---
Parameters:
  AponoConnectorId:
    Type: "String"
    Description: "Apono Connector ID"
  OrganizationalUnitId:
    Type: "String"
    Description: "Provide any Organizational Unit ID to connect all of its accounts.\
      \ To integrate all the accounts in the Organization, provide the ROOT Organization\
      \ Unit ID"
  ConnectorRoleArn:
    Type: "String"
    Description: "The connector role that will be able to assume the provisioned role"
  S3AWSLogsScanning:
    Type: "String"
    Default: "Enabled"
    AllowedValues:
    - "Enabled"
    - "Disabled"
    Description: "Enable retrieval of AWSLogs/* objects from S3 buckets"
  Permissions:
    Type: "String"
    Default: "Read-Only (Discovery)"
    AllowedValues:
    - "Read-Only (Discovery)"
    - "Full-Access (Manage IAM)"
    Description: "Decide the account level permissions the connector should have"
  OrganizationId:
    Type: "String"
    Description: "AWS Organizations ID (Required for Resource Explorer discovery)"
  EnableResourceExplorerDiscovery:
    Type: "String"
    Default: "Disabled"
    AllowedValues:
    - "Enabled"
    - "Disabled"
    Description: "Create Resource Explorer view to support multi-region, multi-account\
      \ resource discovery (requires AWS Resource Explorer service to be enabled in\
      \ the management account)"
  ManagementAccountCustomRoleName:
    Type: "String"
    Default: ""
    Description: "Optional custom name for the assumable role in the management account.\
      \ If not provided, a default name will be used."
  StackSetFailureTolerancePercentage:
    Type: "Number"
    Default: "0"
    AllowedValues:
    - "0"
    - "10"
    - "20"
    - "30"
    - "40"
    - "50"
    - "60"
    - "70"
    - "80"
    - "90"
    - "100"
    Description: "Percentage of accounts in which the stack set operation can fail\
      \ before the operation is stopped (0-100, multiples of 10)"
Conditions:
  ReadS3TrailLogsCondition:
    Fn::Equals:
    - Ref: "S3AWSLogsScanning"
    - "Enabled"
  ManagementAccountCustomRoleNameCoalesceCondition:
    Fn::Not:
    - Fn::Equals:
      - Ref: "ManagementAccountCustomRoleName"
      - ""
  UseReadOnlyAccess:
    Fn::Equals:
    - Ref: "Permissions"
    - "Read-Only (Discovery)"
  UseFullAccess:
    Fn::Equals:
    - Ref: "Permissions"
    - "Full-Access (Manage IAM)"
  EnableResourceExplorerDiscoveryCondition:
    Fn::Equals:
    - Ref: "EnableResourceExplorerDiscovery"
    - "Enabled"
Resources:
  IAMRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action:
          - "sts:AssumeRole"
          - "sts:TagSession"
          Effect: "Allow"
          Principal:
            AWS:
              Fn::Split:
              - ","
              - Ref: "ConnectorRoleArn"
          Sid: ""
        Version: "2012-10-17"
      ManagedPolicyArns:
      - "arn:aws:iam::aws:policy/SecurityAudit"
      - "arn:aws:iam::aws:policy/AWSCloudFormationReadOnlyAccess"
      - "arn:aws:iam::aws:policy/AWSResourceExplorerReadOnlyAccess"
      MaxSessionDuration: 3600
      Path: "/"
      Policies:
      - PolicyDocument:
          Statement:
          - Action:
            - "rds:DescribeDBInstances"
            - "rds:ListTagsForResource"
            Effect: "Allow"
            Resource: "arn:aws:rds:*:*:db:*"
          Version: "2012-10-17"
        PolicyName: "rds-list-policy"
      - PolicyDocument:
          Statement:
          - Action:
            - "s3:GetBucketTagging"
            - "s3:ListAllMyBuckets"
            - "s3:ListBucket"
            - "s3:GetBucketLocation"
            Effect: "Allow"
            Resource: "arn:aws:s3:::*"
          Version: "2012-10-17"
        PolicyName: "s3-list-policy"
      - PolicyDocument:
          Statement:
          - Action: "ssm:GetParameters*"
            Effect: "Allow"
            Resource: "arn:aws:ssm:*:*:parameter/*"
          - Action: "ssm:DescribeParameters"
            Effect: "Allow"
            Resource: "*"
          Version: "2012-10-17"
        PolicyName: "ssm-params-list-policy"
      - PolicyDocument:
          Statement:
          - Action: "tag:GetResources"
            Effect: "Allow"
            Resource: "*"
          Version: "2012-10-17"
        PolicyName: "read-resource-tags-policy"
      - PolicyDocument:
          Statement:
          - Action:
            - "ec2:DescribeInstances"
            - "ec2:DescribeTags"
            Effect: "Allow"
            Resource: "*"
          Version: "2012-10-17"
        PolicyName: "ec2-policy"
      - PolicyDocument:
          Statement:
          - Action:
            - "ecr:DescribeImages"
            - "ecr:DescribeRepositories"
            Effect: "Allow"
            Resource: "*"
            Sid: "assume"
          Version: "2012-10-17"
        PolicyName: "ecr-policy"
      - PolicyDocument:
          Statement:
          - Action:
            - "logs:DescribeLogStreams"
            - "logs:GetLogEvents"
            Effect: "Allow"
            Resource: "arn:aws:logs:*:*:log-group:/ecs/apono-connector-logs-*:*"
            Sid: "AllowReadingAponoConnectorLogs"
          Version: "2012-10-17"
        PolicyName: "AponoConnectorLogsRead"
      - PolicyDocument:
          Statement:
          - Action:
            - "eks:AccessKubernetesApi"
            - "eks:ListTagsForResource"
            - "eks:ListAccessEntries"
            - "eks:DescribeAccessEntry"
            - "eks:ListAssociatedAccessPolicies"
            - "eks:DescribeCluster"
            - "eks:ListAccessPolicies"
            - "eks:ListClusters"
            Effect: "Allow"
            Resource: "*"
          Version: "2012-10-17"
        PolicyName: "eks-read-policy"
      - PolicyDocument:
          Statement:
          - Action:
            - "sts:AssumeRole"
            - "sts:TagSession"
            Effect: "Allow"
            Resource: "arn:aws:iam::*:role/apono-*"
            Sid: "assume"
          Version: "2012-10-17"
        PolicyName: "remote-management"
      - PolicyDocument:
          Statement:
          - Action: "kms:Sign"
            Condition:
              StringEquals:
                aws:ResourceTag/apono-connector-read: "true"
            Effect: "Allow"
            Resource: "*"
          - Action: "kms:Decrypt"
            Condition:
              StringEquals:
                aws:ResourceTag/apono-connector-access: "true"
            Effect: "Allow"
            Resource: "*"
          Version: "2012-10-17"
        PolicyName: "apono-tagged-keys-access-policy"
      - PolicyDocument:
          Statement:
          - Action:
            - "secretsmanager:GetSecretValue"
            - "secretsmanager:DescribeSecret"
            Condition:
              StringEquals:
                aws:ResourceTag/apono-connector-read: "true"
            Effect: "Allow"
            Resource: "arn:aws:secretsmanager:*:*:secret:*"
          Version: "2012-10-17"
        PolicyName: "apono-tagged-secrets-access-policy"
      - PolicyDocument:
          Statement:
          - Action:
            - "lambda:InvokeFunction"
            - "lambda:GetFunction"
            Condition:
              StringEquals:
                aws:ResourceTag/apono-connector-access: "true"
            Effect: "Allow"
            Resource: "arn:aws:lambda:*:*:function:*"
          Version: "2012-10-17"
        PolicyName: "apono-tagged-lambda-functions-access-policy"
      - PolicyDocument:
          Statement:
          - Action: "s3:GetObject"
            Effect: "Allow"
            Resource: "arn:aws:s3:::aws-cloudtrail-logs-apono-*/*"
