AWSTemplateFormatVersion: "2010-09-09"
Description: >
  VaultForge AWS Cost & Security Quick Check - read-only audit role.
  Grants view-only access to resource metadata, security configuration and billing data.
  It cannot modify resources and cannot read S3 object contents, database items or secrets.
  Delete this stack when the review is finished.

Parameters:
  AuditorAccountId:
    Type: String
    Description: AWS account ID of the auditor (provided by VaultForge)
    AllowedPattern: "^[0-9]{12}$"
  ExternalId:
    Type: String
    Description: Unique external ID for this engagement (provided by VaultForge)
    MinLength: 16
    NoEcho: true

Resources:
  VaultForgeAuditRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: VaultForgeReadOnlyAudit
      MaxSessionDuration: 14400
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub "arn:aws:iam::${AuditorAccountId}:root"
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                sts:ExternalId: !Ref ExternalId
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/SecurityAudit
        - arn:aws:iam::aws:policy/job-function/ViewOnlyAccess
      Policies:
        - PolicyName: CostAndOptimizationReadOnly
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Sid: BillingAndCostRead
                Effect: Allow
                Action:
                  - ce:Get*
                  - ce:Describe*
                  - ce:List*
                  - budgets:ViewBudget
                  - budgets:Describe*
                  - cur:DescribeReportDefinitions
                  - savingsplans:Describe*
                  - pricing:GetProducts
                  - pricing:DescribeServices
                Resource: "*"
              - Sid: OptimizationRecommendationsRead
                Effect: Allow
                Action:
                  - compute-optimizer:Get*
                  - compute-optimizer:Describe*
                  - trustedadvisor:Describe*
                  - support:DescribeTrustedAdvisor*
                Resource: "*"
              - Sid: ExplicitDenyDataAccess
                Effect: Deny
                Action:
                  - s3:GetObject
                  - s3:GetObjectVersion
                  - dynamodb:GetItem
                  - dynamodb:BatchGetItem
                  - dynamodb:Query
                  - dynamodb:Scan
                  - rds-data:*
                  - secretsmanager:GetSecretValue
                  - ssm:GetParameter
                  - ssm:GetParameters
                  - ssm:GetParametersByPath
                  - kms:Decrypt
                Resource: "*"
      Tags:
        - Key: Purpose
          Value: VaultForge read-only audit (delete after review)

Outputs:
  RoleArn:
    Description: Send this ARN to VaultForge
    Value: !GetAtt VaultForgeAuditRole.Arn