AWSTemplateFormatVersion: "2010-09-09"
Description: >
  Read-only IAM role for the AWS Database Cost Audit.
  Grants access to cost data, RDS/Redshift metadata, and CloudWatch
  metrics only. No write permissions of any kind. Delete this stack
  after the audit to revoke access instantly.

Parameters:
  AuditorRoleArn:
    Type: String
    Description: Dedicated auditor role ARN permitted to assume this role
  ExternalId:
    Type: String
    Description: Unique external ID provided by the auditor (confused-deputy guard)
    NoEcho: true

Resources:
  DbCostAuditRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: db-cost-audit-readonly
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Ref AuditorRoleArn
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                sts:ExternalId: !Ref ExternalId
      Policies:
        - PolicyName: db-cost-audit-readonly
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Sid: CostData
                Effect: Allow
                Action:
                  - ce:GetCostAndUsage
                  - ce:GetDimensionValues
                  - ce:GetReservationUtilization
                  - ce:GetReservationPurchaseRecommendation
                  - ce:GetSavingsPlansUtilization
                Resource: "*"
              - Sid: RdsRead
                Effect: Allow
                Action:
                  - rds:Describe*
                  - rds:ListTagsForResource
                Resource: "*"
              - Sid: PublicPricing
                Effect: Allow
                Action:
                  - pricing:GetProducts
                Resource: "*"
              - Sid: RedshiftRead
                Effect: Allow
                Action:
                  - redshift:Describe*
                Resource: "*"
              - Sid: ElastiCacheRead
                Effect: Allow
                Action:
                  - elasticache:Describe*
                Resource: "*"
              - Sid: Metrics
                Effect: Allow
                Action:
                  - cloudwatch:GetMetricData
                  - cloudwatch:ListMetrics
                Resource: "*"
              - Sid: PerformanceInsights
                Effect: Allow
                Action:
                  - pi:GetResourceMetrics
                  - pi:DescribeDimensionKeys
                Resource: "*"
              # --- v2 additions (Phase 3 services). Existing deployments:
              # update the stack in place; RoleArn and ExternalId are
              # unchanged, no re-onboarding needed.
              - Sid: OpenSearchRead
                Effect: Allow
                Action:
                  - es:Describe*
                  - es:List*
                Resource: "*"
              - Sid: DynamoDBRead
                Effect: Allow
                Action:
                  - dynamodb:ListTables
                  - dynamodb:DescribeTable
                  - dynamodb:DescribeContinuousBackups
                  - dynamodb:DescribeTimeToLive
                  - dynamodb:ListTagsOfResource
                Resource: "*"
              - Sid: FutureDatabaseReads
                Effect: Allow
                Action:
                  - memorydb:Describe*
                  - dax:Describe*
                Resource: "*"
              - Sid: DmsRead
                Effect: Allow
                Action:
                  - dms:DescribeReplicationInstances
                  - dms:DescribeReplicationTasks
                Resource: "*"

Outputs:
  RoleArn:
    Description: Share this ARN with the auditor
    Value: !GetAtt DbCostAuditRole.Arn