# yaml-language-server: $schema=../../schemas/@aws-mdaa/roles.json
generatePolicies:
  GlueJobPolicy:
    # TODO: Review the below policyDocument permissions and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM5"
    #     reason: "Wildcard in log-group ARN (/aws-glue/*) required because Glue dynamically generates log group names at runtime."
    policyDocument:
        Statement:
          - SID: GlueCloudwatch
            Effect: Allow
            Resource:
              - "arn:{{partition}}:logs:{{region}}:{{account}}:log-group:/aws-glue/*"
            Action:
              - logs:CreateLogStream
              - logs:AssociateKmsKey
              - logs:CreateLogGroup
              - logs:PutLogEvents

  DataAdminPolicy:
    # TODO: Review the below policyDocument permissions and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM5"
    #     reason: "s3:ListAllMyBuckets, s3:GetAccountPublicAccessBlock, s3:ListAccessPoints, and kms:ListAliases are account-level actions that do not support resource-level permissions."
    policyDocument:
      Statement:
        - Sid: BasicS3Access
          Effect: Allow
          Action:
            - s3:ListAllMyBuckets
            - s3:GetAccountPublicAccessBlock
            - s3:GetBucketPublicAccessBlock
            - s3:GetBucketPolicyStatus
            - s3:GetBucketAcl
            - s3:ListAccessPoints
            - s3:GetBucketLocation
          Resource: "*"

        # Allows basic listing of KMS keys (required for up)
        - Sid: BasicKMSAccess
          Effect: Allow
          Action:
            - kms:ListAliases
          Resource: "*"

  DataUserPolicy:
    # TODO: Review the below policyDocument permissions and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM5"
    #     reason: "Glue database/table wildcards are intentional — fine-grained data access is governed by Lake Formation grants, not IAM resource ARNs. lakeformation:GetDataAccess and athena:ListWorkGroups do not support resource-level permissions."
    policyDocument:
      Statement:
        # This statement allows coarse-grained access to Glue catalog resources, but does not itself grant any access to data.
        # Effective permissions are the intersection between IAM Glue Permissions and LF Grants. By establishing broad, coarse-grained permissions here,
        # we are effectively concentrating effective permissions management in LF Grants.
        - SID: GlueCoarseGrainedAccess
          Effect: Allow
          Resource:
            - arn:{{partition}}:glue:{{region}}:{{account}}:catalog
            - arn:{{partition}}:glue:{{region}}:{{account}}:database/*
            - arn:{{partition}}:glue:{{region}}:{{account}}:table/*
          Action:
            - glue:GetDatabase
            - glue:GetDatabases
            - glue:GetCatalogImportStatus
            - glue:GetTable
            - glue:GetTables
            - glue:GetPartition
            - glue:GetPartitions
            - glue:SearchTables

        # This statement allows the usage of LakeFormation, but does not itself grant any access to data.
        # For data access, an explicit LF Grant is required.
        - SID: LakeFormationGetDataAccess
          Effect: Allow
          Action:
            - lakeformation:GetDataAccess
          Resource: "*"

        # This statement allows the basic listing of Athena workgroups
        # Specific Athena accesses are granted by the Athena Workgroup module itself.
        - SID: BasicAthenaAccess
          Effect: Allow
          Action:
            - athena:ListWorkGroups
          Resource: "*"

  DataScienceAdminPolicy:
    # TODO: Review the below policyDocument permissions and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM5"
    #     reason: "SageMaker admin actions (ListUserProfiles, ListDomains, ListApps), iam:ListRoles, license-manager:ListReceivedLicenses, and servicecatalog:ListAcceptedPortfolioShares are account-level actions that do not support resource-level permissions."
    policyDocument:
      Statement:
        # Provides basic SageMaker Studio admin permissions.
        # Suitable for managing user profiles (except for creation, which should be MDAA-managed).
        - Sid: StudioAdminAccess
          Effect: Allow
          Action:
            - sagemaker:ListUserProfiles
            - sagemaker:DescribeUserProfile
            - sagemaker:UpdateUserProfile
            - sagemaker:DeleteUserProfile
            - sagemaker:ListApps
            - sagemaker:DeleteApp
            - sagemaker:DescribeDomain
            - sagemaker:ListDomains
            - sagemaker:GetSagemakerServicecatalogPortfolioStatus
            - license-manager:ListReceivedLicenses
            - servicecatalog:ListAcceptedPortfolioShares
            - servicecatalog:DisassociatePrincipalFromPortfolio
            - iam:ListRoles
            - sagemaker:ListTags
            - sagemaker:AddTags
            - sagemaker:DeleteTags
          Resource: "*"