          Version: "2012-10-17"
        PolicyName: "apono-cloudtrail-logs-s3-access-policy"
      - PolicyDocument:
          Statement:
          - Action:
            - "iam:ListPolicies"
            - "iam:CreateInstanceProfile"
            - "iam:ListGroups"
            - "iam:ListInstanceProfiles"
            - "iam:ListRoles"
            Effect: "Allow"
            Resource: "*"
          - Action:
            - "iam:CreateInstanceProfile"
            - "iam:GetRole"
            - "iam:UpdateAssumeRolePolicy"
            - "iam:ListRoleTags"
            - "iam:TagRole"
            - "iam:UntagRole"
            - "iam:CreateRole"
            - "iam:DeleteRole"
            - "iam:AttachRolePolicy"
            - "iam:PutRolePolicy"
            - "iam:AddRoleToInstanceProfile"
            - "iam:ListInstanceProfilesForRole"
            - "iam:DetachRolePolicy"
            - "iam:ListAttachedRolePolicies"
            - "iam:DeleteRolePolicy"
            - "iam:ListAttachedGroupPolicies"
            - "iam:ListRolePolicies"
            - "iam:GetRolePolicy"
            - "iam:PassRole"
            - "iam:GetInstanceProfile"
            - "iam:CreateUser"
            - "iam:CreateAccessKey"
            - "iam:DeleteAccessKey"
            - "iam:PutUserPolicy"
            - "iam:DeleteUserPolicy"
            - "iam:GetUser"
            - "iam:GetUserPolicy"
            - "iam:DeleteUser"
            - "iam:ListAttachedUserPolicies"
            - "iam:ListUserPolicies"
            - "iam:UpdateLoginProfile"
            - "iam:ListAccessKeys"
            - "iam:AttachUserPolicy"
            - "iam:DetachUserPolicy"
            - "iam:CreateLoginProfile"
            - "iam:CreateServiceLinkedRole"
            - "iam:GetPolicy"
            - "iam:GetPolicyVersion"
            - "iam:ListGroupPolicies"
            - "iam:GetGroupPolicy"
            - "iam:PutRolePermissionsBoundary"
            - "iam:DeleteRolePermissionsBoundary"
            - "iam:PutUserPermissionsBoundary"
            - "iam:DeleteUserPermissionsBoundary"
            - "iam:TagUser"
            - "iam:ListUserTags"
            - "iam:UpdateRole"
            Effect: "Allow"
            Resource:
            - "arn:aws:iam::*:instance-profile/*"
            - "arn:aws:iam::*:role/*"
            - "arn:aws:iam::*:group/*"
            - "arn:aws:iam::*:user/*"
            - "arn:aws:iam::*:policy/*"
          Version: "2012-10-17"
        PolicyName: "iam-access-policy"
      - PolicyDocument:
          Statement:
          - Action:
            - "organizations:ListAccounts"
            - "tag:GetResources"
            - "tag:GetTagValues"
            - "sso:ListInstances"
            - "identitystore:*"
            - "tag:GetTagKeys"
            - "sso:TagResource"
            - "sso:UntagResource"
            - "sso-directory:SearchUsers"
            Effect: "Allow"
            Resource: "*"
            Sid: "sso0"
          - Action:
            - "organizations:ListAccountsForParent"
            - "sso:ListPermissionSets"
            - "sso:CreateAccountAssignment"
            - "sso:DescribeAccountAssignmentCreationStatus"
            - "organizations:ListParents"
            - "sso:DeleteAccountAssignment"
            - "sso:DescribePermissionSet"
            - "organizations:ListChildren"
            - "sso:DescribeAccountAssignmentDeletionStatus"
            - "sso:DeletePermissionSet"
            - "sso:CreatePermissionSet"
            - "sso:PutInlinePolicyToPermissionSet"
            - "iam:CreateSAMLProvider"
            - "iam:UpdateSAMLProvider"
            - "iam:GetSAMLProvider"
            - "sso:GetInlinePolicyForPermissionSet"
            - "sso:DeleteInlinePolicyFromPermissionSet"
            - "sso:ProvisionPermissionSet"
            - "sso:AttachManagedPolicyToPermissionSet"
            - "sso:DetachManagedPolicyFromPermissionSet"
            - "sso:ListManagedPoliciesInPermissionSet"
            - "sso:ListCustomerManagedPolicyReferencesInPermissionSet"
            - "sso:AttachCustomerManagedPolicyReferenceToPermissionSet"
            - "sso:DetachCustomerManagedPolicyReferenceFromPermissionSet"
            - "sso:DescribePermissionSetProvisioningStatus"
            - "sso:GetPermissionsBoundaryForPermissionSet"
            - "sso:PutPermissionsBoundaryToPermissionSet"
            - "sso:DeletePermissionsBoundaryFromPermissionSet"
            Effect: "Allow"
            Resource:
            - "arn:aws:organizations::*:root/o-*/r-*"
            - "arn:aws:organizations::*:ou/o-*/ou-*"
            - "arn:aws:sso:::instance/*"
            - "arn:aws:sso:::permissionSet/*/*"
            - "arn:aws:sso:::account/*"
            - "arn:aws:iam::*:saml-provider/*"
            Sid: "sso1"
          Version: "2012-10-17"
        PolicyName: "sso-policy"
      - PolicyDocument:
          Statement:
          - Action: "rds-db:connect"
            Effect: "Allow"
            Resource: "arn:aws:rds-db:*:*:dbuser:*/apono_connector"
          Version: "2012-10-17"
        PolicyName: "rds-connect"
      - PolicyDocument:
          Statement:
          - Action:
            - "eks:DeleteAccessEntry"
            - "eks:UntagResource"
            - "eks:AssociateAccessPolicy"
            - "eks:DisassociateAccessPolicy"
            - "eks:TagResource"
            - "eks:CreateAccessEntry"
            - "eks:UpdateAccessEntry"
            Effect: "Allow"
            Resource: "*"
          Version: "2012-10-17"
        PolicyName: "eks-write-policy"
      - Fn::If:
        - "ReadS3TrailLogsCondition"
        - PolicyName: "AponoConnectorS3LogsRead"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
            - Sid: "AponoS3AWSLogsGetObject"
              Effect: "Allow"
              Action:
              - "s3:GetObject"
              - "s3:GetObjectRetention"
              - "s3:GetObjectAttributes"
              Resource:
              - "arn:aws:s3:::*/AWSLogs/*"
              - "arn:aws:s3:::*/*/AWSLogs/*"
            - Sid: "AponoS3AWSLogsListBucket"
              Effect: "Allow"
              Action: "s3:ListBucket"
              Resource: "arn:aws:s3:::*"
              Condition:
                StringLike:
                  s3:prefix:
                  - "AWSLogs/*"
                  - "AWSLogs/*/*"
        - Ref: "AWS::NoValue"
      RoleName:
        Fn::If:
        - "ManagementAccountCustomRoleNameCoalesceCondition"
        - Ref: "ManagementAccountCustomRoleName"
        - Fn::Join:
          - ""
          - - "apono-connector-role-"
            - Fn::Select:
              - 2
              - Fn::Split:
                - "/"
                - Ref: "AWS::StackId"
  CrossAccountRoleStackSetResource:
    Type: "AWS::CloudFormation::StackSet"
    Properties:
      AutoDeployment:
        Enabled: true
        RetainStacksOnAccountRemoval: false
      Capabilities:
      - "CAPABILITY_NAMED_IAM"
      OperationPreferences:
        FailureTolerancePercentage:
          Ref: "StackSetFailureTolerancePercentage"
      Parameters:
      - ParameterKey: "AponoConnectorId"
        ParameterValue:
          Ref: "AponoConnectorId"
      - ParameterKey: "AponoConnectorRoleArn"
        ParameterValue:
          Ref: "ConnectorRoleArn"
      - ParameterKey: "ExternalID"
        ParameterValue: ""
      - ParameterKey: "S3AWSLogsScanning"
        ParameterValue:
          Ref: "S3AWSLogsScanning"
      PermissionModel: "SERVICE_MANAGED"
      StackInstancesGroup:
      - DeploymentTargets:
          OrganizationalUnitIds:
          - Ref: "OrganizationalUnitId"
