Description: Create IAM roles to deploy tidbcloud
Parameters:
  # ControlPlane account id
  ControlPlaneAccountId:
    Type: String
    Description: "TiDB Cloud Control Plane AWS Principal"
    Default: "385595570414"
  GithubRunnerGoogleAccountId:
    Type: String
    Description: "The Google Account ID of the GitHub runner for PingCAP"
    Default: "114667344163696279999"
Resources:
  TiDBCloudSyncImageRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: auto-deploy-sync-image
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Federated: "accounts.google.com"
            Action: sts:AssumeRoleWithWebIdentity
            Condition:
              StringEquals:
                accounts.google.com:aud: !Sub ${GithubRunnerGoogleAccountId}
      Policies:
        - PolicyName: auto-deploy-sync-image-policy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Action:
                  - ecr:GetAuthorizationToken
                Effect: Allow
                Resource:
                  - "*"
                Sid: GetToken
              - Action:
                  - ecr:DescribeRepositories
                Effect: Allow
                Resource:
                  - "*"
                Sid: CheckRepository
              - Action:
                  - ecr:CreateRepository
                  - ecr:TagResource
                Condition:
                  ForAllValues:StringEquals:
                    aws:TagKeys:
                      - ManagedBy
                  StringEquals:
                    aws:RequestTag/ManagedBy: PingCAP
                Effect: Allow
                Resource:
                  - "*"
                Sid: CreateRepository
              - Action:
                  - ecr:BatchCheckLayerAvailability
                  - ecr:BatchGetImage
                  - ecr:InitiateLayerUpload
                  - ecr:UploadLayerPart
                  - ecr:CompleteLayerUpload
                  - ecr:PutImage
                Condition:
                  StringEquals:
                    aws:ResourceTag/ManagedBy: PingCAP
                Effect: Allow
                Resource:
                  - "*"
                Sid: PushImage
  TiDBCloudAutoDeployRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: auto-deploy-cli
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${ControlPlaneAccountId}:role/auto-deploy-cli
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - !Ref TiDBCloudAutoDeployIdentityPolicy
        - !Ref TiDBCloudAutoDeployComputePolicy
        - !Ref TiDBCloudAutoDeployStoragePolicy
        - !Ref TiDBCloudAutoDeployNetworkPolicy
        - !Ref TiDBCloudAutoDeployMonitoringPolicy
        - !Ref TiDBCloudAutoDeployKMSPolicy
  TiDBCloudAutoDeployIdentityPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: auto-deploy-cli-iam
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          # Requested by o11y iam
          - Action:
              - iam:GetRole
            Effect: Allow
            Resource:
              - !Sub arn:aws:iam::${AWS::AccountId}:role/auto-deploy-cli
              - !Sub arn:aws:iam::${AWS::AccountId}:role/tidbcloud-o11y-control-plane-role
              - !Sub arn:aws:iam::${AWS::AccountId}:role/tidbcloud-o11y-agent-role
              - !Sub arn:aws:iam::${AWS::AccountId}:role/tidbcloud-o11y-eks-cluster-role
              - !Sub arn:aws:iam::${AWS::AccountId}:role/tidbcloud-o11y-eks-node-role
              - !Sub arn:aws:iam::${AWS::AccountId}:role/tidbcloud-o11y-apigw-role
              - !Sub arn:aws:iam::${AWS::AccountId}:role/tidbcloud-sli-firehose-role
              - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/aws-service-role/eks-nodegroup.amazonaws.com/AWSServiceRoleForAmazonEKSNodegroup
              - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/aws-service-role/eks.amazonaws.com/AWSServiceRoleForAmazonEKS
              - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/aws-service-role/ops.apigateway.amazonaws.com/AWSServiceRoleForAPIGateway
            Sid: GetDeployTargetRoles
          - Action:
              - iam:UpdateAssumeRolePolicy
            Effect: Allow
            Resource:
              - !Sub arn:aws:iam::${AWS::AccountId}:role/tidbcloud-o11y-control-plane-role
            Sid: UpdateO11yControlPlaneRole
          # Requested by o11y eks
          - Action:
              - iam:CreateOpenIDConnectProvider
              - iam:DeleteOpenIDConnectProvider
              - iam:GetOpenIDConnectProvider
              - iam:ListOpenIDConnectProviders
              - iam:TagOpenIDConnectProvider
              - iam:UntagOpenIDConnectProvider
            Effect: Allow
            Resource: "*"
            Sid: CreateOIDCProvider
          # Requested by o11y eks
          - Action:
              - iam:PassRole
