AWSTemplateFormatVersion: 2010-09-09
Description: Illumio AWS Integration
Parameters:
  IAMRoleName:
    Description: Use the same IAMRoleName when onboarding aws to cloudsecure.
    Type: String
    Default: IllumioCloudIntegrationRole
    MinLength: 1
    ConstraintDescription: "IAMRoleName cannot be empty"

Resources:
  IllumioCloudAWSIntegrationPolicy:
    Type: "AWS::IAM::Policy"
    Properties:
      Roles:
        - !Ref IAMRoleName
      PolicyName: IllumioCloudAWSIntegrationPolicy
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Resource: "*"
            Action:
              - "apigateway:GET"
              - "autoscaling:Describe*"
              - "cloudtrail:DescribeTrails"
              - "cloudtrail:GetTrailStatus"
              - "cloudtrail:LookupEvents"
              - "cloudwatch:Describe*"
              - "cloudwatch:Get*"
              - "cloudwatch:List*"
              - "codedeploy:List*"
              - "codedeploy:BatchGet*"
              - "directconnect:Describe*"
              - "docdb-elastic:GetCluster"
              - "docdb-elastic:ListTagsForResource"
              - "dynamodb:List*"
              - "dynamodb:Describe*"
              - "ec2:Describe*"
              - "ec2:SearchTransitGatewayMulticastGroups"
              - "ecs:Describe*"
              - "ecs:List*"
              - "eks:DescribeAddon"
              - "eks:ListAddons"
              - "elasticache:Describe*"
              - "elasticache:List*"
              - "elasticfilesystem:DescribeAccessPoints"
              - "elasticfilesystem:DescribeFileSystems"
              - "elasticfilesystem:DescribeTags"
              - "elasticloadbalancing:Describe*"
              - "elasticmapreduce:List*"
              - "elasticmapreduce:Describe*"
              - "es:ListTags"
              - "es:ListDomainNames"
              - "es:DescribeElasticsearchDomains"
              - "fsx:DescribeFileSystems"
              - "fsx:ListTagsForResource"
              - "health:DescribeEvents"
              - "health:DescribeEventDetails"
              - "health:DescribeAffectedEntities"
              - "kinesis:List*"
              - "kinesis:Describe*"
              - "lambda:GetPolicy"
              - "lambda:List*"
              - "logs:TestMetricFilter"
              - "logs:DescribeSubscriptionFilters"
              - "organizations:Describe*"
              - "organizations:List*"
              - "rds:Describe*"
              - "rds:List*"
              - "redshift:DescribeClusters"
              - "redshift:DescribeLoggingStatus"
              - "route53:List*"
              - "s3:GetBucketLogging"
              - "s3:GetBucketLocation"
              - "s3:GetBucketNotification"
              - "s3:GetBucketTagging"
              - "s3:ListAllMyBuckets"
              - "sns:List*"
              - "sqs:ListQueues"
              - "states:ListStateMachines"
              - "states:DescribeStateMachine"
              - "support:DescribeTrustedAdvisor*"
              - "support:RefreshTrustedAdvisorCheck"
              - "tag:GetResources"
              - "tag:GetTagKeys"
              - "tag:GetTagValues"
              - "xray:BatchGetTraces"
              - "xray:GetTraceSummaries"
              - "networkmanager:ListCoreNetworks"
              - "networkmanager:GetCoreNetwork"
              - "networkmanager:ListAttachments"
              - "networkmanager:GetVpcAttachment"
              - "networkmanager:GetSiteToSiteVpnAttachment"
              - "networkmanager:GetConnectAttachment"
              - "networkmanager:GetTransitGatewayRouteTableAttachment"
              - "networkmanager:ListPeerings"
              - "networkmanager:GetTransitGatewayPeering"
              - "networkmanager:GetTransitGatewayRegistrations"
              - "memorydb:ListTagsForResource"
