AWSTemplateFormatVersion: 2010-09-09
Description: 'AWS Control Tower Account Factory customization that grants permissions for an existing shared services Commvault backup account to perform backup & recovery operations for Amazon EC2, Amazon EBS, Amazon Aurora, Amazon RDS, Amazon DocumentDB, Amazon DynamoDB, Amazon S3, and Amazon Redshift resources in the member account'

Parameters:
  CommvaultSharedServicesAccountID:
    Type: String
    Description: Account ID of the shared services account hosting Commvault backup insfrastructure

Mappings:
  Constants:
    TemplateVersion: 
      Value: '11.2024e.001'

Resources:
  CommvaultBackupAndRecoveryRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: CommvaultBackupAndRecovery-AFC
      Description: 'Grant Commvault permission to perform data protection for Amazon
        EC2, EBS, S3, RDS, DynamoDB, DocDB, Redshift.'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal:
            AWS:
            - !Sub 'arn:aws:iam::${CommvaultSharedServicesAccountID}:role/Commvault/CommvaultBackupAndRecovery-AFC'
            Service:
            - ec2.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: /Commvault/
      ManagedPolicyArns:
      - !Ref CommvaultAmazonEC2ProtectionPolicy
      - !Ref CommvaultAmazonVPCRecoveryPolicy
      - !Ref CommvaultAmazonRDSProtectionPolicy
      - !Ref CommvaultAmazonRedshiftProtectionPolicy
      - !Ref CommvaultAmazonDocDBProtectionPolicy
      - !Ref CommvaultIntelliSnapDBFSProtectionPolicy
      - !Ref CommvaultAmazonDynamoDBProtectionPolicy
      - !Ref CommvaultAmazonS3ProtectionPolicy
      Tags:
      - Key: commvault-afc-template-version
        Value: !FindInMap [Constants, TemplateVersion, Value]
      - Key: stack-name
        Value: !Sub '${AWS::StackName}'

  CommvaultAmazonEC2ProtectionPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties: 
      ManagedPolicyName: Commvault_AmazonEC2Protection-AFC
      PolicyDocument:
        Version: 2012-10-17
        Statement:
        - Sid: AmazonEC2BackupAndRestore
          Effect: Allow
          Action:
          - ebs:CompleteSnapshot
          - ebs:GetSnapshotBlock
          - ebs:ListChangedBlocks
          - ebs:ListSnapshotBlocks
          - ebs:PutSnapshotBlock
          - ebs:StartSnapshot
          - ec2:AssociateIamInstanceProfile
          - ec2:AttachNetworkInterface
          - ec2:AttachVolume
          - ec2:CreateImage
          - ec2:CreateNetworkInterface
          - ec2:CreateSnapshot
          - ec2:CreateTags
          - ec2:CreateVolume
          - ec2:DeleteNetworkInterface
          - ec2:DeregisterImage
          - ec2:DescribeAccountAttributes
          - ec2:DescribeAvailabilityZones
          - ec2:DescribeIamInstanceProfileAssociations
          - ec2:DescribeImages
          - ec2:DescribeInstanceAttribute
          - ec2:DescribeInstanceStatus
          - ec2:DescribeInstanceTypeOfferings
          - ec2:DescribeInstanceTypes
          - ec2:DescribeInstances
          - ec2:DescribeKeyPairs
          - ec2:DescribeNetworkInterfaces
          - ec2:DescribeRegions
          - ec2:DescribeSecurityGroups
          - ec2:DescribeSnapshots
          - ec2:DescribeSubnets
          - ec2:DescribeTags
          - ec2:DescribeVolumeAttribute
          - ec2:DescribeVolumes
          - ec2:DescribeVpcEndpoints
          - ec2:DescribeVpcs
          - ec2:DetachNetworkInterface
          - ec2:DisassociateIamInstanceProfile
          - ec2:GetConsoleOutput
          - ec2:GetEbsDefaultKmsKeyId
          - ec2:GetEbsEncryptionByDefault
          - ec2:ModifyInstanceAttribute
          - ec2:ModifyNetworkInterfaceAttribute
          - ec2:RegisterImage
          - ec2:RunInstances
          - ec2:StartInstances
          - ec2:StopInstances
          - iam:GetAccountAuthorizationDetails
