AWSTemplateFormatVersion: 2010-09-09
Description: Dynatrace Data Acquisition AWS monitoring role (v0.8.3)

Metadata:
  Version:
    Number: v0.8.3

Parameters:
  DynatraceUrl:
    Type: String
    AllowedPattern: "^https:\\/\\/.+[^\\/]$"
  RoleExternalId:
    Type: String
    MinLength: 1

Conditions:
  ProductionEnvironment: !Or
    - !Equals [ !Select [ 1, !Split [ ".", !Ref DynatraceUrl ] ], 'live' ]
    - !Equals [ !Select [ 1, !Split [ ".", !Ref DynatraceUrl ] ], 'apps' ]

Resources:
  DynatraceMonitoringPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Description: Dynatrace Data Acquisition Monitoring Policy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: TopologyInventory
            Effect: Allow
            Action:
              - account:GetAccountInformation
              - acm-pca:ListCertificateAuthorities
              - aoss:BatchGetCollection
              - aoss:ListCollections
              - apigateway:GET
              - apprunner:DescribeAutoScalingConfiguration
              - apprunner:DescribeService
              - apprunner:DescribeVpcConnector
              - apprunner:DescribeVpcIngressConnection
              - apprunner:ListAutoScalingConfigurations
              - apprunner:ListServices
              - apprunner:ListTagsForResource
              - apprunner:ListVpcConnectors
              - apprunner:ListVpcIngressConnections
              - athena:GetWorkGroup
              - athena:ListWorkGroups
              - autoscaling:DescribeAutoScalingGroups
              - autoscaling:DescribeWarmPool
              - bedrock:GetAgent
              - bedrock:GetAgentAlias
              - bedrock:GetGuardrail
              - bedrock:GetKnowledgeBase
              - bedrock:ListAgentAliases
              - bedrock:ListAgents
              - bedrock:ListGuardrails
              - bedrock:ListKnowledgeBases
              - cloudformation:ListStackResources
              - cloudfront:GetDistribution
              - cloudfront:ListDistributions
              - cloudhsm:DescribeClusters
              - cloudtrail:GetEventSelectors
              - cloudtrail:GetTrail
              - cloudtrail:GetTrailStatus
              - cloudtrail:ListTrails
              - cloudtrail:LookupEvents
              - dax:DescribeClusters
              - dax:DescribeSubnetGroups
              - directconnect:DescribeConnections
              - directconnect:DescribeVirtualInterfaces
              - dms:DescribeReplicationInstances
              - dynamodb:DescribeContinuousBackups
              - dynamodb:DescribeKinesisStreamingDestination
              - dynamodb:DescribeTable
              - dynamodb:DescribeTimeToLive
              - dynamodb:ListTables
              - ec2:DescribeAddresses
              - ec2:DescribeAvailabilityZones
              - ec2:DescribeClientVpnEndpoints
              - ec2:DescribeCustomerGateways
              - ec2:DescribeDhcpOptions
              - ec2:DescribeEgressOnlyInternetGateways
              - ec2:DescribeIamInstanceProfileAssociations
              - ec2:DescribeInstances
              - ec2:DescribeInternetGateways
              - ec2:DescribeLaunchTemplateVersions
              - ec2:DescribeLaunchTemplates
              - ec2:DescribeNatGateways
              - ec2:DescribeNetworkAcls
              - ec2:DescribeNetworkInterfaces
              - ec2:DescribeRegions
              - ec2:DescribeRouteTables
              - ec2:DescribeSecurityGroups
              - ec2:DescribeSnapshots
              - ec2:DescribeSubnets
              - ec2:DescribeTransitGatewayAttachments
              - ec2:DescribeTransitGatewayConnects
              - ec2:DescribeTransitGatewayMulticastDomains
              - ec2:DescribeTransitGatewayRouteTables
              - ec2:DescribeTransitGateways
              - ec2:DescribeVolumes
              - ec2:DescribeVpcEndpointServiceConfigurations
              - ec2:DescribeVpcEndpoints
              - ec2:DescribeVpcPeeringConnections
              - ec2:DescribeVpcs
              - ec2:DescribeVpnConnections
              - ec2:DescribeVpnGateways
              - ecr-public:DescribeRepositories
              - ecr-public:GetRepositoryPolicy
              - ecr:DescribeRepositories
              - ecr:GetRepositoryPolicy
              - ecs:DescribeCapacityProviders
              - ecs:DescribeClusters
              - ecs:DescribeContainerInstances
              - ecs:DescribeServices
              - ecs:DescribeTaskDefinition
              - ecs:DescribeTasks
              - ecs:ListClusters
              - ecs:ListContainerInstances
              - ecs:ListServices
              - ecs:ListTaskDefinitions
              - ecs:ListTasks
