aws-resources.yaml

---
AWSTemplateFormatVersion: "2010-09-09"
Conditions:
  EnableSecretsManagerCondition:
    Fn::Equals:
      - Ref: EnableSecretsManager
      - "True"
  PackerIAMRoleCondition:
    Fn::Equals:
      - Ref: CreatePackerIAMRole
      - "True"
  PackerBucketCondition:
    Fn::Equals:
      - Ref: CreatePackerBucket
      - "True"

Description: Create Instance Profile for running Packer AEM
Parameters:
  PackerAemS3Bucket:
    Type: String
    Description: Name of the S3 Bucket where the artifacts are to be stored
  StackPrefix:
    Description: Used to Namespace the Exported Resources
    Type: String
  EnableSecretsManager:
    Description: Toggle creating an AWS Secrets Manager secret (true/false)
    Type: String
  CreatePackerBucket:
    Description: Toggle creating an S3 Bucket for Packer AEM (true/false)
    Type: String
  CreatePackerIAMRole:
    Description: Toggle creating a Packer IAM role/instance profile (true/false)
    Default: "true"
    Type: String

Resources:
  PackerAemArtefactBucket:
    Type: AWS::S3::Bucket
    Condition: PackerBucketCondition
    Properties:
      BucketName:
        Ref: PackerAemS3Bucket
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256

  SecretsManagerAemCertificateKey:
    Type: AWS::SecretsManager::Secret
    Condition: EnableSecretsManagerCondition
    Properties:
      Description:
        Fn::Join: ['', ['The Private Key used for TLS on ELBs and AEM OpenCloud for: ', Ref: 'StackPrefix']]
      SecretString: "overwrite-me"
      Name:
        # Workaround for bug where delimiter does not apply and triggers an invalid QDN on cloudformation.
        Fn::Join: ['/', ['aem-opencloud', Ref: 'StackPrefix', 'certificate-key']]

  PackerAemBucketPolicy:
    Type: AWS::IAM::Policy
    Condition: PackerIAMRoleCondition
    Properties:
      PolicyDocument:
        Statement:
        - Action: ['s3:GetObject', 's3:ListBucket']
          Effect: Allow
          Resource:
          - Fn::Join: ['', ['arn:aws:s3:::', Ref: 'PackerAemS3Bucket']]
      PolicyName: PackerAemBucketPolicy
      Roles: [Ref: 'PackerAemRole']

  PackerAemRole:
    Type: AWS::IAM::Role
    Condition: PackerIAMRoleCondition
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: PackerAemRolePolicy
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - acm:GetCertificate
                  - ec2:AttachVolume
                  - ec2:AuthorizeSecurityGroupIngress
                  - ec2:CopyImage
                  - ec2:CreateImage
                  - ec2:CreateKeypair
                  - ec2:CreateSecurityGroup
                  - ec2:CreateSnapshot
                  - ec2:CreateTags
                  - ec2:CreateVolume
                  - ec2:DeleteKeypair
                  - ec2:DeleteSecurityGroup
                  - ec2:DeleteSnapshot
                  - ec2:DeleteVolume
                  - ec2:DeregisterImage
                  - ec2:DescribeImageAttribute
                  - ec2:DescribeImages
                  - ec2:DescribeInstances
                  - ec2:DescribeRegions
                  - ec2:DescribeSecurityGroups
                  - ec2:DescribeSnapshots
                  - ec2:DescribeSubnets
                  - ec2:DescribeTags
                  - ec2:DescribeVolumes
                  - ec2:DetachVolume
                  - ec2:GetPasswordData
                  - ec2:ModifyImageAttribute
                  - ec2:ModifyInstanceAttribute
                  - ec2:ModifySnapshotAttribute
                  - ec2:RegisterImage
                  - ec2:RunInstances
                  - ec2:StopInstances
                  - ec2:TerminateInstances
                  - iam:GetServerCertificate
                  - iam:PassRole
                  - kms:Decrypt
                  - secretsmanager:GetSecretValue
                  - ssm:GetParameterHistory
                  - ssm:GetParametersByPath
                  - ssm:GetParameters
                  - ssm:GetParameter
                Resource: "*"
              - Effect: Allow
                Action:
                  - s3:*
                Resource: "*"
              - Effect: Allow
                Action:
                  - logs:*
                Resource:
                  - arn:aws:logs:*:*:*

  PackerAemInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Condition: PackerIAMRoleCondition
    Properties:
      Path: /
      Roles:
        - Ref: PackerAemRole