        Regions:
        - "us-east-1"
      StackSetName:
        Fn::Join:
        - ""
        - - "apono-cross-account-role-stack-set-"
          - Fn::Select:
            - 2
            - Fn::Split:
              - "/"
              - Ref: "AWS::StackId"
      TemplateBody:
        Fn::If:
        - "UseFullAccess"
        - "---\nParameters:\n  AponoConnectorId:\n    Type: \"String\"\n    Description:\
          \ \"Apono Connector ID\"\n  AponoConnectorRoleArn:\n    Type: \"String\"\
          \n    Description: \"The ARN of the connector's IAM Role\"\n  ExternalID:\n\
          \    Type: \"String\"\n    Description: \"The cross-account access role\
          \ created by the stack will use this\\\n      \\ value for its ExternalID.\
          \ Do not change this value!\"\n  S3AWSLogsScanning:\n    Type: \"String\"\
          \n    Default: \"Enabled\"\n    AllowedValues:\n    - \"Enabled\"\n    -\
          \ \"Disabled\"\n    Description: \"Enable retrieval of AWSLogs/* objects\
          \ from S3 buckets\"\nMappings:\n  AponoEnvironment:\n    env:\n      organizationID:\
          \ \"026598536039\"\n      SnsNameForConfirmCustomerDeployment: \"aws-integration-callback\"\
          \nConditions:\n  ReadS3TrailLogsCondition:\n    Fn::Equals:\n    - Ref:\
          \ \"S3AWSLogsScanning\"\n    - \"Enabled\"\nResources:\n  AponoCWSSACrossAccountAccessRole:\n\
          \    Type: \"AWS::IAM::Role\"\n    Properties:\n      AssumeRolePolicyDocument:\n\
          \        Statement:\n        - Action:\n          - \"sts:AssumeRole\"\n\
          \          - \"sts:TagSession\"\n          Effect: \"Allow\"\n         \
          \ Principal:\n            AWS:\n              Fn::Split:\n             \
          \ - \",\"\n              - Ref: \"AponoConnectorRoleArn\"\n        Version:\
          \ \"2012-10-17\"\n      ManagedPolicyArns:\n      - \"arn:aws:iam::aws:policy/SecurityAudit\"\
          \n      - \"arn:aws:iam::aws:policy/AWSCloudFormationReadOnlyAccess\"\n\
          \      - \"arn:aws:iam::aws:policy/AWSResourceExplorerReadOnlyAccess\"\n\
          \      Policies:\n      - PolicyDocument:\n          Statement:\n      \
          \    - Action:\n            - \"ecr:GetLifecyclePolicy\"\n            -\
          \ \"lambda:Get*\"\n            - \"s3:ListBucket\"\n            - \"sns:GetSubscriptionAttributes\"\
          \n            - \"dynamodb:ListTagsOfResource\"\n            - \"sns:ListTagsForResource\"\
          \n            - \"es:ListTags\"\n            - \"rds:DescribeDBClusters\"\
          \n            Effect: \"Allow\"\n            Resource: \"*\"\n         \
          \   Sid: \"AllowDescribingResources\"\n          Version: \"2012-10-17\"\
          \n        PolicyName: \"AponoDescribePolicy\"\n      - PolicyDocument:\n\
          \          Statement:\n          - Action:\n            - \"rds:DescribeDBInstances\"\
          \n            - \"rds:ListTagsForResource\"\n            Effect: \"Allow\"\
          \n            Resource: \"arn:aws:rds:*:*:db:*\"\n          Version: \"\
          2012-10-17\"\n        PolicyName: \"rds-list-policy\"\n      - PolicyDocument:\n\
          \          Statement:\n          - Action:\n            - \"s3:GetBucketTagging\"\
          \n            - \"s3:ListAllMyBuckets\"\n            - \"s3:ListBucket\"\
          \n            - \"s3:GetBucketLocation\"\n            Effect: \"Allow\"\n\
          \            Resource: \"arn:aws:s3:::*\"\n          Version: \"2012-10-17\"\
          \n        PolicyName: \"s3-list-policy\"\n      - PolicyDocument:\n    \
          \      Statement:\n          - Action: \"ssm:GetParameters*\"\n        \
          \    Effect: \"Allow\"\n            Resource: \"arn:aws:ssm:*:*:parameter/*\"\
          \n          - Action: \"ssm:DescribeParameters\"\n            Effect: \"\
          Allow\"\n            Resource: \"*\"\n          Version: \"2012-10-17\"\n\
          \        PolicyName: \"ssm-params-list-policy\"\n      - PolicyDocument:\n\
          \          Statement:\n          - Action: \"tag:GetResources\"\n      \
          \      Effect: \"Allow\"\n            Resource: \"*\"\n          Version:\
          \ \"2012-10-17\"\n        PolicyName: \"read-resource-tags-policy\"\n  \
          \    - PolicyDocument:\n          Statement:\n          - Action:\n    \
          \        - \"ec2:DescribeInstances\"\n            - \"ec2:DescribeTags\"\
          \n            Effect: \"Allow\"\n            Resource: \"*\"\n         \
          \ Version: \"2012-10-17\"\n        PolicyName: \"ec2-policy\"\n      - PolicyDocument:\n\
          \          Statement:\n          - Action:\n            - \"ecr:DescribeImages\"\
          \n            - \"ecr:DescribeRepositories\"\n            Effect: \"Allow\"\
          \n            Resource: \"*\"\n            Sid: \"assume\"\n          Version:\
          \ \"2012-10-17\"\n        PolicyName: \"ecr-policy\"\n      - PolicyDocument:\n\
          \          Statement:\n          - Action:\n            - \"logs:DescribeLogStreams\"\
          \n            - \"logs:GetLogEvents\"\n            Effect: \"Allow\"\n \
          \           Resource: \"arn:aws:logs:*:*:log-group:/ecs/apono-connector-logs-*:*\"\
          \n            Sid: \"AllowReadingAponoConnectorLogs\"\n          Version:\
          \ \"2012-10-17\"\n        PolicyName: \"AponoConnectorLogsRead\"\n     \
          \ - PolicyDocument:\n          Statement:\n          - Action:\n       \
          \     - \"eks:AccessKubernetesApi\"\n            - \"eks:ListTagsForResource\"\
          \n            - \"eks:ListAccessEntries\"\n            - \"eks:DescribeAccessEntry\"\
          \n            - \"eks:ListAssociatedAccessPolicies\"\n            - \"eks:DescribeCluster\"\
          \n            - \"eks:ListAccessPolicies\"\n            - \"eks:ListClusters\"\
          \n            Effect: \"Allow\"\n            Resource: \"*\"\n         \
          \ Version: \"2012-10-17\"\n        PolicyName: \"eks-read-policy\"\n   \
          \   - PolicyDocument:\n          Statement:\n          - Action:\n     \
          \       - \"sts:AssumeRole\"\n            - \"sts:TagSession\"\n       \
          \     Effect: \"Allow\"\n            Resource: \"arn:aws:iam::*:role/apono-*\"\
          \n            Sid: \"assume\"\n          Version: \"2012-10-17\"\n     \
          \   PolicyName: \"remote-management\"\n      - PolicyDocument:\n       \
          \   Statement:\n          - Action: \"kms:Sign\"\n            Condition:\n\
          \              StringEquals:\n                aws:ResourceTag/apono-connector-read:\
          \ \"true\"\n            Effect: \"Allow\"\n            Resource: \"*\"\n\
          \          - Action: \"kms:Decrypt\"\n            Condition:\n         \
          \     StringEquals:\n                aws:ResourceTag/apono-connector-access:\
          \ \"true\"\n            Effect: \"Allow\"\n            Resource: \"*\"\n\
          \          Version: \"2012-10-17\"\n        PolicyName: \"apono-tagged-keys-access-policy\"\
          \n      - PolicyDocument:\n          Statement:\n          - Action:\n \
          \           - \"secretsmanager:GetSecretValue\"\n            - \"secretsmanager:DescribeSecret\"\
          \n            Condition:\n              StringEquals:\n                aws:ResourceTag/apono-connector-read:\
          \ \"true\"\n            Effect: \"Allow\"\n            Resource: \"arn:aws:secretsmanager:*:*:secret:*\"\
