AWSTemplateFormatVersion: '2010-09-09'
Description: CloudFormation template to create an IAM Role with cross-account trust, inline policy, and specific permissions.

Resources:
  IAMRoleWithCrossAccountTrustAndPermissions:
    Type: AWS::IAM::Role
    Properties: 
      RoleName: aws-cloudsanalytics-integration-role
      AssumeRolePolicyDocument: 
        Version: '2012-10-17'
        Statement: 
          - Effect: Allow
            Principal: 
              AWS: "arn:aws:iam::654654634301:root"
            Action: "sts:AssumeRole"
            Condition: 
              StringEquals: 
                "sts:ExternalId": "567567"

      # Attach AWS Managed Policy for ReadOnlyAccess
      ManagedPolicyArns: 
        - arn:aws:iam::aws:policy/ReadOnlyAccess
      
      MaxSessionDuration: 43200

      # Inline policy with specified permissions
      Policies: 
        - PolicyName: aws-cloudsanalytics-integration-policy
          PolicyDocument: 
            Version: '2012-10-17'
            Statement: 
              - Sid: "VisualEditor0"
                Effect: Allow
                Action: 
                  - "rds:StartDBCluster"
                  - "rds:StopDBCluster"
                  - "ec2:StartInstances"
                  - "autoscaling-plans:UpdateScalingPlan"
                  - "rds:StopDBInstance"
                  - "ec2:StopInstances"
                  - "rds:StartDBInstance"
                Resource: "*"

              - Sid: "AllowS3ListBuckets"
                Effect: Allow
                Action: "s3:ListAllMyBuckets"
                Resource: "arn:aws:s3:::*"

              - Sid: "DenyS3ObjectAndBucketAccess"
                Effect: Deny
                Action: 
                  - "s3:ListBucket"
                  - "s3:GetObject"
                  - "s3:PutObject"
                  - "s3:DeleteObject"
                  - "s3:GetBucketAcl"
                  - "s3:PutBucketAcl"
                  - "s3:GetBucketLocation"
                  - "s3:PutBucketPolicy"
                  - "s3:ListBucketVersions"
                  - "s3:PutBucketVersioning"
                Resource: "*"

Outputs:
  IAMRoleArn:
    Description: "The ARN of the created IAM role"
    Value: !GetAtt IAMRoleWithCrossAccountTrustAndPermissions.Arn

  AccountId:
    Description: "The AWS Account ID where the stack is deployed"
    Value: !Sub "${AWS::AccountId}"
