AWSTemplateFormatVersion: 2010-09-09
Outputs:
  CrossAccountRoleArn:
    Value: !GetAtt
      - HarnessCloudFormationRole
      - Arn
Parameters:
  PrincipalBilling:
    Type: String
    Default: 'arn:aws:iam::108817434118:root'
  ExternalId:
    Type: String
  BucketName:
    Description: Leave this field blank if BillingEnabled is false
    Type: String
  RoleName:
    Type: String
    Default: HarnessCERole
  LambdaExecutionRoleName:
    Type: String
    Default: HarnessCELambdaExecutionRole
  BillingEnabled:
    Description: Whether CostAndUsage Report feature is enabled or not.
    Default: false
    Type: String
    AllowedValues: [true, false]
  EventsEnabled:
    Default: false
    Type: String
    AllowedValues: [true, false]
  OptimizationEnabled:
    Default: false
    Type: String
    AllowedValues: [true, false]
  GovernanceEnabled:
    Default: false
    Type: String
    AllowedValues: [true, false]
  CommitmentEC2Enabled:
    Default: false
    Type: String
    AllowedValues: [true, false]
  CommitmentRDSEnabled:
    Default: false
    Type: String
    AllowedValues: [true, false]
  CommitmentElastiCacheEnabled:
    Default: false
    Type: String
    AllowedValues: [true, false]
  ClusterOrchestratorEnabled:
    Default: false
    Type: String
    AllowedValues: [true, false]
  AutostoppingEC2Enabled:
    Default: false
    Type: String
    AllowedValues: [true, false]
  AutostoppingSpotEnabled:
    Default: false
    Type: String
    AllowedValues: [true, false]
  AutostoppingASGEnabled:
    Default: false
    Type: String
    AllowedValues: [true, false]
  AutostoppingECSEnabled:
    Default: false
    Type: String
    AllowedValues: [true, false]
  AutostoppingRDSEnabled:
    Default: false
    Type: String
    AllowedValues: [true, false]
  AutostoppingALBEnabled:
    Default: false
    Type: String
    AllowedValues: [true, false]
  AutostoppingProxyEnabled:
    Default: false
    Type: String
    AllowedValues: [true, false]
Conditions:
  CreatingHarnessBillingMonitoringPolicy: !Equals
    - !Ref BillingEnabled
    - true
  CreateHarnessEventsMonitoringPolicy: !Equals
    - !Ref EventsEnabled
    - true
  CreateHarnessOptimisationPolicy: !Equals
    - !Ref OptimizationEnabled
    - true
  CreateHarnessGovernancePolicy: !Equals
    - !Ref GovernanceEnabled
    - true
  CreateHarnessCommitmentRDSEC2CombinedPolicy: !And
    - !Equals [ !Ref CommitmentEC2Enabled, true ]
    - !Equals [ !Ref CommitmentRDSEnabled, true ]
  CreateHarnessCommitmentEC2Policy: !And
    - !Equals [ !Ref CommitmentEC2Enabled, true ]
    - !Equals [ !Ref CommitmentRDSEnabled, false ]
  CreateHarnessCommitmentRDSPolicy: !And
    - !Equals [ !Ref CommitmentEC2Enabled, false ]
    - !Equals [ !Ref CommitmentRDSEnabled, true ]
  CreateHarnessCommitmentElastiCachePolicy: !Equals
    - !Ref CommitmentElastiCacheEnabled
    - true
  CreateHarnessAutostoppingEC2Policy: !And
    - !Equals [ !Ref AutostoppingSpotEnabled, false ]
    - !Equals [ !Ref AutostoppingEC2Enabled, true ]
  CreateHarnessAutostoppingASGPolicy: !Equals
    - !Ref AutostoppingASGEnabled
    - true
  CreateHarnessAutostoppingSpotPolicy: !And
    - !Equals [ !Ref AutostoppingSpotEnabled, true ]
    - !Equals [ !Ref AutostoppingEC2Enabled, false ]
  CreateSingleHarnessAutostoppingVMPolicy: !And
    - !Equals [ !Ref AutostoppingSpotEnabled, true ]
    - !Equals [ !Ref AutostoppingEC2Enabled, true ]
  CreateHarnessAutostoppingRDSASGCombinedPolicy: !And
    - !Equals [ !Ref AutostoppingECSEnabled, true ]
    - !Equals [ !Ref AutostoppingRDSEnabled, true ]
  CreateHarnessAutostoppingECSPolicy: !And
    - !Equals [ !Ref AutostoppingECSEnabled, true ]
    - !Equals [ !Ref AutostoppingRDSEnabled, false ]
  CreateHarnessAutostoppingRDSPolicy: !And
    - !Equals [ !Ref AutostoppingECSEnabled, false ]