          \n          Version: \"2012-10-17\"\n        PolicyName: \"apono-tagged-secrets-access-policy\"\
          \n      - PolicyDocument:\n          Statement:\n          - Action:\n \
          \           - \"lambda:InvokeFunction\"\n            - \"lambda:GetFunction\"\
          \n            Condition:\n              StringEquals:\n                aws:ResourceTag/apono-connector-access:\
          \ \"true\"\n            Effect: \"Allow\"\n            Resource: \"arn:aws:lambda:*:*:function:*\"\
          \n          Version: \"2012-10-17\"\n        PolicyName: \"apono-tagged-lambda-functions-access-policy\"\
          \n      - PolicyDocument:\n          Statement:\n          - Action: \"\
          s3:GetObject\"\n            Effect: \"Allow\"\n            Resource: \"\
          arn:aws:s3:::aws-cloudtrail-logs-apono-*/*\"\n          Version: \"2012-10-17\"\
          \n        PolicyName: \"apono-cloudtrail-logs-s3-access-policy\"\n     \
          \ - PolicyDocument:\n          Statement:\n          - Action:\n       \
          \     - \"iam:ListPolicies\"\n            - \"iam:CreateInstanceProfile\"\
          \n            - \"iam:ListGroups\"\n            - \"iam:ListInstanceProfiles\"\
          \n            - \"iam:ListRoles\"\n            Effect: \"Allow\"\n     \
          \       Resource: \"*\"\n          - Action:\n            - \"iam:CreateInstanceProfile\"\
          \n            - \"iam:GetRole\"\n            - \"iam:UpdateAssumeRolePolicy\"\
          \n            - \"iam:ListRoleTags\"\n            - \"iam:TagRole\"\n  \
          \          - \"iam:UntagRole\"\n            - \"iam:CreateRole\"\n     \
          \       - \"iam:DeleteRole\"\n            - \"iam:AttachRolePolicy\"\n \
          \           - \"iam:PutRolePolicy\"\n            - \"iam:AddRoleToInstanceProfile\"\
          \n            - \"iam:ListInstanceProfilesForRole\"\n            - \"iam:DetachRolePolicy\"\
          \n            - \"iam:ListAttachedRolePolicies\"\n            - \"iam:DeleteRolePolicy\"\
          \n            - \"iam:ListAttachedGroupPolicies\"\n            - \"iam:ListRolePolicies\"\
          \n            - \"iam:GetRolePolicy\"\n            - \"iam:PassRole\"\n\
          \            - \"iam:GetInstanceProfile\"\n            - \"iam:CreateUser\"\
          \n            - \"iam:CreateAccessKey\"\n            - \"iam:DeleteAccessKey\"\
          \n            - \"iam:PutUserPolicy\"\n            - \"iam:DeleteUserPolicy\"\
          \n            - \"iam:GetUser\"\n            - \"iam:GetUserPolicy\"\n \
          \           - \"iam:DeleteUser\"\n            - \"iam:ListAttachedUserPolicies\"\
          \n            - \"iam:ListUserPolicies\"\n            - \"iam:UpdateLoginProfile\"\
          \n            - \"iam:ListAccessKeys\"\n            - \"iam:AttachUserPolicy\"\
          \n            - \"iam:DetachUserPolicy\"\n            - \"iam:CreateLoginProfile\"\
          \n            - \"iam:CreateServiceLinkedRole\"\n            - \"iam:GetPolicy\"\
          \n            - \"iam:GetPolicyVersion\"\n            - \"iam:ListGroupPolicies\"\
          \n            - \"iam:GetGroupPolicy\"\n            - \"iam:PutRolePermissionsBoundary\"\
          \n            - \"iam:DeleteRolePermissionsBoundary\"\n            - \"\
          iam:PutUserPermissionsBoundary\"\n            - \"iam:DeleteUserPermissionsBoundary\"\
          \n            - \"iam:TagUser\"\n            - \"iam:ListUserTags\"\n  \
          \          - \"iam:UpdateRole\"\n            Effect: \"Allow\"\n       \
          \     Resource:\n            - \"arn:aws:iam::*:instance-profile/*\"\n \
          \           - \"arn:aws:iam::*:role/*\"\n            - \"arn:aws:iam::*:group/*\"\
          \n            - \"arn:aws:iam::*:user/*\"\n            - \"arn:aws:iam::*:policy/*\"\
          \n          Version: \"2012-10-17\"\n        PolicyName: \"iam-access-policy\"\
          \n      - PolicyDocument:\n          Statement:\n          - Action:\n \
          \           - \"organizations:ListAccounts\"\n            - \"tag:GetResources\"\
          \n            - \"tag:GetTagValues\"\n            - \"sso:ListInstances\"\
          \n            - \"identitystore:*\"\n            - \"tag:GetTagKeys\"\n\
          \            - \"sso:TagResource\"\n            - \"sso:UntagResource\"\n\
          \            - \"sso-directory:SearchUsers\"\n            Effect: \"Allow\"\
          \n            Resource: \"*\"\n            Sid: \"sso0\"\n          - Action:\n\
          \            - \"organizations:ListAccountsForParent\"\n            - \"\
          sso:ListPermissionSets\"\n            - \"sso:CreateAccountAssignment\"\n\
          \            - \"sso:DescribeAccountAssignmentCreationStatus\"\n       \
          \     - \"organizations:ListParents\"\n            - \"sso:DeleteAccountAssignment\"\
          \n            - \"sso:DescribePermissionSet\"\n            - \"organizations:ListChildren\"\
          \n            - \"sso:DescribeAccountAssignmentDeletionStatus\"\n      \
          \      - \"sso:DeletePermissionSet\"\n            - \"sso:CreatePermissionSet\"\
          \n            - \"sso:PutInlinePolicyToPermissionSet\"\n            - \"\
          iam:CreateSAMLProvider\"\n            - \"iam:UpdateSAMLProvider\"\n   \
          \         - \"iam:GetSAMLProvider\"\n            - \"sso:GetInlinePolicyForPermissionSet\"\
          \n            - \"sso:DeleteInlinePolicyFromPermissionSet\"\n          \
          \  - \"sso:ProvisionPermissionSet\"\n            - \"sso:AttachManagedPolicyToPermissionSet\"\
          \n            - \"sso:DetachManagedPolicyFromPermissionSet\"\n         \
          \   - \"sso:ListManagedPoliciesInPermissionSet\"\n            - \"sso:ListCustomerManagedPolicyReferencesInPermissionSet\"\
          \n            - \"sso:AttachCustomerManagedPolicyReferenceToPermissionSet\"\
          \n            - \"sso:DetachCustomerManagedPolicyReferenceFromPermissionSet\"\
          \n            - \"sso:DescribePermissionSetProvisioningStatus\"\n      \
          \      - \"sso:GetPermissionsBoundaryForPermissionSet\"\n            - \"\
          sso:PutPermissionsBoundaryToPermissionSet\"\n            - \"sso:DeletePermissionsBoundaryFromPermissionSet\"\
          \n            Effect: \"Allow\"\n            Resource:\n            - \"\
          arn:aws:organizations::*:root/o-*/r-*\"\n            - \"arn:aws:organizations::*:ou/o-*/ou-*\"\
          \n            - \"arn:aws:sso:::instance/*\"\n            - \"arn:aws:sso:::permissionSet/*/*\"\
          \n            - \"arn:aws:sso:::account/*\"\n            - \"arn:aws:iam::*:saml-provider/*\"\
          \n            Sid: \"sso1\"\n          Version: \"2012-10-17\"\n       \
          \ PolicyName: \"sso-policy\"\n      - PolicyDocument:\n          Statement:\n\
          \          - Action: \"rds-db:connect\"\n            Effect: \"Allow\"\n\
          \            Resource: \"arn:aws:rds-db:*:*:dbuser:*/apono_connector\"\n\
          \          Version: \"2012-10-17\"\n        PolicyName: \"rds-connect\"\n\
          \      - PolicyDocument:\n          Statement:\n          - Action:\n  \
          \          - \"eks:DeleteAccessEntry\"\n            - \"eks:UntagResource\"\
          \n            - \"eks:AssociateAccessPolicy\"\n            - \"eks:DisassociateAccessPolicy\"\
          \n            - \"eks:TagResource\"\n            - \"eks:CreateAccessEntry\"\
          \n            - \"eks:UpdateAccessEntry\"\n            Effect: \"Allow\"\
