#-----------------------------------------------------------------------#

# Stack description:
# This is an example template

# Stack purpose:
# - Create IAM policies
# - Assign IAM policies to groups

# Cross-stack dependencies:
# - Buckets deployed through another stack

#-----------------------------------------------------------------------#

service: policies-roles-usergroups

provider:
  name: aws
  runtime: python3.7
  profile: ${opt:profile, 'default'} 
  region: ${opt:region, 'eu-west-1'}
  stage: ${self:provider.profile}
  deploymentBucket:
    name:  ${self:custom.ServerlessBucketName} 

plugins:
  - serverless-pseudo-parameters

custom:
  
  # Bucket used to store serverless deployment artifacts
  ServerlessBucketName: ${cf:serverless-framework-${self:provider.profile}.ServerlessBucket}
  
  IAMPolicies:
    EnforceMFA: 'rain-enforce-mfa-policy'
    AuditorsAccess: 'rain-auditors-access-policy' 

  IAMGroups:
    Auditors: 'rain-auditors-group'

resources:
  Resources:

  # Policies:

    # Policy enforcing MFA
    EnforceMFAPolicy: 
      Type: AWS::IAM::ManagedPolicy
      Properties:
        ManagedPolicyName: ${self:custom.IAMPolicies.EnforceMFA}
        PolicyDocument:
          Version: "2012-10-17"
          #Custom policy permissions:
          Statement: [
            {    
              "Sid": "DoNotAllowAnythingOtherThanIAMUnlessMFAd",
              "Effect" : "Deny",
              "NotAction" : "iam:*",
              "Resource": "*",
              "Condition" : { 
                "BoolIfExists" : { 
                  "aws:MultiFactorAuthPresent" : false 
                } 
              }   
            }
          ]

    # Policy granting audit users access to S3
    AuditorsAccessPolicy:  
      Type: AWS::IAM::ManagedPolicy
      Properties:
        ManagedPolicyName: ${self:custom.IAMPolicies.AuditorsAccess}
        PolicyDocument:
          Version: "2012-10-17"
          #Custom policy permissions:
          Statement: [
            {
              "Sid": "S3ListAllBuckets",
              "Effect": "Allow",
              "Action": [
                "s3:ListAllMyBuckets"
              ],
              "Resource": "*"
            },
            {
              "Sid": "S3AccessToAuditorBucket",
              "Effect": "Allow",
              "Action": [
                "s3:GetObject",
                "s3:GetObjectTagging",
                "s3:ListBucket",
                "s3:GetBucketLocation",
                "s3:PutObject",
              ],
              "Resource": [
                !Sub "arn:aws:s3:::auditors-resources-rain-audit-eu-west-1",
                !Sub "arn:aws:s3:::auditors-resources-rain-audit-eu-west-1/*"
              ]
            }
          ]


  # Groups:

    # Group containing Audit users
    IAMAuditorsGroup:
      Type: AWS::IAM::Group
      DependsOn: 
        - EnforceMFAPolicy
        - AuditorsAccessPolicy
      Properties:
        GroupName: ${self:custom.IAMGroups.Auditors}
        ManagedPolicyArns: 
          # Customer managed policies:
          - !Ref EnforceMFAPolicy
          - !Ref AuditorsAccessPolicy
          # AWS managed policies:
          - 'arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess'


#-----------------------------------------------------------------------#