    - !Equals [ !Ref AutostoppingRDSEnabled, true ]
  CreateHarnessAutostoppingALBPolicy: !Equals
    - !Ref AutostoppingALBEnabled
    - true
  CreateHarnessAutostoppingLambdaPolicy: !Equals
    - !Ref AutostoppingALBEnabled
    - true
  CreateHarnessAutostoppingProxyPolicy: !Equals
    - !Ref AutostoppingProxyEnabled
    - true
  CreateHarnessClusterOrchestratorPolicy: !Equals
    - !Ref ClusterOrchestratorEnabled
    - true
Resources:
  HarnessCloudFormationRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Ref RoleName
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS:
                - !Ref PrincipalBilling
            Action: 'sts:AssumeRole'
            Condition:
              StringEquals:
                'sts:ExternalId': !Ref ExternalId
      ManagedPolicyArns: !If
        - CreateHarnessGovernancePolicy
        - - arn:aws:iam::aws:policy/ReadOnlyAccess
        - !Ref 'AWS::NoValue'
  HarnessOptimizationLambdaExecutionRole:
    Type: 'AWS::IAM::Role'
    Condition: CreateHarnessAutostoppingLambdaPolicy
    Properties:
      RoleName: !Ref LambdaExecutionRoleName
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: "lambda.amazonaws.com"
            Action: 'sts:AssumeRole'
      Path: /ce-optimization-service-role/
  HarnessGetRolePolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Properties:
      Description: Policy granting Harness Simulate Principle Policy
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - 'iam:SimulatePrincipalPolicy'
            Resource:
              - !Join
                - ''
                - - 'arn:aws:iam::'
                  - !Ref AWS::AccountId
                  - ':role/'
                  - !Ref RoleName
      Roles:
        - !Ref HarnessCloudFormationRole
  HarnessEventsMonitoringPolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Condition: CreateHarnessEventsMonitoringPolicy
    Properties:
      Description: Policy granting Harness Access to Enable Event Collection
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - 'ec2:DescribeInstances*'
              - 'ec2:DescribeRegions'
              - 'ec2:DescribeVolumes'
              - 'ec2:DescribeSnapshots'
              - 'ec2:DescribeInstanceTypes'
              - 'ecs:ListClusters*'
              - 'ecs:DescribeClusters'
              - 'ecs:ListServices'
              - 'ecs:DescribeServices'
              - 'ecs:DescribeContainerInstances'
              - 'ecs:ListTasks'
              - 'ecs:ListContainerInstances'
              - 'ecs:DescribeTasks'
              - 'ce:GetRightsizingRecommendation'
              - 'cloudwatch:ListMetrics'
              - 'cloudwatch:GetMetricData'
              - 'cloudwatch:GetMetricStatistics'
              - 'compute-optimizer:GetEC2InstanceRecommendations'
              - 'compute-optimizer:GetRecommendationPreferences'
              - 'compute-optimizer:PutRecommendationPreferences'
              - 'cost-optimization-hub:GetRecommendation'
              - 'cost-optimization-hub:ListRecommendations'
              - 'cost-optimization-hub:GetPreferences'
              - 'organizations:ListAccounts'
              - 'organizations:ListTagsForResource'
              - 'rds:DescribeDBSnapshots'
              - 'rds:DescribeDBInstances'
              - 'rds:DescribeDBClusters'
              - 'rds:DescribeDBSnapshotAttributes'
              - 'account:ListRegions'
            Resource: '*'
      Roles:
        - !Ref HarnessCloudFormationRole
  HarnessBillingMonitoringPolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Condition: CreatingHarnessBillingMonitoringPolicy
    Properties:
      Description: Policy granting Harness Access to Collect Billing Data
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - 's3:GetBucketLocation'
              - 's3:ListBucket'