          \n            Resource: \"*\"\n          Version: \"2012-10-17\"\n     \
          \   PolicyName: \"eks-write-policy\"\n      - Fn::If:\n        - \"ReadS3TrailLogsCondition\"\
          \n        - PolicyName: \"AponoConnectorS3LogsRead\"\n          PolicyDocument:\n\
          \            Version: \"2012-10-17\"\n            Statement:\n         \
          \   - Sid: \"AponoS3AWSLogsGetObject\"\n              Effect: \"Allow\"\n\
          \              Action:\n              - \"s3:GetObject\"\n             \
          \ - \"s3:GetObjectRetention\"\n              - \"s3:GetObjectAttributes\"\
          \n              Resource:\n              - \"arn:aws:s3:::*/AWSLogs/*\"\n\
          \              - \"arn:aws:s3:::*/*/AWSLogs/*\"\n            - Sid: \"AponoS3AWSLogsListBucket\"\
          \n              Effect: \"Allow\"\n              Action: \"s3:ListBucket\"\
          \n              Resource: \"arn:aws:s3:::*\"\n              Condition:\n\
          \                StringLike:\n                  s3:prefix:\n           \
          \       - \"AWSLogs/*\"\n                  - \"AWSLogs/*/*\"\n        -\
          \ Ref: \"AWS::NoValue\"\n      RoleName:\n        Fn::Join:\n        - \"\
          \"\n        - - \"apono-cross-account-role-\"\n          - Ref: \"AponoConnectorId\"\
          \n"
        - "---\nParameters:\n  AponoConnectorId:\n    Type: \"String\"\n    Description:\
          \ \"Apono Connector ID\"\n  AponoConnectorRoleArn:\n    Type: \"String\"\
          \n    Description: \"The ARN of the connector's IAM Role\"\n  ExternalID:\n\
          \    Type: \"String\"\n    Description: \"The cross-account access role\
          \ created by the stack will use this\\\n      \\ value for its ExternalID.\
          \ Do not change this value!\"\n  S3AWSLogsScanning:\n    Type: \"String\"\
          \n    Default: \"Enabled\"\n    AllowedValues:\n    - \"Enabled\"\n    -\
          \ \"Disabled\"\n    Description: \"Enable retrieval of AWSLogs/* objects\
          \ from S3 buckets\"\nMappings:\n  AponoEnvironment:\n    env:\n      organizationID:\
          \ \"026598536039\"\n      SnsNameForConfirmCustomerDeployment: \"aws-integration-callback\"\
          \nConditions:\n  ReadS3TrailLogsCondition:\n    Fn::Equals:\n    - Ref:\
          \ \"S3AWSLogsScanning\"\n    - \"Enabled\"\nResources:\n  AponoCWSSACrossAccountAccessRole:\n\
          \    Type: \"AWS::IAM::Role\"\n    Properties:\n      AssumeRolePolicyDocument:\n\
          \        Statement:\n        - Action:\n          - \"sts:AssumeRole\"\n\
          \          - \"sts:TagSession\"\n          Effect: \"Allow\"\n         \
          \ Principal:\n            AWS:\n              Fn::Split:\n             \
          \ - \",\"\n              - Ref: \"AponoConnectorRoleArn\"\n        Version:\
          \ \"2012-10-17\"\n      ManagedPolicyArns:\n      - \"arn:aws:iam::aws:policy/SecurityAudit\"\
          \n      - \"arn:aws:iam::aws:policy/AWSCloudFormationReadOnlyAccess\"\n\
          \      - \"arn:aws:iam::aws:policy/AWSResourceExplorerReadOnlyAccess\"\n\
          \      Policies:\n      - PolicyDocument:\n          Statement:\n      \
          \    - Action:\n            - \"ecr:GetLifecyclePolicy\"\n            -\
          \ \"lambda:Get*\"\n            - \"s3:ListBucket\"\n            - \"sns:GetSubscriptionAttributes\"\
          \n            - \"dynamodb:ListTagsOfResource\"\n            - \"sns:ListTagsForResource\"\
          \n            - \"es:ListTags\"\n            - \"rds:DescribeDBClusters\"\
          \n            Effect: \"Allow\"\n            Resource: \"*\"\n         \
          \   Sid: \"AllowDescribingResources\"\n          Version: \"2012-10-17\"\
          \n        PolicyName: \"AponoDescribePolicy\"\n      - PolicyDocument:\n\
          \          Statement:\n          - Action:\n            - \"rds:DescribeDBInstances\"\
          \n            - \"rds:ListTagsForResource\"\n            Effect: \"Allow\"\
          \n            Resource: \"arn:aws:rds:*:*:db:*\"\n          Version: \"\
          2012-10-17\"\n        PolicyName: \"rds-list-policy\"\n      - PolicyDocument:\n\
          \          Statement:\n          - Action:\n            - \"s3:GetBucketTagging\"\
          \n            - \"s3:ListAllMyBuckets\"\n            - \"s3:ListBucket\"\
          \n            - \"s3:GetBucketLocation\"\n            Effect: \"Allow\"\n\
          \            Resource: \"arn:aws:s3:::*\"\n          Version: \"2012-10-17\"\
          \n        PolicyName: \"s3-list-policy\"\n      - PolicyDocument:\n    \
          \      Statement:\n          - Action: \"ssm:GetParameters*\"\n        \
          \    Effect: \"Allow\"\n            Resource: \"arn:aws:ssm:*:*:parameter/*\"\
          \n          - Action: \"ssm:DescribeParameters\"\n            Effect: \"\
          Allow\"\n            Resource: \"*\"\n          Version: \"2012-10-17\"\n\
          \        PolicyName: \"ssm-params-list-policy\"\n      - PolicyDocument:\n\
          \          Statement:\n          - Action: \"tag:GetResources\"\n      \
          \      Effect: \"Allow\"\n            Resource: \"*\"\n          Version:\
          \ \"2012-10-17\"\n        PolicyName: \"read-resource-tags-policy\"\n  \
          \    - PolicyDocument:\n          Statement:\n          - Action:\n    \
          \        - \"ec2:DescribeInstances\"\n            - \"ec2:DescribeTags\"\
          \n            Effect: \"Allow\"\n            Resource: \"*\"\n         \
          \ Version: \"2012-10-17\"\n        PolicyName: \"ec2-policy\"\n      - PolicyDocument:\n\
          \          Statement:\n          - Action:\n            - \"ecr:DescribeImages\"\
          \n            - \"ecr:DescribeRepositories\"\n            Effect: \"Allow\"\
          \n            Resource: \"*\"\n            Sid: \"assume\"\n          Version:\
          \ \"2012-10-17\"\n        PolicyName: \"ecr-policy\"\n      - PolicyDocument:\n\
          \          Statement:\n          - Action:\n            - \"logs:DescribeLogStreams\"\
          \n            - \"logs:GetLogEvents\"\n            Effect: \"Allow\"\n \
          \           Resource: \"arn:aws:logs:*:*:log-group:/ecs/apono-connector-logs-*:*\"\
          \n            Sid: \"AllowReadingAponoConnectorLogs\"\n          Version:\
          \ \"2012-10-17\"\n        PolicyName: \"AponoConnectorLogsRead\"\n     \
          \ - PolicyDocument:\n          Statement:\n          - Action:\n       \
          \     - \"eks:AccessKubernetesApi\"\n            - \"eks:ListTagsForResource\"\
          \n            - \"eks:ListAccessEntries\"\n            - \"eks:DescribeAccessEntry\"\
          \n            - \"eks:ListAssociatedAccessPolicies\"\n            - \"eks:DescribeCluster\"\
          \n            - \"eks:ListAccessPolicies\"\n            - \"eks:ListClusters\"\
          \n            Effect: \"Allow\"\n            Resource: \"*\"\n         \
          \ Version: \"2012-10-17\"\n        PolicyName: \"eks-read-policy\"\n   \
          \   - PolicyDocument:\n          Statement:\n          - Action:\n     \
          \       - \"sts:AssumeRole\"\n            - \"sts:TagSession\"\n       \
          \     Effect: \"Allow\"\n            Resource: \"arn:aws:iam::*:role/apono-*\"\
          \n            Sid: \"assume\"\n          Version: \"2012-10-17\"\n     \
          \   PolicyName: \"remote-management\"\n      - PolicyDocument:\n       \
          \   Statement:\n          - Action: \"kms:Sign\"\n            Condition:\n\
