-
Notifications
You must be signed in to change notification settings - Fork 205
/
dev-iam.yaml
45 lines (45 loc) · 1.24 KB
/
dev-iam.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
AWSTemplateFormatVersion: "2010-09-09"
Parameters:
CentralAccountId:
Type: String
CentralAccountRoleName:
Type: String
Default: XaccBlogCentralAccountRole
DevAccountRoleName:
Type: String
Default: XaccBlogDevAccountRole
Resources:
DevAccountRole:
Type: AWS::IAM::Role
Properties:
RoleName: !Ref DevAccountRoleName
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
AWS: !Sub 'arn:aws:iam::${CentralAccountId}:role/${CentralAccountRoleName}'
Action: sts:AssumeRole
Path: /
Policies:
- PolicyName: CfnStackAssumeRole
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- 'cloudformation:CreateStack'
- 'cloudformation:UpdateStack'
- 'cloudformation:DeleteStack'
- 'cloudformation:DescribeStacks'
Resource: "*"
- Effect: Allow
Action:
- 's3:CreateBucket'
- 's3:DeleteBucket'
- 's3:DeleteBucket*'
- 's3:PutBucket*'
Resource: "*"
Outputs:
DevAccountRoleArn:
Value: !GetAtt DevAccountRole.Arn