---
AWSTemplateFormatVersion: 2010-09-09
Description: 'Lambda resources'


Parameters:
  NameTag:
    Type: String


Resources:
  VPCPeeringRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: 'VPCPeeringRole'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            AWS:
            - !Sub '${AWS::AccountId}'
          Action: sts:AssumeRole
      Path: '/'
      ManagedPolicyArns:
      - !Sub 'arn:${AWS::Partition}:iam::aws:policy/ReadOnlyAccess'
      Policies:
      - PolicyName: AmazonEC2Policy
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - 'ec2:AcceptVpcPeeringConnection'
            - 'ec2:CreateRoute'
            - 'ec2:Deleteroute'
            - 'ec2:CreateTags'
            - 'ec2:DeleteTags'
            - 'ec2:RevokeSecurityGroup*'
            - 'ec2:UpdateSecurityGroup*'
            - 'ec2:AuthorizeSecurityGroup*'
            Resource: '*'

  CustomResourceLambdaRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: 'sts:AssumeRole'
            Principal:
              Service: lambda.amazonaws.com
      ManagedPolicyArns:
      - !Sub 'arn:${AWS::Partition}:iam::aws:policy/ReadOnlyAccess'
      - !Sub 'arn:${AWS::Partition}:iam::aws:policy/AWSBackupAdminPolicy'
      Policies:
      - PolicyName: AmazonPCAPolicy
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action: 'acm-pca:*'
            Resource: '*'
      - PolicyName: AmazonBackupPolicy
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action: 'iam:PassRole'
            Resource: !Sub 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/service-role/AWSBackupDefaultServiceRole'
      - PolicyName: AmazonCloudWatchPolicy
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - 'logs:CreateLogGroup'
            - 'logs:CreateLogStream'
            - 'logs:PutLogEvents'
            Resource: !Sub 'arn:${AWS::Partition}:logs:*:*:*'
      - PolicyName: AmazonEC2Policy
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - 'ec2:*ClientVpn*'
            Resource: '*'
      - PolicyName: AmazonCognitoPolicy
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - 'cognito-idp:*UserPool*'
            - 'cognito-idp:*ResourceServer'
            - 'cognito-idp:*IdentityProvider'
            Resource: '*'
      - PolicyName: AmazonSTSPolicy
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - 'sts:AssumeRole'
            - 'sts:PassRole'
            Resource:
            - !Sub 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/VPCPeeringRole'

  CustomResourceLambda:
    Type: 'AWS::Lambda::Function'
    Properties:
      FunctionName: 'generic-custom-resource-provider'
      Handler: generic_provider.lambda_handler
      Code: 'generic_provider/build'
      Runtime: python3.7
      Role: !Sub '${CustomResourceLambdaRole.Arn}'
      Description: 'CloudFormation custom generic resource provider.'
      Timeout: 900
      Environment:
        # debug, set to 0 or remove in production
        Variables:
          VERBOSE: 1
      Tags:
      - Key: Name
        Value: !Sub '${NameTag}'


Outputs:
  StackName:
    Value: !Sub '${AWS::StackName}'
    Export:
      Name: !Sub 'StackName-${AWS::StackName}'
  CustomResourceLambdaArn:
    Value: !Sub '${CustomResourceLambda.Arn}'
    Export:
      Name: !Sub 'CustomResourceLambdaArn-${AWS::StackName}'