{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Parameters": {
    "RoleName": {
      "Type": "String",
      "Default": "CloudForecast-ZeroWaste",
      "Description": "IAM Role Name"
    },
    "CloudForecastAccount": {
      "Type": "String",
      "Default": "656227328603",
      "Description": "CloudForecast Account"
    },
    "CFExternalId": {
      "Type": "String",
      "Default": "",
      "Description": "This is a unique ID that CloudForecast gives you during the setup process."
    },
    "CloudForecastAccessRole": {
      "Type": "String",
      "Description": "The CloudForecast IAM role that will access your data.",
      "AllowedValues": [
        "CloudForecast-CustomerDataAccess-D8f3a2",
        "CloudForecast-CustomerDataAccess-Pa7c9b"
      ]
    }
  },
  "Conditions": {

  },
  "Resources": {
    "IamRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "RoleName": {
          "Ref": "RoleName"
        },
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "AWS": {
                  "Fn::Sub": "arn:aws:iam::${CloudForecastAccount}:role/${CloudForecastAccessRole}"
                }
              },
              "Action": "sts:AssumeRole",
              "Condition": {
                "StringEquals": {
                  "sts:ExternalId": {
                    "Ref": "CFExternalId"
                  }
                }
              }
            }
          ]
        }
      }
    },
    "CommonPolicy": {
      "Type": "AWS::IAM::Policy",
      "DependsOn": "IamRole",
      "Properties": {
        "Roles": [
          {
            "Ref": "IamRole"
          }
        ],
        "PolicyName": "CloudForecast-Aws-Common-Policy",
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Action": [
                "cloudwatch:GetMetricStatistics"
              ],
              "Effect": "Allow",
              "Resource": "*"
            },
            {
              "Action": [
                "tag:GetResources"
              ],
              "Effect": "Allow",
              "Resource": "*"
            }
          ]
        }
      }
    },
    "OrganizationPolicy": {
      "Type": "AWS::IAM::Policy",
      "DependsOn": "IamRole",
      "Properties": {
        "Roles": [
          {
            "Ref": "IamRole"
          }
        ],
        "PolicyName": "CloudForecast-Aws-Organization-Policy",
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Sid": "OrganizationListAccess",
              "Action": [
                "organizations:ListAccounts"
              ],
              "Effect": "Allow",
              "Resource": [
                "*"
              ]
            }
          ]
        }
      }
    },
    "AlbUnusedPolicy": {
      "Type": "AWS::IAM::Policy",
      "DependsOn": "IamRole",
      "Properties": {
        "Roles": [
          {
            "Ref": "IamRole"
          }
        ],
        "PolicyName": "CloudForecast-ZW-AlbUnusedPolicy",
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "elasticloadbalancing:DescribeLoadBalancers",
                "elasticloadbalancing:DescribeTags"
              ],
              "Resource": "*"
            }
          ]
        }
      }
    },
    "EbsOldSnapshots": {
      "Type": "AWS::IAM::Policy",
      "DependsOn": "IamRole",
      "Properties": {
        "Roles": [
          {
            "Ref": "IamRole"
          }
        ],
        "PolicyName": "CloudForecast-ZW-EbsOldSnapshots",
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "ec2:DescribeSnapshots"
              ],
              "Resource": "*"
            }
          ]
        }
      }
    },
    "EbsUnusedOrUnattached": {
      "Type": "AWS::IAM::Policy",
      "DependsOn": "IamRole",
      "Properties": {
        "Roles": [
          {
            "Ref": "IamRole"
          }
        ],
        "PolicyName": "CloudForecast-ZW-EbsUnusedOrUnattached",
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "ec2:DescribeVolumes"
              ],
              "Resource": "*"
            }
          ]
        }
      }
    },
    "Ec2PreviousGeneration": {
      "Type": "AWS::IAM::Policy",
      "DependsOn": "IamRole",
      "Properties": {
        "Roles": [
          {
            "Ref": "IamRole"
          }
