AWSTemplateFormatVersion: "2010-09-09"
Description: >
  Grants DuploCloud HelpDesk granular access to your AWS account and EKS cluster.
  Creates 4 independent roles (AWS admin/read-only, EKS admin/read-only)
  with individual enable/disable controls. Takes 2-3 minutes to deploy.

Parameters:
  HelpdeskAccountId:
    Type: String
    Default: ""
    Description: "Optional: Helpdesk AWS Account ID for cross-account access. Leave empty for same-account access only."
    AllowedPattern: "^$|[0-9]{12}"
    ConstraintDescription: "Must be empty or a 12-digit AWS account ID"

  EKSClusterName:
    Type: String
    Default: ""
    Description: "Optional: Name of the EKS cluster. Required only if enabling EKS Admin or EKS Read-Only roles."
    AllowedPattern: "^$|[a-zA-Z0-9][a-zA-Z0-9\\-]{0,99}"
    ConstraintDescription: "Must be empty or 1-100 chars (letters/numbers/hyphens, must start with letter or digit)"

  EnableAWSAdmin:
    Type: String
    Default: "false"
    AllowedValues:
      - "true"
      - "false"
    Description: "Create AWS Admin role with AdministratorAccess policy"

  EnableAWSReadOnly:
    Type: String
    Default: "true"
    AllowedValues:
      - "true"
      - "false"
    Description: "Create AWS Read-Only role with ReadOnlyAccess policy"

  EnableEKSAdmin:
    Type: String
    Default: "false"
    AllowedValues:
      - "true"
      - "false"
    Description: "Create EKS Admin role with AmazonEKSClusterAdminPolicy"

  EnableEKSReadOnly:
    Type: String
    Default: "true"
    AllowedValues:
      - "true"
      - "false"
    Description: "Create EKS Read-Only role with AmazonEKSViewPolicy"

Conditions:
  HasHelpdeskAccount: !Not [!Equals [!Ref HelpdeskAccountId, ""]]
  HasEKSClusterName: !Not [!Equals [!Ref EKSClusterName, ""]]
  CreateAWSAdminRole: !Equals [!Ref EnableAWSAdmin, "true"]
  CreateAWSReadOnlyRole: !Equals [!Ref EnableAWSReadOnly, "true"]
  CreateEKSAdminRole: !Equals [!Ref EnableEKSAdmin, "true"]
  CreateEKSReadOnlyRole: !Equals [!Ref EnableEKSReadOnly, "true"]

Resources:
  # -------------------------------------------------------
  # AWS Admin IAM Role (no EKS access)
  # -------------------------------------------------------
  AWSAdminRole:
    Type: AWS::IAM::Role
    Condition: CreateAWSAdminRole
    Properties:
      RoleName: "DuploCloud-AWS-Admin"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS: !If
                - HasHelpdeskAccount
                - - !Sub "arn:aws:iam::${HelpdeskAccountId}:root"
                  - !Sub "arn:aws:iam::${AWS::AccountId}:root"
                - - !Sub "arn:aws:iam::${AWS::AccountId}:root"
            Action: "sts:AssumeRole"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AdministratorAccess

  # -------------------------------------------------------
  # AWS Read-Only IAM Role (no EKS access)
  # -------------------------------------------------------
  AWSReadOnlyRole:
    Type: AWS::IAM::Role
    Condition: CreateAWSReadOnlyRole
    Properties:
      RoleName: "DuploCloud-AWS-ReadOnly"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS: !If
                - HasHelpdeskAccount
                - - !Sub "arn:aws:iam::${HelpdeskAccountId}:root"
                  - !Sub "arn:aws:iam::${AWS::AccountId}:root"
                - - !Sub "arn:aws:iam::${AWS::AccountId}:root"
            Action: "sts:AssumeRole"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/ReadOnlyAccess

  # -------------------------------------------------------
  # EKS Admin IAM Role (no AWS IAM policies)
  # -------------------------------------------------------
  EKSAdminRole:
    Type: AWS::IAM::Role
    Condition: CreateEKSAdminRole
    Properties:
      RoleName: !Sub "DuploCloud-EKS-Admin-${EKSClusterName}"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS: !If
                - HasHelpdeskAccount
                - - !Sub "arn:aws:iam::${HelpdeskAccountId}:root"
                  - !Sub "arn:aws:iam::${AWS::AccountId}:root"
                - - !Sub "arn:aws:iam::${AWS::AccountId}:root"
            Action: "sts:AssumeRole"

  EKSAdminAccessEntry:
    Type: AWS::EKS::AccessEntry
    Condition: CreateEKSAdminRole
    Properties:
      ClusterName: !Ref EKSClusterName
      PrincipalArn: !GetAtt EKSAdminRole.Arn
      Type: STANDARD
      AccessPolicies:
        - PolicyArn: "arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy"
          AccessScope:
            Type: cluster

  # -------------------------------------------------------
  # EKS Read-Only IAM Role (no AWS IAM policies)
  # -------------------------------------------------------
  EKSReadOnlyRole:
    Type: AWS::IAM::Role
    Condition: CreateEKSReadOnlyRole
    Properties:
      RoleName: !Sub "DuploCloud-EKS-ReadOnly-${EKSClusterName}"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS: !If
                - HasHelpdeskAccount
                - - !Sub "arn:aws:iam::${HelpdeskAccountId}:root"
                  - !Sub "arn:aws:iam::${AWS::AccountId}:root"
                - - !Sub "arn:aws:iam::${AWS::AccountId}:root"
            Action: "sts:AssumeRole"

  EKSReadOnlyAccessEntry:
    Type: AWS::EKS::AccessEntry
    Condition: CreateEKSReadOnlyRole
    Properties:
      ClusterName: !Ref EKSClusterName
      PrincipalArn: !GetAtt EKSReadOnlyRole.Arn
      Type: STANDARD
      AccessPolicies:
        - PolicyArn: "arn:aws:eks::aws:cluster-access-policy/AmazonEKSViewPolicy"
          AccessScope:
            Type: cluster

Outputs:
  AWSAdminRoleArn:
    Description: "AWS Admin Role ARN - provide to helpdesk"
    Condition: CreateAWSAdminRole
    Value: !GetAtt AWSAdminRole.Arn

  AWSReadOnlyRoleArn:
    Description: "AWS Read-Only Role ARN - provide to helpdesk"
    Condition: CreateAWSReadOnlyRole
    Value: !GetAtt AWSReadOnlyRole.Arn

  EKSAdminRoleArn:
    Description: "EKS Admin Role ARN - provide to helpdesk"
    Condition: CreateEKSAdminRole
    Value: !GetAtt EKSAdminRole.Arn

  EKSReadOnlyRoleArn:
    Description: "EKS Read-Only Role ARN - provide to helpdesk"
    Condition: CreateEKSReadOnlyRole
    Value: !GetAtt EKSReadOnlyRole.Arn

  ClusterName:
    Description: "EKS Cluster Name"
    Condition: HasEKSClusterName
    Value: !Ref EKSClusterName
