AWSTemplateFormatVersion: "2010-09-09"
Description: >-
  MILLENNIUMS.AI read-only cloud scan role. Creates one IAM role that the MILLENNIUMS.AI scanner can
  assume only with your workspace's external id. Read-only: AWS managed ReadOnlyAccess + SecurityAudit.
  Delete this stack at any time to revoke access completely.

Parameters:
  ScannerPrincipal:
    Type: String
    Description: The MILLENNIUMS.AI scanner identity allowed to assume the role. Pre-filled for you.
    AllowedPattern: "^arn:aws:iam::[0-9]{12}:(user|role)/.+$"
  ExternalId:
    Type: String
    Description: Your workspace's external id (confused-deputy protection). Pre-filled for you.
    MinLength: 8
    MaxLength: 64
    AllowedPattern: "^[A-Za-z0-9_+=,.@:/-]+$"
  RoleName:
    Type: String
    Default: millenniums-cloud-scan
    Description: Leave as is - MILLENNIUMS.AI looks for this exact name.

Resources:
  ScanRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref RoleName
      Description: Read-only access for the MILLENNIUMS.AI estate scan. Delete the stack to revoke.
      MaxSessionDuration: 3600
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Ref ScannerPrincipal
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                sts:ExternalId: !Ref ExternalId
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/ReadOnlyAccess
        - arn:aws:iam::aws:policy/SecurityAudit

Outputs:
  RoleArn:
    Description: The role MILLENNIUMS.AI assumes. You do not need to copy this - your account number is enough.
    Value: !GetAtt ScanRole.Arn