - s3:ListBucket
          - s3:PutBucketAcl
          - s3:PutBucketOwnershipControls
          - s3:PutBucketPolicy
          - s3:PutBucketPublicAccessBlock
          - s3:PutBucketVersioning
          - s3:PutEncryptionConfiguration
          - s3:PutLifecycleConfiguration
          - s3:PutObject
          Effect: Allow
          Resource:
          - !Sub arn:${AWS::Partition}:s3:::aws-athena-query-results-cid-${AWS::AccountId}-${AWS::Region}
          - !Sub arn:${AWS::Partition}:s3:::aws-athena-query-results-cid-${AWS::AccountId}-${AWS::Region}/*
          - !Sub arn:${AWS::Partition}:s3:::aws-athena-query-results-cidcmd-${AWS::AccountId}-${AWS::Region}
          - !Sub arn:${AWS::Partition}:s3:::aws-athena-query-results-cidcmd-${AWS::AccountId}-${AWS::Region}/*

    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W13
            reason: "Some resources are not possible to restrict. See comments."
          - id: W28
            reason: "No Replacement needed"

  CURDestinationPolicy:
    Type: AWS::IAM::ManagedPolicy
    Condition: CreateCURDestinationPolicy
    Properties:
      ManagedPolicyName: CidCURDestinationPolicy
      Description: 'CloudIntelligenceDashboards Policy for Deployment of CUR at Destination (Data Collection Account)'
      Roles:
        - !Ref RoleName
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Sid: CloudFormation
          Action:
          - cloudformation:CreateChangeSet
          - cloudformation:CreateStack
          - cloudformation:DeleteStack
          - cloudformation:DescribeStackEvents
          - cloudformation:DescribeStacks
          - cloudformation:GetStackPolicy
          - cloudformation:ListStackResources
          - cloudformation:RollbackStack
          - cloudformation:UpdateStack
          Effect: Allow
          Resource:
          - !Sub arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/CID-CUR-Destination/*

        - Sid: IAMForCFN
          Action:
          - iam:CreateRole
          - iam:DeleteRole
          - iam:DeleteRolePolicy
          - iam:GetRole
          - iam:GetRolePolicy
          - iam:PutRolePolicy
          - iam:GetPolicy
          - iam:DeletePolicy
          - iam:ListPolicyVersions
          - iam:DeletePolicyVersion
          - iam:PassRole
          Effect: Allow
          Resource:
          - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cid/CID-CUR-Destination-*
          - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/CID-CUR-Destination-*
          - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:policy/cidDataExportsReadAccess # hardcoded prefix

        - Sid: Lambda
          Action:
          - lambda:CreateFunction
          - lambda:DeleteFunction
          - lambda:GetFunction
          - lambda:InvokeFunction
          - lambda:UpdateFunctionConfiguration
          - lambda:UpdateFunctionCode
          Effect: Allow
          Resource:
          - !Sub arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:cid-CID-Analytics
          - !Sub arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:cid-CID-CURCreator

        - Sid: S3
          Action:
          - s3:CreateBucket
          - s3:DeleteBucket
          - s3:GetBucketLocation
          - s3:GetBucketPolicy
          - s3:GetObject
          - s3:ListBucket
          - s3:ListBucketVersions
          - s3:PutBucketAcl
          - s3:PutBucketOwnershipControls
          - s3:PutBucketPolicy
          - s3:PutBucketPublicAccessBlock
          - s3:PutBucketVersioning
          - s3:PutEncryptionConfiguration
          - s3:PutLifecycleConfiguration
          - s3:PutObject
          Effect: Allow
          Resource:
          - !Sub arn:${AWS::Partition}:s3:::cid-${AWS::AccountId}-shared
          - !Sub arn:${AWS::Partition}:s3:::cid-${AWS::AccountId}-shared/*
          - !Sub arn:${AWS::Partition}:s3:::cid-${AWS::AccountId}-data-exports
          - !Sub arn:${AWS::Partition}:s3:::cid-${AWS::AccountId}-data-exports/*

        - Sid: CostUsageReport
          Action:
          - cur:DeleteReportDefinition
          - cur:DescribeReportDefinitions
          - cur:PutReportDefinition
          Effect: Allow
          Resource:
          - !Sub arn:${AWS::Partition}:cur:*:${AWS::AccountId}:definition/cid

