#Defines all IAM roles for the account. Default iam roles are:
#twitch_inventory
#cpe_admin
#availability_monitoring
iam :twitch_accounts do
  role :availability_monitoring do
    role_name 'inventory-read-only'

    trust account: '007917851548', role: 'inventory-read-only'

    managed_policy 'arn:aws:iam::aws:policy/ReadOnlyAccess'
  end

  role :cpe_admin do
    role_name 'CPE-Admin'

    trust account: '544854064936'

    managed_policy 'arn:aws:iam::aws:policy/AdministratorAccess'
  end

  role :twitch_inventory do
    role_name 'twitch-inventory'
    trust account: '578510050023', role: 'twitch-inventory-master'

    allow actions: ['ce:*'], resource: '*'

    managed_policy 'arn:aws:iam::aws:policy/ReadOnlyAccess'
    managed_policy 'arn:aws:iam::aws:policy/AWSSupportAccess'
  end

  role :grafana_readonly do
    role_name 'grafana-cloudwatch-read-only'

    trust account: '109561199089', role: 'grafana-production'
    trust account: '963768028156', role: 'grafana-development'
    managed_policy 'arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess'
  end
end