AWSTemplateFormatVersion: '2010-09-09'
Description: >
  GhostHunter AI — Cross-Account Scan Role (Phase 1: Metadata Only)
  Creates a granular, read-only role that GhostHunter uses to safely analyze 
  your infrastructure metadata for idle, unattached, or orphaned resources.
  This template explicitly blocks access to data payloads, logs, and secrets.

Parameters:
  GhostHunterAccountId:
    Type: String
    Description: >
      The 12-digit AWS Account ID of the central GhostHunter service engine.
      Provided in your GhostHunter deployment dashboard.
    AllowedPattern: '^\d{12}$'
    ConstraintDescription: Must be a 12-digit AWS Account ID.

  ExternalId:
    Type: String
    Description: >
      A unique handshake token generated for your organization to prevent 
      Confused Deputy security compromises. Do not change this value.
    MinLength: 8
    MaxLength: 128

  RoleName:
    Type: String
    Default: GhostHunterScanner
    Description: >
      The structural identity mapping name for the integration. 
      We recommend keeping the default 'GhostHunterScanner'.

Resources:
  GhostHunterRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref RoleName
      Description: Highly restricted metadata assessment role for GhostHunter AI
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::${GhostHunterAccountId}:root'
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                sts:ExternalId: !Ref ExternalId

      Policies:
        - PolicyName: GhostHunterLeastPrivilegeScan
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              # Operational Cost Leaks, Security Groups, Log Groups & Storage Metadata
              - Effect: Allow
                Action:
                  - 'ec2:DescribeVolumes'
                  - 'ec2:DescribeSnapshots'
                  - 'ec2:DescribeAddresses'
                  - 'ec2:DescribeInstances'
                  - 'ec2:DescribeNatGateways'
                  - 'ec2:DescribeNetworkInterfaces'
                  - 'ec2:DescribeSecurityGroups'
                  - 'rds:DescribeDBInstances'
                  - 'rds:DescribeDBClusters'
                  - 'rds:DescribeDBSnapshots'
                  - 'elasticloadbalancing:DescribeLoadBalancers'
                  - 'elasticloadbalancing:DescribeTargetGroups'
                  - 'elasticloadbalancing:DescribeTags'
                  - 'lambda:ListFunctions'
                  - 'lambda:GetFunctionConfiguration'
                  - 'logs:DescribeLogGroups'
                  - 's3:ListAllMyBuckets'
                  - 's3:ListBucket'
                  - 's3:GetBucketLocation'
                  - 's3:GetBucketTagging'
                  - 'cloudwatch:GetMetricStatistics'
                  - 'cloudwatch:ListMetrics'
                Resource: '*'

      Tags:
        - Key: ManagedBy
          Value: GhostHunterAI
        - Key: Purpose
          Value: CloudCostOptimization

Outputs:
  RoleArn:
    Description: >
      The completed cross-account identity string. Copy and paste this ARN 
      directly into your GhostHunter dashboard to link your environment.
    Value: !GetAtt GhostHunterRole.Arn
    Export:
      Name: !Sub '${AWS::StackName}-RoleArn'