AWSTemplateFormatVersion: '2010-09-09'
Description: |
  Traversal - Bootstrap IAM Role

  Grants Traversal's GitHub Actions (InteractionLabs/infrastructure) permission
  to assume a deployment role in this account. This is the only manual step
  required from the customer — all subsequent infrastructure provisioning is
  handled automatically by Traversal's CI/CD pipeline via this role.

  Deploy time: ~1 minute

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "GitHub Configuration"
        Parameters:
          - GitHubOrg
          - GitHubRepo

Parameters:
  GitHubOrg:
    Type: String
    Default: InteractionLabs
    Description: GitHub organization that will assume this role

  GitHubRepo:
    Type: String
    Default: infrastructure
    Description: GitHub repository that will assume this role

Resources:
  GitHubOidcProvider:
    Type: AWS::IAM::OIDCProvider
    Properties:
      Url: https://token.actions.githubusercontent.com
      ClientIdList:
        - sts.amazonaws.com
      ThumbprintList:
        - 6938fd4d98bab03faadb97b34396831e3780aea1
        - 1c58a3a8518e8759bf075b76b750d4f2df264fcd
      Tags:
        - Key: traversal.com/component
          Value: deploy-bootstrap
        - Key: traversal.com/managed-by
          Value: cloudformation

  TraversalDeployRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: TraversalDeploy
      Description: Allows Traversal GitHub Actions to provision infrastructure via Terraform
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Federated: !GetAtt GitHubOidcProvider.Arn
            Action: sts:AssumeRoleWithWebIdentity
            Condition:
              StringEquals:
                token.actions.githubusercontent.com:aud: sts.amazonaws.com
              StringLike:
                token.actions.githubusercontent.com:sub: !Sub "repo:${GitHubOrg}/${GitHubRepo}:*"
      Policies:
        - PolicyName: TraversalDeployPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Resource: "*"
                Action:
                  - acm:*
                  - apigateway:*
                  - cloudformation:*
                  - autoscaling:*
                  - cloudwatch:*
                  - ec2:*
                  - ecr:*
                  - eks:*
                  - elasticloadbalancing:*
                  - iam:*
                  - kinesis:*
                  - kms:*
                  - lambda:*
                  - logs:*
                  - rds:*
                  - route53:*
                  - s3:*
                  - secretsmanager:*
                  - sqs:*
                  - ssm:*
                  - sts:*
                  - tag:*
      Tags:
        - Key: traversal.com/component
          Value: deploy-bootstrap
        - Key: traversal.com/managed-by
          Value: cloudformation

Outputs:
  RoleArn:
    Description: ARN of the role for Traversal GitHub Actions to assume
    Value: !GetAtt TraversalDeployRole.Arn

  OidcProviderArn:
    Description: ARN of the GitHub Actions OIDC provider
    Value: !GetAtt GitHubOidcProvider.Arn
