AWSTemplateFormatVersion: '2010-09-09'
Description: |
  Language Services - IAM Roles Only
  Use this template to create just the IAM roles for an existing deployment

Parameters:
  AppName:
    Type: String
    Default: language-services
    Description: Name of the application

  Environment:
    Type: String
    Default: production
    Description: Deployment environment

  InputBucketArn:
    Type: String
    Description: ARN of the input S3 bucket

  OutputBucketArn:
    Type: String
    Description: ARN of the output S3 bucket

  SecretsArn:
    Type: String
    Description: ARN of the Secrets Manager secret

Resources:
  ECSTaskExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${AppName}-${Environment}-ecs-execution-role
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
      Policies:
        - PolicyName: SecretsManagerAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - secretsmanager:GetSecretValue
                Resource: !Ref SecretsArn
        - PolicyName: CloudWatchLogsAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/ecs/${AppName}-${Environment}*
      Tags:
        - Key: Application
          Value: !Ref AppName
        - Key: Environment
          Value: !Ref Environment

  ECSTaskRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${AppName}-${Environment}-ecs-task-role
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: S3Access
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:PutObject
                  - s3:DeleteObject
                  - s3:ListBucket
                  - s3:GetBucketLocation
                Resource:
                  - !Ref InputBucketArn
                  - !Sub ${InputBucketArn}/*
                  - !Ref OutputBucketArn
                  - !Sub ${OutputBucketArn}/*
        - PolicyName: TextractAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - textract:AnalyzeDocument
                  - textract:DetectDocumentText
                  - textract:AnalyzeExpense
                  - textract:StartDocumentAnalysis
                  - textract:StartDocumentTextDetection
                  - textract:GetDocumentAnalysis
                  - textract:GetDocumentTextDetection
                Resource: '*'
        - PolicyName: TranscribeAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - transcribe:StartTranscriptionJob
                  - transcribe:StartMedicalTranscriptionJob
                  - transcribe:GetTranscriptionJob
                  - transcribe:GetMedicalTranscriptionJob
                  - transcribe:DeleteTranscriptionJob
                  - transcribe:DeleteMedicalTranscriptionJob
                  - transcribe:ListTranscriptionJobs
                  - transcribe:ListMedicalTranscriptionJobs
                Resource: '*'
        - PolicyName: TranslateAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - translate:TranslateText
                  - translate:TranslateDocument
                  - translate:ListLanguages
                Resource: '*'
        - PolicyName: PollyAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - polly:SynthesizeSpeech
                  - polly:DescribeVoices
                  - polly:GetLexicon
                  - polly:ListLexicons
                Resource: '*'
        - PolicyName: ComprehendAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - comprehend:DetectDominantLanguage
                  - comprehend:DetectEntities
                  - comprehend:DetectKeyPhrases
                  - comprehend:DetectSentiment
                  - comprehend:DetectSyntax
                Resource: '*'
        - PolicyName: ComprehendMedicalAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - comprehendmedical:DetectEntitiesV2
                  - comprehendmedical:DetectPHI
                  - comprehendmedical:InferICD10CM
                  - comprehendmedical:InferRxNorm
                Resource: '*'
        - PolicyName: STSAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - sts:GetCallerIdentity
                Resource: '*'
        - PolicyName: SecretsManagerRefresh
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - secretsmanager:GetSecretValue
                Resource: !Ref SecretsArn
      Tags:
        - Key: Application
          Value: !Ref AppName
        - Key: Environment
          Value: !Ref Environment

Outputs:
  TaskRoleArn:
    Description: ECS Task Role ARN
    Value: !GetAtt ECSTaskRole.Arn
    Export:
      Name: !Sub ${AppName}-${Environment}-TaskRoleArn

  TaskRoleName:
    Description: ECS Task Role Name
    Value: !Ref ECSTaskRole

  ExecutionRoleArn:
    Description: ECS Task Execution Role ARN
    Value: !GetAtt ECSTaskExecutionRole.Arn
    Export:
      Name: !Sub ${AppName}-${Environment}-ExecutionRoleArn

  ExecutionRoleName:
    Description: ECS Task Execution Role Name
    Value: !Ref ECSTaskExecutionRole
