lights_off_aws_prereq.yaml

---
AWSTemplateFormatVersion: "2010-09-09"

Description: |-
  Deployment role for

  github.com/sqlxpert/lights-off-aws/  GPLv3  Copyright Paul Marcelin

Parameters:

  PlaceholderHelp:
    Type: String
    Default: "https://github.com/sqlxpert/lights-off-aws#least-privilege"

  LambdaSourceS3BucketNamePrefix:
    Type: String
    Description: >-
      Exclude the region suffix, even though Lights Off REQUIRES a region
      suffix in the S3 bucket name. For example, if you are creating this
      stack in the US East (Northern Virginia) region and you set this to
      "my-bucket", then the bucket named "my-bucket-us-east-1" must exist,
      must have been created in the US East (Northern Virginia) region, and
      must contain lights_off_aws.py.zip . These requirements apply in EVERY
      region where you create a Lights Off CloudFormation stack. If you are
      are creating a CloudFormation StackSet, then the file must also be
      readable by every target AWS account, which generally requires that each
      bucket have a bucket policy.

  StackNameBase:
    Type: String
    Description: >-
      When using the DeploymentRole provided by this stack, you MUST include
      this string in the name of any Lights Off CloudFormation stack or
      StackSet that you create. For security, no other stack or StackSet's
      name should include this string. You may add prefixes and suffixes to
      your future stack or StackSet's name. For example, if you set this to
      "LightsOff", you can alternate between a "LightsOff1" stack and a
      "LightsOff2" stack for blue/green deployment of updates, or you can
      create a "TestLightsOff" stack marked for testing.
    Default: "LightsOff"

Metadata:

  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Essentials
        Parameters:
          - PlaceholderHelp
          - LambdaSourceS3BucketNamePrefix
          - StackNameBase
    ParameterLabels:
      PlaceholderHelp:
        default: For help with this stack, see
      LambdaSourceS3BucketNamePrefix:
        default: S3 bucket for AWS Lambda function source code
      StackNameBase:
        default: >-
          Name of future stack or StackSet

Resources:

  DeploymentRole:
    Type: AWS::IAM::Role
    Properties:
      Description: >-
        Resources in Lights Off CloudFormation stack: create, update, delete
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal: { Service: cloudformation.amazonaws.com }
            Action: sts:AssumeRole
      # In-line policies apply only to this role, which, in turn, can only be
      # assumed by CloudFormation. Separate, "managed" policies could be
      # attached to other roles or users, allowing permission escalation.
      # Administrator should restrict iam:PassRole to prevent use of this role
      # with arbitrary CloudFormation stacks.
      Policies:
        - PolicyName: LightsOffCloudFormationStackDeploy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:

              # Sufficient only for the current AWS account. For a multi-account
              # deployment, also allow access from all StackSets target accounts,
              # in each S3 bucket's bucket policy.
              - Effect: Allow
                Action:
                  - s3:GetObject*
                Resource:
                  - !Sub "arn:${AWS::Partition}:s3:::${LambdaSourceS3BucketNamePrefix}-*/*"

              - Effect: Allow
                Action:
                  - lambda:CreateFunction
                  - lambda:GetFunction
                  - lambda:DeleteFunction
                  - lambda:UpdateFunctionCode
                  - lambda:GetFunctionConfiguration
                  - lambda:UpdateFunctionConfiguration
                  - lambda:AddPermission
                  - lambda:RemovePermission
                  - lambda:PutFunctionConcurrency
                  - lambda:DeleteFunctionConcurrency
                  - lambda:TagResource
                  - lambda:UntagResource
                Resource:
                  - !Sub "arn:${AWS::Partition}:lambda:*:${AWS::AccountId}:function:StackSet-*${StackNameBase}*"
                  - !Sub "arn:${AWS::Partition}:lambda:*:${AWS::AccountId}:function:*${StackNameBase}*"
              - Effect: Allow
                Action:
                  - lambda:CreateEventSourceMapping
                  - lambda:GetEventSourceMapping
                  - lambda:UpdateEventSourceMapping
                  - lambda:DeleteEventSourceMapping
                Resource: "*"
                Condition:
                  ArnLikeIfExists:
                    "lambda:FunctionArn":
                      - !Sub "arn:${AWS::Partition}:lambda:*:${AWS::AccountId}:function:StackSet-*${StackNameBase}*"
                      - !Sub "arn:${AWS::Partition}:lambda:*:${AWS::AccountId}:function:*${StackNameBase}*"

