AWSTemplateFormatVersion: '2010-09-09'
Description: Hoogly - Create read-only Cost Audit role (AssumeRole + ExternalId)

Parameters:
  HooglyAccountId:
    Type: String
    Description: Hoogly AWS account ID (the trusted principal)
    AllowedPattern: '^[0-9]{12}$'
  ExternalId:
    Type: String
    Description: ExternalId provided by Hoogly (prevents confused deputy)
    MinLength: 6
    MaxLength: 64
  RoleName:
    Type: String
    Default: HooglyCostRole
    Description: Name of the role Hoogly will assume for cost analysis

Resources:
  HooglyCostRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref RoleName
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${HooglyAccountId}:root
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                sts:ExternalId: !Ref ExternalId
      Policies:
        - PolicyName: HooglyCostAuditReadOnly
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: CostExplorerReadOnly
                Effect: Allow
                Action:
                  - ce:GetCostAndUsage
                  - ce:GetCostAndUsageWithResources
                  - ce:GetCostForecast
                  - ce:GetAnomalies
                  - ce:GetAnomalyMonitors
                  - ce:GetAnomalySubscriptions
                  - ce:GetRightsizingRecommendation
                  - ce:GetSavingsPlansCoverage
                  - ce:GetSavingsPlansUtilization
                  - ce:GetReservationCoverage
                  - ce:GetReservationUtilization
                  - ce:GetDimensionValues
                  - ce:GetTags
                  - ce:ListCostAllocationTags
                  - ce:ListCostCategoryDefinitions
                  - ce:DescribeCostCategoryDefinition
                  - cost-optimization-hub:GetRecommendation
                  - cost-optimization-hub:ListRecommendations
                Resource: "*"
              - Sid: ComputeOptimizerReadOnly
                Effect: Allow
                Action:
                  - compute-optimizer:Get*
                Resource: "*"
              - Sid: CostInventoryReadOnly
                Effect: Allow
                Action:
                  - ec2:DescribeRegions
                  - ec2:DescribeInstances
                  - ec2:DescribeVolumes
                  - ec2:DescribeSnapshots
                  - ec2:DescribeAddresses
                  - ec2:DescribeNatGateways
                  - autoscaling:DescribeAutoScalingGroups
                  - elasticloadbalancing:DescribeLoadBalancers
                  - elasticloadbalancing:DescribeTargetGroups
                  - rds:DescribeDBInstances
                  - rds:DescribeDBClusters
                  - lambda:ListFunctions
                  - lambda:GetFunctionConfiguration
                  - tag:GetResources
                  - tag:GetTagKeys
                  - tag:GetTagValues
                Resource: "*"
              - Sid: IdleResourceMetrics
                Effect: Allow
                Action:
                  - cloudwatch:GetMetricData
                  - cloudwatch:GetMetricStatistics
                  - cloudwatch:ListMetrics
                Resource: "*"
              - Sid: CostGovernanceReadOnly
                Effect: Allow
                Action:
                  - budgets:ViewBudget
                  - cur:DescribeReportDefinitions
                  - s3:ListAllMyBuckets
                  - s3:GetBucketLocation
                  - s3:GetBucketTagging
                  - s3:GetLifecycleConfiguration
                  - s3:ListBucket
                Resource: "*"

Outputs:
  RoleArn:
    Description: Role ARN to paste into Hoogly
    Value: !GetAtt HooglyCostRole.Arn
  ExternalId:
    Description: External ID (for reference) - should match Hoogly
    Value: !Ref ExternalId
