{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Outputs": {
    "AikidoRoleArn": {
      "Value": {
        "Fn::GetAtt": ["AikidoSecurityRole", "Arn"]
      }
    }
  },
  "Parameters": {
    "ExternalId": {
      "Type": "String"
    }
  },
  "Resources": {
    "AikidoSecurityAuditPolicy": {
      "Type": "AWS::IAM::ManagedPolicy",
      "Properties": {
        "Description": "Aikido Security Audit Policy",
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "backup:ListBackupPlans",
                "backup:GetBackupPlan",
                "backup:ListProtectedResources",
                "batch:DescribeJobQueues",
                "budgets:ViewBudget",
                "ec2:GetSnapshotBlockPublicAccessState",
                "ec2:GetLaunchTemplateData",
                "ec2:GetEbsEncryptionByDefault",
                "eks:DescribeNodegroup",
                "eks:DescribeAddon",
                "eks:DescribeAddonConfiguration",
                "eks:DescribeIdentityProviderConfig",
                "eks:DescribePodIdentityAssociation",
                "lambda:GetFunction",
                "lambda:GetFunctionUrlConfig",
                "scheduler:GetSchedule",
                "scheduler:ListSchedules"
              ],
              "Resource": "*"
            },
            {
              "Effect": "Deny",
              "Action": ["rds:DownloadDBLogFilePortion"],
              "Resource": "*"
            }
          ]
        }
      }
    },
    "AikidoSecurityRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "AWS": "arn:aws:iam::881830977366:role/service-role/lambda-aws-cloud-findings-role-uox26vzd"
              },
              "Action": "sts:AssumeRole",
              "Condition": {
                "StringEquals": {
                  "sts:ExternalId": {
                    "Ref": "ExternalId"
                  }
                }
              }
            }
          ]
        },
        "ManagedPolicyArns": [
          "arn:aws:iam::aws:policy/SecurityAudit",
          {
            "Ref": "AikidoSecurityAuditPolicy"
          }
        ]
      }
    }
  }
}