          - iam:GetInstanceProfile
          - iam:GetRole
          - iam:GetUser
          - iam:ListInstanceProfiles
          - iam:ListRoles
          - kms:ListAliases
          Resource: '*'
        - Sid: RestrictedVolumeAndSnapshotDeletion
          Effect: Allow
          Action:
          - ec2:DeleteSnapshot
          - ec2:DeleteVolume
          Resource: '*'
          Condition:
            StringLike:
              ec2:ResourceTag/_GX_BACKUP_: '*'
        - Sid: RestrictedTagDeletion
          Effect: Allow
          Action: ec2:DeleteTags
          Resource: '*'
          Condition:
            ForAnyValue:StringEquals:
              aws:TagKeys:
              - CV_Integrity_Snap
              - CV_Retain_Snap
              - Description
              - Name
              - _GX_AMI_
              - _GX_BACKUP_
        - Sid: RestrictedVolumeDetach
          Effect: Allow
          Action: ec2:DetachVolume
          Resource:
          - arn:aws:ec2:*:*:volume/*
          Condition:
            StringLike:
              ec2:ResourceTag/_GX_BACKUP_: '*'
        - Sid: RestrictedDeleteInstance1
          Effect: Allow
          Action: ec2:TerminateInstances
          Resource: '*'
          Condition:
            StringLike:
              ec2:ResourceTag/CV_Integrity_Snap: '*'
        - Sid: RestrictedDeleteInstance2
          Effect: Allow
          Action: ec2:TerminateInstances
          Resource: '*'
          Condition:
            StringLike:
              ec2:ResourceTag/_GX_BACKUP_: '*'
        - Sid: AllowDetachfromInstance
          Effect: Allow
          Action: ec2:DetachVolume
          Resource:
          - arn:aws:ec2:*:*:instance/*
        - Sid: RestrictPassRoleToEC2
          Effect: Allow
          Action: iam:PassRole
          Resource: '*'
          Condition:
            StringEquals:
              'iam:PassedToService': 'ec2.amazonaws.com'
        - Sid: HotaddBackupAddon
          Effect: Allow
          Action:
          - ec2:DescribeVolumesModifications
          - ec2:ModifySnapshotAttribute
          - ec2:ModifyVolume
          Resource: '*'
        - Sid: ImportRestoreAddon
          Effect: Allow
          Action:
          - ec2:CancelImportTask
          - ec2:DescribeImportImageTasks
          - ec2:ImportImage
          - ec2:ModifyImageAttribute          
          Resource: '*'
        - Sid: KMSPermissionsIfNotAllowedAtKeyPolicy
          Effect: Allow
          Action:
          - kms:CreateAlias
          - kms:CreateGrant
          - kms:CreateKey
          - kms:Decrypt
          - kms:DescribeKey
          - kms:Encrypt
          - kms:GenerateDataKey
          - kms:GenerateDataKeyPair
          - kms:GenerateDataKeyPairWithoutPlaintext
          - kms:GenerateDataKeyWithoutPlaintext
          - kms:ListAliases
          - kms:ListGrants
          - kms:ListKeys
          - kms:ListResourceTags
          - kms:ReEncryptFrom
          - kms:ReEncryptTo
          - kms:TagResource          
          Resource: '*'
        - Sid: AgentlessRestore
          Effect: Allow
          Action:
          - ssm:CancelCommand
          - ssm:DescribeInstanceInformation
          - ssm:ListCommands          
          Resource: '*'
        - Sid: RestrictedSendCommandForAgentlessRestore
          Effect: Allow
          Action: 
          - ssm:SendCommand
          Resource: 
          - arn:aws:ec2:*:*:instance/*
          - arn:aws:ssm:*:*:document/AWS-RunPowerShellScript
          - arn:aws:ssm:*:*:document/AWS-RunShellScript
          - arn:aws:ssm:*:*:document/AWS-UpdateSSMAgent
        - Sid: S3PermissionsForRestore
          Effect: Allow
          Action:
          - s3:CreateBucket
          - s3:DeleteObject
          - s3:DeleteObjectVersion
          - s3:GetBucketAcl
          - s3:GetBucketLocation
