# yaml-language-server: $schema=../../../schemas/@aws-mdaa/roles.json
generatePolicies:
  FileManagerPolicy:
    # TODO: Review the below policyDocument permissions and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM5"
    #     reason: "DynamoDB table wildcard required because table names are generated dynamically by MDAA and not known at policy authoring time."
    policyDocument:
      Statement:
        - SID: DynamoDBWriter
          Effect: Allow
          Resource:
            - "arn:{{partition}}:dynamodb:{{region}}:{{account}}:table/*"
          Action:
            - dynamodb:PutItem
            - dynamodb:TransactWriteItems
            - dynamodb:DeleteItem
            - dynamodb:GetItem
            - dynamodb:Scan
            - dynamodb:Query
            - dynamodb:UpdateItem

  StepFunctionLogPolicy:
    # TODO: Review the below policyDocument permissions and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM5"
    #     reason: "CloudWatch Logs delivery actions (CreateLogDelivery, ListLogDeliveries, DescribeLogGroups, etc.) are account-level operations that do not support resource-level permissions. See https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudwatchlogs.html"
    policyDocument:
      Statement:
        - SID: GeneralLogging
          Effect: Allow
          Resource:
            - "*"
          Action:
            - logs:CreateLogDelivery
            - logs:GetLogDelivery
            - logs:UpdateLogDelivery
            - logs:DeleteLogDelivery
            - logs:ListLogDeliveries
            - logs:PutResourcePolicy
            - logs:DescribeResourcePolicies
            - logs:DescribeLogGroups
        - SID: LogStreamLogging
          Effect: Allow
          Resource:
            - "arn:{{partition}}:logs:{{region}}:{{account}}:log-group:/aws/stepfunction/*:*"
          Action:
            - logs:CreateLogStream
            - logs:PutLogEvents

  DataOpsGlueJobPolicy:
    # TODO: Review the below policyDocument permissions and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM5"
    #     reason: "Glue job wildcard required because job names are generated dynamically by MDAA and not known at policy authoring time."
    policyDocument:
      Statement:
        - SID: GlueInvoker
          Effect: Allow
          Resource:
            - "arn:{{partition}}:glue:{{region}}:{{account}}:job/*"
          Action:
            - glue:StartJobRun
            - glue:GetJobRun

  BatchGeneratorDdbPolicy:
    # TODO: Review the below policyDocument permissions and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM5"
    #     reason: "DynamoDB table wildcard required because table names are generated dynamically by MDAA and not known at policy authoring time."
    policyDocument:
      Statement:
        - SID: DynamoDBWriter
          Effect: Allow
          Resource:
            - "arn:{{partition}}:dynamodb:{{region}}:{{account}}:table/*"
          Action:
            - dynamodb:GetItem
            - dynamodb:Query

  FileProcessorLambdaPolicy:
    # TODO: Review the below policyDocument permissions and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM5"
    #     reason: "Lambda function wildcard required because function names are generated dynamically by MDAA and not known at policy authoring time."
    policyDocument:
      Statement:
        - SID: LambdaInvoker
          Effect: Allow
          Resource:
            - "arn:{{partition}}:lambda:{{region}}:{{account}}:function:*"
          Action:
            - lambda:InvokeFunction

  FileProcessorLogPolicy:
    # TODO: Review the below policyDocument permissions and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM5"
    #     reason: "CloudWatch Logs delivery actions (CreateLogDelivery, ListLogDeliveries, DescribeLogGroups, etc.) are account-level operations that do not support resource-level permissions. See https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudwatchlogs.html"
    policyDocument:
      Statement:
        - SID: GeneralLogging
          Effect: Allow
          Resource:
            - "*"
          Action:
            - logs:CreateLogDelivery
            - logs:GetLogDelivery
            - logs:UpdateLogDelivery
            - logs:DeleteLogDelivery
            - logs:ListLogDeliveries
            - logs:PutResourcePolicy
            - logs:DescribeResourcePolicies
            - logs:DescribeLogGroups
        - SID: LogStreamLogging
          Effect: Allow
          Resource:
            - "arn:{{partition}}:logs:{{region}}:{{account}}:log-group:/aws/stepfunction/*:*"
          Action:
            - logs:CreateLogStream
            - logs:PutLogEvents


# The list of roles which will be generated
generateRoles:
  file-manager-lambda-role:
    # TODO: Review the below awsManagedPolicies and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM4"
    #     reason: "AWSLambdaBasicExecutionRole provides minimal CloudWatch Logs permissions (CreateLogGroup, CreateLogStream, PutLogEvents) required for Lambda function logging. See https://docs.aws.amazon.com/lambda/latest/dg/lambda-intro-execution-role.html"
    trustedPrincipal: service:lambda.amazonaws.com
    # A list of AWS managed policies which will be added to the role
    awsManagedPolicies:
      - service-role/AWSLambdaBasicExecutionRole
    generatedPolicies:
      - FileManagerPolicy

  file-processor-role:
    trustedPrincipal: service:states.amazonaws.com
    # A list of AWS managed policies which will be added to the role
    generatedPolicies:
      - FileProcessorLambdaPolicy
      - StepFunctionLogPolicy

  transformation-role:
    trustedPrincipal: service:states.amazonaws.com
    # A list of AWS managed policies which will be added to the role
    generatedPolicies:
      - DataOpsGlueJobPolicy
      - StepFunctionLogPolicy

  batch-generator-lambda-role:
    # TODO: Review the below awsManagedPolicies and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM4"
    #     reason: "AWSLambdaBasicExecutionRole provides minimal CloudWatch Logs permissions (CreateLogGroup, CreateLogStream, PutLogEvents) required for Lambda function logging. See https://docs.aws.amazon.com/lambda/latest/dg/lambda-intro-execution-role.html"
    trustedPrincipal: service:lambda.amazonaws.com
    generatedPolicies:
      - BatchGeneratorDdbPolicy
    # A list of AWS managed policies which will be added to the role
    awsManagedPolicies:
      - service-role/AWSLambdaBasicExecutionRole

  file-processor-trigger-lambda-role:
    # TODO: Review the below awsManagedPolicies and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM4"
    #     reason: "AWSLambdaBasicExecutionRole provides minimal CloudWatch Logs permissions (CreateLogGroup, CreateLogStream, PutLogEvents) required for Lambda function logging. See https://docs.aws.amazon.com/lambda/latest/dg/lambda-intro-execution-role.html"
    trustedPrincipal: service:lambda.amazonaws.com
    # A list of AWS managed policies which will be added to the role
    generatedPolicies:
      - DataOpsGlueJobPolicy
    # A list of AWS managed policies which will be added to the role
    awsManagedPolicies:
      - service-role/AWSLambdaBasicExecutionRole