              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:DeleteLogGroup
                  - logs:PutRetentionPolicy
                  - logs:DeleteRetentionPolicy
                  - logs:TagLogGroup
                  - logs:UntagLogGroup
                Resource:
                  - !Sub "arn:${AWS::Partition}:logs:*:${AWS::AccountId}:log-group:/aws/lambda/StackSet-*${StackNameBase}*"
                  - !Sub "arn:${AWS::Partition}:logs:*:${AWS::AccountId}:log-group:/aws/lambda/*${StackNameBase}*"
              - Effect: Allow
                Action:
                  - logs:DescribeLogGroups
                Resource: "*"

              - Effect: Allow
                Action:
                  - events:PutRule
                  - events:DescribeRule
                  - events:EnableRule
                  - events:DisableRule
                  - events:DeleteRule
                  - events:PutTargets
                  - events:ListTargetsByRule
                  - events:RemoveTargets
                  - events:TagResource
                  - events:UntagResource
                Resource:
                  - !Sub "arn:${AWS::Partition}:events:*:${AWS::AccountId}:rule/StackSet-*${StackNameBase}*"
                  - !Sub "arn:${AWS::Partition}:events:*:${AWS::AccountId}:rule/*${StackNameBase}*"

              - Effect: Allow
                Action:
                  - sqs:CreateQueue
                  - sqs:SetQueueAttributes
                  - sqs:GetQueueAttributes
                  - sqs:GetQueueUrl
                  - sqs:ListDeadLetterSourceQueues
                  - sqs:DeleteQueue
                  - sqs:AddPermission
                  - sqs:RemovePermission
                  - sqs:TagQueue
                  - sqs:UntagQueue
                Resource:
                  - !Sub "arn:${AWS::Partition}:sqs:*:${AWS::AccountId}:StackSet-*${StackNameBase}*"
                  - !Sub "arn:${AWS::Partition}:sqs:*:${AWS::AccountId}:*${StackNameBase}*"
              - Effect: Allow
                Action:
                  - sqs:ListQueues
                Resource: "*"

              - Effect: Allow
                Action: iam:PassRole
                Resource:
                  - !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/StackSet-*${StackNameBase}*"
                  - !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/*${StackNameBase}*"
              - Effect: Allow
                Action:
                  - iam:CreatePolicy
                  - iam:GetPolicy
                  - iam:DeletePolicy
                  - iam:CreatePolicyVersion
                  - iam:ListPolicyVersions
                  - iam:GetPolicyVersion
                  - iam:DeletePolicyVersion
                  - iam:TagPolicy
                  - iam:UntagPolicy
                Resource:
                  - !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:policy/StackSet-*${StackNameBase}*"
                  - !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:policy/*${StackNameBase}*"
              - Effect: Allow
                Action:
                  - iam:CreateRole
                  - iam:GetRole
                  - iam:DeleteRole
                  - iam:UpdateAssumeRolePolicy
                  - iam:ListRolePolicies
                  - iam:GetRolePolicy
                  - iam:AttachRolePolicy
                  - iam:DetachRolePolicy
                  - iam:PutRolePolicy
                  - iam:GetRolePolicy
                  - iam:DeleteRolePolicy
                  - iam:ListEntitiesForPolicy
                Resource:
                  - !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/StackSet-*${StackNameBase}*"
                  - !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:policy/StackSet-*${StackNameBase}*"
                  - !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/*${StackNameBase}*"
                  - !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:policy/*${StackNameBase}*"
              - Effect: Allow
                Action:
                  - iam:TagRole
                  - iam:UntagRole
                Resource:
                  - !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/StackSet-*${StackNameBase}*"
                  - !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/*${StackNameBase}*"
              - Effect: Allow
                Action:
                  - iam:ListAttachedRolePolicies
                Resource: "*"

              - Effect: Allow
                Action:
                  - kms:ListKeys
                  - kms:ListAliases
                  - kms:DescribeKey
                Resource: "*"

  SampleDeploymentRolePassRolePol:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      Description:
        Fn::Sub: >-
          ${DeploymentRole}: pass to CloudFormation. Demonstrates a privilege
          that non-adminstrators need before they can create a Lights Off
          CloudFormation stack using the deployment role.
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action: "iam:PassRole"
            Resource: !GetAtt DeploymentRole.Arn