{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Parameters": {
        "CFBucket": {
            "Type": "String",
            "Description": "This is the S3 bucket that you selected earlier in the CloudForecast Setup."
        },
        "CloudForecastAccount": {
            "Type": "String",
            "Default": "656227328603",
            "Description": "CloudForecast Account"
        },
        "CFExternalId": {
            "Type": "String",
            "Default": "",
            "Description": "This is a unique ID that CloudForecast gives you during the setup process."
        },
        "CloudForecastAccessRole": {
            "Type": "String",
            "Description": "The CloudForecast IAM role that will access your data.",
            "AllowedValues": [
                "CloudForecast-CustomerDataAccess-D8f3a2",
                "CloudForecast-CustomerDataAccess-Pa7c9b"
            ]
        }
    },
    "Conditions": {},
    "Resources": {
        "IamRole": {
            "Type": "AWS::IAM::Role",
            "Properties": {
                "AssumeRolePolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [{
                        "Effect": "Allow",
                        "Principal": {
                            "AWS": {
                                "Fn::Sub": "arn:aws:iam::${CloudForecastAccount}:role/${CloudForecastAccessRole}"
                            }
                        },
                        "Action": "sts:AssumeRole",
                        "Condition": {
                            "StringEquals": {
                                "sts:ExternalId": {
                                    "Ref": "CFExternalId"
                                }
                            }
                        }
                    }]
                }
            }
        },
        "CurPolicy": {
            "Type": "AWS::IAM::Policy",
            "DependsOn": "IamRole",
            "Properties": {
                "Roles": [{
                    "Ref": "IamRole"
                }],
                "PolicyName": "CloudForecast-CUR-Policy",
                "PolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [{
                        "Sid": "CostReadCUR",
                        "Action": [
                            "s3:Get*",
                            "s3:List*"
                        ],
                        "Effect": "Allow",
                        "Resource": [{
                                "Fn::Sub": "arn:aws:s3:::${CFBucket}"
                            },
                            {
                                "Fn::Sub": "arn:aws:s3:::${CFBucket}/*"
                            }
                        ]
                    }]
                }
            }
        },
        "CostExplorerPolicy": {
            "Type": "AWS::IAM::Policy",
            "DependsOn": "IamRole",
            "Properties": {
                "Roles": [{
                    "Ref": "IamRole"
                }],
                "PolicyName": "CloudForecast-CostExplorer-Policy",
                "PolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [{
                        "Sid": "CostExplorerAccess",
                        "Action": [
                            "ce:Get*",
                            "ce:List*",
                            "ce:Describe*",
                        ],
                        "Effect": "Allow",
                        "Resource": "*"
                    }]
                }
            }
        },
        "SavingPlanPolicy": {
            "Type": "AWS::IAM::Policy",
            "DependsOn": "IamRole",
            "Properties": {
                "Roles": [{
                    "Ref": "IamRole"
                }],
                "PolicyName": "CloudForecast-Aws-SavingPlan-Policy",
                "PolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Sid": "SavingPlanReadAccess",
                            "Effect": "Allow",
                            "Action": [
                                "savingsplans:List*",
                                "savingsplans:Describe*"
                            ],
                            "Resource": "*"
                        }
                    ]
                }
            }
        },
        "OrganizationPolicy": {
            "Type": "AWS::IAM::Policy",
            "DependsOn": "IamRole",
            "Properties": {
                "Roles": [{
                    "Ref": "IamRole"
                }],
                "PolicyName": "CloudForecast-Aws-Organization-Policy",
                "PolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [{
                        "Sid": "OrganizationListAccess",
                        "Action": [
                            "organizations:ListAccounts"
                        ],
                        "Effect": "Allow",
                        "Resource": [
                            "*"
                        ]
                    }]
                }
            }
        }, 
        "TrustedAdvisorSupportPolicy": {
            "Type": "AWS::IAM::Policy",
            "DependsOn": "IamRole",
            "Properties": {
                "Roles": [{
                    "Ref": "IamRole"
                }],
                "PolicyName": "CloudForecast-Aws-Trusted-Advisor-Support",
                "PolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [{
                        "Sid": "TrustedAdvisorSupportAccess",
                        "Action": [
                            "support:DescribeTrustedAdvisorCheckRefreshStatuses",
                            "support:DescribeTrustedAdvisorCheckResult",
                            "support:DescribeTrustedAdvisorChecks",
                            "support:DescribeTrustedAdvisorCheckSummaries",
                            "support:RefreshTrustedAdvisorCheck",
                            "trustedadvisor:Describe*"
                        ],
                        "Effect": "Allow",
                        "Resource": [
                            "*"
                        ]
                    }]
                }
            }
        }
    },
    "Outputs": {
        "RoleArn": {
            "Description": "ARN of the IAM Role",
            "Value": {
                "Fn::GetAtt": [
                    "IamRole",
                    "Arn"
                ]
            }
        }
    }
}