              - eks:DescribeCluster
              - eks:DescribeNodegroup
              - eks:ListClusters
              - eks:ListNodegroups
              - elasticache:DescribeCacheClusters
              - elasticache:DescribeCacheParameterGroups
              - elasticache:DescribeCacheParameters
              - elasticache:DescribeCacheSubnetGroups
              - elasticache:DescribeServerlessCaches
              - elasticbeanstalk:DescribeApplications
              - elasticbeanstalk:DescribeEnvironmentResources
              - elasticbeanstalk:DescribeEnvironments
              - elasticfilesystem:DescribeAccessPoints
              - elasticfilesystem:DescribeFileSystems
              - elasticfilesystem:DescribeMountTargets
              - elasticloadbalancing:DescribeListeners
              - elasticloadbalancing:DescribeLoadBalancerAttributes
              - elasticloadbalancing:DescribeLoadBalancerPolicies
              - elasticloadbalancing:DescribeLoadBalancers
              - elasticloadbalancing:DescribeRules
              - elasticloadbalancing:DescribeTargetGroupAttributes
              - elasticloadbalancing:DescribeTargetGroups
              - elasticloadbalancing:DescribeTargetHealth
              - es:DescribeDomains
              - es:ListDomainNames
              - events:DescribeEventBus
              - events:ListEventBuses
              - firehose:DescribeDeliveryStream
              - firehose:ListDeliveryStreams
              - iam:ListAccountAliases
              - iam:GetAccountSummary
              - iam:GetAccountPasswordPolicy
              - iam:GenerateCredentialReport
              - iam:GetAccountAuthorizationDetails
              - iam:GetCredentialReport
              - iam:ListInstanceProfiles
              - iam:ListServerCertificates
              - iam:ListMFADevices
              - kafka:ListClustersV2
              - kms:DescribeKey
              - kms:GetKeyRotationStatus
              - kms:ListAliases
              - kms:ListKeys
              - lambda:GetFunction
              - lambda:GetPolicy
              - lambda:ListAliases
              - lambda:ListEventSourceMappings
              - lambda:ListFunctions
              - logs:DescribeLogGroups
              - logs:DescribeSubscriptionFilters
              - mq:DescribeBroker
              - mq:DescribeConfiguration
              - mq:ListBrokers
              - mq:ListConfigurations
              - organizations:DescribeOrganization
              - rds:DescribeDbClusters
              - rds:DescribeDbInstances
              - rds:DescribeDbSubnetGroups
              - rds:DescribeOptionGroups
              - rds:ListTagsForResource
              - redshift-serverless:ListNamespaces
              - redshift-serverless:ListWorkgroups
              - redshift:DescribeClusterSubnetGroups
              - redshift:DescribeClusters
              - redshift:DescribeLoggingStatus
              - route53:GetHostedZone
              - route53:ListHealthChecks
              - route53:ListHostedZones
              - s3:GetAccelerateConfiguration
              - s3:GetBucketAcl
              - s3:GetBucketLogging
              - s3:GetBucketNotification
              - s3:GetBucketPolicy
              - s3:GetBucketPublicAccessBlock
              - s3:GetBucketRequestPayment
              - s3:GetBucketVersioning
              - s3:GetEncryptionConfiguration
              - s3:ListAllMyBuckets
              - sns:GetTopicAttributes
              - sns:ListTopics
              - sqs:GetQueueAttributes
              - sqs:ListQueues
              - states:DescribeStateMachine
              - states:ListStateMachines
              - storagegateway:ListGateways
              - storagegateway:DescribeGatewayInformation
              - tag:GetResources
              - tag:GetTagKeys
              - tag:GetTagValues
              - wafv2:GetWebACL
              - wafv2:ListWebACLs
            Resource: '*'
          - Sid: CloudWatchMonitoring
            Effect: Allow
            Action:
              - cloudwatch:GetMetricData
              - cloudwatch:ListMetrics
            Resource: '*'

  DynatraceMonitoringRole:
    Type: AWS::IAM::Role
    Properties:
      Description: Dynatrace Data Acquisition Monitoring Role
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS:
                Fn::If:
                  - ProductionEnvironment
                  - '314146291599'
                  - '476114158034'
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                sts:ExternalId: !Ref RoleExternalId
      ManagedPolicyArns:
        - !Ref 'DynatraceMonitoringPolicy'

Outputs:
  MonitoringRoleArn:
    Value: !GetAtt DynatraceMonitoringRole.Arn
