Description: Creates ML Engine IAM Resources

Resources:
  MLEngineECSTaskRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: "{{ serviceName }}-{{ ENVIRONMENT }}-ml-engine-ecs-task-role"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Principal:
              Service:
                - "ecs-tasks.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
      Policies:
        -
          PolicyName: "ECSTaskRolePolicy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - "s3:ListBucket"
                Resource:
                  {% for arn in ml_engine.iam.resources.S3.Buckets[ENVIRONMENT] %}
                  - "{{ arn }}"
                  {% endfor %}
              - Effect: "Allow"
                Action:
                  - "s3:GetObject"
                  - "s3:GetObjectTagging"
                  - "s3:PutObject"
                  - "s3:DeleteObject"
                Resource:
                  {% for arn in ml_engine.iam.resources.S3.Buckets[ENVIRONMENT] %}
                  - "{{ arn }}/*"
                  {% endfor %}
              - Effect: "Allow"
                Action:
                  - "secretsmanager:GetSecretValue"
                Resource:
                  {% for arn in ml_engine.iam.resources.SecretsManager.Secrets[ENVIRONMENT] %}
                  - "{{ arn }}"
                  {% endfor %}

Outputs:
  MLEngineECSTaskRoleARN:
    Value: !GetAtt MLEngineECSTaskRole.Arn
    Export:
      Name: "{{ serviceName }}-{{ ENVIRONMENT }}-iam-MLEngineECSTaskRoleArn"