AWSTemplateFormatVersion: 2010-09-09

Description: Autoscaling and worker IAM roles

Parameters:
  AssumeRoleARN:
    Type: String

Resources:
  WorkerRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: ValohaiWorkerRole
      AssumeRolePolicyDocument: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":["ec2.amazonaws.com"]},"Action":["sts:AssumeRole"]}]}
      Tags:
        - Key: valohai
          Value: "1"

  WorkerPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: ValohaiWorkerPolicy
      Roles:
        - !Ref WorkerRole
      PolicyDocument: {"Version":"2012-10-17","Statement":[{"Sid":"1","Effect":"Allow","Action":"autoscaling:SetInstanceProtection","Resource":"*"},{"Sid":"2","Effect":"Allow","Action":"ec2:DescribeInstances","Resource":"*"}]}

  WorkerInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      InstanceProfileName: ValohaiWorkerInstanceProfile
      Roles:
        - !Ref WorkerRole

  ValohaiMasterRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: ValohaiMaster
      AssumeRolePolicyDocument: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":{"Ref":AssumeRoleARN}},"Action":"sts:AssumeRole","Condition":{}}]}
      Tags:
        - Key: valohai
          Value: "1"

  ValohaiMasterPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: ValohaiMasterPolicy
      Roles:
        - !Ref ValohaiMasterRole
      PolicyDocument: {"Version":"2012-10-17","Statement":[{"Sid":"2","Effect":"Allow","Action":["ec2:DescribeInstances","ec2:DescribeVpcs","ec2:DescribeKeyPairs","ec2:DescribeImages","ec2:DescribeSecurityGroups","ec2:DescribeSubnets","ec2:DescribeInstanceTypes","ec2:DescribeLaunchTemplates","ec2:DescribeLaunchTemplateVersions","ec2:DescribeInstanceAttribute", "ec2:DescribeInternetGateways", "ec2:DescribeRouteTables", "ec2:CreateTags","autoscaling:DescribeAutoScalingGroups","autoscaling:DescribeScalingActivities"],"Resource":"*"},{"Sid":"AllowUpdatingSpotLaunchTemplates","Effect":"Allow","Action":["ec2:CreateLaunchTemplate","ec2:CreateLaunchTemplateVersion","ec2:ModifyLaunchTemplate","ec2:RunInstances", "ec2:RebootInstances","autoscaling:UpdateAutoScalingGroup","autoscaling:CreateOrUpdateTags","autoscaling:SetDesiredCapacity","autoscaling:CreateAutoScalingGroup"],"Resource":"*","Condition":{"ForAllValues:StringEquals":{"aws:ResourceTag/Valohai":"1"}}},{"Sid":"ServiceLinkedRole","Effect":"Allow","Action":"iam:CreateServiceLinkedRole","Resource":"arn:aws:iam::*:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling"},{"Sid":"4","Effect":"Allow","Action":["iam:PassRole","iam:GetRole"],"Resource":{"Fn::GetAtt":"WorkerRole.Arn"}},{"Sid":0,"Effect":"Allow","Condition":{"StringEquals":{"secretsmanager:ResourceTag/valohai":"1"}},"Action":["secretsmanager:GetResourcePolicy","secretsmanager:GetSecretValue","secretsmanager:DescribeSecret","secretsmanager:ListSecretVersionIds"],"Resource":"*"},{"Action":"secretsmanager:GetRandomPassword","Resource":"*","Effect":"Allow","Sid":"1"}]}

  QueueRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: ValohaiQueueRole
      AssumeRolePolicyDocument: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":["ec2.amazonaws.com"]},"Action":["sts:AssumeRole"]}]}
      Tags:
        - Key: valohai
          Value: "1"

  QueuePolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: ValohaiQueuePolicy
      Roles:
        - !Ref QueueRole
      PolicyDocument: {"Version":"2012-10-17","Statement":[{"Sid":"0","Effect":"Allow","Action":["secretsmanager:GetResourcePolicy","secretsmanager:GetSecretValue","secretsmanager:DescribeSecret","secretsmanager:ListSecretVersionIds"],"Resource":"*","Condition":{"StringEquals":{"secretsmanager:ResourceTag/valohai":"1"}}},{"Sid":"1","Effect":"Allow","Action":"secretsmanager:GetRandomPassword","Resource":"*"}]}

  QueueInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      InstanceProfileName: ValohaiQueueInstanceProfile
      Roles:
        - !Ref QueueRole

Outputs:
  ValohaiMasterRoleARN:
    Value: !GetAtt ValohaiMasterRole.Arn
