AWSTemplateFormatVersion: 2010-09-09
Description: IAM role for Datadog AWS Integration
Parameters:
  ExternalId:
    Description: >-
      External ID for the Datadog role (generate at
      https://app.datadoghq.com/account/settings#integrations/amazon-web-services)
    Type: String
  IAMRoleName:
    Description: Customize the name of IAM role for Datadog AWS integration
    Type: String
    Default: DatadogIntegrationRole
  BasePermissions:
    Description: >-
      Customize the base permissions for the Datadog IAM role.
      Select "Core" to only grant Datadog permissions to a very limited set of metrics and metadata (not recommended).
    Type: String
    Default: Full
    AllowedValues:
      - Full
      - Core
  LogArchives:
    Description: >-
      S3 paths to store log archives for log rehydration. Separate multiple paths with comma,
      e.g., "my-bucket,my-bucket-with-path/path".
    Type: String
    Default: ''
  CloudTrails:
    Description: >-
      S3 buckets for the Datadog CloudTrail integration. Separate multiple buckets with commas,
      e.g., "bucket1,bucket2". Permissions will be automatically added to the Datadog integration IAM role.
      https://docs.datadoghq.com/integrations/amazon_cloudtrail/
    Type: String
    Default: ''
  CloudSecurityPostureManagementPermissions:
    Type: String
    Default: false
    AllowedValues:
      - true
      - false
    Description: >-
      Set this value to "true" to add permissions for Datadog's Cloud Security Posture Management product
      to monitor your AWS cloud resource configurations.
      You need this set to "true" to use Cloud Security Posture Management. You will also need "BasePermissions" set to "Full".
  DdAWSAccountId:
    Description: >-
      Datadog AWS account ID allowed to assume the integration IAM role. DO NOT CHANGE!
    Type: String
    Default: '464622532012'
Conditions:
  GrantFullPermissions:
    Fn::Equals:
      - Ref: BasePermissions
      - Full
  ShouldInstallCSPMPolicy:
    Fn::Equals:
      - Ref: CloudSecurityPostureManagementPermissions
      - true
Resources:
  DatadogIntegrationRole:
    Type: 'AWS::IAM::Role'
    Metadata:
      cfn-lint:
        config:
          # cfn-lint does not yet support "Fn::Transform"
          ignore_checks:
            - E3002
            - E3003
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub
                - 'arn:aws:iam::${DdAWSAccountId}:root'
                - { DdAWSAccountId: !Ref DdAWSAccountId }
            Action:
              - 'sts:AssumeRole'
            Condition:
              StringEquals:
                'sts:ExternalId': !Ref ExternalId
      Path: /
      RoleName: !Ref IAMRoleName
      ManagedPolicyArns:
        !If [
          ShouldInstallCSPMPolicy,
          ['arn:aws:iam::aws:policy/SecurityAudit'],
          !Ref AWS::NoValue,
        ]
      Policies:
        - PolicyName: DatadogAWSIntegrationPolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - !If
                - GrantFullPermissions
                - Effect: Allow
                  Resource: '*'
                  Action:
                    - 'account:GetAccountInformation'
                    - 'airflow:GetEnvironment'
                    - 'airflow:ListEnvironments'
                    - 'apigateway:GET'
                    - 'appsync:ListGraphqlApis'
                    - 'autoscaling:Describe*'
                    - 'backup:List*'
                    - 'batch:DescribeJobDefinitions'
                    - 'bcm-data-exports:GetExport'
                    - 'bcm-data-exports:ListExports'
                    - 'budgets:ViewBudget'
                    - 'cloudfront:GetDistributionConfig'
                    - 'cloudfront:ListDistributions'
                    - 'cloudtrail:DescribeTrails'
                    - 'cloudtrail:GetTrail'
                    - 'cloudtrail:GetTrailStatus'
                    - 'cloudtrail:ListTrails'
                    - 'cloudtrail:LookupEvents'
                    - 'cloudwatch:Describe*'
                    - 'cloudwatch:Get*'
                    - 'cloudwatch:List*'
                    - 'codebuild:BatchGetProjects'
                    - 'codebuild:ListProjects'
                    - 'codedeploy:BatchGet*'
                    - 'codedeploy:List*'
                    - 'cur:DescribeReportDefinitions'
                    - 'directconnect:Describe*'
                    - 'dms:DescribeReplicationInstances'
                    - 'dynamodb:Describe*'
                    - 'dynamodb:List*'
                    - 'ec2:Describe*'
                    - 'ecs:Describe*'
                    - 'ecs:List*'
                    - 'eks:DescribeCluster'
                    - 'eks:ListClusters'
                    - 'elasticache:Describe*'
                    - 'elasticache:List*'
                    - 'elasticfilesystem:DescribeAccessPoints'
                    - 'elasticfilesystem:DescribeFileSystems'
                    - 'elasticfilesystem:DescribeTags'
                    - 'elasticloadbalancing:Describe*'
                    - 'elasticmapreduce:Describe*'
                    - 'elasticmapreduce:List*'
                    - 'es:DescribeElasticsearchDomains'
                    - 'es:ListDomainNames'
                    - 'es:ListTags'
                    - 'events:CreateEventBus'
                    - 'fsx:DescribeFileSystems'
                    - 'fsx:ListTagsForResource'
                    - 'health:DescribeAffectedEntities'
                    - 'health:DescribeEventDetails'