          \              StringEquals:\n                aws:ResourceTag/apono-connector-read:\
          \ \"true\"\n            Effect: \"Allow\"\n            Resource: \"*\"\n\
          \          - Action: \"kms:Decrypt\"\n            Condition:\n         \
          \     StringEquals:\n                aws:ResourceTag/apono-connector-access:\
          \ \"true\"\n            Effect: \"Allow\"\n            Resource: \"*\"\n\
          \          Version: \"2012-10-17\"\n        PolicyName: \"apono-tagged-keys-access-policy\"\
          \n      - PolicyDocument:\n          Statement:\n          - Action:\n \
          \           - \"secretsmanager:GetSecretValue\"\n            - \"secretsmanager:DescribeSecret\"\
          \n            Condition:\n              StringEquals:\n                aws:ResourceTag/apono-connector-read:\
          \ \"true\"\n            Effect: \"Allow\"\n            Resource: \"arn:aws:secretsmanager:*:*:secret:*\"\
          \n          Version: \"2012-10-17\"\n        PolicyName: \"apono-tagged-secrets-access-policy\"\
          \n      - PolicyDocument:\n          Statement:\n          - Action:\n \
          \           - \"lambda:InvokeFunction\"\n            - \"lambda:GetFunction\"\
          \n            Condition:\n              StringEquals:\n                aws:ResourceTag/apono-connector-access:\
          \ \"true\"\n            Effect: \"Allow\"\n            Resource: \"arn:aws:lambda:*:*:function:*\"\
          \n          Version: \"2012-10-17\"\n        PolicyName: \"apono-tagged-lambda-functions-access-policy\"\
          \n      - PolicyDocument:\n          Statement:\n          - Action: \"\
          s3:GetObject\"\n            Effect: \"Allow\"\n            Resource: \"\
          arn:aws:s3:::aws-cloudtrail-logs-apono-*/*\"\n          Version: \"2012-10-17\"\
          \n        PolicyName: \"apono-cloudtrail-logs-s3-access-policy\"\n     \
          \ - Fn::If:\n        - \"ReadS3TrailLogsCondition\"\n        - PolicyName:\
          \ \"AponoConnectorS3LogsRead\"\n          PolicyDocument:\n            Version:\
          \ \"2012-10-17\"\n            Statement:\n            - Sid: \"AponoS3AWSLogsGetObject\"\
          \n              Effect: \"Allow\"\n              Action:\n             \
          \ - \"s3:GetObject\"\n              - \"s3:GetObjectRetention\"\n      \
          \        - \"s3:GetObjectAttributes\"\n              Resource:\n       \
          \       - \"arn:aws:s3:::*/AWSLogs/*\"\n              - \"arn:aws:s3:::*/*/AWSLogs/*\"\
          \n            - Sid: \"AponoS3AWSLogsListBucket\"\n              Effect:\
          \ \"Allow\"\n              Action: \"s3:ListBucket\"\n              Resource:\
          \ \"arn:aws:s3:::*\"\n              Condition:\n                StringLike:\n\
          \                  s3:prefix:\n                  - \"AWSLogs/*\"\n     \
          \             - \"AWSLogs/*/*\"\n        - Ref: \"AWS::NoValue\"\n     \
          \ RoleName:\n        Fn::Join:\n        - \"\"\n        - - \"apono-cross-account-role-\"\
          \n          - Ref: \"AponoConnectorId\"\n"
  CrossAccountRoleFullAccess:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action:
          - "sts:AssumeRole"
          - "sts:TagSession"
          Effect: "Allow"
          Principal:
            AWS:
              Fn::Split:
              - ","
              - Ref: "ConnectorRoleArn"
        Version: "2012-10-17"
      ManagedPolicyArns:
      - "arn:aws:iam::aws:policy/SecurityAudit"
      - "arn:aws:iam::aws:policy/AWSCloudFormationReadOnlyAccess"
      - "arn:aws:iam::aws:policy/AWSResourceExplorerReadOnlyAccess"
      Policies:
      - PolicyDocument:
          Statement:
          - Action:
            - "ecr:GetLifecyclePolicy"
            - "lambda:Get*"
            - "s3:ListBucket"
            - "sns:GetSubscriptionAttributes"
            - "dynamodb:ListTagsOfResource"
            - "sns:ListTagsForResource"
            - "es:ListTags"
            - "rds:DescribeDBClusters"
            Effect: "Allow"
            Resource: "*"
            Sid: "AllowDescribingResources"
          Version: "2012-10-17"
        PolicyName: "AponoDescribePolicy"
      - PolicyDocument:
          Statement:
          - Action:
            - "rds:DescribeDBInstances"
            - "rds:ListTagsForResource"
            Effect: "Allow"
            Resource: "arn:aws:rds:*:*:db:*"
          Version: "2012-10-17"
        PolicyName: "rds-list-policy"
      - PolicyDocument:
          Statement:
          - Action:
            - "s3:GetBucketTagging"
            - "s3:ListAllMyBuckets"
            - "s3:ListBucket"
            - "s3:GetBucketLocation"
            Effect: "Allow"
            Resource: "arn:aws:s3:::*"
          Version: "2012-10-17"
        PolicyName: "s3-list-policy"
      - PolicyDocument:
          Statement:
          - Action: "ssm:GetParameters*"
            Effect: "Allow"
            Resource: "arn:aws:ssm:*:*:parameter/*"
          - Action: "ssm:DescribeParameters"
            Effect: "Allow"
            Resource: "*"
          Version: "2012-10-17"
        PolicyName: "ssm-params-list-policy"
      - PolicyDocument:
          Statement:
          - Action: "tag:GetResources"
            Effect: "Allow"
            Resource: "*"
          Version: "2012-10-17"
        PolicyName: "read-resource-tags-policy"
      - PolicyDocument:
          Statement:
          - Action:
            - "ec2:DescribeInstances"
            - "ec2:DescribeTags"
            Effect: "Allow"
            Resource: "*"
          Version: "2012-10-17"
        PolicyName: "ec2-policy"
      - PolicyDocument:
          Statement:
          - Action:
            - "ecr:DescribeImages"
            - "ecr:DescribeRepositories"
            Effect: "Allow"
            Resource: "*"
            Sid: "assume"
          Version: "2012-10-17"
        PolicyName: "ecr-policy"
      - PolicyDocument:
          Statement:
          - Action:
            - "logs:DescribeLogStreams"
            - "logs:GetLogEvents"
            Effect: "Allow"
            Resource: "arn:aws:logs:*:*:log-group:/ecs/apono-connector-logs-*:*"
            Sid: "AllowReadingAponoConnectorLogs"
          Version: "2012-10-17"
        PolicyName: "AponoConnectorLogsRead"
      - PolicyDocument:
          Statement:
          - Action:
            - "eks:AccessKubernetesApi"
            - "eks:ListTagsForResource"
            - "eks:ListAccessEntries"
            - "eks:DescribeAccessEntry"
            - "eks:ListAssociatedAccessPolicies"
            - "eks:DescribeCluster"
            - "eks:ListAccessPolicies"
            - "eks:ListClusters"
            Effect: "Allow"
            Resource: "*"
          Version: "2012-10-17"
        PolicyName: "eks-read-policy"
      - PolicyDocument:
          Statement:
          - Action:
            - "sts:AssumeRole"
            - "sts:TagSession"
            Effect: "Allow"
            Resource: "arn:aws:iam::*:role/apono-*"
            Sid: "assume"
          Version: "2012-10-17"
        PolicyName: "remote-management"
      - PolicyDocument:
          Statement:
          - Action: "kms:Sign"
            Condition:
              StringEquals:
                aws:ResourceTag/apono-connector-read: "true"
            Effect: "Allow"
            Resource: "*"
          - Action: "kms:Decrypt"
            Condition:
              StringEquals:
                aws:ResourceTag/apono-connector-access: "true"
            Effect: "Allow"