              - 's3:GetObject'
            Resource:
              - !Join
                - ''
                - - 'arn:aws:s3:::'
                  - !Ref BucketName
              - !Join
                - /
                - - !Join
                    - ''
                    - - 'arn:aws:s3:::'
                      - !Ref BucketName
                  - '*'
          - Effect: Allow
            Action:
              - 's3:ListBucket'
              - 's3:PutObject'
              - 's3:PutObjectAcl'
            Resource:
              - 'arn:aws:s3:::customer-billing-data-dev*'
              - 'arn:aws:s3:::customer-billing-data-dev*/*'
          - Effect: Allow
            Action:
              - 'cur:DescribeReportDefinitions'
              - 'bcm-data-exports:GetExport'
              - 'bcm-data-exports:ListExports'
              - 'organizations:Describe*'
              - 'organizations:List*'
            Resource: "*"
          - Effect: Allow
            Action:
              - "ec2:DescribeReservedInstancesOfferings"
              - "ce:GetSavingsPlansUtilization"
              - "ce:GetReservationUtilization"
              - "ec2:DescribeInstanceTypeOfferings"
              - "ce:GetDimensionValues"
              - "ce:GetSavingsPlansUtilizationDetails"
              - "ec2:DescribeReservedInstances"
              - "ce:GetReservationCoverage"
              - "ce:GetSavingsPlansCoverage"
              - "savingsplans:DescribeSavingsPlans"
              - "organizations:DescribeOrganization"
              - "ce:GetCostAndUsage"
            Resource: "*"
      Roles:
        - !Ref HarnessCloudFormationRole
  HarnessAutostoppingEC2Policy:
    Type: 'AWS::IAM::ManagedPolicy'
    Condition: CreateHarnessAutostoppingEC2Policy
    Properties:
      Description: Policy granting Harness Access to Enable EC2 Autostopping
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - 'ec2:DescribeInstances'
              - 'ec2:CreateTags'
              - 'ec2:StartInstances'
              - 'ec2:StopInstances'
            Resource: "*"
      Roles:
        - !Ref HarnessCloudFormationRole
  HarnessAutostoppingVMPolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Condition: CreateSingleHarnessAutostoppingVMPolicy
    Properties:
      Description: Policy granting Harness Access to Enable EC2 Autostopping
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - 'ec2:DescribeInstances'
              - 'ec2:CreateTags'
              - 'ec2:StartInstances'
              - 'ec2:StopInstances'
              - 'ec2:DescribeVolumes'
              - 'ec2:CreateImage'
              - 'ec2:DescribeImages'
              - 'ec2:TerminateInstances'
              - 'ec2:DeregisterImage'
              - 'ec2:DeleteSnapshot'
              - 'ec2:RequestSpotInstances'
              - 'ec2:DescribeSpotInstanceRequests'
              - 'ec2:DescribeAddresses'
              - 'ec2:RunInstances'
              - 'ec2:CancelSpotInstanceRequests'
            Resource: "*"
      Roles:
        - !Ref HarnessCloudFormationRole
  HarnessAutostoppingASGPolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Condition: CreateHarnessAutostoppingASGPolicy
    Properties:
      Description: Policy granting Harness Access to Enable ASG Autostopping
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - 'autoscaling:DescribeAutoScalingGroups'
              - 'autoscaling:UpdateAutoScalingGroup'
              - 'ec2:DescribeSpotPriceHistory'
            Resource: "*"
      Roles:
        - !Ref HarnessCloudFormationRole
  HarnessAutostoppingSpotPolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Condition: CreateHarnessAutostoppingSpotPolicy
    Properties:
      Description: Policy granting Harness Access to Enable Spot Autostopping
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - 'ec2:DescribeVolumes'