                    - 'health:DescribeEvents'
                    - 'iam:ListAccountAliases'
                    - 'kinesis:Describe*'
                    - 'kinesis:List*'
                    - 'lambda:List*'
                    - 'logs:DeleteSubscriptionFilter'
                    - 'logs:DescribeDeliveries'
                    - 'logs:DescribeDeliverySources'
                    - 'logs:DescribeLogGroups'
                    - 'logs:DescribeLogStreams'
                    - 'logs:DescribeSubscriptionFilters'
                    - 'logs:FilterLogEvents'
                    - 'logs:GetDeliveryDestination'
                    - 'logs:PutSubscriptionFilter'
                    - 'logs:TestMetricFilter'
                    - 'network-firewall:DescribeLoggingConfiguration'
                    - 'network-firewall:ListFirewalls'
                    - 'oam:ListAttachedLinks'
                    - 'oam:ListSinks'
                    - 'organizations:Describe*'
                    - 'organizations:List*'
                    - 'rds:Describe*'
                    - 'rds:List*'
                    - 'redshift-serverless:ListNamespaces'
                    - 'redshift:DescribeClusters'
                    - 'redshift:DescribeLoggingStatus'
                    - 'route53:List*'
                    - 'route53resolver:ListResolverQueryLogConfigs'
                    - 's3:GetBucketLocation'
                    - 's3:GetBucketLogging'
                    - 's3:GetBucketNotification'
                    - 's3:GetBucketTagging'
                    - 's3:ListAllMyBuckets'
                    - 's3:PutBucketNotification'
                    - 'ses:Get*'
                    - 'ses:List*'
                    - 'sns:GetSubscriptionAttributes'
                    - 'sns:List*'
                    - 'sns:Publish'
                    - 'sqs:ListQueues'
                    - 'ssm:GetServiceSetting'
                    - 'ssm:ListCommands'
                    - 'states:DescribeStateMachine'
                    - 'states:ListStateMachines'
                    - 'support:DescribeTrustedAdvisor*'
                    - 'support:RefreshTrustedAdvisorCheck'
                    - 'tag:GetResources'
                    - 'tag:GetTagKeys'
                    - 'tag:GetTagValues'
                    - 'timestream:DescribeEndpoints'
                    - 'wafv2:ListLoggingConfigurations'
                    - 'xray:BatchGetTraces'
                    - 'xray:GetTraceSummaries'
                - Effect: Allow
                  Resource: '*'
                  Action:
                    - 'cloudwatch:Get*'
                    - 'cloudwatch:List*'
                    - 'ec2:Describe*'
                    - 'tag:GetResources'
                    - 'tag:GetTagKeys'
                    - 'tag:GetTagValues'
        - Fn::Transform:
            - Name: 'DatadogPolicy'
              Parameters:
                PolicyType: LogArchive
                LogArchives: !Ref LogArchives
        - Fn::Transform:
            - Name: 'DatadogPolicy'
              Parameters:
                PolicyType: CloudTrail
                CloudTrails: !Ref CloudTrails
  DatadogIntegrationRoleManagedPolicy1:
    Type: 'AWS::IAM::ManagedPolicy'
    Condition: GrantFullPermissions
    Properties:
      ManagedPolicyName: !Sub
        - '${IAMRoleName}-ManagedPolicy-1'
        - { IAMRoleName: !Ref IAMRoleName }
      Roles:
        - !Ref DatadogIntegrationRole
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Resource: '*'
            Action:
              - 'account:GetContactInformation'
              - 'amplify:ListApps'
              - 'amplify:ListBackendEnvironments'
              - 'amplify:ListBranches'
              - 'amplify:ListDomainAssociations'
              - 'amplify:ListJobs'
              - 'amplify:ListWebhooks'
              - 'aoss:BatchGetCollection'
              - 'aoss:ListCollections'
              - 'app-integrations:GetApplication'
              - 'app-integrations:GetDataIntegration'
              - 'app-integrations:ListApplicationAssociations'
              - 'app-integrations:ListApplications'
              - 'app-integrations:ListDataIntegrationAssociations'
              - 'app-integrations:ListDataIntegrations'
              - 'app-integrations:ListEventIntegrationAssociations'
              - 'app-integrations:ListEventIntegrations'
              - 'appflow:DescribeConnector'
              - 'appflow:DescribeConnectorProfiles'
              - 'appflow:DescribeFlow'
              - 'appflow:ListConnectors'
              - 'application-signals:GetServiceLevelObjective'
              - 'application-signals:ListServiceLevelObjectives'
              - 'appstream:DescribeAppBlockBuilders'
              - 'appstream:DescribeAppBlocks'
              - 'appstream:DescribeApplications'
              - 'appstream:DescribeFleets'
              - 'appstream:DescribeImageBuilders'
              - 'appstream:DescribeImages'
              - 'appstream:DescribeStacks'
              - 'appsync:GetGraphqlApi'
              - 'aps:DescribeRuleGroupsNamespace'
              - 'aps:DescribeScraper'
              - 'aps:DescribeWorkspace'
              - 'aps:ListRuleGroupsNamespaces'
              - 'aps:ListScrapers'
              - 'aps:ListWorkspaces'
              - 'athena:BatchGetNamedQuery'
              - 'athena:BatchGetPreparedStatement'
              - 'auditmanager:GetAssessment'
              - 'auditmanager:GetAssessmentFramework'
