---
AWSTemplateFormatVersion: 2010-09-09
Description: Creates ASM Role across multiple AWS accounts and regions

Parameters:
  ExternalID:
    Type: String
    Description: External ID from ASM
    AllowedPattern: "^[0-9a-fA-F]{32}$"
    ConstraintDescription: "Please check the External ID provided from ASM and try again"
    #NoEcho: true

Resources:
  rASMrole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: Mandiant-ASM-Access
      Description: MASM Integration Role _aws-management_
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS: "arn:aws:iam::220283773642:root" # ASM Account
            Action: "sts:AssumeRole"
            Condition:
              StringEquals:
                "sts:ExternalId": !Ref ExternalID
      Tags: 
        - Key: "Name"
          Value: "Mandiant-ASM-Access"
      Path: /

  rASMPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: masm-access-policy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - "ec2:DescribeInstances"
            Resource: "*"
          - Effect: Allow
            Action:
              - "route53:ListHostedZones"
              - "route53:ListResourceRecordSets"
            Resource: "*"
          - Effect: Allow
            Action:
              - "s3:ListAllMyBuckets" 
            Resource: "*"
          - Effect: "Allow"
            Action: 
              - "rds:DescribeDBInstances"
            Resource: "*"
      Roles:
        - !Ref rASMrole
