{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Create the TrustProof read-only IAM role for an AWS account.",
  "Parameters": {
    "TrustProofPrincipalArn": {
      "Type": "String",
      "Description": "TrustProof's AWS workload role ARN.",
      "AllowedPattern": "^arn:aws:iam::[0-9]{12}:role/.+$",
      "ConstraintDescription": "Enter a TrustProof IAM role ARN."
    },
    "ExternalId": {
      "Type": "String",
      "Description": "The external ID generated for this TrustProof workspace.",
      "MinLength": 2,
      "MaxLength": 1224,
      "AllowedPattern": "^[A-Za-z0-9+=,.@:/_-]+$",
      "ConstraintDescription": "Enter the workspace external ID shown by TrustProof."
    }
  },
  "Resources": {
    "TrustProofReadOnlyRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "RoleName": "TrustProofReadOnlyRole",
        "Description": "Read-only AWS access for TrustProof security checks.",
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "AWS": { "Ref": "TrustProofPrincipalArn" }
              },
              "Action": "sts:AssumeRole",
              "Condition": {
                "StringEquals": {
                  "sts:ExternalId": { "Ref": "ExternalId" }
                }
              }
            }
          ]
        },
        "Policies": [
          {
            "PolicyName": "TrustProofReadOnlyAccess",
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "cloudtrail:DescribeTrails",
                    "cloudtrail:GetTrailStatus",
                    "ec2:DescribeRegions",
                    "ec2:DescribeSecurityGroups",
                    "ec2:DescribeVolumes",
                    "iam:GetAccountPasswordPolicy",
                    "iam:GetAccountSummary",
                    "iam:GetCredentialReport",
                    "iam:GetPolicy",
                    "iam:GetPolicyVersion",
                    "iam:GetGroupPolicy",
                    "iam:GetRolePolicy",
                    "iam:GetUserPolicy",
                    "iam:GenerateCredentialReport",
                    "iam:ListAttachedGroupPolicies",
                    "iam:ListAttachedRolePolicies",
                    "iam:ListAttachedUserPolicies",
                    "iam:ListGroups",
                    "iam:ListGroupPolicies",
                    "iam:ListRoles",
                    "iam:ListRolePolicies",
                    "iam:ListUsers",
                    "iam:ListUserPolicies",
                    "rds:DescribeDBClusters",
                    "rds:DescribeDBInstances",
                    "s3:GetAccountPublicAccessBlock",
                    "s3:GetBucketAcl",
                    "s3:GetEncryptionConfiguration",
                    "s3:GetBucketLocation",
                    "s3:GetBucketPolicyStatus",
                    "s3:GetBucketPublicAccessBlock",
                    "s3:ListAllMyBuckets",
                    "auditmanager:ListAssessments",
                    "auditmanager:GetAssessment",
                    "auditmanager:GetEvidenceFoldersByAssessmentControl",
                    "auditmanager:GetEvidenceByEvidenceFolder",
                    "guardduty:ListDetectors",
                    "guardduty:GetDetector",
                    "guardduty:ListFindings",
                    "guardduty:GetFindings",
                    "cloudtrail:GetEventSelectors",
                    "config:DescribeConfigurationRecorders",
                    "config:DescribeConfigurationRecorderStatus",
                    "ec2:DescribeFlowLogs",
                    "ec2:DescribeSnapshots",
                    "ec2:DescribeVpcs",
                    "elasticloadbalancing:DescribeListeners",
                    "elasticloadbalancing:DescribeLoadBalancers",
                    "kms:DescribeKey",
                    "kms:GetKeyRotationStatus",
                    "kms:ListKeys",
                    "rds:DescribeDBClusterSnapshots",
                    "rds:DescribeDBSnapshots",
                    "s3:GetBucketPolicy",
                    "bedrock:GetModelInvocationLoggingConfiguration",
                    "bedrock:ListAgents",
                    "bedrock:ListCustomModels",
                    "bedrock:ListGuardrails",
                    "bedrock:ListImportedModels",
                    "bedrock:ListInferenceProfiles",
                    "bedrock:ListKnowledgeBases",
                    "bedrock:ListProvisionedModelThroughputs",
                    "sagemaker:ListEndpoints",
                    "sagemaker:ListModels",
                    "access-analyzer:ListAnalyzers",
                    "acm:ListCertificates",
                    "artifact:ListCustomerAgreements",
                    "backup:GetBackupPlan",
                    "backup:ListBackupPlans",
                    "backup:ListBackupVaults",
                    "backup:ListProtectedResources",
                    "cloudfront:ListDistributions",
                    "cloudwatch:DescribeAlarms",
                    "config:DescribeConformancePacks",
                    "dynamodb:DescribeContinuousBackups",
                    "dynamodb:ListTables",
                    "ec2:DescribeVpcEndpoints",
                    "inspector2:BatchGetAccountStatus",
                    "inspector2:ListCoverage",
                    "logs:DescribeLogGroups",
                    "macie2:GetMacieSession",
                    "s3:GetBucketVersioning",
                    "secretsmanager:ListSecrets",
                    "securityhub:DescribeHub",
                    "securityhub:GetEnabledStandards",
                    "shield:GetSubscriptionState",
                    "ssm:DescribeInstanceInformation",
                    "wafv2:ListResourcesForWebACL",
                    "wafv2:ListWebACLs"
                  ],
                  "Resource": "*"
                },
                {
                  "Effect": "Allow",
                  "Action": ["account:GetAlternateContact"],
                  "Resource": {
                    "Fn::Sub": "arn:${AWS::Partition}:account::${AWS::AccountId}:account"
                  },
                  "Condition": {
                    "ForAnyValue:StringEquals": { "account:AlternateContactTypes": ["SECURITY"] }
                  }
                }
              ]
            }
          }
        ]
      }
    }
  }
}