AWSTemplateFormatVersion: '2010-09-09'
Description: O11y iam roles

Parameters:
  Env:
    Type: String
  Region:
    Type: String
  ClusterName:
    Type: String
  AccountId:
    Type: String
  OIDCIssuer:
    Type: String

Resources:
  # ControlNodeGroupRole:
  #   Type: AWS::IAM::Role
  #   Properties:
  #     RoleName: !Sub "autonomous-o11y-rs-control-${ClusterName}"
  #     ManagedPolicyArns:
  #       - !Sub "arn:aws:iam::${AccountId}:policy/autonomous-o11y-rs-control"
  #       - arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy
  #       - arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly
  #       - arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy
  #       - arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy
  #       - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
  #     AssumeRolePolicyDocument:
  #       Version: '2012-10-17'
  #       Statement:
  #         - Effect: Allow
  #           Principal:
  #             Service:
  #               - eks.amazonaws.com
  #               - ec2.amazonaws.com
  #           Action:
  #             - sts:AssumeRole

  # DataNodeGroupRole:
  #   Type: AWS::IAM::Role
  #   Properties:
  #     RoleName: !Sub "autonomous-o11y-rs-data-${ClusterName}"
  #     ManagedPolicyArns:
  #       - !Sub "arn:aws:iam::${AccountId}:policy/autonomous-o11y-rs-data"
  #       - arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy
  #       - arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly
  #       - arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy
  #       - arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy
  #     AssumeRolePolicyDocument:
  #       Version: '2012-10-17'
  #       Statement:
  #         - Effect: Allow
  #           Principal:
  #             Service:
  #               - eks.amazonaws.com
  #               - ec2.amazonaws.com
  #           Action:
  #             - sts:AssumeRole

  AwsLoadBalancerControllerRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "lb-controller-${ClusterName}"
      ManagedPolicyArns:
        - !Sub "arn:aws:iam::${AccountId}:policy/aws-load-balancer-controller"
      AssumeRolePolicyDocument:
        Fn::Sub:
          - |
            {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "sts:AssumeRoleWithWebIdentity"
                  ],
                  "Condition": {
                    "StringEquals": {
                      "${OIDCIssuer}:sub": "system:serviceaccount:kube-system:aws-load-balancer-controller"
                    }
                  },
                  "Principal": {
                    "Federated": "arn:aws:iam::${AccountId}:oidc-provider/${OIDCIssuer}"
                  }
                }
              ]
            }
          - AccountId: !Ref AccountId
            OIDCIssuer: !Ref OIDCIssuer

  ExternalDnsRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "external-dns-${ClusterName}"
      ManagedPolicyArns:
        - !Sub "arn:aws:iam::${AccountId}:policy/external-dns"
      AssumeRolePolicyDocument:
        Fn::Sub:
          - |
            {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "sts:AssumeRoleWithWebIdentity"
                  ],
                  "Condition": {
                    "StringEquals": {
                      "${OIDCIssuer}:sub": "system:serviceaccount:kube-system:external-dns"
                    }
                  },
                  "Principal": {
                    "Federated": "arn:aws:iam::${AccountId}:oidc-provider/${OIDCIssuer}"
                  }
                }
              ]
            }
          - AccountId: !Ref AccountId
            OIDCIssuer: !Ref OIDCIssuer

  AwsClusterAutoScalerRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "auto-scaler-${ClusterName}"
      ManagedPolicyArns:
        - !Sub "arn:aws:iam::${AccountId}:policy/aws-cluster-auto-scaler"
      AssumeRolePolicyDocument:
        Fn::Sub:
          - |
            {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "sts:AssumeRoleWithWebIdentity"
                  ],
                  "Condition": {
                    "StringEquals": {
                      "${OIDCIssuer}:sub": "system:serviceaccount:kube-system:cluster-autoscaler"
                    }
                  },
                  "Principal": {
                    "Federated": "arn:aws:iam::${AccountId}:oidc-provider/${OIDCIssuer}"
                  }
                }
              ]
            }
          - AccountId: !Ref AccountId
            OIDCIssuer: !Ref OIDCIssuer

  RegionalServerRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "regional-server-${ClusterName}"
      ManagedPolicyArns:
        - !Sub "arn:aws:iam::${AccountId}:policy/regional-server-iam"
      AssumeRolePolicyDocument:
        Fn::Sub:
          - |
            {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "sts:AssumeRoleWithWebIdentity"
                  ],
                  "Condition": {
                    "StringLike": {
                      "${OIDCIssuer}:aud": "sts.amazonaws.com",
                      "${OIDCIssuer}:sub": [
                        "system:serviceaccount:observability:*",
                        "system:serviceaccount:ops-system:ops-server"
                      ]
                    }
                  },
                  "Principal": {
                    "Federated": "arn:aws:iam::${AccountId}:oidc-provider/${OIDCIssuer}"
                  }
                }
              ]
            }
          - AccountId: !Ref AccountId
            OIDCIssuer: !Ref OIDCIssuer

  LokiRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "loki-${ClusterName}"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonS3FullAccess
      AssumeRolePolicyDocument:
        Fn::Sub:
          - |
            {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "sts:AssumeRoleWithWebIdentity"
                  ],
                  "Condition": {
                    "StringEquals": {
                      "${OIDCIssuer}:aud": "sts.amazonaws.com",
                      "${OIDCIssuer}:sub": "system:serviceaccount:observability:loki-ha"
                    }
                  },
                  "Principal": {
                    "Federated": "arn:aws:iam::${AccountId}:oidc-provider/${OIDCIssuer}"
                  }
                }
              ]
            }
          - AccountId: !Ref AccountId
            OIDCIssuer: !Ref OIDCIssuer

  VmBackupRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "vmbackup-${ClusterName}"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonS3FullAccess
      AssumeRolePolicyDocument:
        Fn::Sub:
          - |
            {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "sts:AssumeRoleWithWebIdentity"
                  ],
                  "Condition": {
                    "StringEquals": {
                      "${OIDCIssuer}:aud": "sts.amazonaws.com",
                      "${OIDCIssuer}:sub": "system:serviceaccount:observability:vmcluster-vmcluster"
                    }
                  },
                  "Principal": {
                    "Federated": "arn:aws:iam::${AccountId}:oidc-provider/${OIDCIssuer}"
                  }
                }
              ]
            }
          - AccountId: !Ref AccountId
            OIDCIssuer: !Ref OIDCIssuer

  AlertManagerRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "self-alertmanager-${ClusterName}"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/CloudWatchFullAccess
      AssumeRolePolicyDocument:
        Fn::Sub:
          - |
            {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "sts:AssumeRoleWithWebIdentity"
                  ],
                  "Condition": {
                    "StringEquals": {
                      "${OIDCIssuer}:aud": "sts.amazonaws.com",
                      "${OIDCIssuer}:sub": "system:serviceaccount:self-monitoring:self-monitoring-kube-prome-alertmanager"
                    }
                  },
                  "Principal": {
                    "Federated": "arn:aws:iam::${AccountId}:oidc-provider/${OIDCIssuer}"
                  }
                }
              ]
            }
          - AccountId: !Ref AccountId
            OIDCIssuer: !Ref OIDCIssuer

  O11yBackupRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "o11y-backup-${ClusterName}"
      Policies:
        - PolicyName: !Sub "o11y-backup-${ClusterName}"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Resource: "*"
                Action:
                  - "s3:*" 
                  - "ec2:*"
      AssumeRolePolicyDocument:
        Fn::Sub:
          - |
            {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "sts:AssumeRoleWithWebIdentity"
                  ],
                  "Condition": {
                    "StringLike": {
                      "${OIDCIssuer}:aud": "sts.amazonaws.com",
                      "${OIDCIssuer}:sub": "system:serviceaccount:cluster-backup:*"
                    }
                  },
                  "Principal": {
                    "Federated": "arn:aws:iam::${AccountId}:oidc-provider/${OIDCIssuer}"
                  }
                }
              ]
            }
          - AccountId: !Ref AccountId
            OIDCIssuer: !Ref OIDCIssuer