AWSTemplateFormatVersion: '2010-09-09'
Description: O11y iam roles

Parameters:
  Env:
    Type: String
  Region:
    Type: String
  ClusterName:
    Type: String
  AccountId:
    Type: String
  OIDCIssuer:
    Type: String

Resources:
  O11yControlPlaneRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${ClusterName}-role"
      ManagedPolicyArns:
        - !Sub "arn:aws:iam::${AccountId}:policy/o11y-control-plane"
      AssumeRolePolicyDocument:
        Fn::Sub:
          - |
            {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "sts:AssumeRoleWithWebIdentity"
                  ],
                  "Condition": {
                    "StringLike": {
                      "${OIDCIssuer}:aud": "sts.amazonaws.com",
                      "${OIDCIssuer}:sub": [
                        "system:serviceaccount:observability:*",
                        "system:serviceaccount:ops-system:ops-server"
                      ]
                    }
                  },
                  "Principal": {
                    "Federated": "arn:aws:iam::${AccountId}:oidc-provider/${OIDCIssuer}"
                  }
                },
                {
                  "Effect": "Allow",
                  "Action": [
                    "sts:AssumeRoleWithWebIdentity"
                  ],
                  "Condition": {
                    "StringLike": {
                      "${OIDCIssuer}:aud": "sts.amazonaws.com",
                      "${OIDCIssuer}:sub": "system:serviceaccount:kube-system:*"
                    }
                  },
                  "Principal": {
                    "Federated": "arn:aws:iam::${AccountId}:oidc-provider/${OIDCIssuer}"
                  }
                },
                {
                  "Effect": "Allow",
                  "Action": [
                    "sts:AssumeRoleWithWebIdentity"
                  ],
                  "Condition": {
                    "StringLike": {
                      "${OIDCIssuer}:aud": "sts.amazonaws.com",
                      "${OIDCIssuer}:sub": "system:serviceaccount:self-monitoring:*"
                    }
                  },
                  "Principal": {
                    "Federated": "arn:aws:iam::${AccountId}:oidc-provider/${OIDCIssuer}"
                  }
                },
                {
                  "Effect": "Allow",
                  "Action": [
                    "sts:AssumeRoleWithWebIdentity"
                  ],
                  "Condition": {
                    "StringLike": {
                      "${OIDCIssuer}:aud": "sts.amazonaws.com",
                      "${OIDCIssuer}:sub": "system:serviceaccount:cluster-backup:*"
                    }
                  },
                  "Principal": {
                    "Federated": "arn:aws:iam::${AccountId}:oidc-provider/${OIDCIssuer}"
                  }
                }
              ]
            }
          - AccountId: !Ref AccountId
            OIDCIssuer: !Ref OIDCIssuer