AWSTemplateFormatVersion: 2010-09-09
Resources:
  SkySaverSolutionsIAM:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: 'SkySaverScheduler'
      Path: "/"
      Policies:
      - PolicyName: MonitorPermissions
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
          - Effect: "Allow"
            Sid: "lambdapermissions"
            Resource:
            - "*"
            Action:
            - "lambda:ListFunctions"
            - "lambda:ListTags"
            - "lambda:GetFunctionConcurrency"
            - "lambda:GetProvisionedConcurrencyConfig"
            - "lambda:ListVersionsByFunction"
            - "lambda:PutFunctionConcurrency"
            - "lambda:DeleteFunctionConcurrency"
            - "lambda:ListProvisionedConcurrencyConfigs"
            - "lambda:PutProvisionedConcurrencyConfig"
          - Effect: "Allow"
            Sid: "ec2permissions"
            Resource:
            - "*"
            Action:
            - "ec2:StartInstances"
            - "ec2:StopInstances"
            - "ec2:DescribeInstances"
            - "ec2:ModifyInstanceAttribute"
          - Effect: "Allow"
            Sid: "asgpermissions"
            Resource:
            - "*"
            Action:
            - "autoscaling:DescribeAutoScalingGroups"
            - "autoscaling:DescribeTags"
            - "autoscaling:UpdateAutoScalingGroup"
          - Effect: "Allow"
            Sid: "rdspermissions"
            Resource:
            - "*"
            Action:
            - "rds:DescribeDBClusters"
            - "rds:DescribeDBInstances"
            - "rds:StopDBCluster"
            - "rds:StopDBInstance"
            - "rds:StartDBInstance"
            - "rds:StartDBCluster"
            - "rds:ModifyDBCluster"
            - "rds:ModifyDBInstance"
          - Effect: "Allow"
            Sid: "taggingperms"
            Resource:
            - "*"
            Action:
            - "tag:GetResources"
          - Effect: "Allow"
            Sid: "s3curpermissions"
            Resource:
            - "*"
            Action:
            - "s3:ListBucket"
            - "s3:GetObject"
            - "s3:GetBucketLocation"
          - Effect: "Allow"
            Sid: "costexplorerpermissions"
            Resource:
            - "*"
            Action:
            - "ce:GetRightsizingRecommendation"
            - "ce:GetCostAndUsage"
            - "ce:GetSavingsPlansPurchaseRecommendation"
            - "ce:GetReservationPurchaseRecommendation"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Effect: "Allow"
          Principal:
            AWS: "arn:aws:iam::975050237171:root"
          Action:
          - "sts:AssumeRole"
          Condition:
            StringEquals:
              sts:ExternalId:
              - "<Your External ID you can find at /project/defaults>"