              - iam:ListAttachedRolePolicies
            Effect: Allow
            Resource:
              - !Sub arn:aws:iam::${AWS::AccountId}:role/auto-deploy-cli
              - !Sub arn:aws:iam::${AWS::AccountId}:role/tidbcloud-o11y-eks-node-role
              - !Sub arn:aws:iam::${AWS::AccountId}:role/tidbcloud-o11y-eks-cluster-role
              - !Sub arn:aws:iam::${AWS::AccountId}:role/tidbcloud-sli-firehose-role
            Sid: GetDeployRole
          # Requested by o11y eks
          - Action:
              - iam:CreateServiceLinkedRole
            Effect: Allow
            Resource:
              - arn:aws:iam::*:role/aws-service-role/eks-nodegroup.amazonaws.com/AWSServiceRoleForAmazonEKSNodegroup
              - arn:aws:iam::*:role/aws-service-role/eks.amazonaws.com/AWSServiceRoleForAmazonEKS
            Sid: EKSCreateServiceLinkedRole
          - Action:
              - iam:CreateServiceLinkedRole
            Effect: Allow
            Resource:
              - arn:aws:iam::*:role/aws-service-role/ops.apigateway.amazonaws.com/AWSServiceRoleForAPIGateway
            Condition:
              StringEquals:
                iam:AWSServiceName: ops.apigateway.amazonaws.com
            Sid: ApiGatewayCreateServiceLinkedRole
  TiDBCloudAutoDeployComputePolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: auto-deploy-cli-compute
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          # Requested by o11y
          - Action:
              - elasticloadbalancing:DescribeLoadBalancers
              - elasticloadbalancing:DescribeLoadBalancerAttributes
              - elasticloadbalancing:DescribeTags
            Effect: Allow
            Resource: "*"
            Sid: ELBRead
          # Requested by o11y
          - Action:
              - cloudformation:DescribeStacks
              - cloudformation:ListStacks
              - cloudformation:DescribeStackEvents
              - cloudformation:DescribeStackResource
              - cloudformation:DescribeStackResources
              - cloudformation:GetTemplate
              - cloudformation:ValidateTemplate
              - cloudformation:GetTemplateSummary
              - cloudformation:DescribeChangeSet
              - cloudformation:ListChangeSets
            Effect: Allow
            Resource: "*"
            Sid: CloudFormationReadOnly
          # Requested by o11y
          - Action:
              - cloudformation:CreateStack
              - cloudformation:DeleteStack
              - cloudformation:UpdateStack
              - cloudformation:TagResource
              - cloudformation:UntagResource
              - cloudformation:CreateChangeSet
              - cloudformation:ExecuteChangeSet
              - cloudformation:DeleteChangeSet
            Effect: Allow
            Resource: arn:aws:cloudformation:*:*:stack/auto-deploy-o11y-*/*
            Sid: CloudFormationWrite
          # Requested by o11y eks
          - Action:
              - ec2:RunInstances
              - ec2:TerminateInstances
              - ec2:CreateVpc
              - ec2:DeleteVpc
              - ec2:ModifyVpcAttribute
              - ec2:CreateSubnet
              - ec2:DeleteSubnet
              - ec2:ModifySubnetAttribute
              - ec2:CreateSecurityGroup
              - ec2:DeleteSecurityGroup
              - ec2:AuthorizeSecurityGroupIngress
              - ec2:RevokeSecurityGroupIngress
              - ec2:AuthorizeSecurityGroupEgress
              - ec2:RevokeSecurityGroupEgress
              - ec2:CreateRouteTable
              - ec2:DeleteRouteTable
              - ec2:AssociateRouteTable
              - ec2:DisassociateRouteTable
              - ec2:CreateRoute
              - ec2:DeleteRoute
              - ec2:CreateInternetGateway
              - ec2:DeleteInternetGateway
              - ec2:AttachInternetGateway
              - ec2:DetachInternetGateway
              - ec2:AllocateAddress
              - ec2:ReleaseAddress
              - ec2:DisassociateAddress
              - ec2:CreateNatGateway
              - ec2:DeleteNatGateway
              - ec2:CreateLaunchTemplate
              - ec2:DeleteLaunchTemplate
              - ec2:CreateLaunchTemplateVersion
              - ec2:DeleteLaunchTemplateVersions
              - ec2:ModifyLaunchTemplate
              - ec2:CreateTags
              - ec2:DeleteTags
              - ec2:CreateNetworkAclEntry
              - ec2:DeleteNetworkAclEntry
              - ec2:CreateVpcEndpoint
              - ec2:DeleteVpcEndpoints
              - ec2:ModifyVpcEndpoint
              - ec2:CreateVpcEndpointServiceConfiguration
              - ec2:DeleteVpcEndpointServiceConfigurations
              - ec2:ModifyVpcEndpointServiceConfiguration
              - ec2:ModifyVpcEndpointServicePermissions
            Effect: Allow