          - s3:GetObject
          - s3:GetObjectAcl
          - s3:ListAllMyBuckets
          - s3:ListBucket
          - s3:PutBucketAcl
          - s3:PutBucketOwnershipControls
          - s3:PutEncryptionConfiguration
          - s3:PutObject
          - s3:PutObjectAcl
          - s3:PutObjectTagging          
          Resource: '*'
        - Sid: SnapReplication
          Effect: Allow
          Action:
          - ec2:CopySnapshot
          - ec2:ModifySnapshotAttribute          
          Resource: '*'
        - Sid: VPCBackupPermissions
          Effect: Allow
          Action:
          - ec2:DescribeCarrierGateways
          - ec2:DescribeCustomerGateways
          - ec2:DescribeDhcpOptions
          - ec2:DescribeEgressOnlyInternetGateways
          - ec2:DescribeFlowLogs
          - ec2:DescribeInternetGateways
          - ec2:DescribeManagedPrefixLists
          - ec2:DescribeNatGateways
          - ec2:DescribeNetworkAcls
          - ec2:DescribeRouteTables
          - ec2:DescribeTransitGatewayVpcAttachments
          - ec2:DescribeTransitGateways
          - ec2:DescribeVpcAttribute
          - ec2:DescribeVpcPeeringConnections
          - ec2:DescribeVpnConnections
          - ec2:DescribeVpnGateways
          - ec2:GetManagedPrefixListEntries
          - ec2:GetSubnetCidrReservations          
          Resource: '*'
        - Sid: EbsDirectOptional
          Effect: Allow
          Action:
          - iam:SimulatePrincipalPolicy
          Resource: '*'
        - Sid: PermissionForBetterJPROptional
          Effect: Allow
          Action:
          - sts:DecodeAuthorizationMessage
          Resource: '*'
  CommvaultAmazonVPCRecoveryPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties: 
      ManagedPolicyName: Commvault_AmazonVPCRecovery-AFC
      PolicyDocument:
        Version: 2012-10-17
        Statement:
        - Sid: VPCRestorePermissions
          Effect: Allow
          Action:
          - ec2:AssignPrivateIpAddresses
          - ec2:AssociateDhcpOptions
          - ec2:AssociateVpcCidrBlock
          - ec2:AttachInternetGateway
          - ec2:AttachVpnGateway
          - ec2:AuthorizeSecurityGroupEgress
          - ec2:AuthorizeSecurityGroupIngress
          - ec2:CreateDhcpOptions
          - ec2:CreateEgressOnlyInternetGateway
          - ec2:CreateFlowLogs
          - ec2:CreateInternetGateway
          - ec2:CreateManagedPrefixList
          - ec2:CreateNatGateway
          - ec2:CreateNetworkAcl
          - ec2:CreateNetworkAclEntry
          - ec2:CreateSecurityGroup
          - ec2:CreateSubnet
          - ec2:CreateSubnetCidrReservation
          - ec2:CreateTransitGateway
          - ec2:CreateTransitGatewayVpcAttachment
          - ec2:CreateVpc
          - ec2:CreateVpnGateway
          - ec2:DeleteDhcpOptions
          - ec2:DeleteEgressOnlyInternetGateway
          - ec2:DeleteInternetGateway
          - ec2:DeleteManagedPrefixList
          - ec2:DeleteNatGateway
          - ec2:DeleteNetworkAcl
          - ec2:DeleteNetworkAclEntry
          - ec2:DeleteSecurityGroup
          - ec2:DeleteSubnet
          - ec2:DeleteTransitGateway
          - ec2:DeleteTransitGatewayVpcAttachment
          - ec2:DeleteVpc
          - ec2:DeleteVpnGateway
          - ec2:DescribeSecurityGroupRules
          - ec2:DetachInternetGateway
          - ec2:DetachVpnGateway
          - ec2:ModifySubnetAttribute
          - ec2:ModifyVpcAttribute
          - ec2:ReplaceNetworkAclAssociation
          - ec2:RevokeSecurityGroupEgress
          - ec2:RevokeSecurityGroupIngress
          - s3:PutObjectTagging          
          Resource: '*'
        - Sid: VPCRestorePermissionToCreateFlowLog
          Effect: Allow
          Action:
          - iam:PassRole
          Resource: 'arn:aws:iam::*:role/*'
  CommvaultAmazonRDSProtectionPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties: 
