-
Notifications
You must be signed in to change notification settings - Fork 59
/
customer-account.yaml
28 lines (27 loc) · 1.09 KB
/
customer-account.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
AWSTemplateFormatVersion: 2010-09-09
Description: Allows another account to publish into this account using a named cross-account role
Parameters:
PartnerAccountParameter:
Type: String
Description: Enter the account ID of the partner account
Resources:
PublishFromPartnerRole:
Type: AWS::IAM::Role
Properties:
RoleName: !Join [ "", [ "publish-from-partner-role-", !Ref PartnerAccountParameter ] ]
AssumeRolePolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Action: sts:AssumeRole
Principal:
AWS: !Join [ "", [ "arn:aws:iam::", !Ref PartnerAccountParameter, ":role/publish-to-customer-role-", !Ref "AWS::AccountId" ] ]
Policies:
- PolicyName: root
PolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Action:
- iot:Publish
Resource: !Join [ "", [ "arn:aws:iot:", !Ref "AWS::Region", ":", !Ref "AWS::AccountId", ":topic/cross_account_publish/", !Ref PartnerAccountParameter, "/*" ] ]