# Customer-side CloudFormation template for the cybersoftware AWS connector.
# Creates a read-only IAM role (PolaraEvidenceCollectorTrust) that the evidence
# collector assumes via STS to collect SOC 2 evidence. Delete this stack to
# fully revoke at the AWS layer.
#
# NOTE: the role name, parameter names, and collector account ID are functional
# identifiers shared with the backend evidence pipeline. Do not rename them.

AWSTemplateFormatVersion: '2010-09-09'
Description: 'cybersoftware SOC 2 Evidence Collector — read-only IAM role for SOC 2 evidence collection. https://cybersoftware.com/integrations/aws'

Parameters:
  PolaraAccountId:
    Type: String
    Default: '081056822971'
    Description: 'Evidence collector AWS account ID. Do not change unless instructed by cybersoftware support.'
    AllowedPattern: '^[0-9]{12}$'
  ExternalId:
    Type: String
    Description: 'Paste the ExternalId from your cybersoftware dashboard. Required for security — do not share this value.'
    MinLength: 1
    NoEcho: true

Resources:
  PolaraEvidenceCollectorTrust:
    Type: AWS::IAM::Role
    Properties:
      RoleName: PolaraEvidenceCollectorTrust
      Description: 'Allows cybersoftware to read SOC 2 evidence from this account. Read-only via AWS-managed SecurityAudit + ViewOnlyAccess policies.'
      MaxSessionDuration: 3600
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::${PolaraAccountId}:role/PolaraEvidenceCollector'
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                'sts:ExternalId': !Ref ExternalId
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/SecurityAudit
        - arn:aws:iam::aws:policy/job-function/ViewOnlyAccess
      Tags:
        - Key: project
          Value: polara
        - Key: managed-by
          Value: cloudformation

Outputs:
  RoleArn:
    Description: 'Paste this ARN back into your cybersoftware dashboard to complete the connection.'
    Value: !GetAtt PolaraEvidenceCollectorTrust.Arn