Resources:                                                                                                                                                                                  
  RoleCreatedForAssessmentFromLucidityEssential:
    Type: AWS::IAM::Role                                                                                                                                                                    
    Properties:                                           
      RoleName: role_created_for_assessment_from_lucidity_essential
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              AWS: '692859952114'
            Condition: {}

  PolicyCreatedForAssessmentFromLucidityEssential:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: policy_created_for_assessment_from_lucidity_essential
      Roles:
        - !Ref RoleCreatedForAssessmentFromLucidityEssential
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: GlobalReadOnlyAccess
            Effect: Allow
            Action:
              - autoscaling:DescribeAutoScalingGroups
              - ce:GetCostAndUsage
              - cloudwatch:GetMetricStatistics
              - ec2:DescribeIamInstanceProfileAssociations
              - ec2:DescribeImages
              - ec2:DescribeInstances
              - ec2:DescribeRegions
              - ec2:DescribeVolumes
              - eks:DescribeNodegroup
              - eks:ListClusters
              - eks:ListNodegroups
              - iam:GetInstanceProfile
              - iam:GetRole
              - iam:ListAttachedRolePolicies
              - iam:ListPolicies
              - iam:ListRoles
              - ssm:DescribeInstanceInformation
              - ssm:GetCommandInvocation
              - iam:SimulatePrincipalPolicy
            Resource:
              - '*'
          - Sid: SendSSMCommands
            Effect: Allow
            Action:
              - ssm:SendCommand
            Resource:
              - !Join [ "", ["arn:aws:ec2:*:", !Ref "AWS::AccountId", ":instance/*"] ]
              - 'arn:aws:ssm:*:*:document/AWS-RunPowerShellScript'
              - 'arn:aws:ssm:*:*:document/AWS-RunShellScript'

