# CloudFormation stack to create a regional KMS key, tag with cvlt-rds, and allow external account usage.
  # Reference policy snippet: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-modifying-external-accounts.html#cross-account-iam-policy
  # {
  #   "Sid": "Allow an external account to use this KMS key",
  #   "Effect": "Allow",
  #   "Principal": {"AWS": ["arn:aws:iam::444455556666:root"]},
  #   "Action": ["kms:Encrypt","kms:Decrypt","kms:ReEncrypt*","kms:GenerateDataKey*","kms:DescribeKey"],
  #   "Resource": "*"
  # }
  # Deploy per region example:
  # aws cloudformation deploy --region <region> --template-file commvaultKMSKeyCreate.yaml --stack-name cvlt-rds-kms \
  #   --capabilities CAPABILITY_NAMED_IAM --parameter-overrides ExternalAccountId=444455556666 KeyAlias=alias/cvlt-rds
  # For multiple regions at once, create a StackSet using this template and target the desired regions.
  # StackSet create (service-managed):
  # aws cloudformation create-stack-set --stack-set-name cvlt-rds-kms-stackset --template-body file://commvaultKMSKeyCreate.yaml \
  #   --parameters ParameterKey=ExternalAccountId,ParameterValue=444455556666 ParameterKey=KeyAlias,ParameterValue=alias/cvlt-rds \
  #   --capabilities CAPABILITY_NAMED_IAM --permission-model SERVICE_MANAGED \
  #   --auto-deployment Enabled=true,RetainStacksOnAccountRemoval=false --managed-execution Active=true
  # StackSet add instances (set OU and regions):
  # aws cloudformation create-stack-instances --stack-set-name cvlt-rds-kms-stackset \
  #   --deployment-targets OrganizationalUnitIds=ou-xxxx-example --regions us-east-1 us-west-2 eu-west-1 \
  #   --operation-preferences FailureTolerancePercentage=20 MaxConcurrentPercentage=100
  # Notes: replace OU and regions as needed; for self-managed permissions switch permission-model and supply admin/execution roles; delete by removing instances then deleting the stack set.
AWSTemplateFormatVersion: 2010-09-09
Description: Regional KMS key (cvlt-rds) with external account access.

Parameters:
  ExternalAccountId:
    Type: String
    Default: "444455556666"
    Description: External AWS account ID to grant use permissions.
  KeyAlias:
    Type: String
    Default: alias/cvlt-rds
    Description: KMS alias for this regional key.

Resources:
  KmsKey:
    Type: AWS::KMS::Key
    Properties:
      Description: Regional KMS key for RDS usage, tagged cvlt-rds
      EnableKeyRotation: true
      PendingWindowInDays: 30
      Tags:
        - Key: Name
          Value: cvlt-rds
        - Key: cvlt-rds
          Value: true
      KeyPolicy:
        Version: "2012-10-17"
        Statement:
          - Sid: EnableRootAccount
            Effect: Allow
            Principal:
              AWS: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:root
            Action: "kms:*"
            Resource: "*"
          - Sid: AllowExternalAccountUse
            Effect: Allow
            Principal:
              AWS:
                - !Sub arn:${AWS::Partition}:iam::${ExternalAccountId}:root
            Action:
              - kms:Encrypt
              - kms:Decrypt
              - kms:ReEncrypt*
              - kms:GenerateDataKey*
              - kms:DescribeKey
            Resource: "*"

  KmsAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: !Ref KeyAlias
      TargetKeyId: !Ref KmsKey

Outputs:
  KeyId:
    Description: KMS Key ID (regional)
    Value: !Ref KmsKey
  KeyArn:
    Description: KMS Key ARN (regional)
    Value: !GetAtt KmsKey.Arn
  AliasName:
    Description: KMS Alias
    Value: !Ref KeyAlias