              - 'auditmanager:GetControl'
              - 'b2bi:GetCapability'
              - 'b2bi:GetPartnership'
              - 'b2bi:GetProfile'
              - 'b2bi:GetTransformer'
              - 'b2bi:ListCapabilities'
              - 'b2bi:ListPartnerships'
              - 'b2bi:ListProfiles'
              - 'b2bi:ListTransformers'
              - 'backup-gateway:GetGateway'
              - 'backup-gateway:GetHypervisor'
              - 'backup-gateway:GetVirtualMachine'
              - 'backup-gateway:ListGateways'
              - 'backup-gateway:ListHypervisors'
              - 'backup-gateway:ListVirtualMachines'
              - 'backup:DescribeFramework'
              - 'backup:GetLegalHold'
              - 'backup:ListBackupPlans'
              - 'backup:ListFrameworks'
              - 'backup:ListLegalHolds'
              - 'backup:ListProtectedResources'
              - 'backup:ListRecoveryPointsByBackupVault'
              - 'batch:DescribeJobQueues'
              - 'batch:DescribeJobs'
              - 'batch:DescribeSchedulingPolicies'
              - 'batch:ListJobs'
              - 'batch:ListSchedulingPolicies'
              - 'bedrock:GetAgent'
              - 'bedrock:GetAgentActionGroup'
              - 'bedrock:GetAsyncInvoke'
              - 'bedrock:GetBlueprint'
              - 'bedrock:GetDataSource'
              - 'bedrock:GetEvaluationJob'
              - 'bedrock:GetFlow'
              - 'bedrock:GetFlowVersion'
              - 'bedrock:GetGuardrail'
              - 'bedrock:GetKnowledgeBase'
              - 'bedrock:GetModelInvocationJob'
              - 'bedrock:GetPrompt'
              - 'bedrock:ListAgentCollaborators'
              - 'bedrock:ListAsyncInvokes'
              - 'bedrock:ListBlueprints'
              - 'bedrock:ListKnowledgeBaseDocuments'
              - 'billingconductor:ListBillingGroups'
              - 'billingconductor:ListCustomLineItems'
              - 'billingconductor:ListPricingPlans'
              - 'billingconductor:ListPricingRules'
              - 'cassandra:Select'
              - 'ce:DescribeCostCategoryDefinition'
              - 'ce:GetAnomalyMonitors'
              - 'ce:GetAnomalySubscriptions'
              - 'ce:GetCostCategories'
              - 'cloudformation:DescribeGeneratedTemplate'
              - 'cloudformation:DescribeResourceScan'
              - 'cloudformation:ListGeneratedTemplates'
              - 'cloudformation:ListResourceScans'
              - 'cloudformation:ListTypes'
              - 'cloudhsm:DescribeBackups'
              - 'cloudhsm:DescribeClusters'
              - 'codeartifact:DescribeDomain'
              - 'codeartifact:DescribePackageGroup'
              - 'codeartifact:DescribeRepository'
              - 'codeartifact:ListDomains'
              - 'codeartifact:ListPackageGroups'
              - 'codeartifact:ListPackages'
              - 'codeguru-profiler:ListFindingsReports'
              - 'codeguru-profiler:ListProfilingGroups'
              - 'codeguru-reviewer:ListCodeReviews'
              - 'codeguru-reviewer:ListRepositoryAssociations'
              - 'codeguru-security:GetFindings'
              - 'codeguru-security:GetScan'
              - 'codeguru-security:ListScans'
              - 'codepipeline:GetActionType'
              - 'codepipeline:ListActionTypes'
              - 'codepipeline:ListWebhooks'
              - 'connect:DescribeAgentStatus'
              - 'connect:DescribeAuthenticationProfile'
              - 'connect:DescribeContactFlow'
              - 'connect:DescribeContactFlowModule'
              - 'connect:DescribeHoursOfOperation'
              - 'connect:DescribeInstance'
              - 'connect:DescribeQueue'
              - 'connect:DescribeQuickConnect'
              - 'connect:DescribeRoutingProfile'
              - 'connect:DescribeSecurityProfile'
              - 'connect:DescribeUser'
              - 'connect:ListAgentStatuses'
              - 'connect:ListAuthenticationProfiles'
              - 'connect:ListContactFlowModules'
              - 'connect:ListContactFlows'
              - 'connect:ListHoursOfOperations'
              - 'connect:ListQueues'
              - 'connect:ListQuickConnects'
              - 'connect:ListRoutingProfiles'
              - 'connect:ListSecurityProfiles'
              - 'connect:ListUsers'
              - 'controltower:GetLandingZone'
              - 'controltower:ListEnabledBaselines'
              - 'controltower:ListEnabledControls'
              - 'controltower:ListLandingZones'
              - 'databrew:ListDatasets'
              - 'databrew:ListRecipes'
              - 'databrew:ListRulesets'
              - 'databrew:ListSchedules'
              - 'datazone:GetDomain'
              - 'datazone:ListDomains'
              - 'deadline:GetBudget'
              - 'deadline:GetLicenseEndpoint'
              - 'deadline:GetQueue'
              - 'deadline:ListBudgets'
              - 'deadline:ListFarms'
              - 'deadline:ListFleets'
              - 'deadline:ListLicenseEndpoints'
              - 'deadline:ListMonitors'
              - 'deadline:ListQueues'
              - 'deadline:ListWorkers'
              - 'devicefarm:ListDeviceInstances'
              - 'devicefarm:ListDevicePools'
              - 'devicefarm:ListDevices'
              - 'devicefarm:ListInstanceProfiles'
              - 'devicefarm:ListNetworkProfiles'
              - 'devicefarm:ListRemoteAccessSessions'
              - 'devicefarm:ListTestGridProjects'