            Resource: "*"
          Version: "2012-10-17"
        PolicyName: "apono-tagged-keys-access-policy"
      - PolicyDocument:
          Statement:
          - Action:
            - "secretsmanager:GetSecretValue"
            - "secretsmanager:DescribeSecret"
            Condition:
              StringEquals:
                aws:ResourceTag/apono-connector-read: "true"
            Effect: "Allow"
            Resource: "arn:aws:secretsmanager:*:*:secret:*"
          Version: "2012-10-17"
        PolicyName: "apono-tagged-secrets-access-policy"
      - PolicyDocument:
          Statement:
          - Action:
            - "lambda:InvokeFunction"
            - "lambda:GetFunction"
            Condition:
              StringEquals:
                aws:ResourceTag/apono-connector-access: "true"
            Effect: "Allow"
            Resource: "arn:aws:lambda:*:*:function:*"
          Version: "2012-10-17"
        PolicyName: "apono-tagged-lambda-functions-access-policy"
      - PolicyDocument:
          Statement:
          - Action: "s3:GetObject"
            Effect: "Allow"
            Resource: "arn:aws:s3:::aws-cloudtrail-logs-apono-*/*"
          Version: "2012-10-17"
        PolicyName: "apono-cloudtrail-logs-s3-access-policy"
      - PolicyDocument:
          Statement:
          - Action:
            - "iam:ListPolicies"
            - "iam:CreateInstanceProfile"
            - "iam:ListGroups"
            - "iam:ListInstanceProfiles"
            - "iam:ListRoles"
            Effect: "Allow"
            Resource: "*"
          - Action:
            - "iam:CreateInstanceProfile"
            - "iam:GetRole"
            - "iam:UpdateAssumeRolePolicy"
            - "iam:ListRoleTags"
            - "iam:TagRole"
            - "iam:UntagRole"
            - "iam:CreateRole"
            - "iam:DeleteRole"
            - "iam:AttachRolePolicy"
            - "iam:PutRolePolicy"
            - "iam:AddRoleToInstanceProfile"
            - "iam:ListInstanceProfilesForRole"
            - "iam:DetachRolePolicy"
            - "iam:ListAttachedRolePolicies"
            - "iam:DeleteRolePolicy"
            - "iam:ListAttachedGroupPolicies"
            - "iam:ListRolePolicies"
            - "iam:GetRolePolicy"
            - "iam:PassRole"
            - "iam:GetInstanceProfile"
            - "iam:CreateUser"
            - "iam:CreateAccessKey"
            - "iam:DeleteAccessKey"
            - "iam:PutUserPolicy"
            - "iam:DeleteUserPolicy"
            - "iam:GetUser"
            - "iam:GetUserPolicy"
            - "iam:DeleteUser"
            - "iam:ListAttachedUserPolicies"
            - "iam:ListUserPolicies"
            - "iam:UpdateLoginProfile"
            - "iam:ListAccessKeys"
            - "iam:AttachUserPolicy"
            - "iam:DetachUserPolicy"
            - "iam:CreateLoginProfile"
            - "iam:CreateServiceLinkedRole"
            - "iam:GetPolicy"
            - "iam:GetPolicyVersion"
            - "iam:ListGroupPolicies"
            - "iam:GetGroupPolicy"
            - "iam:PutRolePermissionsBoundary"
            - "iam:DeleteRolePermissionsBoundary"
            - "iam:PutUserPermissionsBoundary"
            - "iam:DeleteUserPermissionsBoundary"
            - "iam:TagUser"
            - "iam:ListUserTags"
            - "iam:UpdateRole"
            Effect: "Allow"
            Resource:
            - "arn:aws:iam::*:instance-profile/*"
            - "arn:aws:iam::*:role/*"
            - "arn:aws:iam::*:group/*"
            - "arn:aws:iam::*:user/*"
            - "arn:aws:iam::*:policy/*"
          Version: "2012-10-17"
        PolicyName: "iam-access-policy"
      - PolicyDocument:
          Statement:
          - Action:
            - "organizations:ListAccounts"
            - "tag:GetResources"
            - "tag:GetTagValues"
            - "sso:ListInstances"
            - "identitystore:*"
            - "tag:GetTagKeys"
            - "sso:TagResource"
            - "sso:UntagResource"
            - "sso-directory:SearchUsers"
            Effect: "Allow"
            Resource: "*"
            Sid: "sso0"
          - Action:
            - "organizations:ListAccountsForParent"
            - "sso:ListPermissionSets"
            - "sso:CreateAccountAssignment"
            - "sso:DescribeAccountAssignmentCreationStatus"
            - "organizations:ListParents"
            - "sso:DeleteAccountAssignment"
            - "sso:DescribePermissionSet"
            - "organizations:ListChildren"
            - "sso:DescribeAccountAssignmentDeletionStatus"
            - "sso:DeletePermissionSet"
            - "sso:CreatePermissionSet"
            - "sso:PutInlinePolicyToPermissionSet"
            - "iam:CreateSAMLProvider"
            - "iam:UpdateSAMLProvider"
            - "iam:GetSAMLProvider"
            - "sso:GetInlinePolicyForPermissionSet"
            - "sso:DeleteInlinePolicyFromPermissionSet"
            - "sso:ProvisionPermissionSet"
            - "sso:AttachManagedPolicyToPermissionSet"
            - "sso:DetachManagedPolicyFromPermissionSet"
            - "sso:ListManagedPoliciesInPermissionSet"
            - "sso:ListCustomerManagedPolicyReferencesInPermissionSet"
            - "sso:AttachCustomerManagedPolicyReferenceToPermissionSet"
            - "sso:DetachCustomerManagedPolicyReferenceFromPermissionSet"
            - "sso:DescribePermissionSetProvisioningStatus"
            - "sso:GetPermissionsBoundaryForPermissionSet"
            - "sso:PutPermissionsBoundaryToPermissionSet"
            - "sso:DeletePermissionsBoundaryFromPermissionSet"
            Effect: "Allow"
            Resource:
            - "arn:aws:organizations::*:root/o-*/r-*"
            - "arn:aws:organizations::*:ou/o-*/ou-*"
            - "arn:aws:sso:::instance/*"
            - "arn:aws:sso:::permissionSet/*/*"
            - "arn:aws:sso:::account/*"
            - "arn:aws:iam::*:saml-provider/*"
            Sid: "sso1"
          Version: "2012-10-17"
        PolicyName: "sso-policy"
      - PolicyDocument:
          Statement:
          - Action: "rds-db:connect"
            Effect: "Allow"
            Resource: "arn:aws:rds-db:*:*:dbuser:*/apono_connector"
          Version: "2012-10-17"
        PolicyName: "rds-connect"
      - PolicyDocument:
          Statement:
          - Action:
            - "eks:DeleteAccessEntry"
            - "eks:UntagResource"
            - "eks:AssociateAccessPolicy"
            - "eks:DisassociateAccessPolicy"
            - "eks:TagResource"
            - "eks:CreateAccessEntry"
            - "eks:UpdateAccessEntry"
            Effect: "Allow"
            Resource: "*"
          Version: "2012-10-17"
        PolicyName: "eks-write-policy"
      - Fn::If:
        - "ReadS3TrailLogsCondition"
        - PolicyName: "AponoConnectorS3LogsRead"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
            - Sid: "AponoS3AWSLogsGetObject"
              Effect: "Allow"
              Action:
              - "s3:GetObject"
              - "s3:GetObjectRetention"
              - "s3:GetObjectAttributes"
              Resource:
              - "arn:aws:s3:::*/AWSLogs/*"
              - "arn:aws:s3:::*/*/AWSLogs/*"
            - Sid: "AponoS3AWSLogsListBucket"
              Effect: "Allow"
              Action: "s3:ListBucket"
              Resource: "arn:aws:s3:::*"
              Condition:
                StringLike:
                  s3:prefix:
                  - "AWSLogs/*"
                  - "AWSLogs/*/*"
        - Ref: "AWS::NoValue"
      RoleName:
        Fn::Join:
        - ""
        - - "apono-cross-account-role-"
