# CloudFormation template for creating an IAM role that Temporal Cloud can assume to invoke AgentCore runtimes.
AWSTemplateFormatVersion: '2010-09-09'
Description:
  Creates an IAM role that Temporal Cloud can assume to invoke Amazon Bedrock AgentCore runtimes for Serverless Workers.

Parameters:
  AssumeRoleExternalId:
    Type: String
    Description: A string you choose. Use the same value when creating the Worker Deployment Version.
    AllowedPattern: '[a-zA-Z0-9_+=,.@-]*'
    MinLength: 5
    MaxLength: 45

  AgentRuntimeARNs:
    Type: CommaDelimitedList
    Description: >-
      Comma-separated list of AgentCore Runtime ARNs that Temporal may invoke. Append a wildcard to each Runtime ARN
      to include its endpoints.

  RoleName:
    Type: String
    Default: 'Temporal-Cloud-Serverless-Worker'

Resources:
  TemporalCloudServerlessWorker:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub '${RoleName}-${AWS::StackName}'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS:
                - arn:aws:iam::902542641901:role/wci-lambda-invoke
                - arn:aws:iam::160190466495:role/wci-lambda-invoke
                - arn:aws:iam::819232936619:role/wci-lambda-invoke
                - arn:aws:iam::829909441867:role/wci-lambda-invoke
                - arn:aws:iam::354116250941:role/wci-lambda-invoke
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                'sts:ExternalId': !Ref AssumeRoleExternalId
      Description: The role Temporal Cloud uses to invoke AgentCore runtimes for Serverless Workers
      MaxSessionDuration: 3600

  TemporalCloudAgentCoreInvokePermissions:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: 'Temporal-Cloud-AgentCore-Invoke-Permissions'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - bedrock-agentcore:InvokeAgentRuntime
              - bedrock-agentcore:GetAgentRuntimeEndpoint
            Resource: !Ref AgentRuntimeARNs
      Roles:
        - !Ref TemporalCloudServerlessWorker

Outputs:
  RoleARN:
    Description: The ARN of the IAM role created for Temporal Cloud
    Value: !GetAtt TemporalCloudServerlessWorker.Arn

  AgentRuntimeARNs:
    Description: The AgentCore Runtime ARNs that Temporal may invoke
    Value: !Join [', ', !Ref AgentRuntimeARNs]