              - 'devicefarm:ListTestGridSessions'
              - 'devicefarm:ListUploads'
              - 'devicefarm:ListVPCEConfigurations'
              - 'dlm:GetLifecyclePolicies'
              - 'dlm:GetLifecyclePolicy'
              - 'docdb-elastic:GetCluster'
              - 'docdb-elastic:GetClusterSnapshot'
              - 'docdb-elastic:ListClusterSnapshots'
              - 'drs:DescribeJobs'
              - 'drs:DescribeLaunchConfigurationTemplates'
              - 'drs:DescribeRecoveryInstances'
              - 'drs:DescribeReplicationConfigurationTemplates'
              - 'drs:DescribeSourceNetworks'
              - 'drs:DescribeSourceServers'
              - 'dsql:GetCluster'
              - 'dsql:ListClusters'
              - 'dynamodb:DescribeBackup'
              - 'dynamodb:DescribeStream'
              - 'ec2:GetAllowedImagesSettings'
              - 'ec2:GetEbsDefaultKmsKeyId'
              - 'ec2:GetInstanceMetadataDefaults'
              - 'ec2:GetSerialConsoleAccessStatus'
              - 'ec2:GetSnapshotBlockPublicAccessState'
              - 'ec2:GetVerifiedAccessEndpointPolicy'
  DatadogIntegrationRoleManagedPolicy2:
    Type: 'AWS::IAM::ManagedPolicy'
    Condition: GrantFullPermissions
    Properties:
      ManagedPolicyName: !Sub
        - '${IAMRoleName}-ManagedPolicy-2'
        - { IAMRoleName: !Ref IAMRoleName }
      Roles:
        - !Ref DatadogIntegrationRole
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Resource: '*'
            Action:
              - 'ec2:GetVerifiedAccessEndpointTargets'
              - 'ec2:GetVerifiedAccessGroupPolicy'
              - 'eks:DescribeAccessEntry'
              - 'eks:DescribeAddon'
              - 'eks:DescribeIdentityProviderConfig'
              - 'eks:DescribeInsight'
              - 'eks:DescribePodIdentityAssociation'
              - 'eks:DescribeUpdate'
              - 'eks:ListAccessEntries'
              - 'eks:ListAddons'
              - 'eks:ListAssociatedAccessPolicies'
              - 'eks:ListEksAnywhereSubscriptions'
              - 'eks:ListIdentityProviderConfigs'
              - 'eks:ListInsights'
              - 'eks:ListPodIdentityAssociations'
              - 'elasticmapreduce:ListInstanceFleets'
              - 'elasticmapreduce:ListInstanceGroups'
              - 'emr-containers:ListManagedEndpoints'
              - 'emr-containers:ListSecurityConfigurations'
              - 'emr-containers:ListVirtualClusters'
              - 'fis:GetAction'
              - 'fis:GetExperiment'
              - 'fis:GetExperimentTemplate'
              - 'fis:ListActions'
              - 'fis:ListExperimentTemplates'
              - 'fis:ListExperiments'
              - 'frauddetector:DescribeDetector'
              - 'frauddetector:DescribeModelVersions'
              - 'frauddetector:GetBatchImportJobs'
              - 'frauddetector:GetBatchPredictionJobs'
              - 'frauddetector:GetDetectorVersion'
              - 'frauddetector:GetEntityTypes'
              - 'frauddetector:GetEventTypes'
              - 'frauddetector:GetExternalModels'
              - 'frauddetector:GetLabels'
              - 'frauddetector:GetListsMetadata'
              - 'frauddetector:GetModels'
              - 'frauddetector:GetOutcomes'
              - 'frauddetector:GetRules'
              - 'frauddetector:GetVariables'
              - 'gamelift:DescribeGameSessionQueues'
              - 'gamelift:DescribeMatchmakingConfigurations'
              - 'gamelift:DescribeMatchmakingRuleSets'
              - 'gamelift:ListAliases'
              - 'gamelift:ListContainerFleets'
              - 'gamelift:ListContainerGroupDefinitions'
              - 'gamelift:ListGameServerGroups'
              - 'gamelift:ListLocations'
              - 'gamelift:ListScripts'
              - 'geo:DescribeGeofenceCollection'
              - 'geo:DescribeKey'
              - 'geo:DescribeMap'
              - 'geo:DescribePlaceIndex'
              - 'geo:DescribeRouteCalculator'
              - 'geo:DescribeTracker'
              - 'geo:ListGeofenceCollections'
              - 'geo:ListKeys'
              - 'geo:ListPlaceIndexes'
              - 'geo:ListRouteCalculators'
              - 'geo:ListTrackers'
              - 'glacier:GetVaultNotifications'
              - 'glue:ListRegistries'
              - 'grafana:DescribeWorkspace'
              - 'greengrass:GetBulkDeploymentStatus'
              - 'greengrass:GetComponent'
              - 'greengrass:GetConnectivityInfo'
              - 'greengrass:GetCoreDevice'
              - 'greengrass:GetDeployment'
              - 'greengrass:GetGroup'
              - 'imagebuilder:GetContainerRecipe'
              - 'imagebuilder:GetDistributionConfiguration'
              - 'imagebuilder:GetImageRecipe'
              - 'imagebuilder:GetInfrastructureConfiguration'
              - 'imagebuilder:GetLifecyclePolicy'
              - 'imagebuilder:GetWorkflow'
              - 'imagebuilder:ListComponents'
              - 'imagebuilder:ListContainerRecipes'
              - 'imagebuilder:ListDistributionConfigurations'
              - 'imagebuilder:ListImagePipelines'
              - 'imagebuilder:ListImageRecipes'
              - 'imagebuilder:ListImages'
              - 'imagebuilder:ListInfrastructureConfigurations'
              - 'imagebuilder:ListLifecyclePolicies'
              - 'imagebuilder:ListWorkflows'
              - 'iotfleetwise:GetCampaign'
              - 'iotfleetwise:GetSignalCatalog'