  DataScienceUserPolicy:
    # TODO: Review the below policyDocument permissions and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM5"
    #     reason: "s3:ListAllMyBuckets, kms:ListAliases, athena:ListWorkGroups/ListDataCatalogs, and sagemaker:CreatePresignedDomainUrl are account-level actions that do not support resource-level permissions. Glue database/table wildcards are scoped to the deployment account and region."
    policyDocument:
      Statement:
        # Provides basic S3 access for interactions via console.
        # Does not provide access to buckets/data
        - Sid: BasicS3Access
          Effect: Allow
          Action:
            - s3:ListAllMyBuckets
            - s3:GetAccountPublicAccessBlock
            - s3:GetBucketPublicAccessBlock
            - s3:GetBucketPolicyStatus
            - s3:GetBucketAcl
            - s3:ListAccessPoints
            - s3:GetBucketLocation
          Resource: "*"

        # Allows basic listing of KMS keys
        - Sid: BasicKMSAccess
          Effect: Allow
          Action:
            - kms:ListAliases
          Resource: "*"

        # Provides readonly access to Glue Catalog resources.
        # Does not provide access to underlying data.
        - Sid: BasicGlueAccess
          Effect: Allow
          Action:
            - glue:GetTable
            - glue:GetTables
            - glue:GetDatabase
            - glue:GetDataBases
            - glue:GetPartitions
            - glue:SearchTables
          Resource:
            - "arn:aws:glue:{{region}}:{{account}}:catalog"
            - "arn:aws:glue:{{region}}:{{account}}:database/*"
            - "arn:aws:glue:{{region}}:{{account}}:table/*"

        # Provides basic Athena access to facilitate
        # interactions via console.
        - Sid: BasicAthenaAccess
          Effect: Allow
          Action:
            - athena:ListWorkGroups
            - athena:ListDataCatalogs
            - athena:ListDatabases
            - athena:ListTableMetadata
            - athena:GetDataCatalog
            - athena:GetDatabase
            - athena:GetTableMetadata
          Resource: "*"

        # Provides users access to launch their own Studio
        # user profile. Each user profile has a 'userid' tag
        # associated which specifies which user owns the profile.
        - Sid: SageMakerLaunchProfileAccess
          Effect: Allow
          Action:
            - sagemaker:CreatePresignedDomainUrl
          Resource: "*"

  TeamExecutionPolicy:
    # TODO: Review the below policyDocument permissions and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM5"
    #     reason: "sagemaker:CreatePresignedDomainUrl requires Resource:* because the team execution role must generate presigned URLs for any user profile in the SageMaker domain."
    policyDocument:
      Statement:
        - Sid: SageMakerExecutionAccess
          Effect: Allow
          Action:
            - sagemaker:CreatePresignedDomainUrl
          Resource: "*"

# The list of roles which will be generated
generateRoles:
  # A data admin role which will be granted admin
  # access to deployed resources.
  glue-etl:
    # TODO: Review the below awsManagedPolicies and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM4"
    #     reason: "AWSGlueServiceRole is required for Glue ETL jobs to access S3, CloudWatch Logs, and EC2 networking for job execution. See https://docs.aws.amazon.com/glue/latest/dg/create-an-iam-role.html"
    trustedPrincipal: service:glue.amazonaws.com
    # A list of AWS managed policies which will be added to the role
    awsManagedPolicies:
      - service-role/AWSGlueServiceRole
    generatedPolicies:
      - GlueJobPolicy

  data-admin:
    # TODO: Review the below awsManagedPolicies and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM4"
    #     reason: "Data-admin role requires AWSGlueConsoleFullAccess for catalog administration, AWSLakeFormationDataAdmin for permission grants, and AWSLakeFormationCrossAccountManager for cross-account data sharing governance."
    trustedPrincipal: this_account
    awsManagedPolicies:
      - AWSGlueConsoleFullAccess
      - AWSLakeFormationDataAdmin
      - AWSLakeFormationCrossAccountManager
    generatedPolicies:
      - DataUserPolicy
      - DataAdminPolicy
      - DataScienceUserPolicy
      - DataScienceAdminPolicy

  data-user:
    trustedPrincipal: this_account
    generatedPolicies:
      - DataUserPolicy
      - DataScienceUserPolicy

  data-scientist:
    trustedPrincipal: this_account
    generatedPolicies:
      - DataScienceUserPolicy

  # A role which will be used to launch SageMaker resources
  # on behalf of data science team members.
  team-execution:
    trustedPrincipal: service:sagemaker.amazonaws.com
    additionalTrustedPrincipals:
      - trustedPrincipal: service:ec2.amazonaws.com
      - trustedPrincipal: service:elasticmapreduce.amazonaws.com
      - trustedPrincipal: service:sagemaker.amazonaws.com
        additionalTrustedActions: ["sts:SetSourceIdentity"]
    generatedPolicies:
      - DataScienceUserPolicy
      - TeamExecutionPolicy