AWSTemplateFormatVersion: '2010-09-09'
Description: API Gateway CloudWatch logging role setup

Resources:
  ApiGatewayCloudWatchRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "ApiGwCloudWatchRole-${AWS::StackName}"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: apigateway.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs
      Description: Role for API Gateway to push execution logs to CloudWatch.

  ApiGatewayAccountSettings:
    Type: AWS::ApiGateway::Account
    Properties:
      CloudWatchRoleArn: !GetAtt ApiGatewayCloudWatchRole.Arn
    DependsOn: ApiGatewayCloudWatchRole

Outputs:
  CloudWatchRoleArn:
    Value: !GetAtt ApiGatewayCloudWatchRole.Arn
    Export:
      Name: !Sub "${AWS::StackName}-CloudWatchRoleArn"
