{
  "ROSTemplateFormatVersion": "2015-09-01",
  "Description": "O11y iam roles",
  "Parameters": {
    "Env": {
      "Type": "String"
    },
    "Region": {
      "Type": "String"
    },
    "ClusterName": {
      "Type": "String"
    },
    "AccountId": {
      "Type": "String"
    },
    "OIDCIssuer": {
      "Type": "String"
    }
  },
  "Resources": {
    "RegionalServerRole": {
      "Type": "ALIYUN::RAM::Role",
      "Properties": {
        "RoleName": {
          "Fn::Sub": "regional-server-${ClusterName}"
        },
        "PolicyAttachments": {
          "Custom": [
            "regional-server-iam"
          ]
        },
        "AssumeRolePolicyDocument": {
          "Version": "1",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": "sts:AssumeRole",
              "Principal": {
                "Federated": [
                  {
                    "Fn::Sub": "acs:ram::${AccountId}:oidc-provider/${OIDCIssuer}"
                  }
                ]
              },
              "Condition": {
                "StringLike": {
                  "oidc:sub": "system:serviceaccount:observability:*",
                  "oidc:aud": "sts.aliyuncs.com"
                }
              }
            }
          ]
        }
      }
    },
    "LokiRole": {
      "Type": "ALIYUN::RAM::Role",
      "Properties": {
        "RoleName": {
          "Fn::Sub": "loki-${ClusterName}"
        },
        "PolicyAttachments": {
          "System": [
            "AliyunOSSFullAccess"
          ]
        },
        "AssumeRolePolicyDocument": {
          "Version": "1",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": "sts:AssumeRole",
              "Principal": {
                "Federated": [
                  {
                    "Fn::Sub": "acs:ram::${AccountId}:oidc-provider/${OIDCIssuer}"
                  }
                ]
              },
              "Condition": {
                "StringEquals": {
                  "oidc:sub": "system:serviceaccount:observability:loki-ha",
                  "oidc:aud": "sts.aliyuncs.com"
                }
              }
            }
          ]
        }
      }
    },
    "VmBackupRole": {
      "Type": "ALIYUN::RAM::Role",
      "Properties": {
        "RoleName": {
          "Fn::Sub": "vmbackup-${ClusterName}"
        },
        "PolicyAttachments": {
          "System": [
            "AliyunOSSFullAccess"
          ]
        },
        "AssumeRolePolicyDocument": {
          "Version": "1",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": "sts:AssumeRole",
              "Principal": {
                "Federated": [
                  {
                    "Fn::Sub": "acs:ram::${AccountId}:oidc-provider/${OIDCIssuer}"
                  }
                ]
              },
              "Condition": {
                "StringEquals": {
                  "oidc:sub": "system:serviceaccount:observability:vmcluster-vmcluster",
                  "oidc:aud": "sts.aliyuncs.com"
                }
              }
            }
          ]
        }
      }
    },
    "O11yBackupRole": {
      "Type": "ALIYUN::RAM::Role",
      "Properties": {
        "RoleName": {
          "Fn::Sub": "o11y-backup-${ClusterName}"
        },
        "PolicyAttachments": {
          "Custom": [
            "cluster-backup-iam"
          ]
        },
        "AssumeRolePolicyDocument": {
          "Version": "1",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": "sts:AssumeRole",
              "Principal": {
                "Federated": [
                  {
                    "Fn::Sub": "acs:ram::${AccountId}:oidc-provider/${OIDCIssuer}"
                  }
                ]
              },
              "Condition": {
                "StringEquals": {
                  "oidc:sub": "system:serviceaccount:cluster-backup:velero-server",
                  "oidc:aud": "sts.aliyuncs.com"
                }
              }
            }
          ]
        }
      }
    }
  }
}