# NOTE: This file is mirrored between infra/aws-customer-template.yml (source) and
# frontend/assets/integrations/aws/cloudformation.yml (served by Netlify CDN).
# Edit one; copy to the other. Plan 35-08 documents the duplication contract.
#
# Phase 35: customer-side CloudFormation template for the Polara AWS connector.
# Creates a read-only IAM role (PolaraEvidenceCollectorTrust) that Polara assumes
# via STS to collect SOC 2 evidence. Delete this stack to fully revoke at the
# AWS layer.

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Polara SOC 2 Evidence Collector — read-only IAM role for SOC 2 evidence collection. https://polaralabs.com/integrations/aws'

Parameters:
  PolaraAccountId:
    Type: String
    Default: '081056822971'
    Description: 'Polara AWS account ID. Do not change unless instructed by Polara support.'
    AllowedPattern: '^[0-9]{12}$'
  ExternalId:
    Type: String
    Description: 'Paste the ExternalId from your Polara dashboard. Required for security — do not share this value.'
    MinLength: 1
    NoEcho: true

Resources:
  PolaraEvidenceCollectorTrust:
    Type: AWS::IAM::Role
    Properties:
      RoleName: PolaraEvidenceCollectorTrust
      Description: 'Allows Polara to read SOC 2 evidence from this account. Read-only via AWS-managed SecurityAudit + ViewOnlyAccess policies.'
      MaxSessionDuration: 3600
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::${PolaraAccountId}:role/PolaraEvidenceCollector'
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                'sts:ExternalId': !Ref ExternalId
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/SecurityAudit
        - arn:aws:iam::aws:policy/job-function/ViewOnlyAccess
      Tags:
        - Key: project
          Value: polara
        - Key: managed-by
          Value: cloudformation

Outputs:
  RoleArn:
    Description: 'Paste this ARN back into Polara to complete the connection.'
    Value: !GetAtt PolaraEvidenceCollectorTrust.Arn