      ManagedPolicyName: Commvault_AmazonRDSProtection-AFC
      PolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Action:
          - ec2:DescribeAccountAttributes
          - ec2:DescribeAvailabilityZones
          - ec2:DescribeRegions
          - ec2:DescribeSecurityGroups
          - ec2:DescribeSubnets
          - ec2:DescribeVpcs
          - iam:GetAccountAuthorizationDetails
          - iam:GetUser
          - kms:CreateGrant
          - kms:Decrypt
          - kms:DescribeKey
          - kms:Encrypt
          - kms:GenerateDataKey
          - kms:GenerateDataKeyPair
          - kms:GenerateDataKeyPairWithoutPlaintext
          - kms:GenerateDataKeyWithoutPlaintext
          - kms:ListAliases
          - kms:ListKeys
          - kms:ListResourceTags
          - kms:ReEncryptFrom
          - kms:ReEncryptTo
          - rds:AddTagsToResource
          - rds:CopyDBClusterSnapshot
          - rds:CopyDBSnapshot
          - rds:CreateDBClusterSnapshot
          - rds:CreateDBInstance
          - rds:CreateDBSnapshot
          - rds:DeleteDBCluster
          - rds:DeleteDBClusterSnapshot
          - rds:DeleteDBInstance
          - rds:DeleteDBSnapshot
          - rds:DescribeDBClusters
          - rds:DescribeDBClusterSnapshots
          - rds:DescribeDBInstances
          - rds:DescribeDBSnapshots
          - rds:ListTagsForResource
          - rds:ModifyDBClusterSnapshotAttribute
          - rds:ModifyDBSnapshotAttribute
          - rds:RestoreDBClusterFromSnapshot
          - rds:RestoreDBInstanceFromDBSnapshot
          - s3:CreateBucket
          - s3:DeleteObject
          - s3:DeleteObjectVersion
          - s3:GetBucketAcl
          - s3:GetBucketLocation
          - s3:GetObject
          - s3:ListAllMyBuckets
          - s3:ListBucket
          - s3:PutBucketAcl
          - s3:PutObject
          - s3:PutObjectAcl
          - s3:PutObjectTagging
          Resource: '*'
  CommvaultAmazonRedshiftProtectionPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties: 
      ManagedPolicyName: Commvault_AmazonRedshiftProtection-AFC
      PolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Action:
          - ec2:DescribeAccountAttributes
          - ec2:DescribeAvailabilityZones
          - ec2:DescribeRegions
          - ec2:DescribeSecurityGroups
          - ec2:DescribeSubnets
          - ec2:DescribeVpcs
          - iam:GetAccountAuthorizationDetails
          - iam:GetUser
          - kms:CreateGrant
          - kms:Decrypt
          - kms:DescribeKey
          - kms:Encrypt
          - kms:GenerateDataKey
          - kms:GenerateDataKeyPair
          - kms:GenerateDataKeyPairWithoutPlaintext
          - kms:GenerateDataKeyWithoutPlaintext
          - kms:ListAliases
          - kms:ListKeys
          - kms:ListResourceTags
          - kms:ReEncryptFrom
          - kms:ReEncryptTo
          - redshift:CreateClusterSnapshot
          - redshift:CreateTags
          - redshift:DeleteClusterSnapshot
          - redshift:DescribeClusters
          - redshift:DescribeTags
          - redshift:DisableSnapshotCopy
          - redshift:EnableSnapshotCopy
          - redshift:DescribeClusterSnapshots
          - redshift:RestoreFromClusterSnapshot
          - s3:CreateBucket
          - s3:DeleteObject
          - s3:DeleteObjectVersion
          - s3:GetBucketAcl
          - s3:GetBucketLocation
          - s3:GetObject
          - s3:ListAllMyBuckets
          - s3:ListBucket
          - s3:PutBucketAcl
          - s3:PutObject
          - s3:PutObjectAcl
          - s3:PutObjectTagging
          Resource: '*'
  CommvaultAmazonDocDBProtectionPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties: 
      ManagedPolicyName: Commvault_AmazonDocDBProtection-AFC
      PolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Action:
