AWSTemplateFormatVersion: 2010-09-09
Description: IAM Role used by CloudFormation SNS emission consumer Lambda functions

Metadata:
  Source: https://github.com/mozilla/cloudformation-cross-account-outputs
  TemplateVersion: 4.2.0

Parameters:
  DynamoDBTableName: 
    Type: String
    Description: The name of the emission DynamoDB table
    Default: cloudformation-stack-emissions
    AllowedPattern: "[A-Za-z0-9._-]+"
    ConstraintDescription: Only alphanumeric characters, dash, underscores and dot
    MinLength: 3
    MaxLength: 255

  DynamoDBTableRegion: 
    Type: String
    Description: The region where the emission DynamoDB table is located
    Default: us-west-2
    AllowedPattern: "[a-z0-9-]+"
    ConstraintDescription: Only lowercase letters, numbers and dashes

  EmissionSNSConsumerIAMRoleName: 
    Type: String
    Description: The region where the emission DynamoDB table is located
    Default: cloudformation-sns-emission-consumer
    AllowedPattern: '[\w+=,.@-]+'
    ConstraintDescription: Should match the role name regex
    MinLength: 1
    MaxLength: 64

Resources:
  ProcessCloudFormationSNSEmissionLambdaIAMRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref EmissionSNSConsumerIAMRoleName
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
          Action:
          - sts:AssumeRole
      Policies:
        - PolicyName: AllowLambdaLogging
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              -
                Effect: Allow
                Action:
                  - logs:*
                  - iam:ListRoles
                Resource: '*'
        - PolicyName: AllowDynamoDB
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              -
                Effect: Allow
                Action:
                  - dynamodb:CreateTable
                  - dynamodb:DescribeTable
                  - dynamodb:PutItem
                  - dynamodb:DeleteItem
                Resource: !Sub 'arn:aws:dynamodb:${DynamoDBTableRegion}:${AWS::AccountId}:table/${DynamoDBTableName}'