AWSTemplateFormatVersion: '2010-09-09'
Description: >
  OptiVulniX Read-Only Scanner Role
  Deploy this to each client AWS account to allow OptiVulniX to perform
  cost optimization and security scans. This role grants READ-ONLY access only.
  No write permissions are granted.

Parameters:
  TrustedAccountId:
    Type: String
    Default: "795425061684"
    Description: "OptiVulniX hub AWS account ID — do not change this value"
    AllowedPattern: "[0-9]{12}"
    ConstraintDescription: "Must be a valid 12-digit AWS account ID"

  RoleName:
    Type: String
    Default: OptivulnixReadOnly
    Description: "Name for the IAM role. Change only if you have naming restrictions."

  ExternalId:
    Type: String
    Default: ""
    Description: "Optional external ID for enhanced security (provided by OptiVulniX)"

Conditions:
  UseExternalId: !Not [!Equals [!Ref ExternalId, ""]]

Resources:

  OptivulnixReadOnlyRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref RoleName
      Description: "Read-only scanner role for OptiVulniX AWS Optimization Platform"
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::${TrustedAccountId}:root'
            Action: sts:AssumeRole
            Condition: !If
              - UseExternalId
              - StringEquals:
                  sts:ExternalId: !Ref ExternalId
              - !Ref AWS::NoValue
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/ReadOnlyAccess
        - arn:aws:iam::aws:policy/SecurityAudit
      Tags:
        - Key: Purpose
          Value: OptivulniX-Scanner
        - Key: ManagedBy
          Value: OptivulniX
        - Key: Website
          Value: https://optivulnix.com

  # Additional policy to allow Cost Explorer and Organizations read access
  OptivulnixCostPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: OptivulnixCostExplorerPolicy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - ce:GetCostAndUsage
              - ce:GetReservationCoverage
              - ce:GetSavingsPlansCoverage
              - ce:GetRightsizingRecommendation
              - ce:GetCostForecast
              - organizations:ListAccounts
              - organizations:DescribeOrganization
              - support:DescribeSeverityLevels
              - trustedadvisor:DescribeChecks
              - trustedadvisor:DescribeCheckResults
              - wellarchitected:List*
              - wellarchitected:Get*
            Resource: "*"
      Roles:
        - !Ref OptivulnixReadOnlyRole

Outputs:
  RoleArn:
    Value: !GetAtt OptivulnixReadOnlyRole.Arn
    Description: "Share this Role ARN with OptiVulniX to complete onboarding"
    Export:
      Name: !Sub "${AWS::StackName}-RoleArn"

  AccountId:
    Value: !Ref AWS::AccountId
    Description: "This AWS account ID"

  OnboardingInstructions:
    Value: !Sub |
      Role ARN: arn:aws:iam::${AWS::AccountId}:role/${RoleName}
      Share this ARN at: https://optivulnix.com/onboard
    Description: "Next steps to complete OptiVulniX onboarding"
