# https://github.com/awslabs/cid-data-collection-framework/blob/main/data-collection/v3.14.1/deploy/deploy-data-read-permissions.yaml
AWSTemplateFormatVersion: '2010-09-09'
Description: CID Data Collection - All-in-One for Management Account v3.14.1 - AWS Solution SO9011
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "Deployment parameters"
        Parameters:
          - DataCollectionAccountID
          - ResourcePrefix
          - ManagementAccountRole
          - MultiAccountRoleName
          - OrganizationalUnitIds
          - AllowModuleReadInMgmt
          - CFNSourceBucket
      - Label:
          default: "Available modules"
        Parameters:
          - IncludeBackupModule
          - IncludeBudgetsModule
          - IncludeComputeOptimizerModule
          - IncludeCostAnomalyModule
          - IncludeSupportCasesModule
          - IncludeECSChargebackModule
          - IncludeHealthEventsModule
          - IncludeInventoryCollectorModule
          - IncludeRDSUtilizationModule
          - IncludeEUCUtilizationModule
          - IncludeRightsizingModule
          - IncludeTAModule
          - IncludeTransitGatewayModule
          - IncludeLicenseManagerModule
          - IncludeServiceQuotasModule
          - IncludeResilienceHubModule
          - IncludeMarketplaceModule
    ParameterLabels:
      ManagementAccountRole:
        default: "Management account role"
      DataCollectionAccountID:
        default: "Data Collection Account Id"
      MultiAccountRoleName:
        default: "Multi Account Role Name"
      OrganizationalUnitIds:
        default: "Comma Delimited list of Organizational Unit IDs. StackSets will deploy a read role in all AWS Accounts within those OUs. See your OU ID here: https://console.aws.amazon.com/organizations/v2/home/accounts (we recommend choosing OU ID of your Root)"
      AllowModuleReadInMgmt:
        default: "Allow creation of read roles for modules in management account"
      ResourcePrefix:
        default: "Role Prefix"
      CFNSourceBucket:
        default: "DO NOT CHANGE - A bucket that contains WA-Labs CloudFormation templates. Must be always 'aws-managed-cost-intelligence-dashboards'"
      IncludeBudgetsModule:
        default: "Include AWS Budgets Collection Module"
      IncludeComputeOptimizerModule:
        default: "Include AWS Compute Optimizer Data Collection Module"
      IncludeCostAnomalyModule:
        default: "Include Cost Anomalies Data Collection Module"
      IncludeSupportCasesModule:
        default: "Include Support Cases Data Collection Module"
      IncludeECSChargebackModule:
        default: "Include ECS Chargeback Data Collection Module"
      IncludeInventoryCollectorModule:
        default: "Include Inventory Collector Module"
      IncludeRDSUtilizationModule:
        default: "Include RDS Utilization Data Collection Module"
      IncludeEUCUtilizationModule:
        default: "Include WorkSpaces Utilization Data Collection Module"
      IncludeRightsizingModule:
        default: "Include Rightsizing Recommendations Data Collection Module"
      IncludeTAModule:
        default: "Include AWS Trusted Advisor Data Collection Module"
      IncludeTransitGatewayModule:
        default: "Include AWS TransitGateway Collection Module"
      IncludeBackupModule:
        default: "Include AWS Backup Collection Module"
      IncludeHealthEventsModule:
        default: "Include AWS Health Events Module"
      IncludeLicenseManagerModule:
        default: "Include Marketplace Licensing Module"
      IncludeServiceQuotasModule:
        default: "Include Service Quotas Module"
      IncludeResilienceHubModule:
        default: "Include ResilienceHub Module"
      IncludeMarketplaceModule:
        default: "Include Marketplace Agreements Module"

Parameters:
  ManagementAccountRole:
    Type: String
    Description: The name of the IAM role that will be deployed in the management account which can retrieve AWS Organization data. KEEP THE SAME AS WHAT IS DEPLOYED INTO MANAGEMENT ACCOUNT
    Default: Lambda-Assume-Role-Management-Account
  DataCollectionAccountID:
    Type: String
    Description: AccountId of where the collector is deployed
  MultiAccountRoleName:
    Type: String
    Description: The name of the IAM role that will be deployed from the management account to linked accounts as a read only role. KEEP THE SAME AS WHAT IS DEPLOYED INTO MANAGEMENT ACCOUNT
    Default: "Optimization-Data-Multi-Account-Role"
  OrganizationalUnitIds:
    Type: String
    AllowedPattern: ^(ou-[a-z0-9]{4,32}-[a-z0-9]{8,32}|r-[a-z0-9]{4,32})(,(ou-[a-z0-9]{4,32}-[a-z0-9]{8,32}|r-[a-z0-9]{4,32}))*$
    Description: "(Ex: r-ab01,ou-ab01-abcd1234) List of Organizational Unit IDs you wish to collect data for. It can be a single organizational unit. The organization root ID is usually preferred to collect data from all the member accounts."