              - 'ec2:CreateImage'
              - 'ec2:DescribeImages'
              - 'ec2:TerminateInstances'
              - 'ec2:DeregisterImage'
              - 'ec2:DeleteSnapshot'
              - 'ec2:RequestSpotInstances'
              - 'ec2:DescribeSpotInstanceRequests'
              - 'ec2:DescribeAddresses'
              - 'ec2:RunInstances'
              - 'ec2:CancelSpotInstanceRequests'
            Resource: "*"
      Roles:
        - !Ref HarnessCloudFormationRole
  HarnessAutostoppingRDSPolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Condition: CreateHarnessAutostoppingRDSPolicy
    Properties:
      Description: Policy granting Harness Access to Enable RDS Autostopping
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - 'rds:DescribeDBInstances'
              - 'rds:DescribeDBClusters'
              - 'rds:ListTagsForResource'
              - 'rds:StartDBInstance'
              - 'rds:StopDBInstance'
              - 'rds:StartDBCluster'
              - 'rds:StopDBCluster'
            Resource: "*"
      Roles:
        - !Ref HarnessCloudFormationRole
  HarnessAutostoppingECSPolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Condition: CreateHarnessAutostoppingECSPolicy
    Properties:
      Description: Policy granting Harness Access to Enable ECS Autostopping
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - 'ecs:ListClusters'
              - 'tag:GetResources'
              - 'ecs:ListServices'
              - 'ecs:ListTasks'
              - 'ecs:DescribeServices'
              - 'ecs:UpdateService'
              - 'ecs:DescribeTaskDefinition'
              - 'ecs:DescribeTasks'
            Resource: "*"
      Roles:
        - !Ref HarnessCloudFormationRole
  HarnessAutostoppingRDSASGCombinedPolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Condition: CreateHarnessAutostoppingRDSASGCombinedPolicy
    Properties:
      Description: Policy granting Harness Access to Enable RDS Autostopping
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - 'rds:DescribeDBInstances'
              - 'rds:DescribeDBClusters'
              - 'rds:ListTagsForResource'
              - 'rds:StartDBInstance'
              - 'rds:StopDBInstance'
              - 'rds:StartDBCluster'
              - 'rds:StopDBCluster'
              - 'ecs:ListClusters'
              - 'tag:GetResources'
              - 'ecs:ListServices'
              - 'ecs:ListTasks'
              - 'ecs:DescribeServices'
              - 'ecs:UpdateService'
              - 'ecs:DescribeTaskDefinition'
              - 'ecs:DescribeTasks'
            Resource: "*"
      Roles:
        - !Ref HarnessCloudFormationRole
  HarnessAutostoppingALBPolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Condition: CreateHarnessAutostoppingALBPolicy
    Properties:
      Description: Policy granting Harness Access to Enable ALB based Autostopping
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - 'acm:ListCertificates'
              - 'elasticloadbalancing:DescribeLoadBalancers'
              - 'elasticloadbalancing:CreateLoadBalancer'
              - 'elasticloadbalancing:DescribeTargetGroups'
              - 'elasticloadbalancing:CreateTargetGroup'
              - 'elasticloadbalancing:AddTags'
              - 'elasticloadbalancing:RegisterTargets'
              - 'elasticloadbalancing:DeleteLoadBalancer'
              - 'elasticloadbalancing:DescribeTargetHealth'
              - 'elasticloadbalancing:DescribeListeners'
              - 'elasticloadbalancing:CreateListener'
              - 'elasticloadbalancing:DescribeRules'
              - 'elasticloadbalancing:CreateRule'
              - 'elasticloadbalancing:DescribeTags'
              - 'elasticloadbalancing:DeleteTargetGroup'
              - 'elasticloadbalancing:DeleteRule'