              - 'iotfleetwise:GetStateTemplate'
              - 'iotfleetwise:GetVehicle'
              - 'iotfleetwise:ListCampaigns'
              - 'iotfleetwise:ListDecoderManifests'
              - 'iotfleetwise:ListFleets'
              - 'iotfleetwise:ListSignalCatalogs'
              - 'iotfleetwise:ListStateTemplates'
              - 'iotfleetwise:ListVehicles'
              - 'iotsitewise:DescribeAsset'
              - 'iotsitewise:DescribeAssetModel'
              - 'iotsitewise:DescribeDashboard'
              - 'iotsitewise:DescribeDataset'
              - 'iotsitewise:DescribePortal'
              - 'iotsitewise:DescribeProject'
              - 'iotsitewise:ListAssets'
              - 'iotsitewise:ListDashboards'
              - 'iotsitewise:ListDatasets'
              - 'iotsitewise:ListPortals'
              - 'iotsitewise:ListProjects'
              - 'iotsitewise:ListTimeSeries'
              - 'iottwinmaker:GetComponentType'
              - 'iottwinmaker:GetEntity'
              - 'iottwinmaker:GetScene'
              - 'iottwinmaker:GetWorkspace'
              - 'iottwinmaker:ListComponentTypes'
              - 'iottwinmaker:ListEntities'
              - 'iottwinmaker:ListScenes'
              - 'iotwireless:GetDeviceProfile'
              - 'iotwireless:GetMulticastGroup'
              - 'iotwireless:GetNetworkAnalyzerConfiguration'
              - 'iotwireless:GetServiceProfile'
              - 'iotwireless:GetWirelessDevice'
              - 'iotwireless:GetWirelessGateway'
              - 'iotwireless:ListDestinations'
              - 'iotwireless:ListDeviceProfiles'
              - 'iotwireless:ListMulticastGroups'
              - 'iotwireless:ListNetworkAnalyzerConfigurations'
              - 'iotwireless:ListServiceProfiles'
              - 'iotwireless:ListWirelessDevices'
              - 'iotwireless:ListWirelessGateways'
              - 'ivs:GetChannel'
              - 'ivs:GetComposition'
              - 'ivs:GetEncoderConfiguration'
              - 'ivs:GetIngestConfiguration'
              - 'ivs:GetPublicKey'
              - 'ivs:GetRecordingConfiguration'
              - 'ivs:GetStage'
              - 'ivs:ListChannels'
              - 'ivs:ListCompositions'
              - 'ivs:ListEncoderConfigurations'
              - 'ivs:ListIngestConfigurations'
              - 'ivs:ListPlaybackKeyPairs'
              - 'ivs:ListPlaybackRestrictionPolicies'
              - 'ivs:ListPublicKeys'
              - 'ivs:ListRecordingConfigurations'
              - 'ivs:ListStages'
              - 'ivs:ListStorageConfigurations'
              - 'ivs:ListStreamKeys'
              - 'ivschat:GetLoggingConfiguration'
              - 'ivschat:GetRoom'
              - 'ivschat:ListLoggingConfigurations'
              - 'ivschat:ListRooms'
              - 'kendra:DescribeAccessControlConfiguration'
              - 'kendra:DescribeDataSource'
              - 'kendra:DescribeExperience'
              - 'kendra:DescribeFaq'
              - 'kendra:DescribeFeaturedResultsSet'
              - 'kendra:DescribeQuerySuggestionsBlockList'
              - 'kendra:DescribeThesaurus'
              - 'kendra:ListAccessControlConfigurations'
              - 'kendra:ListExperiences'
              - 'kendra:ListFaqs'
              - 'kendra:ListFeaturedResultsSets'
              - 'kendra:ListQuerySuggestionsBlockLists'
              - 'kendra:ListThesauri'
              - 'lakeformation:GetDataLakeSettings'
              - 'lakeformation:ListPermissions'
              - 'lambda:GetFunction'
              - 'launchwizard:GetDeployment'
              - 'launchwizard:ListDeployments'
              - 'lightsail:GetAlarms'
              - 'lightsail:GetCertificates'
              - 'lightsail:GetDistributions'
              - 'lightsail:GetInstancePortStates'
              - 'lightsail:GetRelationalDatabaseParameters'
              - 'lightsail:GetRelationalDatabaseSnapshots'
              - 'lightsail:GetRelationalDatabases'
              - 'lightsail:GetStaticIps'
              - 'macie2:GetAllowList'
              - 'macie2:GetCustomDataIdentifier'
              - 'macie2:GetMacieSession'
              - 'macie2:ListAllowLists'
              - 'macie2:ListCustomDataIdentifiers'
              - 'macie2:ListMembers'
              - 'managedblockchain:GetAccessor'
              - 'managedblockchain:GetMember'
              - 'managedblockchain:GetNetwork'
              - 'managedblockchain:GetNode'
              - 'managedblockchain:GetProposal'
  DatadogIntegrationRoleManagedPolicy3:
    Type: 'AWS::IAM::ManagedPolicy'
    Condition: GrantFullPermissions
    Properties:
      ManagedPolicyName: !Sub
        - '${IAMRoleName}-ManagedPolicy-3'
        - { IAMRoleName: !Ref IAMRoleName }
      Roles:
        - !Ref DatadogIntegrationRole
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Resource: '*'
            Action:
              - 'managedblockchain:ListAccessors'
              - 'managedblockchain:ListInvitations'
              - 'managedblockchain:ListMembers'
              - 'managedblockchain:ListNodes'
              - 'managedblockchain:ListProposals'
              - 'mediaconvert:ListJobTemplates'
              - 'mediaconvert:ListPresets'
              - 'mediaconvert:ListQueues'
              - 'medialive:ListChannelPlacementGroups'
              - 'medialive:ListCloudWatchAlarmTemplateGroups'
              - 'medialive:ListCloudWatchAlarmTemplates'
              - 'medialive:ListClusters'
