Description: Create IAM roles for tidbcloud dataplane
Parameters:
  ControlPlaneAccountId:
    Type: String
    Description: "TiDB Cloud Control Plane AWS Principal"
  ClinicAccountId:
    Type: String
    Description: "TiDB Cloud Clinic Account AWS Principal"
Resources:
  TiDBCloudEKSServiceRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: tidbcloud-eks-service-role
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: eks.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonEKSClusterPolicy
  TiDBCloudDataplaneManagerRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: tidbcloud-dataplane-manager-assumed-role
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${ControlPlaneAccountId}:root
            Action: sts:AssumeRole
      Policies:
        - PolicyName: dataplane-manager-policy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Sid: IAMReadOnlyOperations
                Effect: Allow
                Action:
                  - iam:ListRoles
                  - iam:ListRolePolicies
                  - iam:ListPolicies
                  - iam:ListPolicyVersions
                  - iam:ListAttachedRolePolicies
                  - iam:ListOpenIDConnectProviders
                  - iam:ListOpenIDConnectProviderTags
                  - iam:ListInstanceProfilesForRole
                Resource: '*'
              - Sid: IAMReadOperationsWithPrefix
                Effect: Allow
                Action:
                  - iam:GetRole
                  - iam:GetPolicy
                  - iam:GetRolePolicy
                  - iam:GetPolicyVersion
                  - iam:GetInstanceProfile
                  - iam:GetOpenIDConnectProvider
                Resource:
                  - arn:aws:iam::*:role/tidbcloud*
                  - arn:aws:iam::*:policy/tidbcloud*
                  - arn:aws:iam::*:instance-profile/tidbcloud*
                  - arn:aws:iam::*:role/aws-service-role/eks-nodegroup.amazonaws.com/AWSServiceRoleForAmazonEKSNodegroup
                  - arn:aws:iam::*:role/*-eks-service-role
              - Sid: IAMWriteOperationsWithPrefix
                Effect: Allow
                Action:
                  - iam:CreateRole
                  - iam:PassRole
                  - iam:TagRole
                  - iam:CreatePolicy
                  - iam:TagPolicy
                  - iam:PutRolePolicy
                  - iam:AttachRolePolicy
                  - iam:DeleteRole
                  - iam:RemoveRoleFromInstanceProfile
                  - iam:DeletePolicy
                  - iam:DetachRolePolicy
                  - iam:DeleteRolePolicy
                  - iam:CreateInstanceProfile
                  - iam:AddRoleToInstanceProfile
                  - iam:DeleteInstanceProfile
                  - iam:TagInstanceProfile
                  - iam:CreateOpenIDConnectProvider
                  - iam:DeleteOpenIDConnectProvider
                  - iam:CreateServiceLinkedRole
                Resource:
                  - arn:aws:iam::*:role/tidbcloud*
                  - arn:aws:iam::*:policy/tidbcloud*
                  - arn:aws:iam::*:instance-profile/tidbcloud*
                  - arn:aws:iam::*:role/*-eks-service-role
              - Sid: S3OperationsWithPrefix
                Effect: Allow
                Action:
                  - s3:ListBucket
                  - s3:GetBucket*
                  - s3:GetEncryptionConfiguration
                  - s3:GetLifecycleConfiguration
                  - s3:GetReplicationConfiguration
                  - s3:GetAccelerateConfiguration
                  - s3:CreateBucket
                  - s3:DeleteBucket
                  - s3:PutBucketTagging
                  - s3:PutBucketPolicy
                  - s3:DeleteBucketPolicy
                  - s3:PutBucketOwnershipControls
                  - s3:DeleteBucketLifecycleConfiguration
                  - s3:PutLifecycleConfiguration
                Resource: arn:aws:s3:::tidbcloud*
              - Sid: EC2ReadOnlyOperations
                Effect: Allow
                Action:
                  - ec2:DescribeVpcs
                  - ec2:DescribeVpcAttribute
                  - ec2:DescribeVpcEndpoints
                  - ec2:DescribeVpcEndpointConnections
                  - ec2:DescribeVpcEndpointServices
                  - ec2:DescribeVpcEndpointServicePermissions
                  - ec2:DescribeVpcEndpointServiceConfigurations
                  - ec2:DescribeAddresses
                  - ec2:DescribeSubnets
                  - ec2:DescribeRouteTables
                  - ec2:DescribeNatGateways
                  - ec2:DescribeInternetGateways
                  - ec2:DescribeSecurityGroup*
                  - ec2:DescribePlacementGroups
                  - ec2:DescribeLaunchTemplates
                  - ec2:DescribeLaunchTemplateVersions
                  - ec2:DescribeInstances
                  - ec2:DescribeInstanceAttribute
                  - ec2:DescribeInstanceTypes
                  - ec2:DescribeAvailabilityZones
                  - ec2:DescribeAddressesAttribute
                  - ec2:DescribePrefixLists
                  - ec2:DescribeNetworkInterfaces
                  - ec2:DescribeVpcPeeringConnections
                Resource: '*'
              - Sid: EC2WriteOperations
                Effect: Allow
                Action:
                  - ec2:CreateVpc