          - ec2:DescribeAccountAttributes
          - ec2:DescribeAvailabilityZones
          - ec2:DescribeRegions
          - ec2:DescribeSecurityGroups
          - ec2:DescribeSubnets
          - ec2:DescribeVpcs
          - iam:GetAccountAuthorizationDetails
          - iam:GetUser
          - kms:CreateGrant
          - kms:Decrypt
          - kms:DescribeKey
          - kms:Encrypt
          - kms:GenerateDataKey
          - kms:GenerateDataKeyPair
          - kms:GenerateDataKeyPairWithoutPlaintext
          - kms:GenerateDataKeyWithoutPlaintext
          - kms:ListAliases
          - kms:ListKeys
          - kms:ListResourceTags
          - kms:ReEncryptFrom
          - kms:ReEncryptTo
          - rds:AddTagsToResource
          - rds:CreateDBClusterSnapshot
          - rds:CreateDBInstance
          - rds:DeleteDBClusterSnapshot
          - rds:DescribeDBClusters
          - rds:DescribeDBClusterSnapshots
          - rds:DescribeDBInstances
          - rds:ListTagsForResource
          - rds:RestoreDBClusterFromSnapshot
          - s3:CreateBucket
          - s3:DeleteObject
          - s3:DeleteObjectVersion
          - s3:GetBucketAcl
          - s3:GetBucketLocation
          - s3:GetObject
          - s3:ListAllMyBuckets
          - s3:ListBucket
          - s3:PutBucketAcl
          - s3:PutObject
          - s3:PutObjectAcl
          - s3:PutObjectTagging
          Resource: '*'
  CommvaultIntelliSnapDBFSProtectionPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties: 
      ManagedPolicyName: Commvault_IntelliSnapDBFSProtection-AFC
      PolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Action:
          - ec2:AttachVolume
          - ec2:CopySnapshot
          - ec2:CreateSnapshots
          - ec2:CreateTags
          - ec2:CreateVolume
          - ec2:DeleteSnapshot
          - ec2:DeleteVolume
          - ec2:DescribeAccountAttributes
          - ec2:DescribeAvailabilityZones
          - ec2:DescribeInstances
          - ec2:DescribeRegions
          - ec2:DescribeSecurityGroups
          - ec2:DescribeSnapshots
          - ec2:DescribeSubnets
          - ec2:DescribeTags
          - ec2:DescribeVolumes
          - ec2:DescribeVpcs
          - ec2:DetachVolume
          - iam:GetAccountAuthorizationDetails
          - iam:GetUser
          - kms:CreateGrant
          - kms:Decrypt
          - kms:DescribeKey
          - kms:Encrypt
          - kms:GenerateDataKey
          - kms:GenerateDataKeyPair
          - kms:GenerateDataKeyPairWithoutPlaintext
          - kms:GenerateDataKeyWithoutPlaintext
          - kms:ListAliases
          - kms:ListKeys
          - kms:ReEncryptFrom
          - kms:ReEncryptTo
          - s3:CreateBucket
          - s3:DeleteObject
          - s3:DeleteObjectVersion
          - s3:GetBucketAcl
          - s3:GetBucketLocation
          - s3:GetObject
          - s3:ListAllMyBuckets
          - s3:ListBucket
          - s3:PutBucketAcl
          - s3:PutObject
          - s3:PutObjectAcl
          - s3:PutObjectTagging
          Resource: '*'
  CommvaultAmazonDynamoDBProtectionPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties: 
      ManagedPolicyName: Commvault_AmazonDynamoDBProtection-AFC
      PolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Action:
          - cloudwatch:DeleteAlarms
          - cloudwatch:DescribeAlarms
          - cloudwatch:PutMetricAlarm
          - dynamodb:BatchWriteItem
          - dynamodb:CreateTable
          - dynamodb:DeleteTable
          - dynamodb:Describestream
          - dynamodb:DescribeTable
          - dynamodb:GetRecords
          - dynamodb:GetShardIterator
          - dynamodb:ListGlobalTables
          - dynamodb:ListStreams
          - dynamodb:ListTables
          - dynamodb:ListTagsOfResource
          - dynamodb:Scan
