AWSTemplateFormatVersion: "2010-09-09"

Description: "InfraSync read-only cross-account role. Creates an IAM role that InfraSync (AWS account 529928147507) can assume via STS, scoped by your per-account External ID, and attaches the AWS-managed ReadOnlyAccess policy. InfraSync never creates, modifies, or deletes your resources."

Parameters:
  ExternalId:
    Type: String
    NoEcho: true
    Description: "The External ID shown in InfraSync for this account. It scopes the trust policy and prevents the confused-deputy problem."
  RoleName:
    Type: String
    Default: "infrasync-readonly-role"
    Description: "Name for the IAM role InfraSync assumes. Paste its ARN into InfraSync when the stack finishes."

Resources:
  InfraSyncReadOnlyRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: !Ref RoleName
      Description: "Read-only role assumed by InfraSync for scanning and cost analysis."
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS: "arn:aws:iam::529928147507:root"
            Action: "sts:AssumeRole"
            Condition:
              StringEquals:
                "sts:ExternalId": !Ref ExternalId
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/ReadOnlyAccess"

Outputs:
  RoleArn:
    Description: "Paste this Role ARN into InfraSync."
    Value: !GetAtt InfraSyncReadOnlyRole.Arn