Parameters:
    SageMakerRoleSuffix:
        Type: String
        Description: Suffix of the SageMaker Execution role
        MinLength: 1
        MaxLength: 15
        AllowedPattern: ^[a-zA-Z](-*[a-zA-Z0-9])*
    PipelineExecutionRoleArn:
        Type: String
        Description: Id of the main account                            
Resources:
    SageMakerCrossRole:
        Type: AWS::IAM::Role
        Properties:
            RoleName: !Sub "sagemaker-role-${SageMakerRoleSuffix}"
            AssumeRolePolicyDocument:
                Version: "2012-10-17"
                Statement:
                    -
                        Effect: "Allow"
                        Principal:
                            Service:
                                - "sagemaker.amazonaws.com"
                        Action:
                            - "sts:AssumeRole"
                    -
                        Effect: "Allow"
                        Principal:
                            AWS: !Sub ${PipelineExecutionRoleArn}
                        Action:
                            - "sts:AssumeRole"
            Path: "/"
            ManagedPolicyArns:
                - arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
            Policies:
                -
                    PolicyName: !Sub "sagemaker-policy-${SageMakerRoleSuffix}"
                    PolicyDocument:
                        Version: "2012-10-17"
                        Statement:
                            -
                                Effect: "Allow"
                                Action:
                                    - "sagemaker:*Model"
                                    - "sagemaker:*EndpointConfig"
                                    - "sagemaker:*Endpoint"
                                Resource:
                                    - !Sub "arn:aws:sagemaker:*:${AWS::AccountId}:endpoint/*"
                                    - !Sub "arn:aws:sagemaker:*:${AWS::AccountId}:endpoint-config/*"
                                    - !Sub "arn:aws:sagemaker:*:${AWS::AccountId}:model/*"
