AWSTemplateFormatVersion: '2010-09-09'
Description: 'Creates a cross-account role that allows Topogy to access your AWS account'

Parameters:
  ExternalId:
    Type: String
    Description: External ID provided by Topogy (access this from the Topogy console)

  TopogyAccountId:
    Type: String
    Description: Topogy's AWS account ID that will assume this role
    Default: "727646469040"
    AllowedPattern: "^[0-9]{12}$"
    ConstraintDescription: "Must be a valid 12-digit AWS account ID"

  IAMRoleName:
    Type: String
    Description: Name of the IAM role to create
    Default: TopogyCrossAccountRole

Resources:
  TopogyCrossRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref IAMRoleName
      Description: Role for Topogy to access your AWS account
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS:
                - !Sub 'arn:aws:iam::${TopogyAccountId}:root'
            Action:
              - 'sts:AssumeRole'
            Condition:
              StringEquals:
                'sts:ExternalId': !Ref ExternalId
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/ReadOnlyAccess'

Outputs:
  RoleARN:
    Description: ARN of the created role
    Value: !GetAtt TopogyCrossRole.Arn

  RoleName:
    Description: Name of the created role
    Value: !Ref IAMRoleName