        - Sid: CostUsageReportForDelete
          Action:
          - cur:DescribeReportDefinitions
          Effect: Allow
          Resource:
          - !Sub arn:${AWS::Partition}:cur:*:${AWS::AccountId}:definition/

        - Sid: ReadOnly
          Action:
          - cloudformation:GetTemplate
          - cloudformation:GetTemplateSummary
          - cloudformation:ListStacks
          - s3:ListAllMyBuckets #?
          Effect: Allow
          Resource: '*' # ReadOnly Policy for CFN


    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W13
            reason: "Some resources are not possible to restrict. See comments."
          - id: W28
            reason: "No Replacement needed"


  CURReplicationPolicy:
    Type: AWS::IAM::ManagedPolicy
    Condition: CreateCURReplicationPolicy
    Properties:
      ManagedPolicyName: CidCURReplicationPolicy
      Description: 'CloudIntelligenceDashboards Policy for CUR Creating and Setting Replication'
      Roles:
        - !Ref RoleName
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Sid: CloudFormation
          Action:
          - cloudformation:CreateChangeSet
          - cloudformation:CreateStack
          - cloudformation:DeleteStack
          - cloudformation:DescribeStackEvents
          - cloudformation:DescribeStacks
          - cloudformation:GetStackPolicy
          - cloudformation:ListStackResources
          - cloudformation:RollbackStack
          - cloudformation:UpdateStack
          Effect: Allow
          Resource:
          - !Sub arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/CID-CUR-Replication/*

        - Sid: CostUsageReport
          Action:
          - cur:DeleteReportDefinition
          - cur:DescribeReportDefinitions
          - cur:PutReportDefinition
          Effect: Allow
          Resource:
          - !Sub arn:${AWS::Partition}:cur:*:${AWS::AccountId}:definition/cid

        - Sid: CostUsageReportForDelete
          Action:
          - cur:DescribeReportDefinitions
          Effect: Allow
          Resource:
          - !Sub arn:${AWS::Partition}:cur:*:${AWS::AccountId}:definition/

        - Sid: IAMForCFN
          Action:
          - iam:CreateRole
          - iam:DeleteRole
          - iam:DeleteRolePolicy
          - iam:GetRole
          - iam:GetRolePolicy
          - iam:ListRoles
          - iam:PassRole
          - iam:PutRolePolicy
          Effect: Allow
          Resource:
          - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cid/CID-CUR-Replication-*

        - Sid: LambdaForCFN
          Action:
          - lambda:CreateFunction
          - lambda:DeleteFunction
          - lambda:GetFunction
          - lambda:GetFunctionCodeSigningConfig
          - lambda:GetRuntimeManagementConfig
          - lambda:InvokeFunction
          - lambda:UpdateFunctionConfiguration
          - lambda:UpdateFunctionCode
          Effect: Allow
          Resource:
          - !Sub arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:cid-CID-Analytics
          - !Sub arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:cid-CID-CURCreator

        - Sid: S3
          Action:
          - s3:CreateBucket
          - s3:DeleteBucket
          - s3:DeleteBucketPolicy
          - s3:ListBucketVersions
          - s3:DeleteObject
          - s3:DeleteObjectVersion
          - s3:GetBucketLocation
          - s3:GetBucketPolicy
          - s3:GetObject
          - s3:ListBucket
          - s3:PutBucketAcl
          - s3:PutBucketOwnershipControls
          - s3:PutBucketPolicy
          - s3:PutBucketPublicAccessBlock
          - s3:PutBucketVersioning
          - s3:PutEncryptionConfiguration
          - s3:PutLifecycleConfiguration
          - s3:PutObject
          - s3:PutReplicationConfiguration
          Effect: Allow
          Resource:
          - !Sub arn:${AWS::Partition}:s3:::cid-${AWS::AccountId}-local
          - !Sub arn:${AWS::Partition}:s3:::cid-${AWS::AccountId}-local/*
          - !Sub arn:${AWS::Partition}:s3:::cid-${AWS::AccountId}-data-local
          - !Sub arn:${AWS::Partition}:s3:::cid-${AWS::AccountId}-data-local/*

        - Sid: ReadOnly
          Action:
          - cloudformation:GetTemplate
          - cloudformation:GetTemplateSummary
          - cloudformation:ListStacks
          - s3:ListAllMyBuckets
          Effect: Allow
          Resource: '*' # ReadOnly Policy for CFN

    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W13
            reason: "Some resources are not possible to restrict. See comments."
          - id: W28
            reason: "No Replacement needed"