              - 'elasticloadbalancing:SetRulePriorities'
              - 'elasticloadbalancing:ModifyTargetGroup'
              - 'elasticloadbalancing:ModifyRule'
              - 'elasticloadbalancing:SetSecurityGroups'
              - 'cloudwatch:GetMetricStatistics'
              - 'ec2:DescribeVpcs'
              - 'ec2:DescribeSecurityGroups'
              - 'ec2:DescribeSubnets'
              - 'lambda:GetFunction'
              - 'lambda:CreateFunction'
              - 'lambda:DeleteFunction'
              - 'lambda:AddPermission'
              - 'iam:PassRole'
              - 'iam:ListRoles'
              - 's3:ListBucket'
              - 's3:GetObject'
              - 's3:ListAllMyBuckets'
              - 's3:GetBucketLocation'
              - 'elasticloadbalancing:DescribeLoadBalancerAttributes'
            Resource: "*"
      Roles:
        - !Ref HarnessCloudFormationRole
  HarnessAutostoppingProxyPolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Condition: CreateHarnessAutostoppingProxyPolicy
    Properties:
      Description: Policy granting Harness Access to Enable Proxy based Autostopping
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - 'ec2:DescribeInstanceTypeOfferings'
              - 'ec2:DescribeKeyPairs'
              - 'ec2:RunInstances'
              - 'ec2:AllocateAddress'
              - 'ec2:DescribeVpcs'
              - 'ec2:DescribeSecurityGroups'
              - 'ec2:DescribeSubnets'
              - 'ec2:TerminateInstances'
              - 'ec2:DescribeImages'
              - 'ec2:AssociateAddress'
              - 'ec2:DisassociateAddress'
              - 'ec2:ReleaseAddress'
              - 'ec2:ModifyInstanceAttribute'
              - 'secretsmanager:GetSecretValue'
            Resource: "*"
      Roles:
        - !Ref HarnessCloudFormationRole
  HarnessAutostoppingLambdaPolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Condition: CreateHarnessAutostoppingLambdaPolicy
    Properties:
      Description: Policy granting Harness Run Lambda for Autostopping
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - 'logs:CreateLogGroup'
              - 'logs:CreateLogStream'
              - 'logs:PutLogEvents'
            Resource: "*"
      Roles:
        - !Ref HarnessOptimizationLambdaExecutionRole
  HarnessCommitmentEC2Policy:
    Type: 'AWS::IAM::ManagedPolicy'
    Condition: CreateHarnessCommitmentEC2Policy
    Properties:
      Description: Policy granting Harness Access to EC2 Reserved Instances and Savings Plans
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - 'ec2:ModifyReservedInstances'
              - 'ec2:GetReservedInstancesExchangeQuote'
              - 'ec2:AcceptReservedInstancesExchangeQuote'
              - 'ec2:DescribeReservedInstancesOfferings'
              - 'ec2:DescribeReservedInstances'
              - 'ec2:DescribeReservedInstancesModifications'
              - 'ec2:DescribeInstanceTypeOfferings'
              - 'ec2:PurchaseReservedInstancesOffering'
              - 'ce:GetSavingsPlansCoverage'
              - 'ce:GetReservationCoverage'
              - 'ce:GetSavingsPlansUtilization'
              - 'ce:GetDimensionValues'
              - 'ce:GetReservationUtilization'
              - 'ce:GetSavingsPlansUtilizationDetails'
              - 'ce:GetCostAndUsage'
              - 'savingsplans:DescribeSavingsPlansOfferings'
              - 'savingsplans:CreateSavingsPlan'
              - 'organizations:ListAccounts'
            Resource: '*'
      Roles:
        - !Ref HarnessCloudFormationRole
  HarnessCommitmentRDSPolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Condition: CreateHarnessCommitmentRDSPolicy
    Properties:
      Description: Policy granting Harness Access to RDS Reserved Instances
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - 'ce:GetSavingsPlansCoverage'
