{
  "Parameters": {
    "RoleName": {
      "Description": "The name of the role that is going to be created to allow access to Qovery",
      "Type": "String",
      "Default": "qovery-user-role",
      "MaxLength": 64
    }
  },
  "Resources": {
    "Role": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "RoleName": {
          "Ref": "RoleName"
        },
        "MaxSessionDuration": 28800,
        "Policies": [
          {
            "PolicyName": "qovery-permissions",
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "application-autoscaling:*",
                    "autoscaling:*",
                    "cloudtrail:LookupEvents",
                    "cloudwatch:*",
                    "dynamodb:*",
                    "ec2:*",
                    "ecr:*",
                    "ecs:*",
                    "eks:*",
                    "elasticache:*",
                    "elasticloadbalancing:*",
                    "es:AddTags",
                    "es:CreateElasticsearchDomain",
                    "es:DeleteElasticsearchDomain",
                    "es:DescribeElasticsearchDomain",
                    "es:ListTags",
                    "es:RemoveTags",
                    "events:DeleteRule",
                    "events:DescribeRule",
                    "events:ListRuleNamesByTarget",
                    "events:ListTagsForResource",
                    "events:ListTargetsByRule",
                    "events:PutRule",
                    "events:PutTargets",
                    "events:RemoveTargets",
                    "events:TagResource",
                    "events:UntagResource",
                    "iam:*",
                    "kms:*",
                    "logs:*",
                    "organizations:DescribeAccount",
                    "organizations:DescribeOrganization",
                    "organizations:DescribeOrganizationalUnit",
                    "organizations:DescribePolicy",
                    "organizations:ListChildren",
                    "organizations:ListParents",
                    "organizations:ListPolicies",
                    "organizations:ListPoliciesForTarget",
                    "organizations:ListRoots",
                    "organizations:ListTargetsForPolicy",
                    "rds:*",
                    "s3:ListAllMyBuckets",
                    "servicequotas:GetServiceQuota",
                    "tag:GetResources"
                  ],
                  "Resource": "*"
                },
                {
                  "Action": [
                    "s3:*",
                    "sqs:*"
                  ],
                  "Effect": "Allow",
                  "Resource": [
                    "arn:aws:s3:::qovery*",
                    "arn:aws:s3:::qovery*/*",
                    "arn:aws:sqs:*:*:qovery*",
                    "arn:aws:sqs:*:*:qovery*/*"
                  ]
                }
              ]
            }
          }
        ],
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "AWS": [
                  "arn:aws:iam::283389881690:role/qovery-deployer",
                  "arn:aws:iam::283389881690:user/qovery-deployer"
                ]
              },
              "Action": "sts:AssumeRole",
              "Condition": {}
            }
          ]
        }
      }
    }
  },
  "Outputs": {
    "RoleARN": {
      "Description": "Arn of the created role. This is the information to give in Qovery console",
      "Value": {
        "Fn::GetAtt": [
          "Role",
          "Arn"
        ]
      },
      "Export": {
        "Name": {
          "Fn::Sub": "${AWS::StackName}-RoleARN"
        }
      }
    }
  }
}