                  - ec2:ModifyVpc*
                  - ec2:CreateVpcEndpointServiceConfiguration
                  - ec2:DeleteVpcEndpointServiceConfigurations
                  - ec2:CreateVpcEndpoint
                  - ec2:DeleteVpcEndpoints
                  - ec2:CreateVpcPeeringConnection
                  - ec2:DeleteVpcPeeringConnection
                  - ec2:DeleteNetworkInterface
                  - ec2:DeleteVpc
                  - ec2:AllocateAddress
                  - ec2:ReleaseAddress
                  - ec2:CreateNatGateway
                  - ec2:CreateInternetGateway
                  - ec2:CreateSubnet
                  - ec2:CreateSecurityGroup
                  - ec2:CreatePlacementGroup
                  - ec2:DeletePlacementGroup
                  - ec2:CreateLaunchTemplate
                  - ec2:DeleteLaunchTemplate
                  - ec2:AuthorizeSecurityGroupIngress
                  - ec2:AuthorizeSecurityGroupEgress
                  - ec2:CreateRouteTable
                  - ec2:CreateRoute
                  - ec2:AttachInternetGateway
                  - ec2:DetachInternetGateway
                  - ec2:AssociateNatGatewayAddress
                  - ec2:AssociateRouteTable
                  - ec2:DisassociateRouteTable
                  - ec2:AcceptVpcEndpointConnections
                  - ec2:RejectVpcEndpointConnections
                  - ec2:StartVpcEndpointServicePrivateDnsVerification
                  - ec2:RevokeSecurityGroupIngress
                  - ec2:DeleteSecurityGroup
                  - ec2:DeleteRouteTable
                  - ec2:DeleteNatGateway
                  - ec2:RunInstances
                  - ec2:DeleteInternetGateway
                  - ec2:DeleteSubnet
                  - ec2:CreateTags
                  - ec2:DeleteTags
                  - ec2:CreateLaunchTemplateVersion
                  - ec2:RevokeSecurityGroupEgress
                Resource: '*'
              - Sid: ELBReadOnlyOperations
                Effect: Allow
                Action:
                  - elasticloadbalancing:DescribeLoadBalancers
                Resource: '*'
              - Sid: AutoscalingReadOnlyOperations
                Effect: Allow
                Action:
                  - autoscaling:DescribeAutoScalingGroups
                  - autoscaling:DescribeScalingActivities
                Resource: '*'
              - Sid: EKSReadOnlyOperations
                Effect: Allow
                Action:
                  - eks:ListClusters
                  - eks:ListNodegroups
                  - eks:ListAddons
                  - eks:DescribeCluster
                  - eks:DescribeNodegroup
                  - eks:DescribeAddon
                  - eks:DescribeUpdate
                  - eks:ListAccessEntries
                  - eks:DescribeAccessEntry
                  - eks:ListAssociatedAccessPolicies
                Resource: '*'
              - Sid: EKSWriteOperationsWithPrefix
                Effect: Allow
                Action:
                  - eks:CreateCluster
                  - eks:TagResource
                  - eks:CreateNodegroup
                  - eks:CreateAddon
                  - eks:UpdateClusterVersion
                  - eks:UpdateClusterConfig
                  - eks:UpdateNodegroupConfig
                  - eks:UpdateNodegroupVersion
                  - eks:UpdateAddon
                  - eks:DeleteCluster
                  - eks:DeleteNodeGroup
                  - eks:DeleteAddon
                  - eks:CreateAccessEntry
                  - eks:DeleteAccessEntry
                  - eks:UpdateAccessEntry
                  - eks:AssociateAccessPolicy
                  - eks:DisassociateAccessPolicy
                  - eks:UntagResource
                Resource:
                  - arn:aws:eks:*:*:cluster/tidbcloud*
                  - arn:aws:eks:*:*:nodegroup/tidbcloud*/*
                  - arn:aws:eks:*:*:addon/tidbcloud*/*
                  - arn:aws:eks:*:*:access-entry/tidbcloud*/*
              - Sid: Route53ResourceRecordSetOperations
                Action:
                  - route53:ListResourceRecordSets
                  - route53:ChangeResourceRecordSets
                  - route53:AssociateVPCWithHostedZone
                  - route53:GetHostedZone
                  - route53:GetChange
                  - route53:ListHostedZones
                  - route53:CreateHostedZone
                  - route53:DeleteHostedZone
                  - route53:DisassociateVPCFromHostedZone
                  - route53:ListTagsForResource
                  - route53:ChangeTagsForResource
                Effect: Allow
                Resource: '*'
              - Sid: MSKVpcConnectionOperations
                Action:
                  - kafka:DescribeCluster
                  - kafka:CreateVpcConnection
                  - kafka:DescribeVpcConnection
                  - kafka:DeleteVpcConnection
                  - kafka:GetBootstrapBrokers
                  - kafka:ListClientVpcConnections
                  - kafka:ListVpcConnections
                  - kafka:TagResource
                Effect: Allow
                Resource: '*'
              - Sid: KMSOperations
                Action:
                  - kms:CreateKey
                  - kms:TagResource
                Effect: Allow
                Resource: '*'