              - 'medialive:ListEventBridgeRuleTemplateGroups'
              - 'medialive:ListEventBridgeRuleTemplates'
              - 'medialive:ListInputDevices'
              - 'medialive:ListInputSecurityGroups'
              - 'medialive:ListInputs'
              - 'medialive:ListMultiplexes'
              - 'medialive:ListNetworks'
              - 'medialive:ListNodes'
              - 'medialive:ListReservations'
              - 'medialive:ListSdiSources'
              - 'medialive:ListSignalMaps'
              - 'mediapackage-vod:DescribeAsset'
              - 'mediapackage-vod:ListAssets'
              - 'mediapackage-vod:ListPackagingConfigurations'
              - 'mediapackage:ListChannels'
              - 'mediapackage:ListHarvestJobs'
              - 'mediapackagev2:GetChannel'
              - 'mediapackagev2:GetChannelGroup'
              - 'mediapackagev2:GetChannelPolicy'
              - 'mediapackagev2:GetOriginEndpoint'
              - 'mediapackagev2:GetOriginEndpointPolicy'
              - 'mediapackagev2:ListChannelGroups'
              - 'mediapackagev2:ListChannels'
              - 'mediapackagev2:ListHarvestJobs'
              - 'mediapackagev2:ListOriginEndpoints'
              - 'mediatailor:ListChannels'
              - 'mediatailor:ListLiveSources'
              - 'mediatailor:ListPlaybackConfigurations'
              - 'mediatailor:ListPrefetchSchedules'
              - 'mediatailor:ListSourceLocations'
              - 'mediatailor:ListVodSources'
              - 'memorydb:DescribeAcls'
              - 'memorydb:DescribeMultiRegionClusters'
              - 'memorydb:DescribeParameterGroups'
              - 'memorydb:DescribeReservedNodes'
              - 'memorydb:DescribeSnapshots'
              - 'memorydb:DescribeSubnetGroups'
              - 'memorydb:DescribeUsers'
              - 'mobiletargeting:GetApps'
              - 'mobiletargeting:GetCampaigns'
              - 'mobiletargeting:GetChannels'
              - 'mobiletargeting:GetEventStream'
              - 'mobiletargeting:GetSegments'
              - 'mobiletargeting:ListJourneys'
              - 'mobiletargeting:ListTemplates'
              - 'network-firewall:DescribeTLSInspectionConfiguration'
              - 'network-firewall:DescribeVpcEndpointAssociation'
              - 'network-firewall:ListTLSInspectionConfigurations'
              - 'network-firewall:ListVpcEndpointAssociations'
              - 'networkmanager:GetConnectPeer'
              - 'networkmanager:GetConnections'
              - 'networkmanager:GetCoreNetwork'
              - 'networkmanager:GetDevices'
              - 'networkmanager:GetLinks'
              - 'networkmanager:GetSites'
              - 'networkmanager:ListAttachments'
              - 'networkmanager:ListConnectPeers'
              - 'networkmanager:ListCoreNetworks'
              - 'networkmanager:ListPeerings'
              - 'omics:GetAnnotationStore'
              - 'omics:GetAnnotationStoreVersion'
              - 'omics:GetSequenceStore'
              - 'omics:GetVariantStore'
              - 'omics:GetWorkflow'
              - 'omics:GetWorkflowVersion'
              - 'omics:ListAnnotationStoreVersions'
              - 'omics:ListAnnotationStores'
              - 'omics:ListReadSets'
              - 'omics:ListReferenceStores'
              - 'omics:ListReferences'
              - 'omics:ListSequenceStores'
              - 'omics:ListVariantStores'
              - 'omics:ListWorkflowVersions'
              - 'omics:ListWorkflows'
              - 'osis:GetPipeline'
              - 'osis:GetPipelineBlueprint'
              - 'osis:ListPipelineBlueprints'
              - 'osis:ListPipelines'
              - 'outposts:ListOutposts'
              - 'outposts:ListSites'
              - 'payment-cryptography:GetKey'
              - 'payment-cryptography:ListAliases'
              - 'payment-cryptography:ListKeys'
              - 'pca-connector-ad:ListConnectors'
              - 'pca-connector-ad:ListDirectoryRegistrations'
              - 'pca-connector-ad:ListTemplates'
              - 'pca-connector-scep:ListConnectors'
              - 'personalize:DescribeAlgorithm'
              - 'personalize:DescribeBatchInferenceJob'
              - 'personalize:DescribeBatchSegmentJob'
              - 'personalize:DescribeCampaign'
              - 'personalize:DescribeDataDeletionJob'
              - 'personalize:DescribeDataset'
              - 'personalize:DescribeDatasetExportJob'
              - 'personalize:DescribeDatasetImportJob'
              - 'personalize:DescribeEventTracker'
              - 'personalize:DescribeFeatureTransformation'
              - 'personalize:DescribeFilter'
              - 'personalize:DescribeMetricAttribution'
              - 'personalize:DescribeRecipe'
              - 'personalize:DescribeRecommender'
              - 'personalize:DescribeSchema'
              - 'personalize:DescribeSolution'
              - 'personalize:ListBatchInferenceJobs'
              - 'personalize:ListBatchSegmentJobs'
              - 'personalize:ListCampaigns'
              - 'personalize:ListDataDeletionJobs'
              - 'personalize:ListDatasetExportJobs'
              - 'personalize:ListDatasetImportJobs'
              - 'personalize:ListDatasets'
              - 'personalize:ListEventTrackers'
              - 'personalize:ListFilters'
              - 'personalize:ListMetricAttributions'
              - 'personalize:ListRecipes'
              - 'personalize:ListRecommenders'
              - 'personalize:ListSchemas'
