AWSTemplateFormatVersion: "2010-09-09"
Description: "Creates the DrataAutopilotRole cross account role (qs-1hrb8as43)"
Metadata:
    AWS::CloudFormation::Interface:
        ParameterGroups:
        - Label:
            default: Secret name
          Parameters:
            - SecretName
        ParameterLabels:
            SecretName:
                default: Secret name
Parameters:
    SecretName: { Description: Secret Name, Type: String }
Resources:
    CrossAccountDrataRole:
        Type: AWS::IAM::Role
        Properties:
            RoleName: "DrataAutopilotRole"
            AssumeRolePolicyDocument:
                Version: "2012-10-17"
                Statement:
                    - Effect: Allow
                      Principal:
                          AWS:
                              Fn::Sub:
                              - "{{resolve:secretsmanager:${inputParameter}:SecretString:PrincipalARN}}"
                              - inputParameter: 
                                  Ref: SecretName
                      Action: sts:AssumeRole
                      Condition:
                          StringEquals:
                              sts:ExternalId:
                                  Fn::Sub:
                                  - "{{resolve:secretsmanager:${inputParameter}:SecretString:ExternalID}}"
                                  - inputParameter: 
                                      Ref: SecretName
            Path: "/"
            ManagedPolicyArns:
                - !Sub "arn:${AWS::Partition}:iam::aws:policy/SecurityAudit"
            Policies:
                - PolicyName: DrataBackupPolicy
                  PolicyDocument:
                      Version: '2012-10-17'
                      Statement:
                          - Effect: Allow
                            Action:
                                - backup:ListBackupJobs
                                - backup:ListRecoveryPointsByResource
                            Resource: '*'
