prerequisites.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: >
  Creates the prerequisites for the AWS Service Broker -
  https://github.com/awslabs/aws-servicebroker/blob/master/docs/install_prereqs.md
Resources:
  BrokerTable:
    Type: "AWS::DynamoDB::Table"
    Properties:
      AttributeDefinitions:
        - AttributeName: id
          AttributeType: S
        - AttributeName: userid
          AttributeType: S
        - AttributeName: type
          AttributeType: S
      KeySchema:
        - AttributeName: id
          KeyType: HASH
        - AttributeName: userid
          KeyType: RANGE
      ProvisionedThroughput:
        ReadCapacityUnits: 5
        WriteCapacityUnits: 5
      TableName: "awssb"
      GlobalSecondaryIndexes:
        - IndexName: "type-userid-index"
          KeySchema:
            - AttributeName: type
              KeyType: HASH
            - AttributeName: userid
              KeyType: RANGE
          Projection:
            ProjectionType: INCLUDE
            NonKeyAttributes: [id, userid, type, locked]
          ProvisionedThroughput:
            ReadCapacityUnits: 5
            WriteCapacityUnits: 5
  BrokerUser:
    Type: "AWS::IAM::User"
    Properties:
      Policies:
        - PolicyName: AwsServiceBrokerPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Action: ["s3:GetObject", "s3:ListBucket"]
                Resource:
                  [
                    "arn:aws:s3:::awsservicebroker/templates/*",
                    "arn:aws:s3:::awsservicebroker",
                  ]
                Effect: "Allow"
              - Action:
                  [
                    "dynamodb:PutItem",
                    "dynamodb:GetItem",
                    "dynamodb:DeleteItem",
                  ]
                Resource: !Sub "arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${BrokerTable}"
                Effect: "Allow"
              - Action: ["ssm:GetParameter", "ssm:GetParameters"]
                Resource:
                  - !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/asb-*"
                  - !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/Asb*"
                Effect: "Allow"
        - PolicyName: AwsServiceBrokerProvisioningPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Action:
                  ["ssm:PutParameter", "ssm:GetParameter", "ssm:GetParameters"]
                Resource:
                  - !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/asb-*"
                  - !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/Asb*"
                Effect: "Allow"
              - Action: "s3:GetObject"
                Resource: "arn:aws:s3:::awsservicebroker/templates/*"
                Effect: "Allow"
              - Action:
                  - "cloudformation:CreateStack"
                  - "cloudformation:DeleteStack"
                  - "cloudformation:DescribeStacks"
                  - "cloudformation:DescribeStackEvents"
                  - "cloudformation:UpdateStack"
                  - "cloudformation:CancelUpdateStack"
                Resource: !Sub "arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/aws-service-broker-*/*"
                Effect: "Allow"
              - Action:
                  [
                    "athena:*",
                    "dynamodb:*",
                    "kms:*",
                    "elasticache:*",
                    "elasticmapreduce:*",
                    "kinesis:*",
                    "rds:*",
                    "redshift:*",
                    "route53:*",
                    "s3:*",
                    "sns:*",
                    "sns:*",
                    "sqs:*",
                    "ec2:*",
                    "iam:*",
                    "lambda:*",
                    "codecommit:*",
                  ]
                Resource: "*"
                Effect: "Allow"
Outputs:
  IAMUser:
    Value: !Ref BrokerUser