AWSTemplateFormatVersion: '2010-09-09'
Description: >
  Creates a read-only IAM role for TurboPentest cloud attack surface discovery.
  This role allows TurboPentest to enumerate your public-facing resources (EC2, ALBs,
  CloudFront, API Gateway, Lambda, ECS, Lightsail, Elastic Beanstalk) without making
  any changes to your infrastructure.

Parameters:
  TurboPentestAccountId:
    Type: String
    Default: '061051239602'
    Description: TurboPentest AWS account ID (do not change unless instructed)
  ExternalId:
    Type: String
    Default: 'turbopentest-discovery'
    Description: External ID for cross-account access (do not change unless instructed)

Resources:
  TurboPentestReadOnlyRole:
    Type: AWS::IAM::Role
    Properties:
      Description: Read-only role for TurboPentest cloud attack surface discovery
      MaxSessionDuration: 3600
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::${TurboPentestAccountId}:root'
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                sts:ExternalId: !Ref ExternalId
      Policies:
        - PolicyName: TurboPentestDiscoveryPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: DiscoverPublicResources
                Effect: Allow
                Action:
                  # EC2 instances
                  - ec2:DescribeInstances
                  - ec2:DescribeSecurityGroups
                  - ec2:DescribeNetworkInterfaces
                  # Load Balancers
                  - elasticloadbalancing:DescribeLoadBalancers
                  - elasticloadbalancing:DescribeListeners
                  - elasticloadbalancing:DescribeTargetGroups
                  # CloudFront
                  - cloudfront:ListDistributions
                  # API Gateway
                  - apigateway:GET
                  # Lambda
                  - lambda:ListFunctions
                  - lambda:GetFunctionUrlConfig
                  # ECS / Fargate
                  - ecs:ListClusters
                  - ecs:ListServices
                  - ecs:DescribeServices
                  # Lightsail
                  - lightsail:GetInstances
                  # Elastic Beanstalk
                  - elasticbeanstalk:DescribeEnvironments
                  # AppSync
                  - appsync:ListGraphqlApis
                  # OpenSearch
                  - es:ListDomainNames
                  - es:DescribeDomains
                  # STS (for identity verification)
                  - sts:GetCallerIdentity
                Resource: '*'

Outputs:
  RoleArn:
    Description: ARN of the TurboPentest read-only role. Paste this into TurboPentest.
    Value: !GetAtt TurboPentestReadOnlyRole.Arn
  Instructions:
    Description: Next steps
    Value: Copy the RoleArn above and paste it into the TurboPentest AWS connection dialog.