          - Ref: "AponoConnectorId"
    Condition: "UseFullAccess"
  CrossAccountRoleReadOnly:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action:
          - "sts:AssumeRole"
          - "sts:TagSession"
          Effect: "Allow"
          Principal:
            AWS:
              Fn::Split:
              - ","
              - Ref: "ConnectorRoleArn"
        Version: "2012-10-17"
      ManagedPolicyArns:
      - "arn:aws:iam::aws:policy/SecurityAudit"
      - "arn:aws:iam::aws:policy/AWSCloudFormationReadOnlyAccess"
      - "arn:aws:iam::aws:policy/AWSResourceExplorerReadOnlyAccess"
      Policies:
      - PolicyDocument:
          Statement:
          - Action:
            - "ecr:GetLifecyclePolicy"
            - "lambda:Get*"
            - "s3:ListBucket"
            - "sns:GetSubscriptionAttributes"
            - "dynamodb:ListTagsOfResource"
            - "sns:ListTagsForResource"
            - "es:ListTags"
            - "rds:DescribeDBClusters"
            Effect: "Allow"
            Resource: "*"
            Sid: "AllowDescribingResources"
          Version: "2012-10-17"
        PolicyName: "AponoDescribePolicy"
      - PolicyDocument:
          Statement:
          - Action:
            - "rds:DescribeDBInstances"
            - "rds:ListTagsForResource"
            Effect: "Allow"
            Resource: "arn:aws:rds:*:*:db:*"
          Version: "2012-10-17"
        PolicyName: "rds-list-policy"
      - PolicyDocument:
          Statement:
          - Action:
            - "s3:GetBucketTagging"
            - "s3:ListAllMyBuckets"
            - "s3:ListBucket"
            - "s3:GetBucketLocation"
            Effect: "Allow"
            Resource: "arn:aws:s3:::*"
          Version: "2012-10-17"
        PolicyName: "s3-list-policy"
      - PolicyDocument:
          Statement:
          - Action: "ssm:GetParameters*"
            Effect: "Allow"
            Resource: "arn:aws:ssm:*:*:parameter/*"
          - Action: "ssm:DescribeParameters"
            Effect: "Allow"
            Resource: "*"
          Version: "2012-10-17"
        PolicyName: "ssm-params-list-policy"
      - PolicyDocument:
          Statement:
          - Action: "tag:GetResources"
            Effect: "Allow"
            Resource: "*"
          Version: "2012-10-17"
        PolicyName: "read-resource-tags-policy"
      - PolicyDocument:
          Statement:
          - Action:
            - "ec2:DescribeInstances"
            - "ec2:DescribeTags"
            Effect: "Allow"
            Resource: "*"
          Version: "2012-10-17"
        PolicyName: "ec2-policy"
      - PolicyDocument:
          Statement:
          - Action:
            - "ecr:DescribeImages"
            - "ecr:DescribeRepositories"
            Effect: "Allow"
            Resource: "*"
            Sid: "assume"
          Version: "2012-10-17"
        PolicyName: "ecr-policy"
      - PolicyDocument:
          Statement:
          - Action:
            - "logs:DescribeLogStreams"
            - "logs:GetLogEvents"
            Effect: "Allow"
            Resource: "arn:aws:logs:*:*:log-group:/ecs/apono-connector-logs-*:*"
            Sid: "AllowReadingAponoConnectorLogs"
          Version: "2012-10-17"
        PolicyName: "AponoConnectorLogsRead"
      - PolicyDocument:
          Statement:
          - Action:
            - "eks:AccessKubernetesApi"
            - "eks:ListTagsForResource"
            - "eks:ListAccessEntries"
            - "eks:DescribeAccessEntry"
            - "eks:ListAssociatedAccessPolicies"
            - "eks:DescribeCluster"
            - "eks:ListAccessPolicies"
            - "eks:ListClusters"
            Effect: "Allow"
            Resource: "*"
          Version: "2012-10-17"
        PolicyName: "eks-read-policy"
      - PolicyDocument:
          Statement:
          - Action:
            - "sts:AssumeRole"
            - "sts:TagSession"
            Effect: "Allow"
            Resource: "arn:aws:iam::*:role/apono-*"
            Sid: "assume"
          Version: "2012-10-17"
        PolicyName: "remote-management"
      - PolicyDocument:
          Statement:
          - Action: "kms:Sign"
            Condition:
              StringEquals:
                aws:ResourceTag/apono-connector-read: "true"
            Effect: "Allow"
            Resource: "*"
          - Action: "kms:Decrypt"
            Condition:
              StringEquals:
                aws:ResourceTag/apono-connector-access: "true"
            Effect: "Allow"
            Resource: "*"
          Version: "2012-10-17"
        PolicyName: "apono-tagged-keys-access-policy"
      - PolicyDocument:
          Statement:
          - Action:
            - "secretsmanager:GetSecretValue"
            - "secretsmanager:DescribeSecret"
            Condition:
              StringEquals:
                aws:ResourceTag/apono-connector-read: "true"
            Effect: "Allow"
            Resource: "arn:aws:secretsmanager:*:*:secret:*"
          Version: "2012-10-17"
        PolicyName: "apono-tagged-secrets-access-policy"
      - PolicyDocument:
          Statement:
          - Action:
            - "lambda:InvokeFunction"
            - "lambda:GetFunction"
            Condition:
              StringEquals:
                aws:ResourceTag/apono-connector-access: "true"
            Effect: "Allow"
            Resource: "arn:aws:lambda:*:*:function:*"
          Version: "2012-10-17"
        PolicyName: "apono-tagged-lambda-functions-access-policy"
      - PolicyDocument:
          Statement:
          - Action: "s3:GetObject"
            Effect: "Allow"
            Resource: "arn:aws:s3:::aws-cloudtrail-logs-apono-*/*"
          Version: "2012-10-17"
        PolicyName: "apono-cloudtrail-logs-s3-access-policy"
      - Fn::If:
        - "ReadS3TrailLogsCondition"
        - PolicyName: "AponoConnectorS3LogsRead"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
            - Sid: "AponoS3AWSLogsGetObject"
              Effect: "Allow"
              Action:
              - "s3:GetObject"
              - "s3:GetObjectRetention"
              - "s3:GetObjectAttributes"
              Resource:
              - "arn:aws:s3:::*/AWSLogs/*"
              - "arn:aws:s3:::*/*/AWSLogs/*"
            - Sid: "AponoS3AWSLogsListBucket"
              Effect: "Allow"
              Action: "s3:ListBucket"
              Resource: "arn:aws:s3:::*"
              Condition:
                StringLike:
                  s3:prefix:
                  - "AWSLogs/*"
                  - "AWSLogs/*/*"
        - Ref: "AWS::NoValue"
      RoleName:
        Fn::Join:
        - ""
        - - "apono-cross-account-role-"
          - Ref: "AponoConnectorId"
    Condition: "UseReadOnlyAccess"
  AponoResourceExplorerView:
    Type: "AWS::ResourceExplorer2::View"
    Properties:
      IncludedProperties:
      - Name: "tags"
      Scope:
        Fn::Join:
        - ""
        - - "arn:"
          - Ref: "AWS::Partition"
          - ":organizations::"
          - Ref: "AWS::AccountId"
          - ":organization/"
          - Ref: "OrganizationId"
      ViewName:
        Fn::Join:
        - ""
        - - "apono-all-accounts-view-"
          - Fn::Select:
            - 2
            - Fn::Split:
              - "/"
              - Ref: "AWS::StackId"
    Condition: "EnableResourceExplorerDiscoveryCondition"
Outputs:
  ManagementAccountRoleArnOutput:
    Description: "The Management Account Role ARN to use when adding AWS Organization\
      \ integration in Apono"
    Value:
      Fn::GetAtt:
      - "IAMRole"
      - "Arn"