            Resource: "*"
            Sid: "EC2Write"
          # Requested by o11y eks
          - Action:
              - ec2:Describe*
            Effect: Allow
            Resource: "*"
            Sid: "EC2ReadOnly"
          # Requested by o11y eks
          - Action:
              - autoscaling:AttachInstances
              - autoscaling:DetachInstances
              - autoscaling:CreateAutoScalingGroup
              - autoscaling:DeleteAutoScalingGroup
              - autoscaling:UpdateAutoScalingGroup
              - autoscaling:TerminateInstanceInAutoScalingGroup
            Effect: Allow
            Resource:
              - "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/eks-worker-*"
              - "arn:aws:ec2:*:*:instance/*"
            Sid: "ASGWriteWithPrefix"
          # Requested by o11y eks
          - Action:
              - autoscaling:DescribeAutoScalingGroups
            Effect: Allow
            Resource: "*"
            Sid: "ASGReadOnly"
          # Requested by o11y eks
          - Action:
              - eks:CreateAddon
              - eks:DeleteAddon
              - eks:UpdateAddon
              - eks:CreateCluster
              - eks:DeleteCluster
              - eks:UpdateClusterConfig
              - eks:UpdateClusterVersion
              - eks:AssociateIdentityProviderConfig
              - eks:DisassociateIdentityProviderConfig
              - eks:CreateNodegroup
              - eks:DeleteNodegroup
              - eks:UpdateNodegroupConfig
              - eks:CreateAccessEntry
              - eks:DeleteAccessEntry
              - eks:AssociateAccessPolicy
              - eks:DisassociateAccessPolicy
              - eks:TagResource
              - eks:UntagResource
            Effect: Allow
            Resource:
              - arn:aws:eks:*:*:cluster/o11y-*
              - arn:aws:eks:*:*:addon/o11y-*/*/*
              - arn:aws:eks:*:*:nodegroup/o11y-*/*/*
              - arn:aws:eks:*:*:access-entry/o11y-*/role/*/*/*
            Sid: "EKSWrite"
          # Requested by o11y eks
          - Action:
              - eks:Describe*
              - eks:List*
            Effect: Allow
            Resource: "*"
            Sid: "EKSReadOnly"
  TiDBCloudAutoDeployStoragePolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: auto-deploy-cli-storage
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          # Requested by o11y, sli
          - Action:
              - s3:CreateBucket
              - s3:PutBucketPolicy
              - s3:PutBucketTagging
              - s3:PutBucketPublicAccessBlock
              - s3:PutLifecycleConfiguration
            Effect: Allow
            Resource:
              - arn:aws:s3:::tidbcloud-*
              - arn:aws:s3:::o11y-*
              - arn:aws:s3:::loki-*
            Sid: "S3Write"
          # Requested by o11y, sli
          - Action:
              - s3:ListBucket
              - s3:GetBucketTagging
              - s3:GetBucketPolicy
              - s3:GetBucketPublicAccessBlock
              - s3:GetLifecycleConfiguration
              - s3:GetBucketAcl
              - s3:GetBucketCORS
              - s3:GetBucketWebsite
              - s3:GetBucketVersioning
              - s3:GetAccelerateConfiguration
              - s3:GetBucketRequestPayment
              - s3:GetBucketLogging
              - s3:GetReplicationConfiguration
              - s3:GetEncryptionConfiguration
              - s3:GetBucketObjectLockConfiguration
            Effect: Allow
            Resource: "*"
            Sid: "S3ReadOnly"
          - Action:
              - glue:CreateDatabase
              - glue:DeleteDatabase
              - glue:CreateTable
              - glue:DeleteTable
              - glue:GetTable
              - glue:TagResource
              - glue:GetDatabase
              - glue:GetTags
            Effect: Allow
            Resource:
              - arn:aws:glue:*:*:catalog
              - arn:aws:glue:*:*:database/tidbcloud-*
              - arn:aws:glue:*:*:table/tidbcloud-*
              - arn:aws:glue:*:*:userDefinedFunction/tidbcloud-*/*
          # Requested by sli
          - Action:
              - firehose:CreateDeliveryStream
              - firehose:DeleteDeliveryStream
              - firehose:TagDeliveryStream
            Effect: Allow
            Resource:
              - arn:aws:firehose:*:*:deliverystream/tidbcloud-*
          # Requested by sli
          - Action:
              - firehose:ListTagsForDeliveryStream
              - firehose:DescribeDeliveryStream
            Effect: Allow
            Resource:
              - arn:aws:firehose:*:*:deliverystream/tidbcloud-*
  TiDBCloudAutoDeployNetworkPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: auto-deploy-cli-network
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          # Requested by o11y
