AWSTemplateFormatVersion: '2010-09-09'
Resources:
  PCCAgentlessAppFirewallUserToGroupAddition:
    Type: AWS::IAM::UserToGroupAddition
    Properties:
      GroupName:
        Ref: PCCAgentlessAppFirewallGroup
      Users:
        - USER
    DependsOn:
      - PCCAgentlessAppFirewallGroup
  PCCAgentlessAppFirewallGroup:
    Type: AWS::IAM::Group
    Properties:
      Policies:
        - PolicyName: PCCAgentlessAppFirewallAutoScalingPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: PCCAgentlessAppFirewallAutoScalingView
                Effect: Allow
                Action:
                  - autoscaling:DescribeAutoScalingGroups
                  - autoscaling:DescribeAutoScalingInstances
                  - autoscaling:DescribeScalingActivities
                  - autoscaling:DescribePolicies
                  - autoscaling:DescribeLaunchConfigurations
                  - ec2:DescribeLaunchTemplates
                  - ec2:DescribeLaunchTemplateVersions
                Resource: '*'
              - Sid: PCCAgentlessAppFirewallAutoScalingCreate
                Effect: Allow
                Action:
                  - cloudformation:CreateResource
                  - autoscaling:CreateLaunchConfiguration
                  - autoscaling:CreateAutoScalingGroup
                  - ec2:CreateLaunchTemplate
                  - ec2:CreateLaunchTemplateVersion
                Resource: '*'
              - Sid: PCCAgentlessAppFirewallAutoScalingModify
                Effect: Allow
                Action:
                  - cloudformation:UpdateResource
                  - autoscaling:DeletePolicy
                  - autoscaling:PutScalingPolicy
                  - autoscaling:UpdateAutoScalingGroup
                  - autoscaling:CompleteLifecycleAction
                  - autoscaling:DeleteLaunchConfiguration
                  - autoscaling:DeleteAutoScalingGroup
                  - autoscaling:DeleteLifecycleHook
                  - ec2:DeleteLaunchTemplate
                Resource: '*'
                Condition:
                  StringEquals:
                    aws:ResourceTag/created-by: prismacloud-vpc-traffic-mirroring
              - Sid: PCCAgentlessAppFirewallAutoScalingELBv2
                Effect: Allow
                Action:
                  - elasticloadbalancing:DeregisterTargets
                  - elasticloadbalancing:ModifyTargetGroup
                Resource: '*'
                Condition:
                  StringEquals:
                    elasticloadbalancing:ResourceTag/created-by: prismacloud-vpc-traffic-mirroring
              - Sid: PCCAgentlessAppFirewallAutoScalingRole
                Effect: Allow
                Action: iam:PassRole
                Resource: arn:aws:iam::*:role/*PCCAgentless*
        - PolicyName: PCCAgentlessAppFirewallPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: PCCAgentlessAppFirewall
                Effect: Allow
                Action:
                  - cloudformation:DescribeStacks
                  - cloudformation:DescribeStackResources
                  - cloudformation:CreateStack
                  - cloudformation:TagResource
                  - cloudformation:UntagResource
                  - ec2:DescribeSecurityGroups
                  - ec2:DescribeSecurityGroupRules
                  - ec2:DescribeInstances
                  - ec2:DescribeNetworkInterfaces
                  - ec2:DescribeVpcs
                  - ec2:DescribeSubnets
                  - ec2:DescribeTrafficMirrorTargets
                  - ec2:DescribeTrafficMirrorFilters
                  - ec2:DescribeTrafficMirrorSessions
                  - ec2:DescribeTags
                  - ec2:CreateSecurityGroup
                  - ec2:AuthorizeSecurityGroupIngress
                  - ec2:CreateNetworkInterface
                  - ec2:RunInstances
                  - ec2:CreateTrafficMirrorTarget
                  - ec2:CreateTrafficMirrorFilter
                  - ec2:CreateTrafficMirrorFilterRule
                  - ec2:CreateTrafficMirrorSession
                  - ec2:CreateTags
                  - elasticloadbalancing:DescribeLoadBalancers
                  - elasticloadbalancing:CreateLoadBalancer
                  - elasticloadbalancing:DescribeListeners
                  - elasticloadbalancing:CreateListener
                  - elasticloadbalancing:DescribeTargetGroups
                  - elasticloadbalancing:CreateTargetGroup
                  - elasticloadbalancing:RegisterTargets
                  - elasticloadbalancing:DescribeTargetHealth
                  - elasticloadbalancing:AddTags