              - 'ce:GetReservationCoverage'
              - 'ce:GetSavingsPlansUtilization'
              - 'ce:GetDimensionValues'
              - 'ce:GetReservationUtilization'
              - 'ce:GetSavingsPlansUtilizationDetails'
              - 'ce:GetCostAndUsage'
              - 'organizations:ListAccounts'
              - 'rds:DescribeReservedDBInstances'
              - 'rds:DescribeReservedDBInstancesOfferings'
              - 'rds:PurchaseReservedDBInstancesOffering'
            Resource: '*'
      Roles:
        - !Ref HarnessCloudFormationRole
  HarnessCommitmentElastiCachePolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Condition: CreateHarnessCommitmentElastiCachePolicy
    Properties:
      Description: Policy granting Harness Access to ElastiCache Reserved Instances
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - 'ce:GetSavingsPlansCoverage'
              - 'ce:GetReservationCoverage'
              - 'ce:GetSavingsPlansUtilization'
              - 'ce:GetDimensionValues'
              - 'ce:GetReservationUtilization'
              - 'ce:GetSavingsPlansUtilizationDetails'
              - 'ce:GetCostAndUsage'
              - 'organizations:ListAccounts'
              - 'elasticache:DescribeReservedCacheNodes'
              - 'elasticache:DescribeReservedCacheNodesOfferings'
              - 'elasticache:PurchaseReservedCacheNodesOffering'
            Resource: '*'
      Roles:
        - !Ref HarnessCloudFormationRole
  HarnessCommitmentRDSEC2CombinedPolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Condition: CreateHarnessCommitmentRDSEC2CombinedPolicy
    Properties:
      Description: Policy granting Harness Access to EC2 and RDS Commitment Management
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - 'ec2:ModifyReservedInstances'
              - 'ec2:GetReservedInstancesExchangeQuote'
              - 'ec2:AcceptReservedInstancesExchangeQuote'
              - 'ec2:DescribeReservedInstancesOfferings'
              - 'ec2:DescribeReservedInstances'
              - 'ec2:DescribeReservedInstancesModifications'
              - 'ec2:DescribeInstanceTypeOfferings'
              - 'ec2:PurchaseReservedInstancesOffering'
              - 'savingsplans:DescribeSavingsPlansOfferings'
              - 'savingsplans:CreateSavingsPlan'
              - 'ce:GetSavingsPlansCoverage'
              - 'ce:GetReservationCoverage'
              - 'ce:GetSavingsPlansUtilization'
              - 'ce:GetDimensionValues'
              - 'ce:GetReservationUtilization'
              - 'ce:GetSavingsPlansUtilizationDetails'
              - 'ce:GetCostAndUsage'
              - 'organizations:ListAccounts'
              - 'rds:DescribeReservedDBInstances'
              - 'rds:DescribeReservedDBInstancesOfferings'
              - 'rds:PurchaseReservedDBInstancesOffering'
            Resource: '*'
      Roles:
        - !Ref HarnessCloudFormationRole
  HarnessClusterOrchestratorPolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Condition: CreateHarnessClusterOrchestratorPolicy
    Properties:
      Description: Policy granting Harness Access to Enable Cluster Orchestrator
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - 'eks:ListNodegroups'
              - 'eks:DescribeFargateProfile'
              - 'eks:UntagResource'
              - 'eks:ListTagsForResource'
              - 'eks:ListFargateProfiles'
              - 'eks:DescribeNodegroup'
              - 'eks:DescribeIdentityProviderConfig'
              - 'eks:TagResource'
              - 'eks:AccessKubernetesApi'
              - 'eks:DescribeCluster'
              - 'eks:ListClusters'
              - 'eks:ListIdentityProviderConfigs'
              - 'eks:AssociateIdentityProviderConfig'
            Resource: '*'
      Roles:
        - !Ref HarnessCloudFormationRole
