stackset.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: "Create StackSet Execution and Administrator Roles for Target Accounts - (v1.0.0)"
Parameters:
  # General Configuration
  StackSetAdministratorAccountId:
    Type: "String"
    Description: AWS Account ID of the administrator account (the account in which StackSets will be created).
    MaxLength: 12
    MinLength: 12
Resources:
  StackSetExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: "AWSCloudFormationStackSetExecutionRole"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Effect: "Allow"
          Principal:
            AWS:
            - !Ref StackSetAdministratorAccountId
          Action:
          - "sts:AssumeRole"
      Path: "/"
      # NOTE: Select the managed policies that your templates will need, do not keep this role with administrator access
      ManagedPolicyArns:
      - !Sub "arn:${AWS::Partition}:iam::aws:policy/AdministratorAccess"
  StackSetAdministrationRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: "AWSCloudFormationStackSetAdministrationRole"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Effect: "Allow"
          Principal:
            Service: "cloudformation.amazonaws.com"
          Action:
            - "sts:AssumeRole"
      Path: "/"
      Policies:
      - PolicyName: "AssumeRole-AWSCloudFormationStackSetExecutionRole"
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
          - Effect: "Allow"
            Action:
            - "sts:AssumeRole"
            Resource:
            - "arn:*:iam::*:role/AWSCloudFormationStackSetExecutionRole"
Outputs:
  StackSetExecutionRoleName:
    Description: "The name of the StackSet Execution Role."
    Value: !Ref StackSetExecutionRole
    Export:
      Name: !Sub "${AWS::StackName}-StackSetExecutionRoleName"
  StackSetExecutionRoleArn:
    Description: "The ARN of the StackSet Execution Role."
    Value: !GetAtt StackSetExecutionRole.Arn
    Export:
      Name: !Sub "${AWS::StackName}-StackSetExecutionRoleArn"
  StackSetExecutionRoleId:
    Description: "The Role ID of the StackSet Execution Role."
    Value: !GetAtt StackSetExecutionRole.RoleId
    Export:
      Name: !Sub "${AWS::StackName}-StackSetExecutionRoleId"
  StackSetAdministrationRoleName:
    Description: "The name of the StackSet Administration Role."
    Value: !Ref StackSetAdministrationRole
    Export:
      Name: !Sub "${AWS::StackName}-StackSetAdministrationRoleName"
  StackSetAdministrationRoleArn:
    Description: "The ARN of the StackSet Administration Role."
    Value: !GetAtt StackSetAdministrationRole.Arn
    Export:
      Name: !Sub "${AWS::StackName}-StackSetAdministrationRoleArn"
  StackSetAdministrationRoleId:
    Description: "The Role ID of the StackSet Execution Role."
    Value: !GetAtt StackSetAdministrationRole.RoleId
    Export:
      Name: !Sub "${AWS::StackName}-StackSetAdministrationRoleId"
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
    - Label:
        default: "General Configuration"
      Parameters:
      - StackSetAdministratorAccountId
    ParameterLabels:
      StackSetAdministratorAccountId:
        default: "StackSet Administrator Account ID:"