                Resource: '*'
              - Sid: PCCAgentlessAppFirewallModify
                Effect: Allow
                Action:
                  - cloudformation:DeleteStack
                  - cloudformation:UpdateStack
                  - ec2:DeleteSecurityGroup
                  - ec2:ModifySecurityGroupRules
                  - ec2:AuthorizeSecurityGroupIngress
                  - ec2:RevokeSecurityGroupIngress
                  - ec2:TerminateInstances
                  - ec2:StartInstances
                  - ec2:StopInstances
                  - ec2:ModifyInstanceAttribute
                  - ec2:ModifyTrafficMirrorSession
                  - ec2:DeleteNetworkInterface
                  - ec2:DeleteTrafficMirrorTarget
                  - ec2:DeleteTrafficMirrorFilter
                  - ec2:DeleteTrafficMirrorSession
                  - ec2:DeleteTags
                Resource:
                  - arn:aws:cloudformation:*:*:stack/*/*
                  - arn:aws:ec2:*:*:security-group/*
                  - arn:aws:ec2:*:*:instance/*
                  - arn:aws:ec2:*:*:network-interface/*
                  - arn:aws:ec2:*:*:traffic-mirror-target/*
                  - arn:aws:ec2:*:*:traffic-mirror-filter/*
                  - arn:aws:ec2:*:*:traffic-mirror-session/*
                Condition:
                  StringEquals:
                    aws:ResourceTag/created-by: prismacloud-vpc-traffic-mirroring
              - Sid: PCCAgentlessAppFirewallTrafficMirrorinFilterRule
                Effect: Allow
                Action: ec2:DeleteTrafficMirrorFilterRule
                Resource: '*'
              - Sid: PCCAgentlessAppFirewallModifyELB
                Effect: Allow
                Action: elasticloadbalancing:DeleteLoadBalancer
                Resource: arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*
                Condition:
                  StringEquals:
                    elasticloadbalancing:ResourceTag/created-by: prismacloud-vpc-traffic-mirroring
              - Sid: PCCAgentlessAppFirewallModifyELBv2
                Effect: Allow
                Action:
                  - elasticloadbalancing:RemoveTags
                  - elasticloadbalancing:DeleteTargetGroup
                Resource: '*'
                Condition:
                  StringEquals:
                    elasticloadbalancing:ResourceTag/created-by: prismacloud-vpc-traffic-mirroring
              - Sid: PCCAgentlessAppFirewallDeleteListener
                Effect: Allow
                Action: elasticloadbalancing:DeleteListener
                Resource: arn:aws:elasticloadbalancing:*:*:listener/net/pcc-vtm-*/*/*
              - Sid: PrismaCloudComputeCloudDiscovery
                Effect: Allow
                Action:
                  - ec2:DescribeImages
                  - ec2:DescribeInstances
                  - ec2:DescribeRegions
                  - ec2:DescribeTags
                  - ecr:DescribeRepositories
                  - ecs:DescribeClusters
                  - ecs:ListClusters
                  - ecs:ListContainerInstances
                  - eks:DescribeCluster
                  - eks:ListClusters
                  - lambda:GetFunction
                  - lambda:ListFunctions
                Resource: '*'
              - Sid: PCCAgentlessSSM
                Effect: Allow
                Action: ssm:GetParameters
                Resource: '*'

  # The Role is used to by the launched instances to notify the Auto Scaling Group that it finished init phase
  PCCAgentlessAppFirewallVPCObserverInstanceRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /
      Policies:
        - PolicyName: PCCAgentlessCompleteLifecyclePolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: PCCAgentlessAppFirewallAutoScalingCompleteLifecycle
                Effect: Allow
                Action:
                  - autoscaling:CompleteLifecycleAction
                Resource: '*'

  # This Instance-Profile will be assigned to PCC Agentless VPC Observer instances created by the Auto Scaling Group
  PCCAgentlessAppFirewallVPCObserverInstanceProfile:
    Type: 'AWS::IAM::InstanceProfile'
    Properties:
      Path: /
      Roles:
        - !Ref PCCAgentlessAppFirewallVPCObserverInstanceRole

Outputs:
  # Export the PCC Agentless Role Arn's so PCC Agentless can access it and pass it to running VPC Observer instances
  PCCAgentlessAppFirewallVPCObserverInstanceProfile:
    Description: The ID of the VPC
    Value: !GetAtt PCCAgentlessAppFirewallVPCObserverInstanceProfile.Arn
    Export:
      Name: PCCAgentlessAppFirewallVPCObserverInstanceProfileArn