          - Action:
              - route53:GetHostedZone
              - route53:GetChange
              - route53:ListHostedZones
              - route53:ListHostedZonesByName
              - route53:ListResourceRecordSets
              - route53:ListTagsForResource
              - route53:GetChange
            Effect: Allow
            Resource: "*"
            Sid: "Route53ReadOnly"
          # Requested by o11y
          - Action:
              - acm:RequestCertificate
              - acm:RevokeCertificate
              - acm:DeleteCertificate
              - acm:AddTagsToCertificate
            Effect: Allow
            Resource: "*"
            Sid: "ACMWrite"
          # Requested by o11y
          - Action:
              - acm:DescribeCertificate
            Effect: Allow
            Resource: "*"
            Sid: "ACMReadOnly"
          # Requested by sli
          - Action:
              - vpce:AllowMultiRegion
            Effect: Allow
            Resource: "*"
          # Requested by sli
          - Action:
              - apigateway:GET
              - apigateway:POST
              - apigateway:PUT
              - apigateway:DELETE
              - apigateway:TagResource
            Effect: Allow
            Resource:
              - arn:aws:apigateway:*::/restapis
              - arn:aws:apigateway:*::/restapis/*
              - arn:aws:apigateway:*::/vpclinks
              - arn:aws:apigateway:*::/vpclinks/*
              - arn:aws:apigateway:*::/tags/*
            Sid: "ApiGatewayWrite"
          - Action:
              - route53-recovery-control-config:ListControlPanels
              - route53domains:ListDomains
              - route53domains:ListOperations
              - route53-recovery-readiness:ListReadinessChecks
            Effect: Allow
            Resource: "*"
  TiDBCloudAutoDeployMonitoringPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: auto-deploy-cli-monitoring
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          # Requested by o11y
          - Action:
              - cloudwatch:DescribeAlarms
              - cloudwatch:ListTagsForResource
            Effect: Allow
            Resource:
              - arn:aws:cloudwatch:*:*:alarm:WatchdogDown-*
              - arn:aws:cloudwatch:*:*:alarm:AlertmanagerClusterFailedToSendAlerts-*
            Sid: "CloudWatchReadOnly"
          # Requested by o11y
          - Action:
              - cloudwatch:PutMetricAlarm
            Effect: Allow
            Resource:
              - arn:aws:cloudwatch:*:*:alarm:WatchdogDown-*
              - arn:aws:cloudwatch:*:*:alarm:AlertmanagerClusterFailedToSendAlerts-*
            Sid: "CloudWatchWrite"
          # Requested by sli, o11y
          - Action:
              - logs:CreateLogGroup
              - logs:PutRetentionPolicy
              - logs:CreateLogStream
              - logs:TagResource
            Effect: Allow
            Resource:
              - arn:aws:logs:*:*:log-group:/aws/eks/o11y-*/cluster:*
              - arn:aws:logs:*:*:log-group:/aws/kinesisfirehose/tidbcloud-*:*
            Sid: "losWrite"
          - Action:
              - logs:ListTagsForResource
            Effect: Allow
            Resource:
              - arn:aws:logs:*:*:log-group:/aws/eks/o11y-*/cluster
              - arn:aws:logs:*:*:log-group:/aws/kinesisfirehose/tidbcloud-*
            Sid: "LogsTagReadOnly"
          - Action:
              - logs:DeleteLogGroup
            Effect: Allow
            Resource:
              - arn:aws:logs:*:*:log-group:/aws/eks/o11y-*/cluster
              - arn:aws:logs:*:*:log-group:/aws/kinesisfirehose/tidbcloud-*
            Sid: "LogsDelete"
          - Action:
              - logs:DeleteLogStream
            Effect: Allow
            Resource:
              - arn:aws:logs:*:*:log-group:/aws/eks/o11y-*/cluster:log-stream:*
              - arn:aws:logs:*:*:log-group:/aws/kinesisfirehose/tidbcloud-*:log-stream:*
            Sid: "LogsStreamDelete"
          - Action:
              - logs:DescribeLogGroups
              - logs:DescribeLogStreams
            Effect: Allow
            Resource: "*"
            Sid: "LogsReadOnly"
  TiDBCloudAutoDeployKMSPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: auto-deploy-cli-kms
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Action:
              - kms:CreateKey
              - kms:CreateAlias
              - kms:TagResource
              - kms:UntagResource
            Effect: Allow
            Resource: "*"
            Sid: "KMSWrite"
          - Action:
              - kms:DescribeKey
              - kms:ListKeys
              - kms:ListAliases
              - kms:ListResourceTags
            Effect: Allow
            Resource: "*"
            Sid: "KMSReadOnly"