AWSTemplateFormatVersion: 2010-09-09

Parameters:
  JamfDataBucketName:
    Type: String
    AllowedPattern: '(?!(^xn--|-s3alias$))^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$'
    Description: Bucket to write Jamf data to.
  JamfDataExternalId:
    Type: String
    Description: External ID from integration configuration

Resources:
  
  JamfDataBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref JamfDataBucketName
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
  
  JamfDataBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref JamfDataBucketName
      PolicyDocument:
        Statement: 
          - Sid: DenyUnSecureCommunications
            Effect: Deny
            Principal:
              AWS: "*"
            Action:
              - s3:*
            Resource: !Sub arn:${AWS::Partition}:s3:::${JamfDataBucketName}/*
            Condition:
              Bool:
                aws:SecureTransport:
                  - "false"

  JamfDataWriterRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS: "arn:aws:iam::888033165788:user/sis_prod"
            Action:
              - "sts:AssumeRole"
            Condition:
              StringEquals:
                sts:ExternalId:
                  - !Ref JamfDataExternalId
      Policies:
        - PolicyName: S3PutPolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - s3:PutObject
                Resource:
                  - !Sub arn:${AWS::Partition}:s3:::${JamfDataBucketName}/*

Outputs:
  JamfDataWriterRoleArn:
    Value: !GetAtt JamfDataWriterRole.Arn
  JamfDataBucket:
    Value: !Ref JamfDataBucketName