AWSTemplateFormatVersion: '2010-09-09'
Description: OpsGlance read-only IAM user. Creates a dedicated user with the OpsGlance read-only policy and an access key pair. The app stores the keys in the device Keychain only.

Parameters:
  UserName:
    Type: String
    Default: opsglance-readonly
    Description: Name for the dedicated IAM user

Resources:
  OpsGlanceUser:
    Type: AWS::IAM::User
    Properties:
      UserName: !Ref UserName
      Policies:
        - PolicyName: OpsGlanceReadOnly
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: OpsGlanceReadOnly
                Effect: Allow
                Action:
                  - cloudwatch:DescribeAlarms
                  - cloudwatch:DescribeAlarmHistory
                  - cloudwatch:GetMetricData
                  - cloudwatch:ListMetrics
                  - elasticbeanstalk:DescribeEnvironments
                  - elasticbeanstalk:DescribeEnvironmentHealth
                  - elasticbeanstalk:DescribeEvents
                  - elasticbeanstalk:DescribeApplications
                  - codepipeline:ListPipelines
                  - codepipeline:GetPipeline
                  - codepipeline:GetPipelineState
                  - codepipeline:ListPipelineExecutions
                  # Pre-granted for the v1.1 EC2 card so existing stacks
                  # will not need a policy bump when it ships.
                  - ec2:DescribeInstances
                  - ec2:DescribeInstanceStatus
                  # Pre-granted July 2026 for the v1.2 alarm-free coverage
                  # release (RDS, load balancers, certs, ECS, SQS, Lambda,
                  # DynamoDB) - all reads, no stack update needed at v1.2.
                  - rds:DescribeDBInstances
                  - elasticloadbalancing:DescribeLoadBalancers
                  - elasticloadbalancing:DescribeTargetGroups
                  - elasticloadbalancing:DescribeTargetHealth
                  - acm:ListCertificates
                  - acm:DescribeCertificate
                  - ecs:ListClusters
                  - ecs:ListServices
                  - ecs:DescribeServices
                  - sqs:ListQueues
                  - sqs:GetQueueAttributes
                  - lambda:ListFunctions
                  - dynamodb:ListTables
                  - ses:GetSendStatistics
                  - ses:GetSendQuota
                  # SESv2 GetAccount authorizes as ses:GetAccount, NOT
                  # sesv2:GetAccount (v2 shares the ses: IAM namespace).
                  - ses:GetAccount
                  - ce:GetCostAndUsage
                  - ce:GetCostForecast
                  # Pre-granted for cost anomaly alerts (backlog spec).
                  - ce:GetAnomalies
                  - ce:GetAnomalyMonitors
                  - sts:GetCallerIdentity
                Resource: '*'

  OpsGlanceAccessKey:
    Type: AWS::IAM::AccessKey
    Properties:
      UserName: !Ref OpsGlanceUser

Outputs:
  AccessKeyId:
    Description: Paste into OpsGlance as the access key ID
    Value: !Ref OpsGlanceAccessKey
  SecretAccessKey:
    Description: Paste into OpsGlance as the secret access key. Shown only here; treat like a password.
    Value: !GetAtt OpsGlanceAccessKey.SecretAccessKey