  AllowModuleReadInMgmt:
    Type: String
    Description: Allows the creation of the read data roles for modules in the management account
    AllowedValues:
      - "yes"
      - "no"
  ResourcePrefix:
    Type: String
    Description: This prefix will be placed in front of all roles created. Note you may wish to add a dash at the end to make more readable e.g. prefix-
    Default: "CID-DC-"
  CFNSourceBucket:
    Type: String
    Description: "DO NOT CHANGE - A bucket that contains WA-Labs CloudFormation templates. Must be always 'aws-managed-cost-intelligence-dashboards'"
    Default: "aws-managed-cost-intelligence-dashboards"
  IncludeBudgetsModule:
    Type: String
    Description: Collects budgets from your accounts
    AllowedValues: ['yes', 'no']
    Default: 'no'
  IncludeComputeOptimizerModule:
    Type: String
    Description: Collects AWS Compute Optimizer service recommendations
    AllowedValues: ['yes', 'no']
    Default: 'no'
  IncludeCostAnomalyModule:
    Type: String
    Description: "Collects AWS Cost Explorer Cost Anomalies Recommendations"
    AllowedValues: ['yes', 'no']
    Default: 'no'
  IncludeSupportCasesModule:
    Type: String
    Description: "Collects AWS Support Cases data"
    AllowedValues: ['yes', 'no']
    Default: 'no'
  IncludeECSChargebackModule:
    Type: String
    Description: Collects data which shows costs associated with ECS Tasks leveraging EC2 instances within a Cluster
    AllowedValues: ['yes', 'no']
    Default: 'no'
  IncludeInventoryCollectorModule:
    Type: String
    Description: Collects data about AMIs, EBS volumes and snapshots
    AllowedValues: ['yes', 'no']
    Default: 'no'
  IncludeRDSUtilizationModule:
    Type: String
    Description: Collects RDS CloudWatch metrics from your accounts
    AllowedValues: ['yes', 'no']
    Default: 'no'
  IncludeEUCUtilizationModule:
    Type: String
    Description: Collects WorkSpaces CloudWatch metrics from your accounts
    AllowedValues: ['yes', 'no']
    Default: 'no'
  IncludeRightsizingModule:
    Type: String
    Description: "Collects AWS Cost Explorer Rightsizing Recommendations"
    AllowedValues: ['yes', 'no']
    Default: 'no'
  IncludeTAModule:
    Type: String
    Description: Collects AWS Trusted Advisor recommendations data
    AllowedValues: ['yes', 'no']
    Default: 'no'
  IncludeTransitGatewayModule:
    Type: String
    Description: Collects TransitGateway from your accounts
    AllowedValues: ['yes', 'no']
    Default: 'no'
  IncludeBackupModule:
    Type: String
    Description: Collects AWS Backup events from your accounts
    AllowedValues: ['yes', 'no']
    Default: 'no'
  IncludeHealthEventsModule:
    Type: String
    Description: Collects AWS Health Events from your accounts
    AllowedValues: ['yes', 'no']
    Default: 'no'
  IncludeLicenseManagerModule:
    Type: String
    Description: Collects Marketplace Licensing information
    AllowedValues: ['yes', 'no']
    Default: 'no'
  IncludeServiceQuotasModule:
    Type: String
    Description: Collects Service Quotas information
    AllowedValues: ['yes', 'no']
    Default: 'no'
  IncludeResilienceHubModule:
    Type: String
    Description: Collects Resilience Hub information
    AllowedValues: ['yes', 'no']
    Default: 'no'
  IncludeMarketplaceModule:
    Type: String
    Description: Collects Marketplace Agreement information
    AllowedValues: ['yes', 'no']
    Default: 'no'
Conditions:
  DeployModuleReadInMgmt: !Equals [!Ref AllowModuleReadInMgmt, "yes"]

Resources:
  DataCollectorMgmtAccountReadStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Sub "https://${CFNSourceBucket}.s3.${AWS::URLSuffix}/cfn/data-collection/v3.14.1/deploy-in-management-account.yaml"
      Parameters:
        DataCollectionAccountID: !Ref DataCollectionAccountID
        ManagementAccountRole: !Ref ManagementAccountRole
        ResourcePrefix: !Ref ResourcePrefix
        IncludeComputeOptimizerModule: !Ref IncludeComputeOptimizerModule
