---
AWSTemplateFormatVersion: '2010-09-09'
Description: Create two AWS Identity and Access Management (IAM) users required to create ServiceNow incidents for Amazon CloudWatch Alarms using AWS Service Management Connector for ServiceNow

Resources:
  ServiceNowUserGroup:
    Type: AWS::IAM::Group
    Properties:
      Policies:
      - PolicyName: OpsCenterExecutionPolicy
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - ssm:CreateOpsItem
            - ssm:GetOpsItem
            - ssm:UpdateOpsItem
            - ssm:DescribeOpsItems
            Resource: '*'
  SCSyncUser:
    Type: AWS::IAM::User
    Properties:
      Groups:
        - !Ref 'ServiceNowUserGroup'
      UserName: SCSyncUser
  SCEndUser:
    Type: AWS::IAM::User
    Properties:
      Groups: 
        - !Ref 'ServiceNowUserGroup'
      UserName: SCEndUser