        ],
        "PolicyName": "CloudForecast-ZW-Ec2PreviousGeneration",
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "ec2:DescribeInstances"
              ],
              "Resource": "*"
            }
          ]
        }
      }
    },
    "Ec2OverProvisioned": {
      "Type": "AWS::IAM::Policy",
      "DependsOn": "IamRole",
      "Properties": {
        "Roles": [
          {
            "Ref": "IamRole"
          }
        ],
        "PolicyName": "CloudForecast-ZW-Ec2OverProvisioned",
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "ec2:DescribeInstances"
              ],
              "Resource": "*"
            }
          ]
        }
      }
    },
    "ElbUnused": {
      "Type": "AWS::IAM::Policy",
      "DependsOn": "IamRole",
      "Properties": {
        "Roles": [
          {
            "Ref": "IamRole"
          }
        ],
        "PolicyName": "CloudForecast-ZW-ElbUnused",
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "elasticloadbalancing:DescribeLoadBalancers"
              ],
              "Resource": "*"
            }
          ]
        }
      }
    },
    "RdsOverProvisioned": {
      "Type": "AWS::IAM::Policy",
      "DependsOn": "IamRole",
      "Properties": {
        "Roles": [
          {
            "Ref": "IamRole"
          }
        ],
        "PolicyName": "CloudForecast-ZW-RdsOverProvisioned",
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "rds:DescribeDBInstances"
              ],
              "Resource": "*"
            }
          ]
        }
      }
    },
    "RdsResizeStoreage": {
      "Type": "AWS::IAM::Policy",
      "DependsOn": "IamRole",
      "Properties": {
        "Roles": [
          {
            "Ref": "IamRole"
          }
        ],
        "PolicyName": "CloudForecast-ZW-RdsResizeStoreage",
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "rds:DescribeDBInstances"
              ],
              "Resource": "*"
            }
          ]
        }
      }
    },
    "RdsUnused": {
      "Type": "AWS::IAM::Policy",
      "DependsOn": "IamRole",
      "Properties": {
        "Roles": [
          {
            "Ref": "IamRole"
          }
        ],
        "PolicyName": "CloudForecast-ZW-RdsUnused",
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "rds:DescribeDBInstances"
              ],
              "Resource": "*"
            }
          ]
        }
      }
    },
    "RdsOldSnapshot": {
      "Type": "AWS::IAM::Policy",
      "DependsOn": "IamRole",
      "Properties": {
        "Roles": [
          {
            "Ref": "IamRole"
          }
        ],
        "PolicyName": "CloudForecast-ZW-RdsOldSnapshot",
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "rds:DescribeDBSnapshots"
              ],
              "Resource": "*"
            }
          ]
        }
      }
    },
    "S3PolicyCheck": {
      "Type": "AWS::IAM::Policy",
      "DependsOn": "IamRole",
      "Properties": {
        "Roles": [
          {
            "Ref": "IamRole"
          }
        ],
        "PolicyName": "CloudForecast-ZW-S3PolicyCheck",
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "s3:ListAllMyBuckets",
                "s3:ListBucket",
                "s3:GetBucketLocation",
                "s3:GetBucketTagging",
                "s3:GetLifecycleConfiguration"
              ],
              "Resource": "*"
            }
          ]
        }
      }
    },
    "CloudWatchPolicy": {
        "Type": "AWS::IAM::Policy",
        "DependsOn": "IamRole",
        "Properties": {
            "Roles": [{
                "Ref": "IamRole"
            }],
            "PolicyName": "CloudForecast-Aws-CloudWatch-Logs",
            "PolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [{
                    "Sid": "CloudWatchAccess",
                    "Action": [
                        "logs:DescribeLogGroups"
                    ],
                    "Effect": "Allow",
                    "Resource": [
                        "*"
                    ]
                }]
            }
        }
    }
  },
  "Outputs": {
    "RoleName": {
      "Description": "RoleName (To be specified in your CloudForecast account)",
      "Value": {
        "Ref": "RoleName"
      }
    }
  }
}