AWSTemplateFormatVersion: '2010-09-09'
Description: >-
    Creates an IAM OIDC Provider for the Ciphrix platform workload-identity federation,
    and a Role for the Ciphrix platform to assume.

Parameters:
    IssuerDomain:
        Type: String
        Description: The URL of the OIDC issuer (e.g., issuer.ciphrix.app)
        Default: issuer.domain.com - replace with the actual issuer
    ConnectionId:
        Type: String
        Description: The unique identifier (sub) that the Ciphrix platform will use and that appears in the AWS role trust policy. This is available in the Ciphrix platform.
        Default: placeholder-connection-id - replace with the actual connection ID from the Ciphrix platform.

Resources:
    OIDCProvider:
        Type: AWS::IAM::OIDCProvider
        Properties:
            Url: !Sub 'https://${IssuerDomain}'
            ClientIdList:
                - sts.amazonaws.com
            # ThumbprintList is omitted; AWS will fetch the top intermediate CA thumbprint automatically.
            Tags:
                - Key: UsedBy
                  Value: Ciphrix-Platform

    RoleForCiphrixPlatformAccess:
        Type: AWS::IAM::Role
        Properties:
            RoleName: !Sub 'Ciphrix-Platform-${ConnectionId}-Role'
            AssumeRolePolicyDocument:
                Fn::Sub:
                    - |
                        {
                          "Version": "2012-10-17",
                          "Statement": [
                            {
                              "Effect": "Allow",
                              "Principal": {
                                "Federated": "${OIDCProviderArn}"
                              },
                              "Action": "sts:AssumeRoleWithWebIdentity",
                              "Condition": {
                                "StringEquals": {
                                  "${IssuerDomain}:sub": "${ConnectionId}",
                                  "${IssuerDomain}:aud": "sts.amazonaws.com"
                                }
                              }
                            }
                          ]
                        }
                    - OIDCProviderArn:
                          Fn::GetAtt:
                              - OIDCProvider
                              - Arn
            Policies:
                - PolicyName: DenyDataPlaneAccess
                  PolicyDocument:
                      Version: '2012-10-17'
                      Statement:
                          - Sid: DenyS3GetAndList
                            Effect: Deny
                            Action:
                                - s3:GetObject
                                - s3:GetObjectVersion
                                - s3:ListBucket
                            Resource: '*'
                          - Sid: DenyDynamoDBRead
                            Effect: Deny
                            Action:
                                - dynamodb:GetItem
                                - dynamodb:BatchGetItem
                                - dynamodb:Query
                                - dynamodb:Scan
                            Resource: '*'
                          - Sid: DenySecretsManagerView
                            Effect: Deny
                            Action:
                                - secretsmanager:GetSecretValue
                            Resource: '*'
                          - Sid: DenyKMSDecrypt
                            Effect: Deny
                            Action:
                                - kms:Decrypt
                            Resource: '*'
                          - Sid: DenyLogsRead
                            Effect: Deny
                            Action:
                                - logs:GetLogEvents
                                - logs:FilterLogEvents
                            Resource: '*'
            ManagedPolicyArns:
                - arn:aws:iam::aws:policy/ReadOnlyAccess

Outputs:
    OIDCProviderArn:
        Description: ARN of the newly created IAM OIDC provider
        Value: !Ref OIDCProvider

    RoleArn:
        Description: ARN of the role the Ciphrix platform will assume
        Value: !GetAtt RoleForCiphrixPlatformAccess.Arn