AWSTemplateFormatVersion: "2010-09-09"
Description: "CloudFormation template to create an IAM Role for SSM Automation to configure MongoDB Config Servers"

Resources:
  SSMAutomationRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: SSM-Automation-TestHarness-ConfigRole
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: 
                - ssm.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: SSM-Automation-TestHarness-ConfigRole-Policy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              # Permissions for executing SSM Automation workflows
              - Effect: Allow
                Action:
                  - "ssm:StartAutomationExecution"
                  - "ssm:GetAutomationExecution"
                  - "ssm:DescribeAutomationExecutions"
                  - "ssm:DescribeAutomationStepExecutions"
                  - "ssm:ListCommands"
                Resource: "*"

              # Permissions for describing EC2 instances
              - Effect: Allow
                Action:
                  - "ec2:DescribeInstances"
                Resource: "*"

              # Permissions for executing SSM commands
              - Effect: Allow
                Action:
                  - "ssm:SendCommand"
                  - "ssm:GetCommandInvocation"
                  - "ssm:ListCommandInvocations"
                Resource: "*"

              # Permissions for interacting with SSM sessions
              - Effect: Allow
                Action:
                  - "ssm:ExecuteAutomation"
                  - "ssm:StartSession"
                  - "ssm:DescribeInstanceInformation"
                Resource: "*"

              # Permissions to pass IAM roles to SSM
              - Effect: Allow
                Action:
                  - "iam:PassRole"
                Resource: "*"
                Condition:
                  StringLike:
                    "iam:PassedToService": "ssm.amazonaws.com"


Outputs:
  SSMAutomationRole:
    Description: "IAM Role for SSM Automation to configure Test Harness Config Servers"
    Value: !Ref SSMAutomationRole
