Parameters:
  S3BucketNameForEMRWorkspaceStorage:
    Type: String
    Description: "Bucket to be created by the cloudformation stack. This bucket will hold EMR studio Workspace files like Notebooks etc. "
    Default: "emroutpostblog-123outpostblog-565393044635"
Resources:

  EMRStudioServiceRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub 'AmazonEMRStudio_ServiceRole_emroutpostblog_${AWS::AccountId}'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - elasticmapreduce.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: '/'
      Policies:
        - PolicyName: TIPBlogStudioWrkspaceAccessPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action: ['s3:GetObject','s3:ListBucket','s3:PutObject','s3:GetEncryptionConfiguration','s3:DeleteObject']
              Resource:
                - !Sub 'arn:${AWS::Partition}:s3:::${S3BucketNameForEMRWorkspaceStorage}/*'
                - !Sub 'arn:${AWS::Partition}:s3:::${S3BucketNameForEMRWorkspaceStorage}'
        - PolicyName: AllowEC2ReadOnlyActions
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - "ec2:DescribeSecurityGroups"
                  - "ec2:DescribeNetworkInterfaces"
                  - "ec2:DescribeTags"
                  - "ec2:DescribeInstances"
                  - "ec2:DescribeSubnets"
                  - "ec2:DescribeVpcs"
                Resource:
                  - "*"
        - PolicyName: EMRSparkAI-Studio-Service-Policy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Sid: AllowEMRReadOnlyActions
              Effect: Allow
              Action:
              - elasticmapreduce:ListInstances
              - elasticmapreduce:DescribeCluster
              - elasticmapreduce:ListSteps
              Resource: "*"
            - Sid: AllowEC2ENIActionsWithEMRTags
              Effect: Allow
              Action:
              - ec2:CreateNetworkInterfacePermission
              - ec2:DeleteNetworkInterface
              Resource: "*"
              Condition:
                StringEquals:
                  aws:ResourceTag/for-use-with-amazon-emr-managed-policies: 'true'
            - Sid: AllowEC2ENIAttributeAction
              Effect: Allow
              Action:
              - ec2:ModifyNetworkInterfaceAttribute
              Resource:
              - !Sub 'arn:${AWS::Partition}:ec2:*:*:instance/*'
              - !Sub 'arn:${AWS::Partition}:ec2:*:*:network-interface/*'
              - !Sub 'arn:${AWS::Partition}:ec2:*:*:security-group/*'
            - Sid: AllowEC2SecurityGroupActionsWithEMRTags
              Effect: Allow
              Action:
              - ec2:AuthorizeSecurityGroupEgress
              - ec2:AuthorizeSecurityGroupIngress
              - ec2:RevokeSecurityGroupEgress
              - ec2:RevokeSecurityGroupIngress
              - ec2:DeleteNetworkInterfacePermission
              Resource: "*"
              Condition:
                StringEquals:
                  aws:ResourceTag/for-use-with-amazon-emr-managed-policies: 'true'
            - Sid: AllowDefaultEC2SecurityGroupsCreationWithEMRTags
              Effect: Allow
              Action:
              - ec2:CreateSecurityGroup
              Resource:
              - !Sub 'arn:${AWS::Partition}:ec2:*:*:security-group/*'
              Condition:
                StringEquals:
                  aws:RequestTag/for-use-with-amazon-emr-managed-policies: 'true'
            - Sid: AllowDefaultEC2SecurityGroupsCreationInVPCWithEMRTags
              Effect: Allow
              Action:
              - ec2:CreateSecurityGroup
              Resource:
              - !Sub 'arn:${AWS::Partition}:ec2:*:*:vpc/*'
              Condition:
                StringEquals:
                  aws:ResourceTag/for-use-with-amazon-emr-managed-policies: 'true'
            - Sid: AllowAddingEMRTagsDuringDefaultSecurityGroupCreation
              Effect: Allow
              Action:
              - ec2:CreateTags
              Resource: !Sub 'arn:${AWS::Partition}:ec2:*:*:security-group/*'
              Condition:
                StringEquals:
                  aws:RequestTag/for-use-with-amazon-emr-managed-policies: 'true'
                  ec2:CreateAction: CreateSecurityGroup
            - Sid: AllowEC2ENICreationInSubnetAndSecurityGroupWithEMRTags
              Effect: Allow
              Action:
              - ec2:CreateNetworkInterface
              Resource:
                - !Sub 'arn:${AWS::Partition}:ec2:*:*:network-interface/*'
                - !Sub 'arn:${AWS::Partition}:ec2:*:*:security-group/*'
                - !Sub 'arn:${AWS::Partition}:ec2:*:*:subnet/*'
            - Sid: AllowAddingTagsDuringEC2ENICreation
              Effect: Allow
              Action:
              - ec2:CreateTags
              Resource: !Sub 'arn:${AWS::Partition}:ec2:*:*:network-interface/*'
              Condition:
                StringEquals:
                  ec2:CreateAction: CreateNetworkInterface
            - Sid: AllowEC2ReadOnlyActions
              Effect: Allow
              Action:
              - ec2:DescribeSecurityGroups
              - ec2:DescribeNetworkInterfaces
              - ec2:DescribeTags
              - ec2:DescribeInstances
              - ec2:DescribeSubnets
              - ec2:DescribeVpcs
              Resource: "*"
            - Sid: AllowSecretsManagerReadOnlyActionsWithEMRTags
              Effect: Allow
              Action:
              - secretsmanager:GetSecretValue
              Resource: !Sub 'arn:${AWS::Partition}:secretsmanager:*:*:secret:*'
              Condition:
                StringEquals:
                  aws:ResourceTag/for-use-with-amazon-emr-managed-policies: 'true'
            - Effect: Allow
              Action:
              - s3:PutObject
              - s3:GetObject
              - s3:GetEncryptionConfiguration
              - s3:ListBucket
              - s3:DeleteObject
              Resource: !Sub 'arn:${AWS::Partition}:s3:::*'
  EMRStudio:
    Type: AWS::EMR::Studio
    Properties:
      Name: emroutpost-blog-studio
      AuthMode: IAM
      DefaultS3Location: !Sub "s3://${S3BucketNameForEMRWorkspaceStorage}/workspace"
      ServiceRole: !GetAtt EMRStudioServiceRole.Arn
      WorkspaceSecurityGroupId: !ImportValue 'EMRWorkspaceSecurityGroup'
      EngineSecurityGroupId: !ImportValue 'EMREngineSecurityGroup'
      SubnetIds:
        - !ImportValue 'OutpostsPrivateSubnet'
      VpcId: !ImportValue 'VPCID'

Outputs:
  EMRStudioURL:
    Description: EMR Studio Environment
    Value: !GetAtt EMRStudio.Url
