AWSTemplateFormatVersion: '2010-09-09'
Description: >-
  ScionTech Cloud Audit - read-only IAM role for AWS security assessment.
  Grants no write permissions of any kind. Delete this stack to revoke access.

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Provided by ScionTech - do not modify
        Parameters:
          - ExternalId
          - TrustedAccountId
    ParameterLabels:
      ExternalId:
        default: External ID
      TrustedAccountId:
        default: ScionTech AWS account ID

Parameters:
  ExternalId:
    Type: String
    Description: >-
      Unique value issued by ScionTech. Prevents anyone else from assuming this
      role even if they learn its ARN. Do not share or reuse it.
    MinLength: 16
    MaxLength: 64
    AllowedPattern: '^[A-Za-z0-9._-]+$'
    ConstraintDescription: 16-64 characters, alphanumeric plus . _ -

  TrustedAccountId:
    Type: String
    Description: The ScionTech AWS account permitted to assume this role.
    AllowedPattern: '^[0-9]{12}$'
    ConstraintDescription: Must be a 12-digit AWS account ID.

Resources:
  ScionTechAuditRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: ScionTechAuditRole
      Description: Read-only access for the ScionTech AWS security audit.
      # One hour is ample for a full scan and limits the blast radius of a
      # leaked session token.
      MaxSessionDuration: 3600
      # AWS-managed policies only. Published and maintained by AWS, so their
      # contents can be verified without reading anything we wrote.
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/SecurityAudit
        - arn:aws:iam::aws:policy/job-function/ViewOnlyAccess
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::${TrustedAccountId}:root'
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                sts:ExternalId: !Ref ExternalId
      Tags:
        - Key: Vendor
          Value: ScionTech
        - Key: Purpose
          Value: SecurityAudit
        - Key: AccessLevel
          Value: ReadOnly

Outputs:
  RoleArn:
    Description: Paste this into ScionTech if verification does not complete automatically.
    Value: !GetAtt ScionTechAuditRole.Arn
  AccountId:
    Description: This AWS account ID.
    Value: !Ref AWS::AccountId
  HowToRevoke:
    Description: Revoking access
    Value: Delete this CloudFormation stack. Access ends immediately.