AWSTemplateFormatVersion: 2010-09-09
Description: The module will create a role to allow Coralogix to describe ec2 instances
Parameters:
  CoralogixRegion:
    Type: String
    Default: EU1
    Description: The Coralogix region that your account is in.
    AllowedValues:
      - EU1
      - EU2
      - AP1
      - AP2
      - AP3
      - US1
      - US2
      - CustomEndpoint
  RoleName:
    Type: String
    Description: The name of the role that will be created.
  CustomAccountId:
    Type: String
    Description: Custom AWS account ID that you want to deploy the integration in.
    Default: ""
  CustomCoralogixEnvId:
    Type: String
    Description: Custom Coralogix region ID that you want to deploy the integration in.
    Default: ""
Mappings:
  CoralogixEnvironment:
    EU1:
      ID: 625240141681
      CxEnvId: production
    EU2:
      ID: 625240141681
      CxEnvId: euprod2
    AP1:
      ID: 625240141681
      CxEnvId: mumbaisaas
    AP2:
      ID: 625240141681
      CxEnvId: approd2
    AP3:
      ID: 025066248247
      CxEnvId: cx440
    US1:
      ID: 625240141681
      CxEnvId: usprod1
    US2:
      ID: 739076534691
      CxEnvId: cx498
    CustomEndpoint:
      ID: 000000000000
      CxEnvId: production
Conditions:
  IsCustomAccountId: !Not [!Equals [!Ref CustomAccountId, ""]]
  IsCustomCoralogixEnvId: !Not [!Equals [!Ref CustomCoralogixEnvId, ""]]
Resources:
  CoralogixAwsMetricsRole:
    Type: AWS::IAM::Role
    Properties:
      Description: "Role to allow coralogix to describe ec2"
      RoleName: !Ref RoleName
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub
                - "arn:aws:iam::${aws_account_id}:role/inventory-manager-${CxEnvId}"
                - aws_account_id: !If
                    - IsCustomAccountId
                    - !Ref CustomAccountId
                    - !FindInMap [CoralogixEnvironment, !Ref CoralogixRegion, "ID"]
                  CxEnvId: !If
                    - IsCustomCoralogixEnvId
                    - !Ref CustomCoralogixEnvId
                    - !FindInMap [CoralogixEnvironment, !Ref CoralogixRegion, "CxEnvId"]
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: CoralogixDescribeEc2Policy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "ec2:DescribeTags"
                  - "ec2:DescribeInstances"
                  - "ec2:DescribeRegions"
                  - "ec2:DescribeTransitGateway*"
                  - "ec2:DescribeNetworkInterfaces"
                Resource: "*"