        IncludeCostAnomalyModule: !Ref IncludeCostAnomalyModule
        IncludeRightsizingModule: !Ref IncludeRightsizingModule
        IncludeBackupModule: !Ref IncludeBackupModule
        IncludeHealthEventsModule: !Ref IncludeHealthEventsModule
        IncludeLicenseManagerModule: !Ref IncludeLicenseManagerModule
        IncludeServiceQuotasModule: !Ref IncludeServiceQuotasModule

  DataCollectorMgmtAccountModulesReadStack:
    Type: AWS::CloudFormation::Stack
    Condition: DeployModuleReadInMgmt
    Properties:
      TemplateURL: !Sub "https://${CFNSourceBucket}.s3.${AWS::URLSuffix}/cfn/data-collection/v3.14.1/deploy-in-linked-account.yaml"
      Parameters:
        DataCollectionAccountID: !Ref DataCollectionAccountID
        MultiAccountRoleName: !Ref MultiAccountRoleName
        ResourcePrefix: !Ref ResourcePrefix
        IncludeTAModule: !Ref IncludeTAModule
        IncludeSupportCasesModule: !Ref IncludeSupportCasesModule
        IncludeInventoryCollectorModule: !Ref IncludeInventoryCollectorModule
        IncludeECSChargebackModule: !Ref IncludeECSChargebackModule
        IncludeRDSUtilizationModule: !Ref IncludeRDSUtilizationModule
        IncludeEUCUtilizationModule: !Ref IncludeEUCUtilizationModule
        IncludeBudgetsModule: !Ref IncludeBudgetsModule
        IncludeTransitGatewayModule: !Ref IncludeTransitGatewayModule
        IncludeServiceQuotasModule: !Ref IncludeServiceQuotasModule
        IncludeResilienceHubModule: !Ref IncludeResilienceHubModule
        IncludeMarketplaceModule: !Ref IncludeMarketplaceModule
        
  DataCollectorOrgAccountModulesReadStackSet:
    Type: AWS::CloudFormation::StackSet
    Properties:
      Description: "StackSet in charge of deploying read roles across organization accounts v3.14.1"
      PermissionModel: SERVICE_MANAGED
      AutoDeployment:
        Enabled: true
        RetainStacksOnAccountRemoval: false
      ManagedExecution:
        Active: true
      OperationPreferences:
        MaxConcurrentPercentage: 100
        FailureTolerancePercentage: 100
        RegionConcurrencyType: PARALLEL
      Parameters:
        - ParameterKey: DataCollectionAccountID
          ParameterValue: !Ref DataCollectionAccountID
        - ParameterKey: MultiAccountRoleName
          ParameterValue: !Ref MultiAccountRoleName
        - ParameterKey: ResourcePrefix
          ParameterValue: !Ref ResourcePrefix
        - ParameterKey: IncludeTAModule
          ParameterValue: !Ref IncludeTAModule
        - ParameterKey: IncludeSupportCasesModule
          ParameterValue: !Ref IncludeSupportCasesModule
        - ParameterKey: IncludeInventoryCollectorModule
          ParameterValue: !Ref IncludeInventoryCollectorModule
        - ParameterKey: IncludeECSChargebackModule
          ParameterValue: !Ref IncludeECSChargebackModule
        - ParameterKey: IncludeRDSUtilizationModule
          ParameterValue: !Ref IncludeRDSUtilizationModule
        - ParameterKey: IncludeEUCUtilizationModule
          ParameterValue: !Ref IncludeEUCUtilizationModule
        - ParameterKey: IncludeBudgetsModule
          ParameterValue: !Ref IncludeBudgetsModule
        - ParameterKey: IncludeTransitGatewayModule
          ParameterValue: !Ref IncludeTransitGatewayModule
        - ParameterKey: IncludeServiceQuotasModule
          ParameterValue: !Ref IncludeServiceQuotasModule
        - ParameterKey: IncludeResilienceHubModule
          ParameterValue: !Ref IncludeResilienceHubModule
        - ParameterKey: IncludeMarketplaceModule
          ParameterValue: !Ref IncludeMarketplaceModule
      StackInstancesGroup:
        - DeploymentTargets:
            OrganizationalUnitIds: !Split [",", !Ref OrganizationalUnitIds]
          Regions:
            - !Ref "AWS::Region"
      Capabilities:
        - CAPABILITY_IAM
        - CAPABILITY_NAMED_IAM
      StackSetName: !Sub "StackSet-${AWS::AccountId}-OptimizationDataRole"
      TemplateURL: !Sub "https://${CFNSourceBucket}.s3.${AWS::URLSuffix}/cfn/data-collection/v3.14.1/deploy-in-linked-account.yaml"