              - 'personalize:ListSolutions'
              - 'pipes:ListPipes'
              - 'proton:GetComponent'
              - 'proton:GetDeployment'
              - 'proton:GetEnvironment'
              - 'proton:GetEnvironmentAccountConnection'
              - 'proton:GetEnvironmentTemplate'
              - 'proton:GetEnvironmentTemplateVersion'
              - 'proton:GetRepository'
              - 'proton:GetService'
              - 'proton:GetServiceInstance'
              - 'proton:GetServiceTemplate'
              - 'proton:GetServiceTemplateVersion'
              - 'proton:ListComponents'
              - 'proton:ListDeployments'
              - 'proton:ListEnvironmentAccountConnections'
              - 'proton:ListEnvironmentTemplateVersions'
              - 'proton:ListEnvironmentTemplates'
              - 'proton:ListEnvironments'
              - 'proton:ListRepositories'
              - 'proton:ListServiceInstances'
              - 'proton:ListServiceTemplateVersions'
              - 'proton:ListServiceTemplates'
              - 'proton:ListServices'
              - 'qbusiness:GetApplication'
              - 'qbusiness:GetDataAccessor'
              - 'qbusiness:GetDataSource'
              - 'qbusiness:GetIndex'
              - 'qbusiness:GetPlugin'
              - 'qbusiness:GetRetriever'
              - 'qbusiness:GetWebExperience'
              - 'qbusiness:ListDataAccessors'
              - 'ram:GetResourceShareInvitations'
              - 'rbin:GetRule'
              - 'rbin:ListRules'
              - 'redshift-serverless:GetSnapshot'
              - 'redshift-serverless:ListEndpointAccess'
              - 'redshift-serverless:ListManagedWorkgroups'
              - 'redshift-serverless:ListNamespaces'
              - 'redshift-serverless:ListRecoveryPoints'
              - 'redshift-serverless:ListSnapshots'
              - 'refactor-spaces:ListApplications'
              - 'refactor-spaces:ListEnvironments'
              - 'refactor-spaces:ListRoutes'
              - 'refactor-spaces:ListServices'
  DatadogIntegrationRoleManagedPolicy4:
    Type: 'AWS::IAM::ManagedPolicy'
    Condition: GrantFullPermissions
    Properties:
      ManagedPolicyName: !Sub
        - '${IAMRoleName}-ManagedPolicy-4'
        - { IAMRoleName: !Ref IAMRoleName }
      Roles:
        - !Ref DatadogIntegrationRole
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Resource: '*'
            Action:
              - 'resiliencehub:DescribeApp'
              - 'resiliencehub:DescribeAppAssessment'
              - 'resiliencehub:ListAppAssessments'
              - 'resiliencehub:ListApps'
              - 'resiliencehub:ListResiliencyPolicies'
              - 'resource-explorer-2:GetIndex'
              - 'resource-explorer-2:GetManagedView'
              - 'resource-explorer-2:GetView'
              - 'resource-explorer-2:ListManagedViews'
              - 'resource-explorer-2:ListViews'
              - 'resource-groups:GetGroup'
              - 'resource-groups:ListGroups'
              - 'route53-recovery-readiness:ListCells'
              - 'route53-recovery-readiness:ListReadinessChecks'
              - 'route53-recovery-readiness:ListRecoveryGroups'
              - 'route53-recovery-readiness:ListResourceSets'
              - 'route53profiles:GetProfile'
              - 'route53profiles:ListProfileAssociations'
              - 'route53profiles:ListProfiles'
              - 'rum:GetAppMonitor'
              - 'rum:ListAppMonitors'
              - 's3-outposts:ListRegionalBuckets'
              - 'scheduler:GetSchedule'
              - 'scheduler:ListScheduleGroups'
              - 'scheduler:ListSchedules'
              - 'securitylake:ListDataLakes'
              - 'securitylake:ListSubscribers'
              - 'serverlessrepo:GetApplication'
              - 'servicecatalog:DescribePortfolio'
              - 'servicecatalog:DescribeProduct'
              - 'servicecatalog:GetApplication'
              - 'servicecatalog:GetAttributeGroup'
              - 'servicecatalog:ListApplications'
              - 'servicecatalog:ListAttributeGroups'
              - 'servicecatalog:ListPortfolios'
              - 'servicecatalog:SearchProducts'
              - 'servicediscovery:GetNamespace'
              - 'servicediscovery:GetService'
              - 'servicediscovery:ListNamespaces'
              - 'servicediscovery:ListServices'
              - 'ses:GetArchive'
              - 'ses:GetContactList'
              - 'ses:GetCustomVerificationEmailTemplate'
              - 'ses:GetDedicatedIpPool'
              - 'ses:GetIdentityMailFromDomainAttributes'
              - 'ses:GetIngressPoint'
              - 'ses:GetMultiRegionEndpoint'
              - 'ses:GetRelay'
              - 'ses:GetRuleSet'
              - 'ses:GetTemplate'
              - 'ses:GetTrafficPolicy'
              - 'ses:ListAddonInstances'
              - 'ses:ListAddonSubscriptions'
              - 'ses:ListAddressLists'
              - 'ses:ListArchives'
              - 'ses:ListContactLists'
              - 'ses:ListCustomVerificationEmailTemplates'
              - 'ses:ListIngressPoints'
              - 'ses:ListMultiRegionEndpoints'
              - 'ses:ListRelays'
              - 'ses:ListRuleSets'
              - 'ses:ListTemplates'
              - 'ses:ListTrafficPolicies'
              - 'signer:GetSigningProfile'
              - 'signer:ListSigningProfiles'
              - 'sms-voice:DescribeConfigurationSets'
