cross-account-role.yml

AWSTemplateFormatVersion: '2010-09-09-OC'

# Include file that contains Organization Section.
# The Organization Section describes Accounts, Organizational Units, etc.
Organization: !Include ../organization.yml

# Any Binding that does not explicitly specify a region will default to this.
# Value can be either string or list
DefaultOrganizationBindingRegion: eu-central-1

Parameters:

  resourcePrefix:
    Type: String
    Default: my

  roleName:
    Type: String

  rolePolicyArns:
    Type: CommaDelimitedList

# Section contains a named set of Bindings.
# Bindings determine what resources are deployed where
# These bindings can be !Ref'd from the Resources in the resource section
OrganizationBindings:

  AssumeRoleBinding:
    Account: !Ref SharedUsersAccount

  RoleBinding:
    Account: '*'
    ExcludeAccount: !Ref SharedUsersAccount

Resources:

  Role:
    OrganizationBinding: !Ref RoleBinding
    Type: AWS::IAM::Role
    Properties:
      ManagedPolicyArns: !Ref rolePolicyArns
      RoleName: !Ref roleName
      AssumeRolePolicyDocument:
       Version: 2012-10-17
       Statement:
         - Effect: Allow
           Action: sts:AssumeRole
           Principal:
            AWS: Fn::EnumTargetAccounts AssumeRoleBinding '${account}' # role can only be assumed from SharedUsersAccount

  AssumeRolePolicy:
    Type: AWS::IAM::ManagedPolicy
    OrganizationBinding: !Ref AssumeRoleBinding
    Properties:
      ManagedPolicyName: !Sub '${resourcePrefix}-${roleName}-assume-role-policy'
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Resource: Fn::EnumTargetAccounts RoleBinding 'arn:aws:iam::${account}:role/${roleName}'