AWSTemplateFormatVersion: "2010-09-09"
Description: Resources used for monitoring the GHA test runs using Grafana
Parameters:
  PrometheusWorkspaceID:
    Type: String
    Description: "Prometheus workspace to give access to Grafana to query metrics from"
Resources:
  GrafanaWorkspace:
    Type: AWS::Grafana::Workspace
    Properties:
      Name: KarpenterTestMonitoring
      Description: Amazon Grafana Workspace for Karpenter Test Monitoring
      AccountAccessType: CURRENT_ACCOUNT
      PermissionType: CUSTOMER_MANAGED
      RoleArn: !Ref GrafanaWorkspaceRole
      AuthenticationProviders:
        - SAML
      SamlConfiguration:
        IdpMetadata:
          Xml: >-
            <?xml version="1.0" encoding="UTF-8"?>
            <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://idp-integ.federate.amazon.com">
                <md:IDPSSODescriptor WantAuthnRequestsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
                    <md:KeyDescriptor use="signing">
                        <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                            <ds:X509Data>
                                <ds:X509Certificate> </ds:X509Certificate>
                            </ds:X509Data>
                        </ds:KeyInfo>
                    </md:KeyDescriptor>
                    <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://idp-integ.federate.amazon.com/api/saml2/v1/logout"/>
                    <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://idp-integ.federate.amazon.com/api/saml2/v1/logout"/>
                    <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified</md:NameIDFormat>
                    <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://idp-integ.federate.amazon.com/api/saml2/v1/sso"/>
                    <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://idp-integ.federate.amazon.com/api/saml2/v1/sso"/>
                </md:IDPSSODescriptor>
            </md:EntityDescriptor>
        AssertionAttributes:
          Name: displayName
          Login: mail
          Email: mail
          Role: role
        RoleValues:
          Admin:
            - admin
        LoginValidityDuration: 120
  GrafanaWorkspaceRole:
    Type: 'AWS::IAM::Role'
    Properties:
      ManagedPolicyArns:
        - !Ref GrafanaToPrometheusDataSourcePolicy
        - arn:aws:iam::aws:policy/service-role/AmazonGrafanaCloudWatchAccess
        - arn:aws:iam::aws:policy/service-role/AmazonTimestreamReadOnlyAccess
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - grafana.amazonaws.com
            Action:
              - 'sts:AssumeRole'
  GrafanaToPrometheusDataSourcePolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: GrafanaToPrometheusDataSourcePolicy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action: aps:ListWorkspaces
            Resource: "*"
          - Effect: Allow
            Action:
              - aps:DescribeWorkspace
              - aps:QueryMetrics
              - aps:GetLabels
              - aps:GetSeries
              - aps:GetMetricMetadata
            Resource: !Sub "arn:${AWS::Partition}:aps:${AWS::Region}:${AWS::AccountId}:workspace/${PrometheusWorkspaceID}"
Outputs:
  WorkspaceEndpoint:
    Value: !GetAtt GrafanaWorkspace.Endpoint
  WorkspaceStatus:
    Value: !GetAtt GrafanaWorkspace.Status
  WorkspaceID:
    Value: !Ref GrafanaWorkspace
  GrafanaVersion:
    Value: !GetAtt GrafanaWorkspace.GrafanaVersion