              - 'sms-voice:DescribeOptOutLists'
              - 'sms-voice:DescribePhoneNumbers'
              - 'sms-voice:DescribePools'
              - 'sms-voice:DescribeProtectConfigurations'
              - 'sms-voice:DescribeRegistrationAttachments'
              - 'sms-voice:DescribeRegistrations'
              - 'sms-voice:DescribeSenderIds'
              - 'sms-voice:DescribeVerifiedDestinationNumbers'
              - 'snowball:DescribeCluster'
              - 'snowball:DescribeJob'
              - 'sns:ListPlatformApplications'
              - 'social-messaging:GetLinkedWhatsAppBusinessAccount'
              - 'social-messaging:ListLinkedWhatsAppBusinessAccounts'
              - 'sqs:GetQueueUrl'
              - 'ssm-incidents:GetIncidentRecord'
              - 'ssm-incidents:GetReplicationSet'
              - 'ssm-incidents:GetResponsePlan'
              - 'ssm-incidents:ListIncidentRecords'
              - 'ssm-incidents:ListReplicationSets'
              - 'ssm-incidents:ListResponsePlans'
              - 'ssm:GetMaintenanceWindow'
              - 'ssm:GetPatchBaseline'
              - 'states:ListActivities'
              - 'states:ListExecutions'
              - 'states:ListStateMachineAliases'
              - 'storagegateway:DescribeFileSystemAssociations'
              - 'storagegateway:DescribeSMBFileShares'
              - 'textract:GetAdapter'
              - 'textract:GetAdapterVersion'
              - 'textract:ListAdapterVersions'
              - 'textract:ListAdapters'
              - 'timestream:ListScheduledQueries'
              - 'timestream:ListTables'
              - 'transcribe:GetCallAnalyticsJob'
              - 'transcribe:GetMedicalScribeJob'
              - 'transcribe:GetMedicalTranscriptionJob'
              - 'transcribe:GetTranscriptionJob'
              - 'transcribe:ListMedicalScribeJobs'
              - 'translate:GetParallelData'
              - 'translate:GetTerminology'
              - 'verifiedpermissions:GetPolicyStore'
              - 'verifiedpermissions:ListIdentitySources'
              - 'verifiedpermissions:ListPolicies'
              - 'verifiedpermissions:ListPolicyStores'
              - 'verifiedpermissions:ListPolicyTemplates'
              - 'vpc-lattice:GetListener'
              - 'vpc-lattice:GetResourceConfiguration'
              - 'vpc-lattice:GetResourceGateway'
              - 'vpc-lattice:GetRule'
              - 'vpc-lattice:GetService'
              - 'vpc-lattice:GetServiceNetwork'
              - 'vpc-lattice:GetTargetGroup'
              - 'vpc-lattice:ListAccessLogSubscriptions'
              - 'vpc-lattice:ListListeners'
              - 'vpc-lattice:ListResourceConfigurations'
              - 'vpc-lattice:ListResourceEndpointAssociations'
              - 'vpc-lattice:ListResourceGateways'
              - 'vpc-lattice:ListRules'
              - 'vpc-lattice:ListServiceNetworkResourceAssociations'
              - 'vpc-lattice:ListServiceNetworkServiceAssociations'
              - 'vpc-lattice:ListServiceNetworkVpcAssociations'
              - 'vpc-lattice:ListServiceNetworks'
              - 'vpc-lattice:ListServices'
              - 'vpc-lattice:ListTargetGroups'
              - 'waf-regional:GetRule'
              - 'waf-regional:GetRuleGroup'
              - 'waf-regional:ListRuleGroups'
              - 'waf-regional:ListRules'
              - 'waf:GetRule'
              - 'waf:GetRuleGroup'
              - 'waf:ListRuleGroups'
              - 'waf:ListRules'
              - 'wafv2:GetIPSet'
              - 'wafv2:GetRegexPatternSet'
              - 'wafv2:GetRuleGroup'
              - 'wellarchitected:GetLens'
              - 'wellarchitected:GetProfile'
              - 'wellarchitected:GetReviewTemplate'
              - 'wellarchitected:GetWorkload'
              - 'wellarchitected:ListLenses'
              - 'wellarchitected:ListProfiles'
              - 'wellarchitected:ListReviewTemplates'
              - 'wellarchitected:ListWorkloads'
              - 'wisdom:ListAssistantAssociations'
              - 'wisdom:ListAssistants'
              - 'wisdom:ListContents'
              - 'wisdom:ListKnowledgeBases'
              - 'wisdom:ListQuickResponses'
              - 'workmail:DescribeOrganization'
              - 'workmail:ListOrganizations'
              - 'workspaces-web:GetBrowserSettings'
              - 'workspaces-web:GetDataProtectionSettings'
              - 'workspaces-web:GetIdentityProvider'
              - 'workspaces-web:GetIpAccessSettings'
              - 'workspaces-web:GetNetworkSettings'
              - 'workspaces-web:GetTrustStore'
              - 'workspaces-web:GetUserAccessLoggingSettings'
              - 'workspaces-web:GetUserSettings'
              - 'workspaces-web:ListBrowserSettings'
              - 'workspaces-web:ListDataProtectionSettings'
              - 'workspaces-web:ListIdentityProviders'
              - 'workspaces-web:ListIpAccessSettings'
              - 'workspaces-web:ListNetworkSettings'
              - 'workspaces-web:ListPortals'
              - 'workspaces-web:ListTrustStores'
              - 'workspaces-web:ListUserAccessLoggingSettings'
              - 'workspaces-web:ListUserSettings'
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Required
        Parameters:
          - ExternalId
          - IAMRoleName
          - BasePermissions
      - Label:
          default: Optional
        Parameters:
          - LogArchives
          - CloudTrails
          - CloudSecurityPostureManagementPermissions
