# (c) 2019 Amazon Web Services, Inc. or its affiliates. All Rights Reserved. 
# This AWS Content is provided subject to the terms of the AWS Customer 
# Agreement available at https://aws.amazon.com/agreement or other written 
# agreement between Customer and Amazon Web Services, Inc. 
AWSTemplateFormatVersion: "2010-09-09" 
Description: This template attaches a policy to the user requiring cross account read-only access that enables them to assume the role in another account. Should be deployed in the account requiring cross account access
##################################################### 
# 
# Metadata 
# 
##################################################### 


##################################################### 
# 
# Parameters 
# 
##################################################### 
Parameters: 

  pRoleName: 
    Type: String  
    Description: S3 Access Point role Name.
    Default: S3AccessPointRole  

  pAccountID: 
    Type: String  
    Description: Account ID of account to be accessed. 

  pUsername: 
    Type: String  
    Description: User name of  admin.
    Default: auditadmin

  pPassword: 
    Type: String  
    Description: Password of  admin.
    NoEcho: true
  
  pPolicyName:
    Type: String  
    Description: policy name for admin user.
    Default: audit-admin-policy
  
    
##################################################### 
# 
# Resources 
# 
##################################################### 
Resources: 

  rS3AdminUser:  
    Type: 'AWS::IAM::User'  
    Properties:  
      UserName: !Ref pUsername
      LoginProfile:
        Password: !Ref pPassword
        PasswordResetRequired: false
      Policies:
        - PolicyDocument:
            Version: '2012-10-17'
            Statement:
              Effect: Allow
              Action: sts:AssumeRole
              Resource: !Sub "arn:aws:iam::${pAccountID}:role/${pRoleName}"
          PolicyName: !Ref pPolicyName
