AWSTemplateFormatVersion: "2010-09-09"
Description: >-
  Ankra read-only cross-account role for cloud cost estimation and cluster
  discovery. Grants Ankra least-privilege read access via STS AssumeRole with a
  per-organisation external ID. No long-lived credentials leave your account.

Parameters:
  ExternalId:
    Type: String
    Description: Per-organisation external ID provided by Ankra during setup. Do not change.
    AllowedPattern: "^ankra-[A-Za-z0-9_-]+$"
  AnkraPrincipalArn:
    Type: String
    Description: The Ankra AWS principal allowed to assume this role.
  RoleName:
    Type: String
    Default: AnkraCloudCostReadOnly
    Description: Name of the IAM role to create.

Resources:
  AnkraReadOnlyRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref RoleName
      Description: Read-only access for Ankra cloud cost estimation and cluster discovery.
      MaxSessionDuration: 3600
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Ref AnkraPrincipalArn
            Action: "sts:AssumeRole"
            Condition:
              StringEquals:
                "sts:ExternalId": !Ref ExternalId
      Policies:
        - PolicyName: AnkraCloudCostReadOnly
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Sid: PricingAndInventory
                Effect: Allow
                Action:
                  - "pricing:GetProducts"
                  - "pricing:DescribeServices"
                  - "ec2:DescribeInstanceTypes"
                  - "ec2:DescribeInstanceTypeOfferings"
                  - "ec2:DescribeAvailabilityZones"
                  - "ec2:DescribeRegions"
                  - "ec2:DescribeInstances"
                Resource: "*"
              - Sid: CostExplorer
                Effect: Allow
                Action:
                  - "ce:GetCostAndUsage"
                  - "ce:GetCostForecast"
                Resource: "*"
              - Sid: ClusterDiscovery
                Effect: Allow
                Action:
                  - "eks:ListClusters"
                  - "eks:DescribeCluster"
                  - "sts:GetCallerIdentity"
                Resource: "*"

Outputs:
  RoleArn:
    Description: Paste this Role ARN back into Ankra to finish connecting your AWS account.
    Value: !GetAtt AnkraReadOnlyRole.Arn
  ExternalId:
    Description: The external ID this role is bound to.
    Value: !Ref ExternalId
