Parameters:
  SnowflakeAccountUrl:
    Type: String
  SnowflakePrivateKey:
    Type: String
  SnowflakeDatabase:
    Type: String
  SnowflakeSchema:
    Type: String
  SnowflakeTable:
    Type: String
  SnowflakeUser:
    Type: String
  SnowflakeRole:
    Type: String
  SnowflakePrivateLinkVpceId:
    Type: String
  KinesisArn:
    Type: String
Resources:
  s3bucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      VersioningConfiguration:
        Status: Enabled

  deliveryRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: ''
            Effect: Allow
            Principal:
              Service: 'firehose.amazonaws.com'
            Action: 'sts:AssumeRole'
            Condition:
              StringEquals:
                'sts:ExternalId': !Ref 'AWS::AccountId'

  deliveryPolicy:
    Type: 'AWS::IAM::Policy'
    Properties:
      PolicyName: firehose_delivery_policy
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - 's3:AbortMultipartUpload'
              - 's3:GetBucketLocation'
              - 's3:GetObject'
              - 's3:ListBucket'
              - 's3:ListBucketMultipartUploads'
              - 's3:PutObject'
            Resource:
              - !Join
                - ''
                - - 'arn:'
                  - !Ref 'AWS::Partition'
                  - ':s3:::'
                  - !Ref s3bucket
              - !Join
                - ''
                - - 'arn:'
                  - !Ref 'AWS::Partition'
                  - ':s3:::'
                  - !Ref s3bucket
                  - '*'
          - Effect: Allow
            Action:
              - 'kinesis:DescribeStream'
              - 'kinesis:GetShardIterator'
              - 'kinesis:GetRecords'
              - 'kinesis:ListShards'
            Resource: !Ref KinesisArn

      Roles:
        - !Ref deliveryRole

  deliverystream:
    DependsOn:
      - deliveryPolicy
    Type: 'AWS::KinesisFirehose::DeliveryStream'
    Properties:
      DeliveryStreamType: KinesisStreamAsSource
      KinesisStreamSourceConfiguration: 
        KinesisStreamARN: !Ref KinesisArn
        RoleARN: !GetAtt
          - deliveryRole
          - Arn
      SnowflakeDestinationConfiguration:
        AccountUrl: !Ref SnowflakeAccountUrl
        PrivateKey: !Ref SnowflakePrivateKey
        User: !Ref SnowflakeUser
        Database: !Ref SnowflakeDatabase
        Schema: !Ref SnowflakeSchema
        Table: !Ref SnowflakeTable
        SnowflakeRoleConfiguration:
          Enabled: true
          SnowflakeRole: !Ref SnowflakeRole
        SnowflakeVpcConfiguration:
          PrivateLinkVpceId: !Ref SnowflakePrivateLinkVpceId
        DataLoadingOption: 'JSON_MAPPING'
        RoleARN: !GetAtt
          - deliveryRole
          - Arn
        S3BackupMode: FailedDataOnly
        S3Configuration:
          BucketARN: !Join
            - ''
            - - 'arn:'
              - !Ref 'AWS::Partition'
              - ':s3:::'
              - !Ref s3bucket
          BufferingHints:
            IntervalInSeconds: '60'
            SizeInMBs: '50'
          CompressionFormat: UNCOMPRESSED
          Prefix: firehose_snowflake_s3prefix/
          RoleARN: !GetAtt
            - deliveryRole
            - Arn