Resources:
  RoleCreatedForAssessmentFromLucidity:
    Type: AWS::IAM::Role
    Properties:
      RoleName: role_created_for_assessment_from_lucidity
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              AWS: '692859952114'
            Condition: {}

  PolicyCreatedForAssessmentFromLucidity:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: policy_created_for_assessment_from_lucidity
      Roles:
        - !Ref RoleCreatedForAssessmentFromLucidity
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: GlobalReadOnlyAccess
            Effect: Allow
            Action:
              - autoscaling:DescribeAutoScalingGroups
              - ce:GetCostAndUsage
              - cloudwatch:GetMetricStatistics
              - ec2:DescribeIamInstanceProfileAssociations
              - ec2:DescribeImages
              - ec2:DescribeInstances
              - ec2:DescribeRegions
              - ec2:DescribeVolumes
              - eks:DescribeNodegroup
              - eks:ListClusters
              - eks:ListNodegroups
              - iam:GetInstanceProfile
              - iam:GetRole
              - iam:ListAttachedRolePolicies
              - iam:ListPolicies
              - iam:ListRoles
              - ssm:DescribeInstanceInformation
              - ssm:GetCommandInvocation
              - iam:SimulatePrincipalPolicy
            Resource:
              - '*'
          - Sid: AssociateInstanceProfile
            Effect: Allow
            Action: ec2:AssociateIamInstanceProfile
            Resource: !Join [ "", ["arn:aws:ec2:*:", !Ref "AWS::AccountId", ":instance/*"] ]
            Condition:
              ArnLike:
                ec2:NewInstanceProfile: !Join [ "", ["arn:aws:iam::", !Ref "AWS::AccountId", ":instance-profile/Lucidity*"] ]
          - Sid: DisassociateInstanceProfile
            Effect: Allow
            Action: ec2:DisassociateIamInstanceProfile
            Resource: !Join [ "", ["arn:aws:ec2:*:", !Ref "AWS::AccountId", ":instance/*"] ]
            Condition:
              ArnLike:
                ec2:InstanceProfile: !Join [ "", ["arn:aws:iam::", !Ref "AWS::AccountId", ":instance-profile/Lucidity*"] ]
          - Sid: ManageInstanceProfiles
            Effect: Allow
            Action:
              - iam:AddRoleToInstanceProfile
              - iam:CreateInstanceProfile
              - iam:DeleteInstanceProfile
              - iam:RemoveRoleFromInstanceProfile
            Resource:
              - !Join [ "", ["arn:aws:iam::", !Ref "AWS::AccountId", ":instance-profile/Lucidity*"] ]
          - Sid: ManageRoles
            Effect: Allow
            Action:
              - iam:CreateRole
              - iam:DeleteRole
            Resource:
              - !Join [ "", ["arn:aws:iam::", !Ref "AWS::AccountId", ":role/Lucidity*"] ]
          - Sid: PassLucidityRolesToEC2
            Effect: Allow
            Action:
              - iam:PassRole
            Resource:
              - !Join [ "", ["arn:aws:iam::", !Ref "AWS::AccountId", ":role/Lucidity*"] ]
            Condition:
              StringEquals:
                iam:PassedToService: ec2.amazonaws.com
          - Sid: AttachDetachSSMPolicy
            Effect: Allow
            Action:
              - iam:AttachRolePolicy
              - iam:DetachRolePolicy
            Resource:
              - !Join [ "", ["arn:aws:iam::", !Ref "AWS::AccountId", ":role/*"] ]
            Condition:
              StringEquals:
                iam:PolicyARN: 'arn:aws:iam::aws:policy/AmazonSSMFullAccess'
          - Sid: SendSSMCommands
            Effect: Allow
            Action:
              - ssm:SendCommand
            Resource:
              - !Join [ "", ["arn:aws:ec2:*:", !Ref "AWS::AccountId", ":instance/*"] ]
              - 'arn:aws:ssm:*:*:document/AWS-RunPowerShellScript'
              - 'arn:aws:ssm:*:*:document/AWS-RunShellScript'
