Metadata:
  Rok::StackName: <FLUENTD_EKS_IAM_CF>

Resources:
  FluentDRole:
    Type: AWS::IAM::Role
    Description: Fluentd Role
    Properties:
      RoleName: <FLUENTD_EKS_IAM_ROLE>
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Action: sts:AssumeRoleWithWebIdentity
          Principal:
            Federated: arn:aws:iam::<AWS_ACCOUNT_ID>:oidc-provider/<EKS_CLUSTER_OIDC>
          Condition:
            StringEquals:
              <EKS_CLUSTER_OIDC>:sub: system:serviceaccount:amazon-cloudwatch:fluentd
      ManagedPolicyArns:
      - !Sub "arn:${AWS::Partition}:iam::aws:policy/CloudWatchAgentServerPolicy"