          - dynamodb:UpdateTable
          - ec2:DescribeAccountAttributes
          - ec2:DescribeAvailabilityZones
          - ec2:DescribeRegions
          - ec2:DescribeSecurityGroups
          - ec2:DescribeSubnets
          - ec2:DescribeVpcs
          - iam:GetAccountAuthorizationDetails
          - iam:GetUser
          - kms:Decrypt
          - kms:DescribeKey
          - kms:Encrypt
          - kms:GenerateDataKey
          - kms:GenerateDataKeyPair
          - kms:GenerateDataKeyPairWithoutPlaintext
          - kms:GenerateDataKeyWithoutPlaintext
          - kms:ListGrants
          - kms:ReEncryptFrom
          - kms:ReEncryptTo
          - s3:CreateBucket
          - s3:DeleteObject
          - s3:DeleteObjectVersion
          - s3:GetBucketAcl
          - s3:GetBucketLocation
          - s3:GetObject
          - s3:ListAllMyBuckets
          - s3:ListBucket
          - s3:PutBucketAcl
          - s3:PutObject
          - s3:PutObjectAcl
          - s3:PutObjectTagging
          Resource: '*'
  CommvaultAmazonS3ProtectionPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties: 
      ManagedPolicyName: Commvault_AmazonS3Protection-AFC
      PolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Action:
          - s3:CreateBucket
          - s3:PutAnalyticsConfiguration
          - s3:GetObjectAcl
          - s3:GetBucketObjectLockConfiguration
          - s3:PutLifecycleConfiguration
          - s3:PutBucketAcl
          - s3:PutObjectTagging
          - s3:DeleteObject
          - s3:GetBucketWebsite
          - s3:PutReplicationConfiguration
          - s3:DeleteObjectVersionTagging
          - s3:GetBucketNotification
          - s3:PutBucketCORS
          - s3:PutObject
          - s3:GetObject
          - s3:PutBucketNotification
          - s3:PutBucketLogging
          - s3:GetAnalyticsConfiguration
          - s3:PutBucketObjectLockConfiguration
          - s3:GetLifecycleConfiguration
          - s3:GetInventoryConfiguration
          - s3:GetBucketTagging
          - s3:PutAccelerateConfiguration
          - s3:DeleteObjectVersion
          - s3:GetBucketLogging
          - s3:ListBucketVersions
          - s3:RestoreObject
          - s3:ListBucket
          - s3:GetAccelerateConfiguration
          - s3:GetBucketPolicy
          - s3:PutEncryptionConfiguration
          - s3:GetEncryptionConfiguration
          - s3:PutBucketTagging
          - s3:GetBucketRequestPayment
          - s3:GetObjectTagging
          - s3:GetMetricsConfiguration
          - s3:PutBucketVersioning
          - s3:PutObjectAcl
          - s3:GetBucketPublicAccessBlock
          - s3:PutBucketPublicAccessBlock
          - s3:PutMetricsConfiguration
          - s3:GetBucketVersioning
          - s3:GetBucketAcl
          - s3:PutInventoryConfiguration
          - s3:PutBucketWebsite
          - s3:ListAllMyBuckets
          - s3:PutObjectRetention
          - s3:GetBucketCORS
          - s3:PutBucketPolicy
          - s3:GetBucketLocation
          - s3-outposts:CreateBucket
          - s3-outposts:GetAccessPoint
          - s3-outposts:GetObject
          - s3-outposts:PutObject
          - s3-outposts:PutObjectAcl
          - s3-outposts:PutObjectTagging
          - s3-outposts:DeleteObject
          - s3-outposts:ListBucket
          - s3-outposts:ListAccessPoints
          - s3-outposts:ListRegionalBuckets
          - s3-outposts:ListRegionalBuckets
          Resource: '*'

  CommvaultInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      InstanceProfileName: CommvaultBackupAndRecovery-AFC
      Path: /Commvault/
      Roles:
      - !Ref 'CommvaultBackupAndRecoveryRole'

Outputs:
  CommvaultBackupAndRecoveryRole:
    Value: !GetAtt CommvaultBackupAndRecoveryRole.Arn
    Description: Role that grants Commvault permissions to protect resources

    