AWSTemplateFormatVersion: '2010-09-09'
Description: 'CloudFormation for cross account IAM role(s) deployment in customer accounts. IAM role(s) are meant for SoftwareOne access.'

Resources:
  IAMRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: 'SWOBillingCrossAccountRole'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: 'Allow'
            Principal:
              AWS: 'arn:aws:iam::010526243342:root'
            Action: 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/AWSBillingReadOnlyAccess'
        - 'arn:aws:iam::aws:policy/AWSSupportAccess'
        - 'arn:aws:iam::aws:policy/AWSBillingConductorFullAccess'
        - !Ref SWOCostExplorerReadAccessPolicy

  SWOCostExplorerReadAccessPolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Properties:
      ManagedPolicyName: 'SWOCostExplorerReadAccessPolicy'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: 'SwoCeAccess'
            Effect: 'Allow'
            Action:
              - 'ce:Describe*'
              - 'ce:List*'
              - 'ce:Get*'
            Resource: '*'