AWSTemplateFormatVersion: 2010-09-09
Description: Kinesis cross account lambda consumer deployment

Parameters:
  LambdaConsumerAccountId:
    Description: Specify account id where lambda consumer will be hosted
    Type: String

Resources:

  KMSKeyForKinesisStream:
    Type: AWS::KMS::Key
    Properties:
      Description: "KMS Key which will be assigned to Kinesis Data Stream"
      KeyPolicy:
        Version: '2012-10-17'
        Id: key-default-1
        Statement:
          - Sid: Enable IAM User Permissions
            Effect: Allow
            Principal:
              AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
            Action: kms:*
            Resource: '*'
          - Sid: Enable lambda consumer account access
            Effect: Allow
            Principal:
              AWS: !Sub
                - "arn:aws:iam::${LambdaConsumerAccountId}:root"
                - LambdaConsumerAccountId: !Ref LambdaConsumerAccountId
            Action: kms:*
            Resource: '*'

  InputKinesisStream:
    Type: 'AWS::Kinesis::Stream'
    Properties:
      Name: 'kds-cross-account-stream'
      StreamModeDetails:
        StreamMode: ON_DEMAND
      StreamEncryption:
        EncryptionType: KMS
        KeyId: !GetAtt KMSKeyForKinesisStream.Arn

  InputKinesisStreamEFOConsumer:
    Type: AWS::Kinesis::StreamConsumer
    Properties:
      ConsumerName: 'kds-cross-account-stream-efo-consumer'
      StreamARN: !GetAtt InputKinesisStream.Arn

Outputs:
  KinesisStreamArn:
    Description: ARN of Kinesis Data Stream
    Value: !GetAtt InputKinesisStream.Arn
  KinesisStreamEFOConsumerArn:
    Description: ARN of Kinesis Data Stream EFO Consumer
    Value: !GetAtt InputKinesisStreamEFOConsumer.ConsumerARN
  KMSKeyArn:
    Description: ARN of KMS key
    Value: !GetAtt KMSKeyForKinesisStream.Arn