Description: "Create a CloudFormation Git Sync Role (v1.2.0)"
Parameters:
  # General Configuration
  SuggestedStackName:
    Type: "String"
    Description: "If creating through the AWS Console, this is the suggested stack name.  Copy and paste this value for the stack name."
    Default: "WebsiteGitSyncRole"
  RoleBaseName:
    Type: "String"
    Description: "The base name for the role that we are creating."
    Default: "website-git-sync"
Resources:
  # TODO: Need to clean up these permissions, I was running into a bug with CodePipeline and I changed some of these permissions while troubleshooting.
  GitSyncRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: !Sub "${RoleBaseName}-${AWS::Region}"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Effect: "Allow"
          Principal:
            Service:
            - "cloudformation.amazonaws.com" #Need to determine if this is really required.
            - "cloudformation.sync.codeconnections.amazonaws.com"
          Action:
          - "sts:AssumeRole"
      Policies:
      - PolicyName: "SetupServiceRole"
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
          - Effect: "Allow"
            Action:
            - "events:*"
            Resource: "*"
          - Effect: "Allow"
            Action:
            - "codestar-connections:*"
            Resource: "*"
      ManagedPolicyArns:
      - "arn:aws:iam::aws:policy/AmazonS3FullAccess"
      - "arn:aws:iam::aws:policy/AWSCloudFormationFullAccess"
      - "arn:aws:iam::aws:policy/AWSCodePipeline_FullAccess"
      - "arn:aws:iam::aws:policy/IAMFullAccess"
      Tags:
      - Key: "ManagedBy"
        Value: "CloudFormation"
      - Key: "StackName"
        Value: !Ref "AWS::StackName"
Outputs:
  GitSyncRoleName:
    Description: "The role name."
    Value: !Ref GitSyncRole
    Export:
      Name: !Sub "${AWS::StackName}-GitSyncRoleName"
  GitSyncRoleArn:
    Description: "The role ARN."
    Value: !GetAtt GitSyncRole.Arn
    Export:
      Name: !Sub "${AWS::StackName}-GitSyncRoleArn"
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
    - Label:
        default: "General Configuration"
      Parameters:
      - SuggestedStackName
      - RoleBaseName
    ParameterLabels:
      # General Configuration
      SuggestedStackName:
        default: "Suggested Stack Name:"
      RoleBaseName:
        default: "Role Base Name:"