AWSTemplateFormatVersion: '2010-09-09'
Description: 'IAM Role for Cross-Account Warcostt Access'

Parameters:
  TrustedAccount:
    Type: String
    Description: 'The 12-digit AWS Account ID of the account hosting the Warcostt Tool.'
    AllowedPattern: '^\d{12}$'
    Default: '539307130135'

Resources:
  WarcosttRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: 'WarcosttCrossAccountRole'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::${TrustedAccount}:root'
            Action: 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/SecurityAudit'
        - 'arn:aws:iam::aws:policy/job-function/Billing'
        - 'arn:aws:iam::aws:policy/ReadOnlyAccess'

Outputs:
  RoleARN:
    Description: 'The ARN of the role to enter into the Warcostt Tool'
    Value: !GetAtt WarcosttRole.Arn
