AWSTemplateFormatVersion: '2010-09-09'
Description: >
  Creates an IAM role that allows the SUP SA Assessment Portal's automated
  assessor to evaluate resources in this account. The assessor assumes this
  role to run read-only (or admin-level) inspections of your infrastructure.

Parameters:
  AssessorAccountId:
    Type: String
    Default: '577638392815'
    Description: AWS account ID of the assessment portal (do not change)
  AssessorRoleName:
    Type: String
    Default: sup-sa-assessor-task-prod
    Description: Name of the assessor's ECS task role that will assume this role (do not change)

Resources:
  AssessmentRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: SUPAssessmentRole
      Description: Allows the SUP SA assessment portal to evaluate this account
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${AssessorAccountId}:role/${AssessorRoleName}
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AdministratorAccess

Outputs:
  AssessmentRoleToSubmit:
    Description: Paste this full value into the Role ARN field on the submission portal
    Value: !GetAtt AssessmentRole.Arn