# This script sets up AWS Roles Anywhere with a custom CA and an IAM role for Lambda invocation.
# Prerequisites:
# - AWS CLI v2 installed, configured and logged in
# - OpenSSL
#
# https://docs.aws.amazon.com/pdfs/rolesanywhere/latest/userguide/rolesanywhere-guide.pdf
#

# Variables (replace with your own values)
$AccountId = "458835642486"
$Region    = "eu-west-1"
$LambdaArn = "arn:aws:lambda:eu-west-1:$AccountId:function:domainCheck"

# Paths for certs
$CertDir = Join-Path $PSScriptRoot "rolesanywhere"
New-Item -ItemType Directory -Force -Path $CertDir | Out-Null

#
$TrustPolicyFile = Join-Path $PSScriptRoot "trust-policy.json"
$LambdaPolicyFile = Join-Path $PSScriptRoot "lambda-policy.json"

function Convert-ToAwsFileUrl {
    param(
        [Parameter(Mandatory)]
        [string]$Path
    )

    # Expand relative paths and resolve directory separators
    $full = (Resolve-Path -LiteralPath $Path).Path

    # Convert backslashes to forward slashes
    $normalized = $full -replace '\\','/'

    # Prepend AWS-style file scheme
    "file://$normalized"
}

# Generate CA key + certificate
openssl genrsa -out "$CertDir\ca.key" 2048
openssl req -x509 -new -nodes -key "$CertDir\ca.key" -sha256 -days 365 `
  -out "$CertDir\ca.pem" -subj "/CN=MyTestCA" `
  -addext "basicConstraints=CA:TRUE" `
  -addext "keyUsage=keyCertSign,cRLSign"

# Generate client key + certificate signed by CA
openssl genrsa -out "$CertDir\client.key" 2048
openssl req -new -key "$CertDir\client.key" -out "$CertDir\client.csr" -subj "/CN=MyPC"
openssl x509 -req -in "$CertDir\client.csr" -CA "$CertDir\ca.pem" -CAkey "$CertDir\ca.key" `
  -CAcreateserial -out "$CertDir\client.pem" -days 365 -sha256

Write-Host "Certificates generated in $CertDir"

# Create Trust Anchor
$TrustAnchorArn = aws rolesanywhere create-trust-anchor `
  --region $Region `
  --name MyPCCA `
  --source "sourceData={x509CertificateData=$(Get-Content -Raw $CertDir\ca.pem)},sourceType=CERTIFICATE_BUNDLE" `
  --query 'trustAnchor.trustAnchorArn' --output text

Write-Host "Trust Anchor ARN: $TrustAnchorArn"

# Create IAM Role
$TrustPolicUrl = Convert-ToAwsFileUrl -Path $TrustPolicyFile
aws iam create-role `
  --role-name DomainCheckInvokerRole `
  --assume-role-policy-document $TrustPolicUrl

Write-Host "IAM Role created: DomainCheckInvokerRole"

# Attach Lambda policy
$LambdaPolicyUrl = Convert-ToAwsFileUrl -Path $LambdaPolicyFile
aws iam put-role-policy `
  --role-name DomainCheckInvokerRole `
  --policy-name LambdaInvokeDomainCheck `
  --policy-document $LambdaPolicyUrl

Write-Host "Policy attached to role: LambdaInvokeDomainCheck"

# Create Profile
$ProfileArn = aws rolesanywhere create-profile `
  --region eu-west-1 `
  --name DomainCheckProfile `
  --role-arns '["arn:aws:iam::458835642486:role/DomainCheckInvokerRole"]' `
  --query "profile.profileArn" `
  --output text

Write-Host "Profile ARN: $ProfileArn"

# Step 5: Print AWS config block
Write-Host ""
Write-Host "`nPaste the following into your AWS config (~/.aws/config):`n"
Write-Host "[profile rolesanywhere]"
Write-Host "credential_process = `"C:\path\to\aws_signing_helper.exe`" credential-process ^"
Write-Host "  --certificate C:\rolesanywhere\client.pem ^"
Write-Host "  --private-key C:\rolesanywhere\client.key ^"
Write-Host "  --trust-anchor-arn $TrustAnchorArn ^"
Write-Host "  --profile-arn $ProfileArn ^"
Write-Host "  --role-arn arn:aws:iam::$AccountId:role/$RoleName"
Write-Host "region = $Region"