AWSTemplateFormatVersion: '2010-09-09'
Description:  Create the AWS S3 bucket for a customer to connect to Autodesk Shotgun.
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Customer Configuration
        Parameters:
          - CustomerBucketName
      - Label:
          default: Shotgun Configuration
        Parameters:
          - ShotgunHostedSiteURL
    ParameterLabels:
      CustomerBucketName:
        default: Customer S3 Bucket Name
      ShotgunHostedSiteURL:
        default: Shotgun Hosted Site URL
Parameters:
  CustomerBucketName:
    AllowedPattern: ^[0-9a-zA-Z]+([0-9a-zA-Z-]*[0-9a-zA-Z])*$
    ConstraintDescription: Bucket name can include numbers, lowercase letters, uppercase letters, and hyphens. It
      cannot start of end with a hyphen (-).
    Description: S3 Bucket where Shotgun stuff will be stored
    Type: String
  ShotgunHostedSiteURL:
    Description: URL of the Shotgun hosted site, for example https://mysite.shotgunstudio.com
    Type: String
    Default: https://<your-site>.shotgunstudio.com
Resources:
  SGAllowedS3AccessPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: shotgun-bucket-access-policy
      PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Action:
              - s3:AbortMultipartUpload
              - s3:GetObject
              - s3:GetObjectAcl
              - s3:ListMultipartUploadParts
              - s3:PutObject
              Resource: !Sub 'arn:aws:s3:::${CustomerBucketName}/*'
              Effect: Allow
            - Action: s3:ListBucket
              Resource: !Sub 'arn:aws:s3:::${CustomerBucketName}'
              Effect: Allow
      Roles:
        - !Ref 'SGCrossAccountRole'
  SGCrossAccountRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: "Allow"
            Principal:
              "AWS":
                - "arn:aws:iam::150697717911:role/cos_ctr_shotgun-p-ue1-db"
                - "arn:aws:iam::150697717911:role/cos_ctr_shotgun-p-ue1-wa"
                - "arn:aws:iam::150697717911:role/cos_ctr_shotgun-p-ue1-sa"
                - "arn:aws:iam::150697717911:role/cos_ctr_shotgun-p-ue1-sd"
                - "arn:aws:iam::150697717911:role/shotgun-batch-prd-activity-worker-job-ctr"
                - "arn:aws:iam::882022952826:role/cos_ctr_shotts-p-ue1"
                - "arn:aws:iam::882022952826:role/cos-batch_shotts-p-ue1"
                - "arn:aws:iam::882022952826:role/shotts-batch-prd-shotts-worker-ctr"
            Action: "sts:AssumeRole"
  S3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: Private
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      BucketName: !Ref CustomerBucketName
      CorsConfiguration:
        CorsRules:
        - AllowedHeaders: ['*']
          AllowedOrigins: [!Ref 'ShotgunHostedSiteURL']
          AllowedMethods: [GET, PUT, HEAD]
          ExposedHeaders: [ETag]
          Id: HostedSiteRuleId
          MaxAge: '3000'
Outputs:
  S3BucketName:
    Value: !Ref 'S3Bucket'
    Description: Name of the Amazon S3 bucket with CORS enabled.
  AWSRegion:
    Value: !Ref 'AWS::Region'
    Description: AWS region
  ShotgunRoleArn:
    Value: !GetAtt 'SGCrossAccountRole.Arn'
    Description: The Shotgun Role ARN
