AWSTemplateFormatVersion: "2010-09-09"
Description: >
  Creates an IAM role that SingleStore workspaces can assume to access S3 buckets.
  This template only creates the IAM role with permissions. The S3 bucket policies
  must be configured separately to allow access from this role. Bucket policy
  configuration is outside the scope of this CloudFormation stack.

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "Role Configuration"
        Parameters:
          - RoleName
          - WorkspaceGroupCloudWorkloadIdentities
      - Label:
          default: "Bucket Configuration"
        Parameters:
          - BucketNames

    ParameterLabels:
      RoleName:
        default: "IAM Role Name"
      WorkspaceGroupCloudWorkloadIdentities:
        default: "Workspace Group Cloud Workload Identities"
      BucketNames:
        default: "S3 Bucket Names"

Parameters:
  BucketNames:
    Type: CommaDelimitedList
    Description: >-
      Comma-separated list of S3 bucket names. Do not include trailing commas.
      The S3 bucket policies must be configured separately to allow access from this role.
      This template only grants permissions to the role, not to the buckets themselves.
  WorkspaceGroupCloudWorkloadIdentities:
    Type: CommaDelimitedList
    Description: >-
      Comma-separated list of SingleStore workspace group cloud workload identity role ARNs that
      will be granted permission to assume this role. Do not include trailing commas.
    ConstraintDescription: Must provide at least one workspace group cloud workload identity role ARN without trailing commas
  RoleName:
    Type: String
    Default: "SingleStoreS3AccessRole-01"
    Description: >-
      Name for the IAM role that SingleStore workspaces will assume to access S3 buckets.
      Must be unique within your AWS account.

Resources:
  SingleStoreS3AccessRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: !Ref RoleName
      Description: Role to provide SingleStore access to S3 Buckets
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Ref WorkspaceGroupCloudWorkloadIdentities
            Action:
              - "sts:AssumeRole"
      Policies:
        - PolicyName: AllowBucketAccess
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetBucketLocation
                  - s3:ListBucket
                Resource: !Split
                  - ","
                  - !Sub
                    - "arn:aws:s3:::${joined}"
                    - joined: !Join
                        - ",arn:aws:s3:::"
                        - !Ref BucketNames
              - Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:GetObjectVersion
                Resource: !Split
                  - ","
                  - !Sub
                    - "arn:aws:s3:::${joined}/*"
                    - joined: !Join
                        - "/*,arn:aws:s3:::"
                        - !Ref BucketNames

Outputs:
  RoleArn:
    Description: ARN of Created IAM Role
    Value: !GetAtt SingleStoreS3AccessRole.Arn
