# yaml-language-server: $schema=../../../schemas/@aws-mdaa/roles.json
generatePolicies:
  data-admin:
    # TODO: Review the below policyDocument permissions and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM5"
    #     reason: "s3:ListAllMyBuckets, kms:ListAliases, sagemaker:ListDomains, and datazone:ListDomains are account-level actions that do not support resource-level permissions."
    policyDocument:
      Statement:
        - Sid: BasicS3Access
          Effect: Allow
          Action:
            - s3:ListAllMyBuckets
            - s3:GetAccountPublicAccessBlock
            - s3:GetBucketPublicAccessBlock
            - s3:GetBucketPolicyStatus
            - s3:GetBucketAcl
            - s3:ListAccessPoints
            - s3:GetBucketLocation
          Resource: '*'

        # Allows basic listing of KMS keys (required for SMUS)
        - Sid: BasicKMSAccess
          Effect: Allow
          Action:
            - kms:ListAliases
          Resource: '*'

        # Basic SageMaker and DataZone permissions for SMUS domain administration
        - Sid: SMUSAdminAccess
          Effect: Allow
          Action:
            - sagemaker:ListDomains
            - sagemaker:DescribeDomain
            - datazone:ListDomains
            - datazone:GetDomain
            - datazone:ListEnvironmentBlueprints
            - datazone:PutEnvironmentBlueprintConfiguration
          Resource: '*'

  domain-admin:
    # TODO: Review the below policyDocument permissions and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM5"
    #     reason: "DataZone/SageMaker domain management APIs do not support resource-level permissions. iam:PassRole is scoped to SMUS domain roles with iam:PassedToService condition."
    policyDocument:
      Statement:
        # SageMaker Unified Studio domain management permissions
        - Sid: SMUSDomainManagement
          Effect: Allow
          Action:
            - sagemaker:CreateDomain
            - sagemaker:UpdateDomain
            - sagemaker:DeleteDomain
            - sagemaker:DescribeDomain
            - sagemaker:ListDomains
            - datazone:CreateDomain
            - datazone:UpdateDomain
            - datazone:DeleteDomain
            - datazone:GetDomain
            - datazone:ListDomains
          Resource: '*'

        # Project and environment read permissions
        - Sid: SMUSProjectRead
          Effect: Allow
          Action:
            - datazone:ListProjects
            - datazone:GetProject
            - datazone:ListEnvironments
            - datazone:GetEnvironment
            - lakeformation:ListPermissions
          Resource: '*'

        # Destructive project/environment actions — consider requiring additional approval or MFA
        - Sid: SMUSProjectCleanup
          Effect: Allow
          Action:
            - datazone:DeleteProject
            - datazone:DeleteEnvironment
            - lakeformation:RevokePermissions
          Resource: '*'

        # KMS read permissions for domain operations
        - Sid: SMUSKmsRead
          Effect: Allow
          Action:
            - kms:ListAliases
            - kms:DescribeKey
          Resource: '*'

        # iam:PassRole scoped to SMUS domain roles only
        - Sid: SMUSPassRole
          Effect: Allow
          Action:
            - iam:PassRole
          Resource:
            - 'arn:{{partition}}:iam::{{account}}:role/*-execution-role'
            - 'arn:{{partition}}:iam::{{account}}:role/*-provisioning-role'
            - 'arn:{{partition}}:iam::{{account}}:role/service-*'
          Condition:
            StringEquals:
              iam:PassedToService: datazone.amazonaws.com

# The list of roles which will be generated
generateRoles:
  data-admin:
    trustedPrincipal: this_account
    generatedPolicies:
      - data-admin
      - domain-admin